Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 206b1d09a56dcd2db1052245c4131879c410eaf8

Authored by Ari Savolainen
Committed by Al Viro
1 parent c2f340a69c
Exists in master and in 6 other branches imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-l5.0.0_1.0.0-ga

Fix POSIX ACL permission check 

After commit 3567866bf261: "RCUify freeing acls, let check_acl() go ahead in
RCU mode if acl is cached" posix_acl_permission is being called with an
unsupported flag and the permission check fails. This patch fixes the issue.

Signed-off-by: Ari Savolainen <ari.m.savolainen@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Showing 1 changed file with 1 additions and 1 deletions Inline Diff

1 /* 1 /*
2 * linux/fs/namei.c 2 * linux/fs/namei.c
3 * 3 *
4 * Copyright (C) 1991, 1992 Linus Torvalds 4 * Copyright (C) 1991, 1992 Linus Torvalds
5 */ 5 */
6 6
7 /* 7 /*
8 * Some corrections by tytso. 8 * Some corrections by tytso.
9 */ 9 */
10 10
11 /* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname 11 /* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname
12 * lookup logic. 12 * lookup logic.
13 */ 13 */
14 /* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture. 14 /* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture.
15 */ 15 */
16 16
17 #include <linux/init.h> 17 #include <linux/init.h>
18 #include <linux/module.h> 18 #include <linux/module.h>
19 #include <linux/slab.h> 19 #include <linux/slab.h>
20 #include <linux/fs.h> 20 #include <linux/fs.h>
21 #include <linux/namei.h> 21 #include <linux/namei.h>
22 #include <linux/pagemap.h> 22 #include <linux/pagemap.h>
23 #include <linux/fsnotify.h> 23 #include <linux/fsnotify.h>
24 #include <linux/personality.h> 24 #include <linux/personality.h>
25 #include <linux/security.h> 25 #include <linux/security.h>
26 #include <linux/ima.h> 26 #include <linux/ima.h>
27 #include <linux/syscalls.h> 27 #include <linux/syscalls.h>
28 #include <linux/mount.h> 28 #include <linux/mount.h>
29 #include <linux/audit.h> 29 #include <linux/audit.h>
30 #include <linux/capability.h> 30 #include <linux/capability.h>
31 #include <linux/file.h> 31 #include <linux/file.h>
32 #include <linux/fcntl.h> 32 #include <linux/fcntl.h>
33 #include <linux/device_cgroup.h> 33 #include <linux/device_cgroup.h>
34 #include <linux/fs_struct.h> 34 #include <linux/fs_struct.h>
35 #include <linux/posix_acl.h> 35 #include <linux/posix_acl.h>
36 #include <asm/uaccess.h> 36 #include <asm/uaccess.h>
37 37
38 #include "internal.h" 38 #include "internal.h"
39 39
40 /* [Feb-1997 T. Schoebel-Theuer] 40 /* [Feb-1997 T. Schoebel-Theuer]
41 * Fundamental changes in the pathname lookup mechanisms (namei) 41 * Fundamental changes in the pathname lookup mechanisms (namei)
42 * were necessary because of omirr. The reason is that omirr needs 42 * were necessary because of omirr. The reason is that omirr needs
43 * to know the _real_ pathname, not the user-supplied one, in case 43 * to know the _real_ pathname, not the user-supplied one, in case
44 * of symlinks (and also when transname replacements occur). 44 * of symlinks (and also when transname replacements occur).
45 * 45 *
46 * The new code replaces the old recursive symlink resolution with 46 * The new code replaces the old recursive symlink resolution with
47 * an iterative one (in case of non-nested symlink chains). It does 47 * an iterative one (in case of non-nested symlink chains). It does
48 * this with calls to <fs>_follow_link(). 48 * this with calls to <fs>_follow_link().
49 * As a side effect, dir_namei(), _namei() and follow_link() are now 49 * As a side effect, dir_namei(), _namei() and follow_link() are now
50 * replaced with a single function lookup_dentry() that can handle all 50 * replaced with a single function lookup_dentry() that can handle all
51 * the special cases of the former code. 51 * the special cases of the former code.
52 * 52 *
53 * With the new dcache, the pathname is stored at each inode, at least as 53 * With the new dcache, the pathname is stored at each inode, at least as
54 * long as the refcount of the inode is positive. As a side effect, the 54 * long as the refcount of the inode is positive. As a side effect, the
55 * size of the dcache depends on the inode cache and thus is dynamic. 55 * size of the dcache depends on the inode cache and thus is dynamic.
56 * 56 *
57 * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink 57 * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink
58 * resolution to correspond with current state of the code. 58 * resolution to correspond with current state of the code.
59 * 59 *
60 * Note that the symlink resolution is not *completely* iterative. 60 * Note that the symlink resolution is not *completely* iterative.
61 * There is still a significant amount of tail- and mid- recursion in 61 * There is still a significant amount of tail- and mid- recursion in
62 * the algorithm. Also, note that <fs>_readlink() is not used in 62 * the algorithm. Also, note that <fs>_readlink() is not used in
63 * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink() 63 * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink()
64 * may return different results than <fs>_follow_link(). Many virtual 64 * may return different results than <fs>_follow_link(). Many virtual
65 * filesystems (including /proc) exhibit this behavior. 65 * filesystems (including /proc) exhibit this behavior.
66 */ 66 */
67 67
68 /* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation: 68 /* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation:
69 * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL 69 * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL
70 * and the name already exists in form of a symlink, try to create the new 70 * and the name already exists in form of a symlink, try to create the new
71 * name indicated by the symlink. The old code always complained that the 71 * name indicated by the symlink. The old code always complained that the
72 * name already exists, due to not following the symlink even if its target 72 * name already exists, due to not following the symlink even if its target
73 * is nonexistent. The new semantics affects also mknod() and link() when 73 * is nonexistent. The new semantics affects also mknod() and link() when
74 * the name is a symlink pointing to a non-existent name. 74 * the name is a symlink pointing to a non-existent name.
75 * 75 *
76 * I don't know which semantics is the right one, since I have no access 76 * I don't know which semantics is the right one, since I have no access
77 * to standards. But I found by trial that HP-UX 9.0 has the full "new" 77 * to standards. But I found by trial that HP-UX 9.0 has the full "new"
78 * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the 78 * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the
79 * "old" one. Personally, I think the new semantics is much more logical. 79 * "old" one. Personally, I think the new semantics is much more logical.
80 * Note that "ln old new" where "new" is a symlink pointing to a non-existing 80 * Note that "ln old new" where "new" is a symlink pointing to a non-existing
81 * file does succeed in both HP-UX and SunOs, but not in Solaris 81 * file does succeed in both HP-UX and SunOs, but not in Solaris
82 * and in the old Linux semantics. 82 * and in the old Linux semantics.
83 */ 83 */
84 84
85 /* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink 85 /* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink
86 * semantics. See the comments in "open_namei" and "do_link" below. 86 * semantics. See the comments in "open_namei" and "do_link" below.
87 * 87 *
88 * [10-Sep-98 Alan Modra] Another symlink change. 88 * [10-Sep-98 Alan Modra] Another symlink change.
89 */ 89 */
90 90
91 /* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks: 91 /* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks:
92 * inside the path - always follow. 92 * inside the path - always follow.
93 * in the last component in creation/removal/renaming - never follow. 93 * in the last component in creation/removal/renaming - never follow.
94 * if LOOKUP_FOLLOW passed - follow. 94 * if LOOKUP_FOLLOW passed - follow.
95 * if the pathname has trailing slashes - follow. 95 * if the pathname has trailing slashes - follow.
96 * otherwise - don't follow. 96 * otherwise - don't follow.
97 * (applied in that order). 97 * (applied in that order).
98 * 98 *
99 * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT 99 * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT
100 * restored for 2.4. This is the last surviving part of old 4.2BSD bug. 100 * restored for 2.4. This is the last surviving part of old 4.2BSD bug.
101 * During the 2.4 we need to fix the userland stuff depending on it - 101 * During the 2.4 we need to fix the userland stuff depending on it -
102 * hopefully we will be able to get rid of that wart in 2.5. So far only 102 * hopefully we will be able to get rid of that wart in 2.5. So far only
103 * XEmacs seems to be relying on it... 103 * XEmacs seems to be relying on it...
104 */ 104 */
105 /* 105 /*
106 * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland) 106 * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland)
107 * implemented. Let's see if raised priority of ->s_vfs_rename_mutex gives 107 * implemented. Let's see if raised priority of ->s_vfs_rename_mutex gives
108 * any extra contention... 108 * any extra contention...
109 */ 109 */
110 110
111 /* In order to reduce some races, while at the same time doing additional 111 /* In order to reduce some races, while at the same time doing additional
112 * checking and hopefully speeding things up, we copy filenames to the 112 * checking and hopefully speeding things up, we copy filenames to the
113 * kernel data space before using them.. 113 * kernel data space before using them..
114 * 114 *
115 * POSIX.1 2.4: an empty pathname is invalid (ENOENT). 115 * POSIX.1 2.4: an empty pathname is invalid (ENOENT).
116 * PATH_MAX includes the nul terminator --RR. 116 * PATH_MAX includes the nul terminator --RR.
117 */ 117 */
118 static int do_getname(const char __user *filename, char *page) 118 static int do_getname(const char __user *filename, char *page)
119 { 119 {
120 int retval; 120 int retval;
121 unsigned long len = PATH_MAX; 121 unsigned long len = PATH_MAX;
122 122
123 if (!segment_eq(get_fs(), KERNEL_DS)) { 123 if (!segment_eq(get_fs(), KERNEL_DS)) {
124 if ((unsigned long) filename >= TASK_SIZE) 124 if ((unsigned long) filename >= TASK_SIZE)
125 return -EFAULT; 125 return -EFAULT;
126 if (TASK_SIZE - (unsigned long) filename < PATH_MAX) 126 if (TASK_SIZE - (unsigned long) filename < PATH_MAX)
127 len = TASK_SIZE - (unsigned long) filename; 127 len = TASK_SIZE - (unsigned long) filename;
128 } 128 }
129 129
130 retval = strncpy_from_user(page, filename, len); 130 retval = strncpy_from_user(page, filename, len);
131 if (retval > 0) { 131 if (retval > 0) {
132 if (retval < len) 132 if (retval < len)
133 return 0; 133 return 0;
134 return -ENAMETOOLONG; 134 return -ENAMETOOLONG;
135 } else if (!retval) 135 } else if (!retval)
136 retval = -ENOENT; 136 retval = -ENOENT;
137 return retval; 137 return retval;
138 } 138 }
139 139
140 static char *getname_flags(const char __user * filename, int flags) 140 static char *getname_flags(const char __user * filename, int flags)
141 { 141 {
142 char *tmp, *result; 142 char *tmp, *result;
143 143
144 result = ERR_PTR(-ENOMEM); 144 result = ERR_PTR(-ENOMEM);
145 tmp = __getname(); 145 tmp = __getname();
146 if (tmp) { 146 if (tmp) {
147 int retval = do_getname(filename, tmp); 147 int retval = do_getname(filename, tmp);
148 148
149 result = tmp; 149 result = tmp;
150 if (retval < 0) { 150 if (retval < 0) {
151 if (retval != -ENOENT || !(flags & LOOKUP_EMPTY)) { 151 if (retval != -ENOENT || !(flags & LOOKUP_EMPTY)) {
152 __putname(tmp); 152 __putname(tmp);
153 result = ERR_PTR(retval); 153 result = ERR_PTR(retval);
154 } 154 }
155 } 155 }
156 } 156 }
157 audit_getname(result); 157 audit_getname(result);
158 return result; 158 return result;
159 } 159 }
160 160
161 char *getname(const char __user * filename) 161 char *getname(const char __user * filename)
162 { 162 {
163 return getname_flags(filename, 0); 163 return getname_flags(filename, 0);
164 } 164 }
165 165
166 #ifdef CONFIG_AUDITSYSCALL 166 #ifdef CONFIG_AUDITSYSCALL
167 void putname(const char *name) 167 void putname(const char *name)
168 { 168 {
169 if (unlikely(!audit_dummy_context())) 169 if (unlikely(!audit_dummy_context()))
170 audit_putname(name); 170 audit_putname(name);
171 else 171 else
172 __putname(name); 172 __putname(name);
173 } 173 }
174 EXPORT_SYMBOL(putname); 174 EXPORT_SYMBOL(putname);
175 #endif 175 #endif
176 176
177 static int check_acl(struct inode *inode, int mask) 177 static int check_acl(struct inode *inode, int mask)
178 { 178 {
179 #ifdef CONFIG_FS_POSIX_ACL 179 #ifdef CONFIG_FS_POSIX_ACL
180 struct posix_acl *acl; 180 struct posix_acl *acl;
181 181
182 if (mask & MAY_NOT_BLOCK) { 182 if (mask & MAY_NOT_BLOCK) {
183 acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS); 183 acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS);
184 if (!acl) 184 if (!acl)
185 return -EAGAIN; 185 return -EAGAIN;
186 /* no ->get_acl() calls in RCU mode... */ 186 /* no ->get_acl() calls in RCU mode... */
187 if (acl == ACL_NOT_CACHED) 187 if (acl == ACL_NOT_CACHED)
188 return -ECHILD; 188 return -ECHILD;
189 return posix_acl_permission(inode, acl, mask); 189 return posix_acl_permission(inode, acl, mask & ~MAY_NOT_BLOCK);
190 } 190 }
191 191
192 acl = get_cached_acl(inode, ACL_TYPE_ACCESS); 192 acl = get_cached_acl(inode, ACL_TYPE_ACCESS);
193 193
194 /* 194 /*
195 * A filesystem can force a ACL callback by just never filling the 195 * A filesystem can force a ACL callback by just never filling the
196 * ACL cache. But normally you'd fill the cache either at inode 196 * ACL cache. But normally you'd fill the cache either at inode
197 * instantiation time, or on the first ->get_acl call. 197 * instantiation time, or on the first ->get_acl call.
198 * 198 *
199 * If the filesystem doesn't have a get_acl() function at all, we'll 199 * If the filesystem doesn't have a get_acl() function at all, we'll
200 * just create the negative cache entry. 200 * just create the negative cache entry.
201 */ 201 */
202 if (acl == ACL_NOT_CACHED) { 202 if (acl == ACL_NOT_CACHED) {
203 if (inode->i_op->get_acl) { 203 if (inode->i_op->get_acl) {
204 acl = inode->i_op->get_acl(inode, ACL_TYPE_ACCESS); 204 acl = inode->i_op->get_acl(inode, ACL_TYPE_ACCESS);
205 if (IS_ERR(acl)) 205 if (IS_ERR(acl))
206 return PTR_ERR(acl); 206 return PTR_ERR(acl);
207 } else { 207 } else {
208 set_cached_acl(inode, ACL_TYPE_ACCESS, NULL); 208 set_cached_acl(inode, ACL_TYPE_ACCESS, NULL);
209 return -EAGAIN; 209 return -EAGAIN;
210 } 210 }
211 } 211 }
212 212
213 if (acl) { 213 if (acl) {
214 int error = posix_acl_permission(inode, acl, mask); 214 int error = posix_acl_permission(inode, acl, mask);
215 posix_acl_release(acl); 215 posix_acl_release(acl);
216 return error; 216 return error;
217 } 217 }
218 #endif 218 #endif
219 219
220 return -EAGAIN; 220 return -EAGAIN;
221 } 221 }
222 222
223 /* 223 /*
224 * This does basic POSIX ACL permission checking 224 * This does basic POSIX ACL permission checking
225 */ 225 */
226 static int acl_permission_check(struct inode *inode, int mask) 226 static int acl_permission_check(struct inode *inode, int mask)
227 { 227 {
228 unsigned int mode = inode->i_mode; 228 unsigned int mode = inode->i_mode;
229 229
230 mask &= MAY_READ | MAY_WRITE | MAY_EXEC | MAY_NOT_BLOCK; 230 mask &= MAY_READ | MAY_WRITE | MAY_EXEC | MAY_NOT_BLOCK;
231 231
232 if (current_user_ns() != inode_userns(inode)) 232 if (current_user_ns() != inode_userns(inode))
233 goto other_perms; 233 goto other_perms;
234 234
235 if (likely(current_fsuid() == inode->i_uid)) 235 if (likely(current_fsuid() == inode->i_uid))
236 mode >>= 6; 236 mode >>= 6;
237 else { 237 else {
238 if (IS_POSIXACL(inode) && (mode & S_IRWXG)) { 238 if (IS_POSIXACL(inode) && (mode & S_IRWXG)) {
239 int error = check_acl(inode, mask); 239 int error = check_acl(inode, mask);
240 if (error != -EAGAIN) 240 if (error != -EAGAIN)
241 return error; 241 return error;
242 } 242 }
243 243
244 if (in_group_p(inode->i_gid)) 244 if (in_group_p(inode->i_gid))
245 mode >>= 3; 245 mode >>= 3;
246 } 246 }
247 247
248 other_perms: 248 other_perms:
249 /* 249 /*
250 * If the DACs are ok we don't need any capability check. 250 * If the DACs are ok we don't need any capability check.
251 */ 251 */
252 if ((mask & ~mode & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0) 252 if ((mask & ~mode & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0)
253 return 0; 253 return 0;
254 return -EACCES; 254 return -EACCES;
255 } 255 }
256 256
257 /** 257 /**
258 * generic_permission - check for access rights on a Posix-like filesystem 258 * generic_permission - check for access rights on a Posix-like filesystem
259 * @inode: inode to check access rights for 259 * @inode: inode to check access rights for
260 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 260 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
261 * 261 *
262 * Used to check for read/write/execute permissions on a file. 262 * Used to check for read/write/execute permissions on a file.
263 * We use "fsuid" for this, letting us set arbitrary permissions 263 * We use "fsuid" for this, letting us set arbitrary permissions
264 * for filesystem access without changing the "normal" uids which 264 * for filesystem access without changing the "normal" uids which
265 * are used for other things. 265 * are used for other things.
266 * 266 *
267 * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk 267 * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk
268 * request cannot be satisfied (eg. requires blocking or too much complexity). 268 * request cannot be satisfied (eg. requires blocking or too much complexity).
269 * It would then be called again in ref-walk mode. 269 * It would then be called again in ref-walk mode.
270 */ 270 */
271 int generic_permission(struct inode *inode, int mask) 271 int generic_permission(struct inode *inode, int mask)
272 { 272 {
273 int ret; 273 int ret;
274 274
275 /* 275 /*
276 * Do the basic POSIX ACL permission checks. 276 * Do the basic POSIX ACL permission checks.
277 */ 277 */
278 ret = acl_permission_check(inode, mask); 278 ret = acl_permission_check(inode, mask);
279 if (ret != -EACCES) 279 if (ret != -EACCES)
280 return ret; 280 return ret;
281 281
282 if (S_ISDIR(inode->i_mode)) { 282 if (S_ISDIR(inode->i_mode)) {
283 /* DACs are overridable for directories */ 283 /* DACs are overridable for directories */
284 if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE)) 284 if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
285 return 0; 285 return 0;
286 if (!(mask & MAY_WRITE)) 286 if (!(mask & MAY_WRITE))
287 if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH)) 287 if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
288 return 0; 288 return 0;
289 return -EACCES; 289 return -EACCES;
290 } 290 }
291 /* 291 /*
292 * Read/write DACs are always overridable. 292 * Read/write DACs are always overridable.
293 * Executable DACs are overridable when there is 293 * Executable DACs are overridable when there is
294 * at least one exec bit set. 294 * at least one exec bit set.
295 */ 295 */
296 if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO)) 296 if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
297 if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE)) 297 if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
298 return 0; 298 return 0;
299 299
300 /* 300 /*
301 * Searching includes executable on directories, else just read. 301 * Searching includes executable on directories, else just read.
302 */ 302 */
303 mask &= MAY_READ | MAY_WRITE | MAY_EXEC; 303 mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
304 if (mask == MAY_READ) 304 if (mask == MAY_READ)
305 if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH)) 305 if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
306 return 0; 306 return 0;
307 307
308 return -EACCES; 308 return -EACCES;
309 } 309 }
310 310
311 /* 311 /*
312 * We _really_ want to just do "generic_permission()" without 312 * We _really_ want to just do "generic_permission()" without
313 * even looking at the inode->i_op values. So we keep a cache 313 * even looking at the inode->i_op values. So we keep a cache
314 * flag in inode->i_opflags, that says "this has not special 314 * flag in inode->i_opflags, that says "this has not special
315 * permission function, use the fast case". 315 * permission function, use the fast case".
316 */ 316 */
317 static inline int do_inode_permission(struct inode *inode, int mask) 317 static inline int do_inode_permission(struct inode *inode, int mask)
318 { 318 {
319 if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) { 319 if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) {
320 if (likely(inode->i_op->permission)) 320 if (likely(inode->i_op->permission))
321 return inode->i_op->permission(inode, mask); 321 return inode->i_op->permission(inode, mask);
322 322
323 /* This gets set once for the inode lifetime */ 323 /* This gets set once for the inode lifetime */
324 spin_lock(&inode->i_lock); 324 spin_lock(&inode->i_lock);
325 inode->i_opflags |= IOP_FASTPERM; 325 inode->i_opflags |= IOP_FASTPERM;
326 spin_unlock(&inode->i_lock); 326 spin_unlock(&inode->i_lock);
327 } 327 }
328 return generic_permission(inode, mask); 328 return generic_permission(inode, mask);
329 } 329 }
330 330
331 /** 331 /**
332 * inode_permission - check for access rights to a given inode 332 * inode_permission - check for access rights to a given inode
333 * @inode: inode to check permission on 333 * @inode: inode to check permission on
334 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 334 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
335 * 335 *
336 * Used to check for read/write/execute permissions on an inode. 336 * Used to check for read/write/execute permissions on an inode.
337 * We use "fsuid" for this, letting us set arbitrary permissions 337 * We use "fsuid" for this, letting us set arbitrary permissions
338 * for filesystem access without changing the "normal" uids which 338 * for filesystem access without changing the "normal" uids which
339 * are used for other things. 339 * are used for other things.
340 */ 340 */
341 int inode_permission(struct inode *inode, int mask) 341 int inode_permission(struct inode *inode, int mask)
342 { 342 {
343 int retval; 343 int retval;
344 344
345 if (unlikely(mask & MAY_WRITE)) { 345 if (unlikely(mask & MAY_WRITE)) {
346 umode_t mode = inode->i_mode; 346 umode_t mode = inode->i_mode;
347 347
348 /* 348 /*
349 * Nobody gets write access to a read-only fs. 349 * Nobody gets write access to a read-only fs.
350 */ 350 */
351 if (IS_RDONLY(inode) && 351 if (IS_RDONLY(inode) &&
352 (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))) 352 (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
353 return -EROFS; 353 return -EROFS;
354 354
355 /* 355 /*
356 * Nobody gets write access to an immutable file. 356 * Nobody gets write access to an immutable file.
357 */ 357 */
358 if (IS_IMMUTABLE(inode)) 358 if (IS_IMMUTABLE(inode))
359 return -EACCES; 359 return -EACCES;
360 } 360 }
361 361
362 retval = do_inode_permission(inode, mask); 362 retval = do_inode_permission(inode, mask);
363 if (retval) 363 if (retval)
364 return retval; 364 return retval;
365 365
366 retval = devcgroup_inode_permission(inode, mask); 366 retval = devcgroup_inode_permission(inode, mask);
367 if (retval) 367 if (retval)
368 return retval; 368 return retval;
369 369
370 return security_inode_permission(inode, mask); 370 return security_inode_permission(inode, mask);
371 } 371 }
372 372
373 /** 373 /**
374 * path_get - get a reference to a path 374 * path_get - get a reference to a path
375 * @path: path to get the reference to 375 * @path: path to get the reference to
376 * 376 *
377 * Given a path increment the reference count to the dentry and the vfsmount. 377 * Given a path increment the reference count to the dentry and the vfsmount.
378 */ 378 */
379 void path_get(struct path *path) 379 void path_get(struct path *path)
380 { 380 {
381 mntget(path->mnt); 381 mntget(path->mnt);
382 dget(path->dentry); 382 dget(path->dentry);
383 } 383 }
384 EXPORT_SYMBOL(path_get); 384 EXPORT_SYMBOL(path_get);
385 385
386 /** 386 /**
387 * path_put - put a reference to a path 387 * path_put - put a reference to a path
388 * @path: path to put the reference to 388 * @path: path to put the reference to
389 * 389 *
390 * Given a path decrement the reference count to the dentry and the vfsmount. 390 * Given a path decrement the reference count to the dentry and the vfsmount.
391 */ 391 */
392 void path_put(struct path *path) 392 void path_put(struct path *path)
393 { 393 {
394 dput(path->dentry); 394 dput(path->dentry);
395 mntput(path->mnt); 395 mntput(path->mnt);
396 } 396 }
397 EXPORT_SYMBOL(path_put); 397 EXPORT_SYMBOL(path_put);
398 398
399 /* 399 /*
400 * Path walking has 2 modes, rcu-walk and ref-walk (see 400 * Path walking has 2 modes, rcu-walk and ref-walk (see
401 * Documentation/filesystems/path-lookup.txt). In situations when we can't 401 * Documentation/filesystems/path-lookup.txt). In situations when we can't
402 * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab 402 * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab
403 * normal reference counts on dentries and vfsmounts to transition to rcu-walk 403 * normal reference counts on dentries and vfsmounts to transition to rcu-walk
404 * mode. Refcounts are grabbed at the last known good point before rcu-walk 404 * mode. Refcounts are grabbed at the last known good point before rcu-walk
405 * got stuck, so ref-walk may continue from there. If this is not successful 405 * got stuck, so ref-walk may continue from there. If this is not successful
406 * (eg. a seqcount has changed), then failure is returned and it's up to caller 406 * (eg. a seqcount has changed), then failure is returned and it's up to caller
407 * to restart the path walk from the beginning in ref-walk mode. 407 * to restart the path walk from the beginning in ref-walk mode.
408 */ 408 */
409 409
410 /** 410 /**
411 * unlazy_walk - try to switch to ref-walk mode. 411 * unlazy_walk - try to switch to ref-walk mode.
412 * @nd: nameidata pathwalk data 412 * @nd: nameidata pathwalk data
413 * @dentry: child of nd->path.dentry or NULL 413 * @dentry: child of nd->path.dentry or NULL
414 * Returns: 0 on success, -ECHILD on failure 414 * Returns: 0 on success, -ECHILD on failure
415 * 415 *
416 * unlazy_walk attempts to legitimize the current nd->path, nd->root and dentry 416 * unlazy_walk attempts to legitimize the current nd->path, nd->root and dentry
417 * for ref-walk mode. @dentry must be a path found by a do_lookup call on 417 * for ref-walk mode. @dentry must be a path found by a do_lookup call on
418 * @nd or NULL. Must be called from rcu-walk context. 418 * @nd or NULL. Must be called from rcu-walk context.
419 */ 419 */
420 static int unlazy_walk(struct nameidata *nd, struct dentry *dentry) 420 static int unlazy_walk(struct nameidata *nd, struct dentry *dentry)
421 { 421 {
422 struct fs_struct *fs = current->fs; 422 struct fs_struct *fs = current->fs;
423 struct dentry *parent = nd->path.dentry; 423 struct dentry *parent = nd->path.dentry;
424 int want_root = 0; 424 int want_root = 0;
425 425
426 BUG_ON(!(nd->flags & LOOKUP_RCU)); 426 BUG_ON(!(nd->flags & LOOKUP_RCU));
427 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) { 427 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
428 want_root = 1; 428 want_root = 1;
429 spin_lock(&fs->lock); 429 spin_lock(&fs->lock);
430 if (nd->root.mnt != fs->root.mnt || 430 if (nd->root.mnt != fs->root.mnt ||
431 nd->root.dentry != fs->root.dentry) 431 nd->root.dentry != fs->root.dentry)
432 goto err_root; 432 goto err_root;
433 } 433 }
434 spin_lock(&parent->d_lock); 434 spin_lock(&parent->d_lock);
435 if (!dentry) { 435 if (!dentry) {
436 if (!__d_rcu_to_refcount(parent, nd->seq)) 436 if (!__d_rcu_to_refcount(parent, nd->seq))
437 goto err_parent; 437 goto err_parent;
438 BUG_ON(nd->inode != parent->d_inode); 438 BUG_ON(nd->inode != parent->d_inode);
439 } else { 439 } else {
440 if (dentry->d_parent != parent) 440 if (dentry->d_parent != parent)
441 goto err_parent; 441 goto err_parent;
442 spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); 442 spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
443 if (!__d_rcu_to_refcount(dentry, nd->seq)) 443 if (!__d_rcu_to_refcount(dentry, nd->seq))
444 goto err_child; 444 goto err_child;
445 /* 445 /*
446 * If the sequence check on the child dentry passed, then 446 * If the sequence check on the child dentry passed, then
447 * the child has not been removed from its parent. This 447 * the child has not been removed from its parent. This
448 * means the parent dentry must be valid and able to take 448 * means the parent dentry must be valid and able to take
449 * a reference at this point. 449 * a reference at this point.
450 */ 450 */
451 BUG_ON(!IS_ROOT(dentry) && dentry->d_parent != parent); 451 BUG_ON(!IS_ROOT(dentry) && dentry->d_parent != parent);
452 BUG_ON(!parent->d_count); 452 BUG_ON(!parent->d_count);
453 parent->d_count++; 453 parent->d_count++;
454 spin_unlock(&dentry->d_lock); 454 spin_unlock(&dentry->d_lock);
455 } 455 }
456 spin_unlock(&parent->d_lock); 456 spin_unlock(&parent->d_lock);
457 if (want_root) { 457 if (want_root) {
458 path_get(&nd->root); 458 path_get(&nd->root);
459 spin_unlock(&fs->lock); 459 spin_unlock(&fs->lock);
460 } 460 }
461 mntget(nd->path.mnt); 461 mntget(nd->path.mnt);
462 462
463 rcu_read_unlock(); 463 rcu_read_unlock();
464 br_read_unlock(vfsmount_lock); 464 br_read_unlock(vfsmount_lock);
465 nd->flags &= ~LOOKUP_RCU; 465 nd->flags &= ~LOOKUP_RCU;
466 return 0; 466 return 0;
467 467
468 err_child: 468 err_child:
469 spin_unlock(&dentry->d_lock); 469 spin_unlock(&dentry->d_lock);
470 err_parent: 470 err_parent:
471 spin_unlock(&parent->d_lock); 471 spin_unlock(&parent->d_lock);
472 err_root: 472 err_root:
473 if (want_root) 473 if (want_root)
474 spin_unlock(&fs->lock); 474 spin_unlock(&fs->lock);
475 return -ECHILD; 475 return -ECHILD;
476 } 476 }
477 477
478 /** 478 /**
479 * release_open_intent - free up open intent resources 479 * release_open_intent - free up open intent resources
480 * @nd: pointer to nameidata 480 * @nd: pointer to nameidata
481 */ 481 */
482 void release_open_intent(struct nameidata *nd) 482 void release_open_intent(struct nameidata *nd)
483 { 483 {
484 struct file *file = nd->intent.open.file; 484 struct file *file = nd->intent.open.file;
485 485
486 if (file && !IS_ERR(file)) { 486 if (file && !IS_ERR(file)) {
487 if (file->f_path.dentry == NULL) 487 if (file->f_path.dentry == NULL)
488 put_filp(file); 488 put_filp(file);
489 else 489 else
490 fput(file); 490 fput(file);
491 } 491 }
492 } 492 }
493 493
494 static inline int d_revalidate(struct dentry *dentry, struct nameidata *nd) 494 static inline int d_revalidate(struct dentry *dentry, struct nameidata *nd)
495 { 495 {
496 return dentry->d_op->d_revalidate(dentry, nd); 496 return dentry->d_op->d_revalidate(dentry, nd);
497 } 497 }
498 498
499 /** 499 /**
500 * complete_walk - successful completion of path walk 500 * complete_walk - successful completion of path walk
501 * @nd: pointer nameidata 501 * @nd: pointer nameidata
502 * 502 *
503 * If we had been in RCU mode, drop out of it and legitimize nd->path. 503 * If we had been in RCU mode, drop out of it and legitimize nd->path.
504 * Revalidate the final result, unless we'd already done that during 504 * Revalidate the final result, unless we'd already done that during
505 * the path walk or the filesystem doesn't ask for it. Return 0 on 505 * the path walk or the filesystem doesn't ask for it. Return 0 on
506 * success, -error on failure. In case of failure caller does not 506 * success, -error on failure. In case of failure caller does not
507 * need to drop nd->path. 507 * need to drop nd->path.
508 */ 508 */
509 static int complete_walk(struct nameidata *nd) 509 static int complete_walk(struct nameidata *nd)
510 { 510 {
511 struct dentry *dentry = nd->path.dentry; 511 struct dentry *dentry = nd->path.dentry;
512 int status; 512 int status;
513 513
514 if (nd->flags & LOOKUP_RCU) { 514 if (nd->flags & LOOKUP_RCU) {
515 nd->flags &= ~LOOKUP_RCU; 515 nd->flags &= ~LOOKUP_RCU;
516 if (!(nd->flags & LOOKUP_ROOT)) 516 if (!(nd->flags & LOOKUP_ROOT))
517 nd->root.mnt = NULL; 517 nd->root.mnt = NULL;
518 spin_lock(&dentry->d_lock); 518 spin_lock(&dentry->d_lock);
519 if (unlikely(!__d_rcu_to_refcount(dentry, nd->seq))) { 519 if (unlikely(!__d_rcu_to_refcount(dentry, nd->seq))) {
520 spin_unlock(&dentry->d_lock); 520 spin_unlock(&dentry->d_lock);
521 rcu_read_unlock(); 521 rcu_read_unlock();
522 br_read_unlock(vfsmount_lock); 522 br_read_unlock(vfsmount_lock);
523 return -ECHILD; 523 return -ECHILD;
524 } 524 }
525 BUG_ON(nd->inode != dentry->d_inode); 525 BUG_ON(nd->inode != dentry->d_inode);
526 spin_unlock(&dentry->d_lock); 526 spin_unlock(&dentry->d_lock);
527 mntget(nd->path.mnt); 527 mntget(nd->path.mnt);
528 rcu_read_unlock(); 528 rcu_read_unlock();
529 br_read_unlock(vfsmount_lock); 529 br_read_unlock(vfsmount_lock);
530 } 530 }
531 531
532 if (likely(!(nd->flags & LOOKUP_JUMPED))) 532 if (likely(!(nd->flags & LOOKUP_JUMPED)))
533 return 0; 533 return 0;
534 534
535 if (likely(!(dentry->d_flags & DCACHE_OP_REVALIDATE))) 535 if (likely(!(dentry->d_flags & DCACHE_OP_REVALIDATE)))
536 return 0; 536 return 0;
537 537
538 if (likely(!(dentry->d_sb->s_type->fs_flags & FS_REVAL_DOT))) 538 if (likely(!(dentry->d_sb->s_type->fs_flags & FS_REVAL_DOT)))
539 return 0; 539 return 0;
540 540
541 /* Note: we do not d_invalidate() */ 541 /* Note: we do not d_invalidate() */
542 status = d_revalidate(dentry, nd); 542 status = d_revalidate(dentry, nd);
543 if (status > 0) 543 if (status > 0)
544 return 0; 544 return 0;
545 545
546 if (!status) 546 if (!status)
547 status = -ESTALE; 547 status = -ESTALE;
548 548
549 path_put(&nd->path); 549 path_put(&nd->path);
550 return status; 550 return status;
551 } 551 }
552 552
553 static __always_inline void set_root(struct nameidata *nd) 553 static __always_inline void set_root(struct nameidata *nd)
554 { 554 {
555 if (!nd->root.mnt) 555 if (!nd->root.mnt)
556 get_fs_root(current->fs, &nd->root); 556 get_fs_root(current->fs, &nd->root);
557 } 557 }
558 558
559 static int link_path_walk(const char *, struct nameidata *); 559 static int link_path_walk(const char *, struct nameidata *);
560 560
561 static __always_inline void set_root_rcu(struct nameidata *nd) 561 static __always_inline void set_root_rcu(struct nameidata *nd)
562 { 562 {
563 if (!nd->root.mnt) { 563 if (!nd->root.mnt) {
564 struct fs_struct *fs = current->fs; 564 struct fs_struct *fs = current->fs;
565 unsigned seq; 565 unsigned seq;
566 566
567 do { 567 do {
568 seq = read_seqcount_begin(&fs->seq); 568 seq = read_seqcount_begin(&fs->seq);
569 nd->root = fs->root; 569 nd->root = fs->root;
570 nd->seq = __read_seqcount_begin(&nd->root.dentry->d_seq); 570 nd->seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
571 } while (read_seqcount_retry(&fs->seq, seq)); 571 } while (read_seqcount_retry(&fs->seq, seq));
572 } 572 }
573 } 573 }
574 574
575 static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *link) 575 static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *link)
576 { 576 {
577 int ret; 577 int ret;
578 578
579 if (IS_ERR(link)) 579 if (IS_ERR(link))
580 goto fail; 580 goto fail;
581 581
582 if (*link == '/') { 582 if (*link == '/') {
583 set_root(nd); 583 set_root(nd);
584 path_put(&nd->path); 584 path_put(&nd->path);
585 nd->path = nd->root; 585 nd->path = nd->root;
586 path_get(&nd->root); 586 path_get(&nd->root);
587 nd->flags |= LOOKUP_JUMPED; 587 nd->flags |= LOOKUP_JUMPED;
588 } 588 }
589 nd->inode = nd->path.dentry->d_inode; 589 nd->inode = nd->path.dentry->d_inode;
590 590
591 ret = link_path_walk(link, nd); 591 ret = link_path_walk(link, nd);
592 return ret; 592 return ret;
593 fail: 593 fail:
594 path_put(&nd->path); 594 path_put(&nd->path);
595 return PTR_ERR(link); 595 return PTR_ERR(link);
596 } 596 }
597 597
598 static void path_put_conditional(struct path *path, struct nameidata *nd) 598 static void path_put_conditional(struct path *path, struct nameidata *nd)
599 { 599 {
600 dput(path->dentry); 600 dput(path->dentry);
601 if (path->mnt != nd->path.mnt) 601 if (path->mnt != nd->path.mnt)
602 mntput(path->mnt); 602 mntput(path->mnt);
603 } 603 }
604 604
605 static inline void path_to_nameidata(const struct path *path, 605 static inline void path_to_nameidata(const struct path *path,
606 struct nameidata *nd) 606 struct nameidata *nd)
607 { 607 {
608 if (!(nd->flags & LOOKUP_RCU)) { 608 if (!(nd->flags & LOOKUP_RCU)) {
609 dput(nd->path.dentry); 609 dput(nd->path.dentry);
610 if (nd->path.mnt != path->mnt) 610 if (nd->path.mnt != path->mnt)
611 mntput(nd->path.mnt); 611 mntput(nd->path.mnt);
612 } 612 }
613 nd->path.mnt = path->mnt; 613 nd->path.mnt = path->mnt;
614 nd->path.dentry = path->dentry; 614 nd->path.dentry = path->dentry;
615 } 615 }
616 616
617 static inline void put_link(struct nameidata *nd, struct path *link, void *cookie) 617 static inline void put_link(struct nameidata *nd, struct path *link, void *cookie)
618 { 618 {
619 struct inode *inode = link->dentry->d_inode; 619 struct inode *inode = link->dentry->d_inode;
620 if (!IS_ERR(cookie) && inode->i_op->put_link) 620 if (!IS_ERR(cookie) && inode->i_op->put_link)
621 inode->i_op->put_link(link->dentry, nd, cookie); 621 inode->i_op->put_link(link->dentry, nd, cookie);
622 path_put(link); 622 path_put(link);
623 } 623 }
624 624
625 static __always_inline int 625 static __always_inline int
626 follow_link(struct path *link, struct nameidata *nd, void **p) 626 follow_link(struct path *link, struct nameidata *nd, void **p)
627 { 627 {
628 int error; 628 int error;
629 struct dentry *dentry = link->dentry; 629 struct dentry *dentry = link->dentry;
630 630
631 BUG_ON(nd->flags & LOOKUP_RCU); 631 BUG_ON(nd->flags & LOOKUP_RCU);
632 632
633 if (link->mnt == nd->path.mnt) 633 if (link->mnt == nd->path.mnt)
634 mntget(link->mnt); 634 mntget(link->mnt);
635 635
636 if (unlikely(current->total_link_count >= 40)) { 636 if (unlikely(current->total_link_count >= 40)) {
637 *p = ERR_PTR(-ELOOP); /* no ->put_link(), please */ 637 *p = ERR_PTR(-ELOOP); /* no ->put_link(), please */
638 path_put(&nd->path); 638 path_put(&nd->path);
639 return -ELOOP; 639 return -ELOOP;
640 } 640 }
641 cond_resched(); 641 cond_resched();
642 current->total_link_count++; 642 current->total_link_count++;
643 643
644 touch_atime(link->mnt, dentry); 644 touch_atime(link->mnt, dentry);
645 nd_set_link(nd, NULL); 645 nd_set_link(nd, NULL);
646 646
647 error = security_inode_follow_link(link->dentry, nd); 647 error = security_inode_follow_link(link->dentry, nd);
648 if (error) { 648 if (error) {
649 *p = ERR_PTR(error); /* no ->put_link(), please */ 649 *p = ERR_PTR(error); /* no ->put_link(), please */
650 path_put(&nd->path); 650 path_put(&nd->path);
651 return error; 651 return error;
652 } 652 }
653 653
654 nd->last_type = LAST_BIND; 654 nd->last_type = LAST_BIND;
655 *p = dentry->d_inode->i_op->follow_link(dentry, nd); 655 *p = dentry->d_inode->i_op->follow_link(dentry, nd);
656 error = PTR_ERR(*p); 656 error = PTR_ERR(*p);
657 if (!IS_ERR(*p)) { 657 if (!IS_ERR(*p)) {
658 char *s = nd_get_link(nd); 658 char *s = nd_get_link(nd);
659 error = 0; 659 error = 0;
660 if (s) 660 if (s)
661 error = __vfs_follow_link(nd, s); 661 error = __vfs_follow_link(nd, s);
662 else if (nd->last_type == LAST_BIND) { 662 else if (nd->last_type == LAST_BIND) {
663 nd->flags |= LOOKUP_JUMPED; 663 nd->flags |= LOOKUP_JUMPED;
664 nd->inode = nd->path.dentry->d_inode; 664 nd->inode = nd->path.dentry->d_inode;
665 if (nd->inode->i_op->follow_link) { 665 if (nd->inode->i_op->follow_link) {
666 /* stepped on a _really_ weird one */ 666 /* stepped on a _really_ weird one */
667 path_put(&nd->path); 667 path_put(&nd->path);
668 error = -ELOOP; 668 error = -ELOOP;
669 } 669 }
670 } 670 }
671 } 671 }
672 return error; 672 return error;
673 } 673 }
674 674
675 static int follow_up_rcu(struct path *path) 675 static int follow_up_rcu(struct path *path)
676 { 676 {
677 struct vfsmount *parent; 677 struct vfsmount *parent;
678 struct dentry *mountpoint; 678 struct dentry *mountpoint;
679 679
680 parent = path->mnt->mnt_parent; 680 parent = path->mnt->mnt_parent;
681 if (parent == path->mnt) 681 if (parent == path->mnt)
682 return 0; 682 return 0;
683 mountpoint = path->mnt->mnt_mountpoint; 683 mountpoint = path->mnt->mnt_mountpoint;
684 path->dentry = mountpoint; 684 path->dentry = mountpoint;
685 path->mnt = parent; 685 path->mnt = parent;
686 return 1; 686 return 1;
687 } 687 }
688 688
689 int follow_up(struct path *path) 689 int follow_up(struct path *path)
690 { 690 {
691 struct vfsmount *parent; 691 struct vfsmount *parent;
692 struct dentry *mountpoint; 692 struct dentry *mountpoint;
693 693
694 br_read_lock(vfsmount_lock); 694 br_read_lock(vfsmount_lock);
695 parent = path->mnt->mnt_parent; 695 parent = path->mnt->mnt_parent;
696 if (parent == path->mnt) { 696 if (parent == path->mnt) {
697 br_read_unlock(vfsmount_lock); 697 br_read_unlock(vfsmount_lock);
698 return 0; 698 return 0;
699 } 699 }
700 mntget(parent); 700 mntget(parent);
701 mountpoint = dget(path->mnt->mnt_mountpoint); 701 mountpoint = dget(path->mnt->mnt_mountpoint);
702 br_read_unlock(vfsmount_lock); 702 br_read_unlock(vfsmount_lock);
703 dput(path->dentry); 703 dput(path->dentry);
704 path->dentry = mountpoint; 704 path->dentry = mountpoint;
705 mntput(path->mnt); 705 mntput(path->mnt);
706 path->mnt = parent; 706 path->mnt = parent;
707 return 1; 707 return 1;
708 } 708 }
709 709
710 /* 710 /*
711 * Perform an automount 711 * Perform an automount
712 * - return -EISDIR to tell follow_managed() to stop and return the path we 712 * - return -EISDIR to tell follow_managed() to stop and return the path we
713 * were called with. 713 * were called with.
714 */ 714 */
715 static int follow_automount(struct path *path, unsigned flags, 715 static int follow_automount(struct path *path, unsigned flags,
716 bool *need_mntput) 716 bool *need_mntput)
717 { 717 {
718 struct vfsmount *mnt; 718 struct vfsmount *mnt;
719 int err; 719 int err;
720 720
721 if (!path->dentry->d_op || !path->dentry->d_op->d_automount) 721 if (!path->dentry->d_op || !path->dentry->d_op->d_automount)
722 return -EREMOTE; 722 return -EREMOTE;
723 723
724 /* We don't want to mount if someone supplied AT_NO_AUTOMOUNT 724 /* We don't want to mount if someone supplied AT_NO_AUTOMOUNT
725 * and this is the terminal part of the path. 725 * and this is the terminal part of the path.
726 */ 726 */
727 if ((flags & LOOKUP_NO_AUTOMOUNT) && !(flags & LOOKUP_PARENT)) 727 if ((flags & LOOKUP_NO_AUTOMOUNT) && !(flags & LOOKUP_PARENT))
728 return -EISDIR; /* we actually want to stop here */ 728 return -EISDIR; /* we actually want to stop here */
729 729
730 /* 730 /*
731 * We don't want to mount if someone's just doing a stat and they've 731 * We don't want to mount if someone's just doing a stat and they've
732 * set AT_SYMLINK_NOFOLLOW - unless they're stat'ing a directory and 732 * set AT_SYMLINK_NOFOLLOW - unless they're stat'ing a directory and
733 * appended a '/' to the name. 733 * appended a '/' to the name.
734 */ 734 */
735 if (!(flags & LOOKUP_FOLLOW)) { 735 if (!(flags & LOOKUP_FOLLOW)) {
736 /* We do, however, want to mount if someone wants to open or 736 /* We do, however, want to mount if someone wants to open or
737 * create a file of any type under the mountpoint, wants to 737 * create a file of any type under the mountpoint, wants to
738 * traverse through the mountpoint or wants to open the mounted 738 * traverse through the mountpoint or wants to open the mounted
739 * directory. 739 * directory.
740 * Also, autofs may mark negative dentries as being automount 740 * Also, autofs may mark negative dentries as being automount
741 * points. These will need the attentions of the daemon to 741 * points. These will need the attentions of the daemon to
742 * instantiate them before they can be used. 742 * instantiate them before they can be used.
743 */ 743 */
744 if (!(flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY | 744 if (!(flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
745 LOOKUP_OPEN | LOOKUP_CREATE)) && 745 LOOKUP_OPEN | LOOKUP_CREATE)) &&
746 path->dentry->d_inode) 746 path->dentry->d_inode)
747 return -EISDIR; 747 return -EISDIR;
748 } 748 }
749 current->total_link_count++; 749 current->total_link_count++;
750 if (current->total_link_count >= 40) 750 if (current->total_link_count >= 40)
751 return -ELOOP; 751 return -ELOOP;
752 752
753 mnt = path->dentry->d_op->d_automount(path); 753 mnt = path->dentry->d_op->d_automount(path);
754 if (IS_ERR(mnt)) { 754 if (IS_ERR(mnt)) {
755 /* 755 /*
756 * The filesystem is allowed to return -EISDIR here to indicate 756 * The filesystem is allowed to return -EISDIR here to indicate
757 * it doesn't want to automount. For instance, autofs would do 757 * it doesn't want to automount. For instance, autofs would do
758 * this so that its userspace daemon can mount on this dentry. 758 * this so that its userspace daemon can mount on this dentry.
759 * 759 *
760 * However, we can only permit this if it's a terminal point in 760 * However, we can only permit this if it's a terminal point in
761 * the path being looked up; if it wasn't then the remainder of 761 * the path being looked up; if it wasn't then the remainder of
762 * the path is inaccessible and we should say so. 762 * the path is inaccessible and we should say so.
763 */ 763 */
764 if (PTR_ERR(mnt) == -EISDIR && (flags & LOOKUP_PARENT)) 764 if (PTR_ERR(mnt) == -EISDIR && (flags & LOOKUP_PARENT))
765 return -EREMOTE; 765 return -EREMOTE;
766 return PTR_ERR(mnt); 766 return PTR_ERR(mnt);
767 } 767 }
768 768
769 if (!mnt) /* mount collision */ 769 if (!mnt) /* mount collision */
770 return 0; 770 return 0;
771 771
772 if (!*need_mntput) { 772 if (!*need_mntput) {
773 /* lock_mount() may release path->mnt on error */ 773 /* lock_mount() may release path->mnt on error */
774 mntget(path->mnt); 774 mntget(path->mnt);
775 *need_mntput = true; 775 *need_mntput = true;
776 } 776 }
777 err = finish_automount(mnt, path); 777 err = finish_automount(mnt, path);
778 778
779 switch (err) { 779 switch (err) {
780 case -EBUSY: 780 case -EBUSY:
781 /* Someone else made a mount here whilst we were busy */ 781 /* Someone else made a mount here whilst we were busy */
782 return 0; 782 return 0;
783 case 0: 783 case 0:
784 path_put(path); 784 path_put(path);
785 path->mnt = mnt; 785 path->mnt = mnt;
786 path->dentry = dget(mnt->mnt_root); 786 path->dentry = dget(mnt->mnt_root);
787 return 0; 787 return 0;
788 default: 788 default:
789 return err; 789 return err;
790 } 790 }
791 791
792 } 792 }
793 793
794 /* 794 /*
795 * Handle a dentry that is managed in some way. 795 * Handle a dentry that is managed in some way.
796 * - Flagged for transit management (autofs) 796 * - Flagged for transit management (autofs)
797 * - Flagged as mountpoint 797 * - Flagged as mountpoint
798 * - Flagged as automount point 798 * - Flagged as automount point
799 * 799 *
800 * This may only be called in refwalk mode. 800 * This may only be called in refwalk mode.
801 * 801 *
802 * Serialization is taken care of in namespace.c 802 * Serialization is taken care of in namespace.c
803 */ 803 */
804 static int follow_managed(struct path *path, unsigned flags) 804 static int follow_managed(struct path *path, unsigned flags)
805 { 805 {
806 struct vfsmount *mnt = path->mnt; /* held by caller, must be left alone */ 806 struct vfsmount *mnt = path->mnt; /* held by caller, must be left alone */
807 unsigned managed; 807 unsigned managed;
808 bool need_mntput = false; 808 bool need_mntput = false;
809 int ret = 0; 809 int ret = 0;
810 810
811 /* Given that we're not holding a lock here, we retain the value in a 811 /* Given that we're not holding a lock here, we retain the value in a
812 * local variable for each dentry as we look at it so that we don't see 812 * local variable for each dentry as we look at it so that we don't see
813 * the components of that value change under us */ 813 * the components of that value change under us */
814 while (managed = ACCESS_ONCE(path->dentry->d_flags), 814 while (managed = ACCESS_ONCE(path->dentry->d_flags),
815 managed &= DCACHE_MANAGED_DENTRY, 815 managed &= DCACHE_MANAGED_DENTRY,
816 unlikely(managed != 0)) { 816 unlikely(managed != 0)) {
817 /* Allow the filesystem to manage the transit without i_mutex 817 /* Allow the filesystem to manage the transit without i_mutex
818 * being held. */ 818 * being held. */
819 if (managed & DCACHE_MANAGE_TRANSIT) { 819 if (managed & DCACHE_MANAGE_TRANSIT) {
820 BUG_ON(!path->dentry->d_op); 820 BUG_ON(!path->dentry->d_op);
821 BUG_ON(!path->dentry->d_op->d_manage); 821 BUG_ON(!path->dentry->d_op->d_manage);
822 ret = path->dentry->d_op->d_manage(path->dentry, false); 822 ret = path->dentry->d_op->d_manage(path->dentry, false);
823 if (ret < 0) 823 if (ret < 0)
824 break; 824 break;
825 } 825 }
826 826
827 /* Transit to a mounted filesystem. */ 827 /* Transit to a mounted filesystem. */
828 if (managed & DCACHE_MOUNTED) { 828 if (managed & DCACHE_MOUNTED) {
829 struct vfsmount *mounted = lookup_mnt(path); 829 struct vfsmount *mounted = lookup_mnt(path);
830 if (mounted) { 830 if (mounted) {
831 dput(path->dentry); 831 dput(path->dentry);
832 if (need_mntput) 832 if (need_mntput)
833 mntput(path->mnt); 833 mntput(path->mnt);
834 path->mnt = mounted; 834 path->mnt = mounted;
835 path->dentry = dget(mounted->mnt_root); 835 path->dentry = dget(mounted->mnt_root);
836 need_mntput = true; 836 need_mntput = true;
837 continue; 837 continue;
838 } 838 }
839 839
840 /* Something is mounted on this dentry in another 840 /* Something is mounted on this dentry in another
841 * namespace and/or whatever was mounted there in this 841 * namespace and/or whatever was mounted there in this
842 * namespace got unmounted before we managed to get the 842 * namespace got unmounted before we managed to get the
843 * vfsmount_lock */ 843 * vfsmount_lock */
844 } 844 }
845 845
846 /* Handle an automount point */ 846 /* Handle an automount point */
847 if (managed & DCACHE_NEED_AUTOMOUNT) { 847 if (managed & DCACHE_NEED_AUTOMOUNT) {
848 ret = follow_automount(path, flags, &need_mntput); 848 ret = follow_automount(path, flags, &need_mntput);
849 if (ret < 0) 849 if (ret < 0)
850 break; 850 break;
851 continue; 851 continue;
852 } 852 }
853 853
854 /* We didn't change the current path point */ 854 /* We didn't change the current path point */
855 break; 855 break;
856 } 856 }
857 857
858 if (need_mntput && path->mnt == mnt) 858 if (need_mntput && path->mnt == mnt)
859 mntput(path->mnt); 859 mntput(path->mnt);
860 if (ret == -EISDIR) 860 if (ret == -EISDIR)
861 ret = 0; 861 ret = 0;
862 return ret; 862 return ret;
863 } 863 }
864 864
865 int follow_down_one(struct path *path) 865 int follow_down_one(struct path *path)
866 { 866 {
867 struct vfsmount *mounted; 867 struct vfsmount *mounted;
868 868
869 mounted = lookup_mnt(path); 869 mounted = lookup_mnt(path);
870 if (mounted) { 870 if (mounted) {
871 dput(path->dentry); 871 dput(path->dentry);
872 mntput(path->mnt); 872 mntput(path->mnt);
873 path->mnt = mounted; 873 path->mnt = mounted;
874 path->dentry = dget(mounted->mnt_root); 874 path->dentry = dget(mounted->mnt_root);
875 return 1; 875 return 1;
876 } 876 }
877 return 0; 877 return 0;
878 } 878 }
879 879
880 static inline bool managed_dentry_might_block(struct dentry *dentry) 880 static inline bool managed_dentry_might_block(struct dentry *dentry)
881 { 881 {
882 return (dentry->d_flags & DCACHE_MANAGE_TRANSIT && 882 return (dentry->d_flags & DCACHE_MANAGE_TRANSIT &&
883 dentry->d_op->d_manage(dentry, true) < 0); 883 dentry->d_op->d_manage(dentry, true) < 0);
884 } 884 }
885 885
886 /* 886 /*
887 * Try to skip to top of mountpoint pile in rcuwalk mode. Fail if 887 * Try to skip to top of mountpoint pile in rcuwalk mode. Fail if
888 * we meet a managed dentry that would need blocking. 888 * we meet a managed dentry that would need blocking.
889 */ 889 */
890 static bool __follow_mount_rcu(struct nameidata *nd, struct path *path, 890 static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
891 struct inode **inode) 891 struct inode **inode)
892 { 892 {
893 for (;;) { 893 for (;;) {
894 struct vfsmount *mounted; 894 struct vfsmount *mounted;
895 /* 895 /*
896 * Don't forget we might have a non-mountpoint managed dentry 896 * Don't forget we might have a non-mountpoint managed dentry
897 * that wants to block transit. 897 * that wants to block transit.
898 */ 898 */
899 if (unlikely(managed_dentry_might_block(path->dentry))) 899 if (unlikely(managed_dentry_might_block(path->dentry)))
900 return false; 900 return false;
901 901
902 if (!d_mountpoint(path->dentry)) 902 if (!d_mountpoint(path->dentry))
903 break; 903 break;
904 904
905 mounted = __lookup_mnt(path->mnt, path->dentry, 1); 905 mounted = __lookup_mnt(path->mnt, path->dentry, 1);
906 if (!mounted) 906 if (!mounted)
907 break; 907 break;
908 path->mnt = mounted; 908 path->mnt = mounted;
909 path->dentry = mounted->mnt_root; 909 path->dentry = mounted->mnt_root;
910 nd->seq = read_seqcount_begin(&path->dentry->d_seq); 910 nd->seq = read_seqcount_begin(&path->dentry->d_seq);
911 /* 911 /*
912 * Update the inode too. We don't need to re-check the 912 * Update the inode too. We don't need to re-check the
913 * dentry sequence number here after this d_inode read, 913 * dentry sequence number here after this d_inode read,
914 * because a mount-point is always pinned. 914 * because a mount-point is always pinned.
915 */ 915 */
916 *inode = path->dentry->d_inode; 916 *inode = path->dentry->d_inode;
917 } 917 }
918 return true; 918 return true;
919 } 919 }
920 920
921 static void follow_mount_rcu(struct nameidata *nd) 921 static void follow_mount_rcu(struct nameidata *nd)
922 { 922 {
923 while (d_mountpoint(nd->path.dentry)) { 923 while (d_mountpoint(nd->path.dentry)) {
924 struct vfsmount *mounted; 924 struct vfsmount *mounted;
925 mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry, 1); 925 mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry, 1);
926 if (!mounted) 926 if (!mounted)
927 break; 927 break;
928 nd->path.mnt = mounted; 928 nd->path.mnt = mounted;
929 nd->path.dentry = mounted->mnt_root; 929 nd->path.dentry = mounted->mnt_root;
930 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); 930 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
931 } 931 }
932 } 932 }
933 933
934 static int follow_dotdot_rcu(struct nameidata *nd) 934 static int follow_dotdot_rcu(struct nameidata *nd)
935 { 935 {
936 set_root_rcu(nd); 936 set_root_rcu(nd);
937 937
938 while (1) { 938 while (1) {
939 if (nd->path.dentry == nd->root.dentry && 939 if (nd->path.dentry == nd->root.dentry &&
940 nd->path.mnt == nd->root.mnt) { 940 nd->path.mnt == nd->root.mnt) {
941 break; 941 break;
942 } 942 }
943 if (nd->path.dentry != nd->path.mnt->mnt_root) { 943 if (nd->path.dentry != nd->path.mnt->mnt_root) {
944 struct dentry *old = nd->path.dentry; 944 struct dentry *old = nd->path.dentry;
945 struct dentry *parent = old->d_parent; 945 struct dentry *parent = old->d_parent;
946 unsigned seq; 946 unsigned seq;
947 947
948 seq = read_seqcount_begin(&parent->d_seq); 948 seq = read_seqcount_begin(&parent->d_seq);
949 if (read_seqcount_retry(&old->d_seq, nd->seq)) 949 if (read_seqcount_retry(&old->d_seq, nd->seq))
950 goto failed; 950 goto failed;
951 nd->path.dentry = parent; 951 nd->path.dentry = parent;
952 nd->seq = seq; 952 nd->seq = seq;
953 break; 953 break;
954 } 954 }
955 if (!follow_up_rcu(&nd->path)) 955 if (!follow_up_rcu(&nd->path))
956 break; 956 break;
957 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); 957 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
958 } 958 }
959 follow_mount_rcu(nd); 959 follow_mount_rcu(nd);
960 nd->inode = nd->path.dentry->d_inode; 960 nd->inode = nd->path.dentry->d_inode;
961 return 0; 961 return 0;
962 962
963 failed: 963 failed:
964 nd->flags &= ~LOOKUP_RCU; 964 nd->flags &= ~LOOKUP_RCU;
965 if (!(nd->flags & LOOKUP_ROOT)) 965 if (!(nd->flags & LOOKUP_ROOT))
966 nd->root.mnt = NULL; 966 nd->root.mnt = NULL;
967 rcu_read_unlock(); 967 rcu_read_unlock();
968 br_read_unlock(vfsmount_lock); 968 br_read_unlock(vfsmount_lock);
969 return -ECHILD; 969 return -ECHILD;
970 } 970 }
971 971
972 /* 972 /*
973 * Follow down to the covering mount currently visible to userspace. At each 973 * Follow down to the covering mount currently visible to userspace. At each
974 * point, the filesystem owning that dentry may be queried as to whether the 974 * point, the filesystem owning that dentry may be queried as to whether the
975 * caller is permitted to proceed or not. 975 * caller is permitted to proceed or not.
976 */ 976 */
977 int follow_down(struct path *path) 977 int follow_down(struct path *path)
978 { 978 {
979 unsigned managed; 979 unsigned managed;
980 int ret; 980 int ret;
981 981
982 while (managed = ACCESS_ONCE(path->dentry->d_flags), 982 while (managed = ACCESS_ONCE(path->dentry->d_flags),
983 unlikely(managed & DCACHE_MANAGED_DENTRY)) { 983 unlikely(managed & DCACHE_MANAGED_DENTRY)) {
984 /* Allow the filesystem to manage the transit without i_mutex 984 /* Allow the filesystem to manage the transit without i_mutex
985 * being held. 985 * being held.
986 * 986 *
987 * We indicate to the filesystem if someone is trying to mount 987 * We indicate to the filesystem if someone is trying to mount
988 * something here. This gives autofs the chance to deny anyone 988 * something here. This gives autofs the chance to deny anyone
989 * other than its daemon the right to mount on its 989 * other than its daemon the right to mount on its
990 * superstructure. 990 * superstructure.
991 * 991 *
992 * The filesystem may sleep at this point. 992 * The filesystem may sleep at this point.
993 */ 993 */
994 if (managed & DCACHE_MANAGE_TRANSIT) { 994 if (managed & DCACHE_MANAGE_TRANSIT) {
995 BUG_ON(!path->dentry->d_op); 995 BUG_ON(!path->dentry->d_op);
996 BUG_ON(!path->dentry->d_op->d_manage); 996 BUG_ON(!path->dentry->d_op->d_manage);
997 ret = path->dentry->d_op->d_manage( 997 ret = path->dentry->d_op->d_manage(
998 path->dentry, false); 998 path->dentry, false);
999 if (ret < 0) 999 if (ret < 0)
1000 return ret == -EISDIR ? 0 : ret; 1000 return ret == -EISDIR ? 0 : ret;
1001 } 1001 }
1002 1002
1003 /* Transit to a mounted filesystem. */ 1003 /* Transit to a mounted filesystem. */
1004 if (managed & DCACHE_MOUNTED) { 1004 if (managed & DCACHE_MOUNTED) {
1005 struct vfsmount *mounted = lookup_mnt(path); 1005 struct vfsmount *mounted = lookup_mnt(path);
1006 if (!mounted) 1006 if (!mounted)
1007 break; 1007 break;
1008 dput(path->dentry); 1008 dput(path->dentry);
1009 mntput(path->mnt); 1009 mntput(path->mnt);
1010 path->mnt = mounted; 1010 path->mnt = mounted;
1011 path->dentry = dget(mounted->mnt_root); 1011 path->dentry = dget(mounted->mnt_root);
1012 continue; 1012 continue;
1013 } 1013 }
1014 1014
1015 /* Don't handle automount points here */ 1015 /* Don't handle automount points here */
1016 break; 1016 break;
1017 } 1017 }
1018 return 0; 1018 return 0;
1019 } 1019 }
1020 1020
1021 /* 1021 /*
1022 * Skip to top of mountpoint pile in refwalk mode for follow_dotdot() 1022 * Skip to top of mountpoint pile in refwalk mode for follow_dotdot()
1023 */ 1023 */
1024 static void follow_mount(struct path *path) 1024 static void follow_mount(struct path *path)
1025 { 1025 {
1026 while (d_mountpoint(path->dentry)) { 1026 while (d_mountpoint(path->dentry)) {
1027 struct vfsmount *mounted = lookup_mnt(path); 1027 struct vfsmount *mounted = lookup_mnt(path);
1028 if (!mounted) 1028 if (!mounted)
1029 break; 1029 break;
1030 dput(path->dentry); 1030 dput(path->dentry);
1031 mntput(path->mnt); 1031 mntput(path->mnt);
1032 path->mnt = mounted; 1032 path->mnt = mounted;
1033 path->dentry = dget(mounted->mnt_root); 1033 path->dentry = dget(mounted->mnt_root);
1034 } 1034 }
1035 } 1035 }
1036 1036
1037 static void follow_dotdot(struct nameidata *nd) 1037 static void follow_dotdot(struct nameidata *nd)
1038 { 1038 {
1039 set_root(nd); 1039 set_root(nd);
1040 1040
1041 while(1) { 1041 while(1) {
1042 struct dentry *old = nd->path.dentry; 1042 struct dentry *old = nd->path.dentry;
1043 1043
1044 if (nd->path.dentry == nd->root.dentry && 1044 if (nd->path.dentry == nd->root.dentry &&
1045 nd->path.mnt == nd->root.mnt) { 1045 nd->path.mnt == nd->root.mnt) {
1046 break; 1046 break;
1047 } 1047 }
1048 if (nd->path.dentry != nd->path.mnt->mnt_root) { 1048 if (nd->path.dentry != nd->path.mnt->mnt_root) {
1049 /* rare case of legitimate dget_parent()... */ 1049 /* rare case of legitimate dget_parent()... */
1050 nd->path.dentry = dget_parent(nd->path.dentry); 1050 nd->path.dentry = dget_parent(nd->path.dentry);
1051 dput(old); 1051 dput(old);
1052 break; 1052 break;
1053 } 1053 }
1054 if (!follow_up(&nd->path)) 1054 if (!follow_up(&nd->path))
1055 break; 1055 break;
1056 } 1056 }
1057 follow_mount(&nd->path); 1057 follow_mount(&nd->path);
1058 nd->inode = nd->path.dentry->d_inode; 1058 nd->inode = nd->path.dentry->d_inode;
1059 } 1059 }
1060 1060
1061 /* 1061 /*
1062 * Allocate a dentry with name and parent, and perform a parent 1062 * Allocate a dentry with name and parent, and perform a parent
1063 * directory ->lookup on it. Returns the new dentry, or ERR_PTR 1063 * directory ->lookup on it. Returns the new dentry, or ERR_PTR
1064 * on error. parent->d_inode->i_mutex must be held. d_lookup must 1064 * on error. parent->d_inode->i_mutex must be held. d_lookup must
1065 * have verified that no child exists while under i_mutex. 1065 * have verified that no child exists while under i_mutex.
1066 */ 1066 */
1067 static struct dentry *d_alloc_and_lookup(struct dentry *parent, 1067 static struct dentry *d_alloc_and_lookup(struct dentry *parent,
1068 struct qstr *name, struct nameidata *nd) 1068 struct qstr *name, struct nameidata *nd)
1069 { 1069 {
1070 struct inode *inode = parent->d_inode; 1070 struct inode *inode = parent->d_inode;
1071 struct dentry *dentry; 1071 struct dentry *dentry;
1072 struct dentry *old; 1072 struct dentry *old;
1073 1073
1074 /* Don't create child dentry for a dead directory. */ 1074 /* Don't create child dentry for a dead directory. */
1075 if (unlikely(IS_DEADDIR(inode))) 1075 if (unlikely(IS_DEADDIR(inode)))
1076 return ERR_PTR(-ENOENT); 1076 return ERR_PTR(-ENOENT);
1077 1077
1078 dentry = d_alloc(parent, name); 1078 dentry = d_alloc(parent, name);
1079 if (unlikely(!dentry)) 1079 if (unlikely(!dentry))
1080 return ERR_PTR(-ENOMEM); 1080 return ERR_PTR(-ENOMEM);
1081 1081
1082 old = inode->i_op->lookup(inode, dentry, nd); 1082 old = inode->i_op->lookup(inode, dentry, nd);
1083 if (unlikely(old)) { 1083 if (unlikely(old)) {
1084 dput(dentry); 1084 dput(dentry);
1085 dentry = old; 1085 dentry = old;
1086 } 1086 }
1087 return dentry; 1087 return dentry;
1088 } 1088 }
1089 1089
1090 /* 1090 /*
1091 * We already have a dentry, but require a lookup to be performed on the parent 1091 * We already have a dentry, but require a lookup to be performed on the parent
1092 * directory to fill in d_inode. Returns the new dentry, or ERR_PTR on error. 1092 * directory to fill in d_inode. Returns the new dentry, or ERR_PTR on error.
1093 * parent->d_inode->i_mutex must be held. d_lookup must have verified that no 1093 * parent->d_inode->i_mutex must be held. d_lookup must have verified that no
1094 * child exists while under i_mutex. 1094 * child exists while under i_mutex.
1095 */ 1095 */
1096 static struct dentry *d_inode_lookup(struct dentry *parent, struct dentry *dentry, 1096 static struct dentry *d_inode_lookup(struct dentry *parent, struct dentry *dentry,
1097 struct nameidata *nd) 1097 struct nameidata *nd)
1098 { 1098 {
1099 struct inode *inode = parent->d_inode; 1099 struct inode *inode = parent->d_inode;
1100 struct dentry *old; 1100 struct dentry *old;
1101 1101
1102 /* Don't create child dentry for a dead directory. */ 1102 /* Don't create child dentry for a dead directory. */
1103 if (unlikely(IS_DEADDIR(inode))) 1103 if (unlikely(IS_DEADDIR(inode)))
1104 return ERR_PTR(-ENOENT); 1104 return ERR_PTR(-ENOENT);
1105 1105
1106 old = inode->i_op->lookup(inode, dentry, nd); 1106 old = inode->i_op->lookup(inode, dentry, nd);
1107 if (unlikely(old)) { 1107 if (unlikely(old)) {
1108 dput(dentry); 1108 dput(dentry);
1109 dentry = old; 1109 dentry = old;
1110 } 1110 }
1111 return dentry; 1111 return dentry;
1112 } 1112 }
1113 1113
1114 /* 1114 /*
1115 * It's more convoluted than I'd like it to be, but... it's still fairly 1115 * It's more convoluted than I'd like it to be, but... it's still fairly
1116 * small and for now I'd prefer to have fast path as straight as possible. 1116 * small and for now I'd prefer to have fast path as straight as possible.
1117 * It _is_ time-critical. 1117 * It _is_ time-critical.
1118 */ 1118 */
1119 static int do_lookup(struct nameidata *nd, struct qstr *name, 1119 static int do_lookup(struct nameidata *nd, struct qstr *name,
1120 struct path *path, struct inode **inode) 1120 struct path *path, struct inode **inode)
1121 { 1121 {
1122 struct vfsmount *mnt = nd->path.mnt; 1122 struct vfsmount *mnt = nd->path.mnt;
1123 struct dentry *dentry, *parent = nd->path.dentry; 1123 struct dentry *dentry, *parent = nd->path.dentry;
1124 int need_reval = 1; 1124 int need_reval = 1;
1125 int status = 1; 1125 int status = 1;
1126 int err; 1126 int err;
1127 1127
1128 /* 1128 /*
1129 * Rename seqlock is not required here because in the off chance 1129 * Rename seqlock is not required here because in the off chance
1130 * of a false negative due to a concurrent rename, we're going to 1130 * of a false negative due to a concurrent rename, we're going to
1131 * do the non-racy lookup, below. 1131 * do the non-racy lookup, below.
1132 */ 1132 */
1133 if (nd->flags & LOOKUP_RCU) { 1133 if (nd->flags & LOOKUP_RCU) {
1134 unsigned seq; 1134 unsigned seq;
1135 *inode = nd->inode; 1135 *inode = nd->inode;
1136 dentry = __d_lookup_rcu(parent, name, &seq, inode); 1136 dentry = __d_lookup_rcu(parent, name, &seq, inode);
1137 if (!dentry) 1137 if (!dentry)
1138 goto unlazy; 1138 goto unlazy;
1139 1139
1140 /* Memory barrier in read_seqcount_begin of child is enough */ 1140 /* Memory barrier in read_seqcount_begin of child is enough */
1141 if (__read_seqcount_retry(&parent->d_seq, nd->seq)) 1141 if (__read_seqcount_retry(&parent->d_seq, nd->seq))
1142 return -ECHILD; 1142 return -ECHILD;
1143 nd->seq = seq; 1143 nd->seq = seq;
1144 1144
1145 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE)) { 1145 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE)) {
1146 status = d_revalidate(dentry, nd); 1146 status = d_revalidate(dentry, nd);
1147 if (unlikely(status <= 0)) { 1147 if (unlikely(status <= 0)) {
1148 if (status != -ECHILD) 1148 if (status != -ECHILD)
1149 need_reval = 0; 1149 need_reval = 0;
1150 goto unlazy; 1150 goto unlazy;
1151 } 1151 }
1152 } 1152 }
1153 if (unlikely(d_need_lookup(dentry))) 1153 if (unlikely(d_need_lookup(dentry)))
1154 goto unlazy; 1154 goto unlazy;
1155 path->mnt = mnt; 1155 path->mnt = mnt;
1156 path->dentry = dentry; 1156 path->dentry = dentry;
1157 if (unlikely(!__follow_mount_rcu(nd, path, inode))) 1157 if (unlikely(!__follow_mount_rcu(nd, path, inode)))
1158 goto unlazy; 1158 goto unlazy;
1159 if (unlikely(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT)) 1159 if (unlikely(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT))
1160 goto unlazy; 1160 goto unlazy;
1161 return 0; 1161 return 0;
1162 unlazy: 1162 unlazy:
1163 if (unlazy_walk(nd, dentry)) 1163 if (unlazy_walk(nd, dentry))
1164 return -ECHILD; 1164 return -ECHILD;
1165 } else { 1165 } else {
1166 dentry = __d_lookup(parent, name); 1166 dentry = __d_lookup(parent, name);
1167 } 1167 }
1168 1168
1169 if (dentry && unlikely(d_need_lookup(dentry))) { 1169 if (dentry && unlikely(d_need_lookup(dentry))) {
1170 dput(dentry); 1170 dput(dentry);
1171 dentry = NULL; 1171 dentry = NULL;
1172 } 1172 }
1173 retry: 1173 retry:
1174 if (unlikely(!dentry)) { 1174 if (unlikely(!dentry)) {
1175 struct inode *dir = parent->d_inode; 1175 struct inode *dir = parent->d_inode;
1176 BUG_ON(nd->inode != dir); 1176 BUG_ON(nd->inode != dir);
1177 1177
1178 mutex_lock(&dir->i_mutex); 1178 mutex_lock(&dir->i_mutex);
1179 dentry = d_lookup(parent, name); 1179 dentry = d_lookup(parent, name);
1180 if (likely(!dentry)) { 1180 if (likely(!dentry)) {
1181 dentry = d_alloc_and_lookup(parent, name, nd); 1181 dentry = d_alloc_and_lookup(parent, name, nd);
1182 if (IS_ERR(dentry)) { 1182 if (IS_ERR(dentry)) {
1183 mutex_unlock(&dir->i_mutex); 1183 mutex_unlock(&dir->i_mutex);
1184 return PTR_ERR(dentry); 1184 return PTR_ERR(dentry);
1185 } 1185 }
1186 /* known good */ 1186 /* known good */
1187 need_reval = 0; 1187 need_reval = 0;
1188 status = 1; 1188 status = 1;
1189 } else if (unlikely(d_need_lookup(dentry))) { 1189 } else if (unlikely(d_need_lookup(dentry))) {
1190 dentry = d_inode_lookup(parent, dentry, nd); 1190 dentry = d_inode_lookup(parent, dentry, nd);
1191 if (IS_ERR(dentry)) { 1191 if (IS_ERR(dentry)) {
1192 mutex_unlock(&dir->i_mutex); 1192 mutex_unlock(&dir->i_mutex);
1193 return PTR_ERR(dentry); 1193 return PTR_ERR(dentry);
1194 } 1194 }
1195 /* known good */ 1195 /* known good */
1196 need_reval = 0; 1196 need_reval = 0;
1197 status = 1; 1197 status = 1;
1198 } 1198 }
1199 mutex_unlock(&dir->i_mutex); 1199 mutex_unlock(&dir->i_mutex);
1200 } 1200 }
1201 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE) && need_reval) 1201 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE) && need_reval)
1202 status = d_revalidate(dentry, nd); 1202 status = d_revalidate(dentry, nd);
1203 if (unlikely(status <= 0)) { 1203 if (unlikely(status <= 0)) {
1204 if (status < 0) { 1204 if (status < 0) {
1205 dput(dentry); 1205 dput(dentry);
1206 return status; 1206 return status;
1207 } 1207 }
1208 if (!d_invalidate(dentry)) { 1208 if (!d_invalidate(dentry)) {
1209 dput(dentry); 1209 dput(dentry);
1210 dentry = NULL; 1210 dentry = NULL;
1211 need_reval = 1; 1211 need_reval = 1;
1212 goto retry; 1212 goto retry;
1213 } 1213 }
1214 } 1214 }
1215 1215
1216 path->mnt = mnt; 1216 path->mnt = mnt;
1217 path->dentry = dentry; 1217 path->dentry = dentry;
1218 err = follow_managed(path, nd->flags); 1218 err = follow_managed(path, nd->flags);
1219 if (unlikely(err < 0)) { 1219 if (unlikely(err < 0)) {
1220 path_put_conditional(path, nd); 1220 path_put_conditional(path, nd);
1221 return err; 1221 return err;
1222 } 1222 }
1223 *inode = path->dentry->d_inode; 1223 *inode = path->dentry->d_inode;
1224 return 0; 1224 return 0;
1225 } 1225 }
1226 1226
1227 static inline int may_lookup(struct nameidata *nd) 1227 static inline int may_lookup(struct nameidata *nd)
1228 { 1228 {
1229 if (nd->flags & LOOKUP_RCU) { 1229 if (nd->flags & LOOKUP_RCU) {
1230 int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK); 1230 int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK);
1231 if (err != -ECHILD) 1231 if (err != -ECHILD)
1232 return err; 1232 return err;
1233 if (unlazy_walk(nd, NULL)) 1233 if (unlazy_walk(nd, NULL))
1234 return -ECHILD; 1234 return -ECHILD;
1235 } 1235 }
1236 return inode_permission(nd->inode, MAY_EXEC); 1236 return inode_permission(nd->inode, MAY_EXEC);
1237 } 1237 }
1238 1238
1239 static inline int handle_dots(struct nameidata *nd, int type) 1239 static inline int handle_dots(struct nameidata *nd, int type)
1240 { 1240 {
1241 if (type == LAST_DOTDOT) { 1241 if (type == LAST_DOTDOT) {
1242 if (nd->flags & LOOKUP_RCU) { 1242 if (nd->flags & LOOKUP_RCU) {
1243 if (follow_dotdot_rcu(nd)) 1243 if (follow_dotdot_rcu(nd))
1244 return -ECHILD; 1244 return -ECHILD;
1245 } else 1245 } else
1246 follow_dotdot(nd); 1246 follow_dotdot(nd);
1247 } 1247 }
1248 return 0; 1248 return 0;
1249 } 1249 }
1250 1250
1251 static void terminate_walk(struct nameidata *nd) 1251 static void terminate_walk(struct nameidata *nd)
1252 { 1252 {
1253 if (!(nd->flags & LOOKUP_RCU)) { 1253 if (!(nd->flags & LOOKUP_RCU)) {
1254 path_put(&nd->path); 1254 path_put(&nd->path);
1255 } else { 1255 } else {
1256 nd->flags &= ~LOOKUP_RCU; 1256 nd->flags &= ~LOOKUP_RCU;
1257 if (!(nd->flags & LOOKUP_ROOT)) 1257 if (!(nd->flags & LOOKUP_ROOT))
1258 nd->root.mnt = NULL; 1258 nd->root.mnt = NULL;
1259 rcu_read_unlock(); 1259 rcu_read_unlock();
1260 br_read_unlock(vfsmount_lock); 1260 br_read_unlock(vfsmount_lock);
1261 } 1261 }
1262 } 1262 }
1263 1263
1264 /* 1264 /*
1265 * Do we need to follow links? We _really_ want to be able 1265 * Do we need to follow links? We _really_ want to be able
1266 * to do this check without having to look at inode->i_op, 1266 * to do this check without having to look at inode->i_op,
1267 * so we keep a cache of "no, this doesn't need follow_link" 1267 * so we keep a cache of "no, this doesn't need follow_link"
1268 * for the common case. 1268 * for the common case.
1269 */ 1269 */
1270 static inline int do_follow_link(struct inode *inode, int follow) 1270 static inline int do_follow_link(struct inode *inode, int follow)
1271 { 1271 {
1272 if (unlikely(!(inode->i_opflags & IOP_NOFOLLOW))) { 1272 if (unlikely(!(inode->i_opflags & IOP_NOFOLLOW))) {
1273 if (likely(inode->i_op->follow_link)) 1273 if (likely(inode->i_op->follow_link))
1274 return follow; 1274 return follow;
1275 1275
1276 /* This gets set once for the inode lifetime */ 1276 /* This gets set once for the inode lifetime */
1277 spin_lock(&inode->i_lock); 1277 spin_lock(&inode->i_lock);
1278 inode->i_opflags |= IOP_NOFOLLOW; 1278 inode->i_opflags |= IOP_NOFOLLOW;
1279 spin_unlock(&inode->i_lock); 1279 spin_unlock(&inode->i_lock);
1280 } 1280 }
1281 return 0; 1281 return 0;
1282 } 1282 }
1283 1283
1284 static inline int walk_component(struct nameidata *nd, struct path *path, 1284 static inline int walk_component(struct nameidata *nd, struct path *path,
1285 struct qstr *name, int type, int follow) 1285 struct qstr *name, int type, int follow)
1286 { 1286 {
1287 struct inode *inode; 1287 struct inode *inode;
1288 int err; 1288 int err;
1289 /* 1289 /*
1290 * "." and ".." are special - ".." especially so because it has 1290 * "." and ".." are special - ".." especially so because it has
1291 * to be able to know about the current root directory and 1291 * to be able to know about the current root directory and
1292 * parent relationships. 1292 * parent relationships.
1293 */ 1293 */
1294 if (unlikely(type != LAST_NORM)) 1294 if (unlikely(type != LAST_NORM))
1295 return handle_dots(nd, type); 1295 return handle_dots(nd, type);
1296 err = do_lookup(nd, name, path, &inode); 1296 err = do_lookup(nd, name, path, &inode);
1297 if (unlikely(err)) { 1297 if (unlikely(err)) {
1298 terminate_walk(nd); 1298 terminate_walk(nd);
1299 return err; 1299 return err;
1300 } 1300 }
1301 if (!inode) { 1301 if (!inode) {
1302 path_to_nameidata(path, nd); 1302 path_to_nameidata(path, nd);
1303 terminate_walk(nd); 1303 terminate_walk(nd);
1304 return -ENOENT; 1304 return -ENOENT;
1305 } 1305 }
1306 if (do_follow_link(inode, follow)) { 1306 if (do_follow_link(inode, follow)) {
1307 if (nd->flags & LOOKUP_RCU) { 1307 if (nd->flags & LOOKUP_RCU) {
1308 if (unlikely(unlazy_walk(nd, path->dentry))) { 1308 if (unlikely(unlazy_walk(nd, path->dentry))) {
1309 terminate_walk(nd); 1309 terminate_walk(nd);
1310 return -ECHILD; 1310 return -ECHILD;
1311 } 1311 }
1312 } 1312 }
1313 BUG_ON(inode != path->dentry->d_inode); 1313 BUG_ON(inode != path->dentry->d_inode);
1314 return 1; 1314 return 1;
1315 } 1315 }
1316 path_to_nameidata(path, nd); 1316 path_to_nameidata(path, nd);
1317 nd->inode = inode; 1317 nd->inode = inode;
1318 return 0; 1318 return 0;
1319 } 1319 }
1320 1320
1321 /* 1321 /*
1322 * This limits recursive symlink follows to 8, while 1322 * This limits recursive symlink follows to 8, while
1323 * limiting consecutive symlinks to 40. 1323 * limiting consecutive symlinks to 40.
1324 * 1324 *
1325 * Without that kind of total limit, nasty chains of consecutive 1325 * Without that kind of total limit, nasty chains of consecutive
1326 * symlinks can cause almost arbitrarily long lookups. 1326 * symlinks can cause almost arbitrarily long lookups.
1327 */ 1327 */
1328 static inline int nested_symlink(struct path *path, struct nameidata *nd) 1328 static inline int nested_symlink(struct path *path, struct nameidata *nd)
1329 { 1329 {
1330 int res; 1330 int res;
1331 1331
1332 if (unlikely(current->link_count >= MAX_NESTED_LINKS)) { 1332 if (unlikely(current->link_count >= MAX_NESTED_LINKS)) {
1333 path_put_conditional(path, nd); 1333 path_put_conditional(path, nd);
1334 path_put(&nd->path); 1334 path_put(&nd->path);
1335 return -ELOOP; 1335 return -ELOOP;
1336 } 1336 }
1337 BUG_ON(nd->depth >= MAX_NESTED_LINKS); 1337 BUG_ON(nd->depth >= MAX_NESTED_LINKS);
1338 1338
1339 nd->depth++; 1339 nd->depth++;
1340 current->link_count++; 1340 current->link_count++;
1341 1341
1342 do { 1342 do {
1343 struct path link = *path; 1343 struct path link = *path;
1344 void *cookie; 1344 void *cookie;
1345 1345
1346 res = follow_link(&link, nd, &cookie); 1346 res = follow_link(&link, nd, &cookie);
1347 if (!res) 1347 if (!res)
1348 res = walk_component(nd, path, &nd->last, 1348 res = walk_component(nd, path, &nd->last,
1349 nd->last_type, LOOKUP_FOLLOW); 1349 nd->last_type, LOOKUP_FOLLOW);
1350 put_link(nd, &link, cookie); 1350 put_link(nd, &link, cookie);
1351 } while (res > 0); 1351 } while (res > 0);
1352 1352
1353 current->link_count--; 1353 current->link_count--;
1354 nd->depth--; 1354 nd->depth--;
1355 return res; 1355 return res;
1356 } 1356 }
1357 1357
1358 /* 1358 /*
1359 * We really don't want to look at inode->i_op->lookup 1359 * We really don't want to look at inode->i_op->lookup
1360 * when we don't have to. So we keep a cache bit in 1360 * when we don't have to. So we keep a cache bit in
1361 * the inode ->i_opflags field that says "yes, we can 1361 * the inode ->i_opflags field that says "yes, we can
1362 * do lookup on this inode". 1362 * do lookup on this inode".
1363 */ 1363 */
1364 static inline int can_lookup(struct inode *inode) 1364 static inline int can_lookup(struct inode *inode)
1365 { 1365 {
1366 if (likely(inode->i_opflags & IOP_LOOKUP)) 1366 if (likely(inode->i_opflags & IOP_LOOKUP))
1367 return 1; 1367 return 1;
1368 if (likely(!inode->i_op->lookup)) 1368 if (likely(!inode->i_op->lookup))
1369 return 0; 1369 return 0;
1370 1370
1371 /* We do this once for the lifetime of the inode */ 1371 /* We do this once for the lifetime of the inode */
1372 spin_lock(&inode->i_lock); 1372 spin_lock(&inode->i_lock);
1373 inode->i_opflags |= IOP_LOOKUP; 1373 inode->i_opflags |= IOP_LOOKUP;
1374 spin_unlock(&inode->i_lock); 1374 spin_unlock(&inode->i_lock);
1375 return 1; 1375 return 1;
1376 } 1376 }
1377 1377
1378 /* 1378 /*
1379 * Name resolution. 1379 * Name resolution.
1380 * This is the basic name resolution function, turning a pathname into 1380 * This is the basic name resolution function, turning a pathname into
1381 * the final dentry. We expect 'base' to be positive and a directory. 1381 * the final dentry. We expect 'base' to be positive and a directory.
1382 * 1382 *
1383 * Returns 0 and nd will have valid dentry and mnt on success. 1383 * Returns 0 and nd will have valid dentry and mnt on success.
1384 * Returns error and drops reference to input namei data on failure. 1384 * Returns error and drops reference to input namei data on failure.
1385 */ 1385 */
1386 static int link_path_walk(const char *name, struct nameidata *nd) 1386 static int link_path_walk(const char *name, struct nameidata *nd)
1387 { 1387 {
1388 struct path next; 1388 struct path next;
1389 int err; 1389 int err;
1390 1390
1391 while (*name=='/') 1391 while (*name=='/')
1392 name++; 1392 name++;
1393 if (!*name) 1393 if (!*name)
1394 return 0; 1394 return 0;
1395 1395
1396 /* At this point we know we have a real path component. */ 1396 /* At this point we know we have a real path component. */
1397 for(;;) { 1397 for(;;) {
1398 unsigned long hash; 1398 unsigned long hash;
1399 struct qstr this; 1399 struct qstr this;
1400 unsigned int c; 1400 unsigned int c;
1401 int type; 1401 int type;
1402 1402
1403 err = may_lookup(nd); 1403 err = may_lookup(nd);
1404 if (err) 1404 if (err)
1405 break; 1405 break;
1406 1406
1407 this.name = name; 1407 this.name = name;
1408 c = *(const unsigned char *)name; 1408 c = *(const unsigned char *)name;
1409 1409
1410 hash = init_name_hash(); 1410 hash = init_name_hash();
1411 do { 1411 do {
1412 name++; 1412 name++;
1413 hash = partial_name_hash(c, hash); 1413 hash = partial_name_hash(c, hash);
1414 c = *(const unsigned char *)name; 1414 c = *(const unsigned char *)name;
1415 } while (c && (c != '/')); 1415 } while (c && (c != '/'));
1416 this.len = name - (const char *) this.name; 1416 this.len = name - (const char *) this.name;
1417 this.hash = end_name_hash(hash); 1417 this.hash = end_name_hash(hash);
1418 1418
1419 type = LAST_NORM; 1419 type = LAST_NORM;
1420 if (this.name[0] == '.') switch (this.len) { 1420 if (this.name[0] == '.') switch (this.len) {
1421 case 2: 1421 case 2:
1422 if (this.name[1] == '.') { 1422 if (this.name[1] == '.') {
1423 type = LAST_DOTDOT; 1423 type = LAST_DOTDOT;
1424 nd->flags |= LOOKUP_JUMPED; 1424 nd->flags |= LOOKUP_JUMPED;
1425 } 1425 }
1426 break; 1426 break;
1427 case 1: 1427 case 1:
1428 type = LAST_DOT; 1428 type = LAST_DOT;
1429 } 1429 }
1430 if (likely(type == LAST_NORM)) { 1430 if (likely(type == LAST_NORM)) {
1431 struct dentry *parent = nd->path.dentry; 1431 struct dentry *parent = nd->path.dentry;
1432 nd->flags &= ~LOOKUP_JUMPED; 1432 nd->flags &= ~LOOKUP_JUMPED;
1433 if (unlikely(parent->d_flags & DCACHE_OP_HASH)) { 1433 if (unlikely(parent->d_flags & DCACHE_OP_HASH)) {
1434 err = parent->d_op->d_hash(parent, nd->inode, 1434 err = parent->d_op->d_hash(parent, nd->inode,
1435 &this); 1435 &this);
1436 if (err < 0) 1436 if (err < 0)
1437 break; 1437 break;
1438 } 1438 }
1439 } 1439 }
1440 1440
1441 /* remove trailing slashes? */ 1441 /* remove trailing slashes? */
1442 if (!c) 1442 if (!c)
1443 goto last_component; 1443 goto last_component;
1444 while (*++name == '/'); 1444 while (*++name == '/');
1445 if (!*name) 1445 if (!*name)
1446 goto last_component; 1446 goto last_component;
1447 1447
1448 err = walk_component(nd, &next, &this, type, LOOKUP_FOLLOW); 1448 err = walk_component(nd, &next, &this, type, LOOKUP_FOLLOW);
1449 if (err < 0) 1449 if (err < 0)
1450 return err; 1450 return err;
1451 1451
1452 if (err) { 1452 if (err) {
1453 err = nested_symlink(&next, nd); 1453 err = nested_symlink(&next, nd);
1454 if (err) 1454 if (err)
1455 return err; 1455 return err;
1456 } 1456 }
1457 if (can_lookup(nd->inode)) 1457 if (can_lookup(nd->inode))
1458 continue; 1458 continue;
1459 err = -ENOTDIR; 1459 err = -ENOTDIR;
1460 break; 1460 break;
1461 /* here ends the main loop */ 1461 /* here ends the main loop */
1462 1462
1463 last_component: 1463 last_component:
1464 nd->last = this; 1464 nd->last = this;
1465 nd->last_type = type; 1465 nd->last_type = type;
1466 return 0; 1466 return 0;
1467 } 1467 }
1468 terminate_walk(nd); 1468 terminate_walk(nd);
1469 return err; 1469 return err;
1470 } 1470 }
1471 1471
1472 static int path_init(int dfd, const char *name, unsigned int flags, 1472 static int path_init(int dfd, const char *name, unsigned int flags,
1473 struct nameidata *nd, struct file **fp) 1473 struct nameidata *nd, struct file **fp)
1474 { 1474 {
1475 int retval = 0; 1475 int retval = 0;
1476 int fput_needed; 1476 int fput_needed;
1477 struct file *file; 1477 struct file *file;
1478 1478
1479 nd->last_type = LAST_ROOT; /* if there are only slashes... */ 1479 nd->last_type = LAST_ROOT; /* if there are only slashes... */
1480 nd->flags = flags | LOOKUP_JUMPED; 1480 nd->flags = flags | LOOKUP_JUMPED;
1481 nd->depth = 0; 1481 nd->depth = 0;
1482 if (flags & LOOKUP_ROOT) { 1482 if (flags & LOOKUP_ROOT) {
1483 struct inode *inode = nd->root.dentry->d_inode; 1483 struct inode *inode = nd->root.dentry->d_inode;
1484 if (*name) { 1484 if (*name) {
1485 if (!inode->i_op->lookup) 1485 if (!inode->i_op->lookup)
1486 return -ENOTDIR; 1486 return -ENOTDIR;
1487 retval = inode_permission(inode, MAY_EXEC); 1487 retval = inode_permission(inode, MAY_EXEC);
1488 if (retval) 1488 if (retval)
1489 return retval; 1489 return retval;
1490 } 1490 }
1491 nd->path = nd->root; 1491 nd->path = nd->root;
1492 nd->inode = inode; 1492 nd->inode = inode;
1493 if (flags & LOOKUP_RCU) { 1493 if (flags & LOOKUP_RCU) {
1494 br_read_lock(vfsmount_lock); 1494 br_read_lock(vfsmount_lock);
1495 rcu_read_lock(); 1495 rcu_read_lock();
1496 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 1496 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
1497 } else { 1497 } else {
1498 path_get(&nd->path); 1498 path_get(&nd->path);
1499 } 1499 }
1500 return 0; 1500 return 0;
1501 } 1501 }
1502 1502
1503 nd->root.mnt = NULL; 1503 nd->root.mnt = NULL;
1504 1504
1505 if (*name=='/') { 1505 if (*name=='/') {
1506 if (flags & LOOKUP_RCU) { 1506 if (flags & LOOKUP_RCU) {
1507 br_read_lock(vfsmount_lock); 1507 br_read_lock(vfsmount_lock);
1508 rcu_read_lock(); 1508 rcu_read_lock();
1509 set_root_rcu(nd); 1509 set_root_rcu(nd);
1510 } else { 1510 } else {
1511 set_root(nd); 1511 set_root(nd);
1512 path_get(&nd->root); 1512 path_get(&nd->root);
1513 } 1513 }
1514 nd->path = nd->root; 1514 nd->path = nd->root;
1515 } else if (dfd == AT_FDCWD) { 1515 } else if (dfd == AT_FDCWD) {
1516 if (flags & LOOKUP_RCU) { 1516 if (flags & LOOKUP_RCU) {
1517 struct fs_struct *fs = current->fs; 1517 struct fs_struct *fs = current->fs;
1518 unsigned seq; 1518 unsigned seq;
1519 1519
1520 br_read_lock(vfsmount_lock); 1520 br_read_lock(vfsmount_lock);
1521 rcu_read_lock(); 1521 rcu_read_lock();
1522 1522
1523 do { 1523 do {
1524 seq = read_seqcount_begin(&fs->seq); 1524 seq = read_seqcount_begin(&fs->seq);
1525 nd->path = fs->pwd; 1525 nd->path = fs->pwd;
1526 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 1526 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
1527 } while (read_seqcount_retry(&fs->seq, seq)); 1527 } while (read_seqcount_retry(&fs->seq, seq));
1528 } else { 1528 } else {
1529 get_fs_pwd(current->fs, &nd->path); 1529 get_fs_pwd(current->fs, &nd->path);
1530 } 1530 }
1531 } else { 1531 } else {
1532 struct dentry *dentry; 1532 struct dentry *dentry;
1533 1533
1534 file = fget_raw_light(dfd, &fput_needed); 1534 file = fget_raw_light(dfd, &fput_needed);
1535 retval = -EBADF; 1535 retval = -EBADF;
1536 if (!file) 1536 if (!file)
1537 goto out_fail; 1537 goto out_fail;
1538 1538
1539 dentry = file->f_path.dentry; 1539 dentry = file->f_path.dentry;
1540 1540
1541 if (*name) { 1541 if (*name) {
1542 retval = -ENOTDIR; 1542 retval = -ENOTDIR;
1543 if (!S_ISDIR(dentry->d_inode->i_mode)) 1543 if (!S_ISDIR(dentry->d_inode->i_mode))
1544 goto fput_fail; 1544 goto fput_fail;
1545 1545
1546 retval = inode_permission(dentry->d_inode, MAY_EXEC); 1546 retval = inode_permission(dentry->d_inode, MAY_EXEC);
1547 if (retval) 1547 if (retval)
1548 goto fput_fail; 1548 goto fput_fail;
1549 } 1549 }
1550 1550
1551 nd->path = file->f_path; 1551 nd->path = file->f_path;
1552 if (flags & LOOKUP_RCU) { 1552 if (flags & LOOKUP_RCU) {
1553 if (fput_needed) 1553 if (fput_needed)
1554 *fp = file; 1554 *fp = file;
1555 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 1555 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
1556 br_read_lock(vfsmount_lock); 1556 br_read_lock(vfsmount_lock);
1557 rcu_read_lock(); 1557 rcu_read_lock();
1558 } else { 1558 } else {
1559 path_get(&file->f_path); 1559 path_get(&file->f_path);
1560 fput_light(file, fput_needed); 1560 fput_light(file, fput_needed);
1561 } 1561 }
1562 } 1562 }
1563 1563
1564 nd->inode = nd->path.dentry->d_inode; 1564 nd->inode = nd->path.dentry->d_inode;
1565 return 0; 1565 return 0;
1566 1566
1567 fput_fail: 1567 fput_fail:
1568 fput_light(file, fput_needed); 1568 fput_light(file, fput_needed);
1569 out_fail: 1569 out_fail:
1570 return retval; 1570 return retval;
1571 } 1571 }
1572 1572
1573 static inline int lookup_last(struct nameidata *nd, struct path *path) 1573 static inline int lookup_last(struct nameidata *nd, struct path *path)
1574 { 1574 {
1575 if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len]) 1575 if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len])
1576 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 1576 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
1577 1577
1578 nd->flags &= ~LOOKUP_PARENT; 1578 nd->flags &= ~LOOKUP_PARENT;
1579 return walk_component(nd, path, &nd->last, nd->last_type, 1579 return walk_component(nd, path, &nd->last, nd->last_type,
1580 nd->flags & LOOKUP_FOLLOW); 1580 nd->flags & LOOKUP_FOLLOW);
1581 } 1581 }
1582 1582
1583 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */ 1583 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
1584 static int path_lookupat(int dfd, const char *name, 1584 static int path_lookupat(int dfd, const char *name,
1585 unsigned int flags, struct nameidata *nd) 1585 unsigned int flags, struct nameidata *nd)
1586 { 1586 {
1587 struct file *base = NULL; 1587 struct file *base = NULL;
1588 struct path path; 1588 struct path path;
1589 int err; 1589 int err;
1590 1590
1591 /* 1591 /*
1592 * Path walking is largely split up into 2 different synchronisation 1592 * Path walking is largely split up into 2 different synchronisation
1593 * schemes, rcu-walk and ref-walk (explained in 1593 * schemes, rcu-walk and ref-walk (explained in
1594 * Documentation/filesystems/path-lookup.txt). These share much of the 1594 * Documentation/filesystems/path-lookup.txt). These share much of the
1595 * path walk code, but some things particularly setup, cleanup, and 1595 * path walk code, but some things particularly setup, cleanup, and
1596 * following mounts are sufficiently divergent that functions are 1596 * following mounts are sufficiently divergent that functions are
1597 * duplicated. Typically there is a function foo(), and its RCU 1597 * duplicated. Typically there is a function foo(), and its RCU
1598 * analogue, foo_rcu(). 1598 * analogue, foo_rcu().
1599 * 1599 *
1600 * -ECHILD is the error number of choice (just to avoid clashes) that 1600 * -ECHILD is the error number of choice (just to avoid clashes) that
1601 * is returned if some aspect of an rcu-walk fails. Such an error must 1601 * is returned if some aspect of an rcu-walk fails. Such an error must
1602 * be handled by restarting a traditional ref-walk (which will always 1602 * be handled by restarting a traditional ref-walk (which will always
1603 * be able to complete). 1603 * be able to complete).
1604 */ 1604 */
1605 err = path_init(dfd, name, flags | LOOKUP_PARENT, nd, &base); 1605 err = path_init(dfd, name, flags | LOOKUP_PARENT, nd, &base);
1606 1606
1607 if (unlikely(err)) 1607 if (unlikely(err))
1608 return err; 1608 return err;
1609 1609
1610 current->total_link_count = 0; 1610 current->total_link_count = 0;
1611 err = link_path_walk(name, nd); 1611 err = link_path_walk(name, nd);
1612 1612
1613 if (!err && !(flags & LOOKUP_PARENT)) { 1613 if (!err && !(flags & LOOKUP_PARENT)) {
1614 err = lookup_last(nd, &path); 1614 err = lookup_last(nd, &path);
1615 while (err > 0) { 1615 while (err > 0) {
1616 void *cookie; 1616 void *cookie;
1617 struct path link = path; 1617 struct path link = path;
1618 nd->flags |= LOOKUP_PARENT; 1618 nd->flags |= LOOKUP_PARENT;
1619 err = follow_link(&link, nd, &cookie); 1619 err = follow_link(&link, nd, &cookie);
1620 if (!err) 1620 if (!err)
1621 err = lookup_last(nd, &path); 1621 err = lookup_last(nd, &path);
1622 put_link(nd, &link, cookie); 1622 put_link(nd, &link, cookie);
1623 } 1623 }
1624 } 1624 }
1625 1625
1626 if (!err) 1626 if (!err)
1627 err = complete_walk(nd); 1627 err = complete_walk(nd);
1628 1628
1629 if (!err && nd->flags & LOOKUP_DIRECTORY) { 1629 if (!err && nd->flags & LOOKUP_DIRECTORY) {
1630 if (!nd->inode->i_op->lookup) { 1630 if (!nd->inode->i_op->lookup) {
1631 path_put(&nd->path); 1631 path_put(&nd->path);
1632 err = -ENOTDIR; 1632 err = -ENOTDIR;
1633 } 1633 }
1634 } 1634 }
1635 1635
1636 if (base) 1636 if (base)
1637 fput(base); 1637 fput(base);
1638 1638
1639 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) { 1639 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
1640 path_put(&nd->root); 1640 path_put(&nd->root);
1641 nd->root.mnt = NULL; 1641 nd->root.mnt = NULL;
1642 } 1642 }
1643 return err; 1643 return err;
1644 } 1644 }
1645 1645
1646 static int do_path_lookup(int dfd, const char *name, 1646 static int do_path_lookup(int dfd, const char *name,
1647 unsigned int flags, struct nameidata *nd) 1647 unsigned int flags, struct nameidata *nd)
1648 { 1648 {
1649 int retval = path_lookupat(dfd, name, flags | LOOKUP_RCU, nd); 1649 int retval = path_lookupat(dfd, name, flags | LOOKUP_RCU, nd);
1650 if (unlikely(retval == -ECHILD)) 1650 if (unlikely(retval == -ECHILD))
1651 retval = path_lookupat(dfd, name, flags, nd); 1651 retval = path_lookupat(dfd, name, flags, nd);
1652 if (unlikely(retval == -ESTALE)) 1652 if (unlikely(retval == -ESTALE))
1653 retval = path_lookupat(dfd, name, flags | LOOKUP_REVAL, nd); 1653 retval = path_lookupat(dfd, name, flags | LOOKUP_REVAL, nd);
1654 1654
1655 if (likely(!retval)) { 1655 if (likely(!retval)) {
1656 if (unlikely(!audit_dummy_context())) { 1656 if (unlikely(!audit_dummy_context())) {
1657 if (nd->path.dentry && nd->inode) 1657 if (nd->path.dentry && nd->inode)
1658 audit_inode(name, nd->path.dentry); 1658 audit_inode(name, nd->path.dentry);
1659 } 1659 }
1660 } 1660 }
1661 return retval; 1661 return retval;
1662 } 1662 }
1663 1663
1664 int kern_path_parent(const char *name, struct nameidata *nd) 1664 int kern_path_parent(const char *name, struct nameidata *nd)
1665 { 1665 {
1666 return do_path_lookup(AT_FDCWD, name, LOOKUP_PARENT, nd); 1666 return do_path_lookup(AT_FDCWD, name, LOOKUP_PARENT, nd);
1667 } 1667 }
1668 1668
1669 int kern_path(const char *name, unsigned int flags, struct path *path) 1669 int kern_path(const char *name, unsigned int flags, struct path *path)
1670 { 1670 {
1671 struct nameidata nd; 1671 struct nameidata nd;
1672 int res = do_path_lookup(AT_FDCWD, name, flags, &nd); 1672 int res = do_path_lookup(AT_FDCWD, name, flags, &nd);
1673 if (!res) 1673 if (!res)
1674 *path = nd.path; 1674 *path = nd.path;
1675 return res; 1675 return res;
1676 } 1676 }
1677 1677
1678 /** 1678 /**
1679 * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair 1679 * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair
1680 * @dentry: pointer to dentry of the base directory 1680 * @dentry: pointer to dentry of the base directory
1681 * @mnt: pointer to vfs mount of the base directory 1681 * @mnt: pointer to vfs mount of the base directory
1682 * @name: pointer to file name 1682 * @name: pointer to file name
1683 * @flags: lookup flags 1683 * @flags: lookup flags
1684 * @path: pointer to struct path to fill 1684 * @path: pointer to struct path to fill
1685 */ 1685 */
1686 int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt, 1686 int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
1687 const char *name, unsigned int flags, 1687 const char *name, unsigned int flags,
1688 struct path *path) 1688 struct path *path)
1689 { 1689 {
1690 struct nameidata nd; 1690 struct nameidata nd;
1691 int err; 1691 int err;
1692 nd.root.dentry = dentry; 1692 nd.root.dentry = dentry;
1693 nd.root.mnt = mnt; 1693 nd.root.mnt = mnt;
1694 BUG_ON(flags & LOOKUP_PARENT); 1694 BUG_ON(flags & LOOKUP_PARENT);
1695 /* the first argument of do_path_lookup() is ignored with LOOKUP_ROOT */ 1695 /* the first argument of do_path_lookup() is ignored with LOOKUP_ROOT */
1696 err = do_path_lookup(AT_FDCWD, name, flags | LOOKUP_ROOT, &nd); 1696 err = do_path_lookup(AT_FDCWD, name, flags | LOOKUP_ROOT, &nd);
1697 if (!err) 1697 if (!err)
1698 *path = nd.path; 1698 *path = nd.path;
1699 return err; 1699 return err;
1700 } 1700 }
1701 1701
1702 static struct dentry *__lookup_hash(struct qstr *name, 1702 static struct dentry *__lookup_hash(struct qstr *name,
1703 struct dentry *base, struct nameidata *nd) 1703 struct dentry *base, struct nameidata *nd)
1704 { 1704 {
1705 struct inode *inode = base->d_inode; 1705 struct inode *inode = base->d_inode;
1706 struct dentry *dentry; 1706 struct dentry *dentry;
1707 int err; 1707 int err;
1708 1708
1709 err = inode_permission(inode, MAY_EXEC); 1709 err = inode_permission(inode, MAY_EXEC);
1710 if (err) 1710 if (err)
1711 return ERR_PTR(err); 1711 return ERR_PTR(err);
1712 1712
1713 /* 1713 /*
1714 * Don't bother with __d_lookup: callers are for creat as 1714 * Don't bother with __d_lookup: callers are for creat as
1715 * well as unlink, so a lot of the time it would cost 1715 * well as unlink, so a lot of the time it would cost
1716 * a double lookup. 1716 * a double lookup.
1717 */ 1717 */
1718 dentry = d_lookup(base, name); 1718 dentry = d_lookup(base, name);
1719 1719
1720 if (dentry && d_need_lookup(dentry)) { 1720 if (dentry && d_need_lookup(dentry)) {
1721 /* 1721 /*
1722 * __lookup_hash is called with the parent dir's i_mutex already 1722 * __lookup_hash is called with the parent dir's i_mutex already
1723 * held, so we are good to go here. 1723 * held, so we are good to go here.
1724 */ 1724 */
1725 dentry = d_inode_lookup(base, dentry, nd); 1725 dentry = d_inode_lookup(base, dentry, nd);
1726 if (IS_ERR(dentry)) 1726 if (IS_ERR(dentry))
1727 return dentry; 1727 return dentry;
1728 } 1728 }
1729 1729
1730 if (dentry && (dentry->d_flags & DCACHE_OP_REVALIDATE)) { 1730 if (dentry && (dentry->d_flags & DCACHE_OP_REVALIDATE)) {
1731 int status = d_revalidate(dentry, nd); 1731 int status = d_revalidate(dentry, nd);
1732 if (unlikely(status <= 0)) { 1732 if (unlikely(status <= 0)) {
1733 /* 1733 /*
1734 * The dentry failed validation. 1734 * The dentry failed validation.
1735 * If d_revalidate returned 0 attempt to invalidate 1735 * If d_revalidate returned 0 attempt to invalidate
1736 * the dentry otherwise d_revalidate is asking us 1736 * the dentry otherwise d_revalidate is asking us
1737 * to return a fail status. 1737 * to return a fail status.
1738 */ 1738 */
1739 if (status < 0) { 1739 if (status < 0) {
1740 dput(dentry); 1740 dput(dentry);
1741 return ERR_PTR(status); 1741 return ERR_PTR(status);
1742 } else if (!d_invalidate(dentry)) { 1742 } else if (!d_invalidate(dentry)) {
1743 dput(dentry); 1743 dput(dentry);
1744 dentry = NULL; 1744 dentry = NULL;
1745 } 1745 }
1746 } 1746 }
1747 } 1747 }
1748 1748
1749 if (!dentry) 1749 if (!dentry)
1750 dentry = d_alloc_and_lookup(base, name, nd); 1750 dentry = d_alloc_and_lookup(base, name, nd);
1751 1751
1752 return dentry; 1752 return dentry;
1753 } 1753 }
1754 1754
1755 /* 1755 /*
1756 * Restricted form of lookup. Doesn't follow links, single-component only, 1756 * Restricted form of lookup. Doesn't follow links, single-component only,
1757 * needs parent already locked. Doesn't follow mounts. 1757 * needs parent already locked. Doesn't follow mounts.
1758 * SMP-safe. 1758 * SMP-safe.
1759 */ 1759 */
1760 static struct dentry *lookup_hash(struct nameidata *nd) 1760 static struct dentry *lookup_hash(struct nameidata *nd)
1761 { 1761 {
1762 return __lookup_hash(&nd->last, nd->path.dentry, nd); 1762 return __lookup_hash(&nd->last, nd->path.dentry, nd);
1763 } 1763 }
1764 1764
1765 /** 1765 /**
1766 * lookup_one_len - filesystem helper to lookup single pathname component 1766 * lookup_one_len - filesystem helper to lookup single pathname component
1767 * @name: pathname component to lookup 1767 * @name: pathname component to lookup
1768 * @base: base directory to lookup from 1768 * @base: base directory to lookup from
1769 * @len: maximum length @len should be interpreted to 1769 * @len: maximum length @len should be interpreted to
1770 * 1770 *
1771 * Note that this routine is purely a helper for filesystem usage and should 1771 * Note that this routine is purely a helper for filesystem usage and should
1772 * not be called by generic code. Also note that by using this function the 1772 * not be called by generic code. Also note that by using this function the
1773 * nameidata argument is passed to the filesystem methods and a filesystem 1773 * nameidata argument is passed to the filesystem methods and a filesystem
1774 * using this helper needs to be prepared for that. 1774 * using this helper needs to be prepared for that.
1775 */ 1775 */
1776 struct dentry *lookup_one_len(const char *name, struct dentry *base, int len) 1776 struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
1777 { 1777 {
1778 struct qstr this; 1778 struct qstr this;
1779 unsigned long hash; 1779 unsigned long hash;
1780 unsigned int c; 1780 unsigned int c;
1781 1781
1782 WARN_ON_ONCE(!mutex_is_locked(&base->d_inode->i_mutex)); 1782 WARN_ON_ONCE(!mutex_is_locked(&base->d_inode->i_mutex));
1783 1783
1784 this.name = name; 1784 this.name = name;
1785 this.len = len; 1785 this.len = len;
1786 if (!len) 1786 if (!len)
1787 return ERR_PTR(-EACCES); 1787 return ERR_PTR(-EACCES);
1788 1788
1789 hash = init_name_hash(); 1789 hash = init_name_hash();
1790 while (len--) { 1790 while (len--) {
1791 c = *(const unsigned char *)name++; 1791 c = *(const unsigned char *)name++;
1792 if (c == '/' || c == '\0') 1792 if (c == '/' || c == '\0')
1793 return ERR_PTR(-EACCES); 1793 return ERR_PTR(-EACCES);
1794 hash = partial_name_hash(c, hash); 1794 hash = partial_name_hash(c, hash);
1795 } 1795 }
1796 this.hash = end_name_hash(hash); 1796 this.hash = end_name_hash(hash);
1797 /* 1797 /*
1798 * See if the low-level filesystem might want 1798 * See if the low-level filesystem might want
1799 * to use its own hash.. 1799 * to use its own hash..
1800 */ 1800 */
1801 if (base->d_flags & DCACHE_OP_HASH) { 1801 if (base->d_flags & DCACHE_OP_HASH) {
1802 int err = base->d_op->d_hash(base, base->d_inode, &this); 1802 int err = base->d_op->d_hash(base, base->d_inode, &this);
1803 if (err < 0) 1803 if (err < 0)
1804 return ERR_PTR(err); 1804 return ERR_PTR(err);
1805 } 1805 }
1806 1806
1807 return __lookup_hash(&this, base, NULL); 1807 return __lookup_hash(&this, base, NULL);
1808 } 1808 }
1809 1809
1810 int user_path_at(int dfd, const char __user *name, unsigned flags, 1810 int user_path_at(int dfd, const char __user *name, unsigned flags,
1811 struct path *path) 1811 struct path *path)
1812 { 1812 {
1813 struct nameidata nd; 1813 struct nameidata nd;
1814 char *tmp = getname_flags(name, flags); 1814 char *tmp = getname_flags(name, flags);
1815 int err = PTR_ERR(tmp); 1815 int err = PTR_ERR(tmp);
1816 if (!IS_ERR(tmp)) { 1816 if (!IS_ERR(tmp)) {
1817 1817
1818 BUG_ON(flags & LOOKUP_PARENT); 1818 BUG_ON(flags & LOOKUP_PARENT);
1819 1819
1820 err = do_path_lookup(dfd, tmp, flags, &nd); 1820 err = do_path_lookup(dfd, tmp, flags, &nd);
1821 putname(tmp); 1821 putname(tmp);
1822 if (!err) 1822 if (!err)
1823 *path = nd.path; 1823 *path = nd.path;
1824 } 1824 }
1825 return err; 1825 return err;
1826 } 1826 }
1827 1827
1828 static int user_path_parent(int dfd, const char __user *path, 1828 static int user_path_parent(int dfd, const char __user *path,
1829 struct nameidata *nd, char **name) 1829 struct nameidata *nd, char **name)
1830 { 1830 {
1831 char *s = getname(path); 1831 char *s = getname(path);
1832 int error; 1832 int error;
1833 1833
1834 if (IS_ERR(s)) 1834 if (IS_ERR(s))
1835 return PTR_ERR(s); 1835 return PTR_ERR(s);
1836 1836
1837 error = do_path_lookup(dfd, s, LOOKUP_PARENT, nd); 1837 error = do_path_lookup(dfd, s, LOOKUP_PARENT, nd);
1838 if (error) 1838 if (error)
1839 putname(s); 1839 putname(s);
1840 else 1840 else
1841 *name = s; 1841 *name = s;
1842 1842
1843 return error; 1843 return error;
1844 } 1844 }
1845 1845
1846 /* 1846 /*
1847 * It's inline, so penalty for filesystems that don't use sticky bit is 1847 * It's inline, so penalty for filesystems that don't use sticky bit is
1848 * minimal. 1848 * minimal.
1849 */ 1849 */
1850 static inline int check_sticky(struct inode *dir, struct inode *inode) 1850 static inline int check_sticky(struct inode *dir, struct inode *inode)
1851 { 1851 {
1852 uid_t fsuid = current_fsuid(); 1852 uid_t fsuid = current_fsuid();
1853 1853
1854 if (!(dir->i_mode & S_ISVTX)) 1854 if (!(dir->i_mode & S_ISVTX))
1855 return 0; 1855 return 0;
1856 if (current_user_ns() != inode_userns(inode)) 1856 if (current_user_ns() != inode_userns(inode))
1857 goto other_userns; 1857 goto other_userns;
1858 if (inode->i_uid == fsuid) 1858 if (inode->i_uid == fsuid)
1859 return 0; 1859 return 0;
1860 if (dir->i_uid == fsuid) 1860 if (dir->i_uid == fsuid)
1861 return 0; 1861 return 0;
1862 1862
1863 other_userns: 1863 other_userns:
1864 return !ns_capable(inode_userns(inode), CAP_FOWNER); 1864 return !ns_capable(inode_userns(inode), CAP_FOWNER);
1865 } 1865 }
1866 1866
1867 /* 1867 /*
1868 * Check whether we can remove a link victim from directory dir, check 1868 * Check whether we can remove a link victim from directory dir, check
1869 * whether the type of victim is right. 1869 * whether the type of victim is right.
1870 * 1. We can't do it if dir is read-only (done in permission()) 1870 * 1. We can't do it if dir is read-only (done in permission())
1871 * 2. We should have write and exec permissions on dir 1871 * 2. We should have write and exec permissions on dir
1872 * 3. We can't remove anything from append-only dir 1872 * 3. We can't remove anything from append-only dir
1873 * 4. We can't do anything with immutable dir (done in permission()) 1873 * 4. We can't do anything with immutable dir (done in permission())
1874 * 5. If the sticky bit on dir is set we should either 1874 * 5. If the sticky bit on dir is set we should either
1875 * a. be owner of dir, or 1875 * a. be owner of dir, or
1876 * b. be owner of victim, or 1876 * b. be owner of victim, or
1877 * c. have CAP_FOWNER capability 1877 * c. have CAP_FOWNER capability
1878 * 6. If the victim is append-only or immutable we can't do antyhing with 1878 * 6. If the victim is append-only or immutable we can't do antyhing with
1879 * links pointing to it. 1879 * links pointing to it.
1880 * 7. If we were asked to remove a directory and victim isn't one - ENOTDIR. 1880 * 7. If we were asked to remove a directory and victim isn't one - ENOTDIR.
1881 * 8. If we were asked to remove a non-directory and victim isn't one - EISDIR. 1881 * 8. If we were asked to remove a non-directory and victim isn't one - EISDIR.
1882 * 9. We can't remove a root or mountpoint. 1882 * 9. We can't remove a root or mountpoint.
1883 * 10. We don't allow removal of NFS sillyrenamed files; it's handled by 1883 * 10. We don't allow removal of NFS sillyrenamed files; it's handled by
1884 * nfs_async_unlink(). 1884 * nfs_async_unlink().
1885 */ 1885 */
1886 static int may_delete(struct inode *dir,struct dentry *victim,int isdir) 1886 static int may_delete(struct inode *dir,struct dentry *victim,int isdir)
1887 { 1887 {
1888 int error; 1888 int error;
1889 1889
1890 if (!victim->d_inode) 1890 if (!victim->d_inode)
1891 return -ENOENT; 1891 return -ENOENT;
1892 1892
1893 BUG_ON(victim->d_parent->d_inode != dir); 1893 BUG_ON(victim->d_parent->d_inode != dir);
1894 audit_inode_child(victim, dir); 1894 audit_inode_child(victim, dir);
1895 1895
1896 error = inode_permission(dir, MAY_WRITE | MAY_EXEC); 1896 error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
1897 if (error) 1897 if (error)
1898 return error; 1898 return error;
1899 if (IS_APPEND(dir)) 1899 if (IS_APPEND(dir))
1900 return -EPERM; 1900 return -EPERM;
1901 if (check_sticky(dir, victim->d_inode)||IS_APPEND(victim->d_inode)|| 1901 if (check_sticky(dir, victim->d_inode)||IS_APPEND(victim->d_inode)||
1902 IS_IMMUTABLE(victim->d_inode) || IS_SWAPFILE(victim->d_inode)) 1902 IS_IMMUTABLE(victim->d_inode) || IS_SWAPFILE(victim->d_inode))
1903 return -EPERM; 1903 return -EPERM;
1904 if (isdir) { 1904 if (isdir) {
1905 if (!S_ISDIR(victim->d_inode->i_mode)) 1905 if (!S_ISDIR(victim->d_inode->i_mode))
1906 return -ENOTDIR; 1906 return -ENOTDIR;
1907 if (IS_ROOT(victim)) 1907 if (IS_ROOT(victim))
1908 return -EBUSY; 1908 return -EBUSY;
1909 } else if (S_ISDIR(victim->d_inode->i_mode)) 1909 } else if (S_ISDIR(victim->d_inode->i_mode))
1910 return -EISDIR; 1910 return -EISDIR;
1911 if (IS_DEADDIR(dir)) 1911 if (IS_DEADDIR(dir))
1912 return -ENOENT; 1912 return -ENOENT;
1913 if (victim->d_flags & DCACHE_NFSFS_RENAMED) 1913 if (victim->d_flags & DCACHE_NFSFS_RENAMED)
1914 return -EBUSY; 1914 return -EBUSY;
1915 return 0; 1915 return 0;
1916 } 1916 }
1917 1917
1918 /* Check whether we can create an object with dentry child in directory 1918 /* Check whether we can create an object with dentry child in directory
1919 * dir. 1919 * dir.
1920 * 1. We can't do it if child already exists (open has special treatment for 1920 * 1. We can't do it if child already exists (open has special treatment for
1921 * this case, but since we are inlined it's OK) 1921 * this case, but since we are inlined it's OK)
1922 * 2. We can't do it if dir is read-only (done in permission()) 1922 * 2. We can't do it if dir is read-only (done in permission())
1923 * 3. We should have write and exec permissions on dir 1923 * 3. We should have write and exec permissions on dir
1924 * 4. We can't do it if dir is immutable (done in permission()) 1924 * 4. We can't do it if dir is immutable (done in permission())
1925 */ 1925 */
1926 static inline int may_create(struct inode *dir, struct dentry *child) 1926 static inline int may_create(struct inode *dir, struct dentry *child)
1927 { 1927 {
1928 if (child->d_inode) 1928 if (child->d_inode)
1929 return -EEXIST; 1929 return -EEXIST;
1930 if (IS_DEADDIR(dir)) 1930 if (IS_DEADDIR(dir))
1931 return -ENOENT; 1931 return -ENOENT;
1932 return inode_permission(dir, MAY_WRITE | MAY_EXEC); 1932 return inode_permission(dir, MAY_WRITE | MAY_EXEC);
1933 } 1933 }
1934 1934
1935 /* 1935 /*
1936 * p1 and p2 should be directories on the same fs. 1936 * p1 and p2 should be directories on the same fs.
1937 */ 1937 */
1938 struct dentry *lock_rename(struct dentry *p1, struct dentry *p2) 1938 struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
1939 { 1939 {
1940 struct dentry *p; 1940 struct dentry *p;
1941 1941
1942 if (p1 == p2) { 1942 if (p1 == p2) {
1943 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT); 1943 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
1944 return NULL; 1944 return NULL;
1945 } 1945 }
1946 1946
1947 mutex_lock(&p1->d_inode->i_sb->s_vfs_rename_mutex); 1947 mutex_lock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
1948 1948
1949 p = d_ancestor(p2, p1); 1949 p = d_ancestor(p2, p1);
1950 if (p) { 1950 if (p) {
1951 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_PARENT); 1951 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_PARENT);
1952 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_CHILD); 1952 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_CHILD);
1953 return p; 1953 return p;
1954 } 1954 }
1955 1955
1956 p = d_ancestor(p1, p2); 1956 p = d_ancestor(p1, p2);
1957 if (p) { 1957 if (p) {
1958 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT); 1958 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
1959 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD); 1959 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD);
1960 return p; 1960 return p;
1961 } 1961 }
1962 1962
1963 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT); 1963 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
1964 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD); 1964 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD);
1965 return NULL; 1965 return NULL;
1966 } 1966 }
1967 1967
1968 void unlock_rename(struct dentry *p1, struct dentry *p2) 1968 void unlock_rename(struct dentry *p1, struct dentry *p2)
1969 { 1969 {
1970 mutex_unlock(&p1->d_inode->i_mutex); 1970 mutex_unlock(&p1->d_inode->i_mutex);
1971 if (p1 != p2) { 1971 if (p1 != p2) {
1972 mutex_unlock(&p2->d_inode->i_mutex); 1972 mutex_unlock(&p2->d_inode->i_mutex);
1973 mutex_unlock(&p1->d_inode->i_sb->s_vfs_rename_mutex); 1973 mutex_unlock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
1974 } 1974 }
1975 } 1975 }
1976 1976
1977 int vfs_create(struct inode *dir, struct dentry *dentry, int mode, 1977 int vfs_create(struct inode *dir, struct dentry *dentry, int mode,
1978 struct nameidata *nd) 1978 struct nameidata *nd)
1979 { 1979 {
1980 int error = may_create(dir, dentry); 1980 int error = may_create(dir, dentry);
1981 1981
1982 if (error) 1982 if (error)
1983 return error; 1983 return error;
1984 1984
1985 if (!dir->i_op->create) 1985 if (!dir->i_op->create)
1986 return -EACCES; /* shouldn't it be ENOSYS? */ 1986 return -EACCES; /* shouldn't it be ENOSYS? */
1987 mode &= S_IALLUGO; 1987 mode &= S_IALLUGO;
1988 mode |= S_IFREG; 1988 mode |= S_IFREG;
1989 error = security_inode_create(dir, dentry, mode); 1989 error = security_inode_create(dir, dentry, mode);
1990 if (error) 1990 if (error)
1991 return error; 1991 return error;
1992 error = dir->i_op->create(dir, dentry, mode, nd); 1992 error = dir->i_op->create(dir, dentry, mode, nd);
1993 if (!error) 1993 if (!error)
1994 fsnotify_create(dir, dentry); 1994 fsnotify_create(dir, dentry);
1995 return error; 1995 return error;
1996 } 1996 }
1997 1997
1998 static int may_open(struct path *path, int acc_mode, int flag) 1998 static int may_open(struct path *path, int acc_mode, int flag)
1999 { 1999 {
2000 struct dentry *dentry = path->dentry; 2000 struct dentry *dentry = path->dentry;
2001 struct inode *inode = dentry->d_inode; 2001 struct inode *inode = dentry->d_inode;
2002 int error; 2002 int error;
2003 2003
2004 /* O_PATH? */ 2004 /* O_PATH? */
2005 if (!acc_mode) 2005 if (!acc_mode)
2006 return 0; 2006 return 0;
2007 2007
2008 if (!inode) 2008 if (!inode)
2009 return -ENOENT; 2009 return -ENOENT;
2010 2010
2011 switch (inode->i_mode & S_IFMT) { 2011 switch (inode->i_mode & S_IFMT) {
2012 case S_IFLNK: 2012 case S_IFLNK:
2013 return -ELOOP; 2013 return -ELOOP;
2014 case S_IFDIR: 2014 case S_IFDIR:
2015 if (acc_mode & MAY_WRITE) 2015 if (acc_mode & MAY_WRITE)
2016 return -EISDIR; 2016 return -EISDIR;
2017 break; 2017 break;
2018 case S_IFBLK: 2018 case S_IFBLK:
2019 case S_IFCHR: 2019 case S_IFCHR:
2020 if (path->mnt->mnt_flags & MNT_NODEV) 2020 if (path->mnt->mnt_flags & MNT_NODEV)
2021 return -EACCES; 2021 return -EACCES;
2022 /*FALLTHRU*/ 2022 /*FALLTHRU*/
2023 case S_IFIFO: 2023 case S_IFIFO:
2024 case S_IFSOCK: 2024 case S_IFSOCK:
2025 flag &= ~O_TRUNC; 2025 flag &= ~O_TRUNC;
2026 break; 2026 break;
2027 } 2027 }
2028 2028
2029 error = inode_permission(inode, acc_mode); 2029 error = inode_permission(inode, acc_mode);
2030 if (error) 2030 if (error)
2031 return error; 2031 return error;
2032 2032
2033 /* 2033 /*
2034 * An append-only file must be opened in append mode for writing. 2034 * An append-only file must be opened in append mode for writing.
2035 */ 2035 */
2036 if (IS_APPEND(inode)) { 2036 if (IS_APPEND(inode)) {
2037 if ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND)) 2037 if ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND))
2038 return -EPERM; 2038 return -EPERM;
2039 if (flag & O_TRUNC) 2039 if (flag & O_TRUNC)
2040 return -EPERM; 2040 return -EPERM;
2041 } 2041 }
2042 2042
2043 /* O_NOATIME can only be set by the owner or superuser */ 2043 /* O_NOATIME can only be set by the owner or superuser */
2044 if (flag & O_NOATIME && !inode_owner_or_capable(inode)) 2044 if (flag & O_NOATIME && !inode_owner_or_capable(inode))
2045 return -EPERM; 2045 return -EPERM;
2046 2046
2047 /* 2047 /*
2048 * Ensure there are no outstanding leases on the file. 2048 * Ensure there are no outstanding leases on the file.
2049 */ 2049 */
2050 return break_lease(inode, flag); 2050 return break_lease(inode, flag);
2051 } 2051 }
2052 2052
2053 static int handle_truncate(struct file *filp) 2053 static int handle_truncate(struct file *filp)
2054 { 2054 {
2055 struct path *path = &filp->f_path; 2055 struct path *path = &filp->f_path;
2056 struct inode *inode = path->dentry->d_inode; 2056 struct inode *inode = path->dentry->d_inode;
2057 int error = get_write_access(inode); 2057 int error = get_write_access(inode);
2058 if (error) 2058 if (error)
2059 return error; 2059 return error;
2060 /* 2060 /*
2061 * Refuse to truncate files with mandatory locks held on them. 2061 * Refuse to truncate files with mandatory locks held on them.
2062 */ 2062 */
2063 error = locks_verify_locked(inode); 2063 error = locks_verify_locked(inode);
2064 if (!error) 2064 if (!error)
2065 error = security_path_truncate(path); 2065 error = security_path_truncate(path);
2066 if (!error) { 2066 if (!error) {
2067 error = do_truncate(path->dentry, 0, 2067 error = do_truncate(path->dentry, 0,
2068 ATTR_MTIME|ATTR_CTIME|ATTR_OPEN, 2068 ATTR_MTIME|ATTR_CTIME|ATTR_OPEN,
2069 filp); 2069 filp);
2070 } 2070 }
2071 put_write_access(inode); 2071 put_write_access(inode);
2072 return error; 2072 return error;
2073 } 2073 }
2074 2074
2075 static inline int open_to_namei_flags(int flag) 2075 static inline int open_to_namei_flags(int flag)
2076 { 2076 {
2077 if ((flag & O_ACCMODE) == 3) 2077 if ((flag & O_ACCMODE) == 3)
2078 flag--; 2078 flag--;
2079 return flag; 2079 return flag;
2080 } 2080 }
2081 2081
2082 /* 2082 /*
2083 * Handle the last step of open() 2083 * Handle the last step of open()
2084 */ 2084 */
2085 static struct file *do_last(struct nameidata *nd, struct path *path, 2085 static struct file *do_last(struct nameidata *nd, struct path *path,
2086 const struct open_flags *op, const char *pathname) 2086 const struct open_flags *op, const char *pathname)
2087 { 2087 {
2088 struct dentry *dir = nd->path.dentry; 2088 struct dentry *dir = nd->path.dentry;
2089 struct dentry *dentry; 2089 struct dentry *dentry;
2090 int open_flag = op->open_flag; 2090 int open_flag = op->open_flag;
2091 int will_truncate = open_flag & O_TRUNC; 2091 int will_truncate = open_flag & O_TRUNC;
2092 int want_write = 0; 2092 int want_write = 0;
2093 int acc_mode = op->acc_mode; 2093 int acc_mode = op->acc_mode;
2094 struct file *filp; 2094 struct file *filp;
2095 int error; 2095 int error;
2096 2096
2097 nd->flags &= ~LOOKUP_PARENT; 2097 nd->flags &= ~LOOKUP_PARENT;
2098 nd->flags |= op->intent; 2098 nd->flags |= op->intent;
2099 2099
2100 switch (nd->last_type) { 2100 switch (nd->last_type) {
2101 case LAST_DOTDOT: 2101 case LAST_DOTDOT:
2102 case LAST_DOT: 2102 case LAST_DOT:
2103 error = handle_dots(nd, nd->last_type); 2103 error = handle_dots(nd, nd->last_type);
2104 if (error) 2104 if (error)
2105 return ERR_PTR(error); 2105 return ERR_PTR(error);
2106 /* fallthrough */ 2106 /* fallthrough */
2107 case LAST_ROOT: 2107 case LAST_ROOT:
2108 error = complete_walk(nd); 2108 error = complete_walk(nd);
2109 if (error) 2109 if (error)
2110 return ERR_PTR(error); 2110 return ERR_PTR(error);
2111 audit_inode(pathname, nd->path.dentry); 2111 audit_inode(pathname, nd->path.dentry);
2112 if (open_flag & O_CREAT) { 2112 if (open_flag & O_CREAT) {
2113 error = -EISDIR; 2113 error = -EISDIR;
2114 goto exit; 2114 goto exit;
2115 } 2115 }
2116 goto ok; 2116 goto ok;
2117 case LAST_BIND: 2117 case LAST_BIND:
2118 error = complete_walk(nd); 2118 error = complete_walk(nd);
2119 if (error) 2119 if (error)
2120 return ERR_PTR(error); 2120 return ERR_PTR(error);
2121 audit_inode(pathname, dir); 2121 audit_inode(pathname, dir);
2122 goto ok; 2122 goto ok;
2123 } 2123 }
2124 2124
2125 if (!(open_flag & O_CREAT)) { 2125 if (!(open_flag & O_CREAT)) {
2126 int symlink_ok = 0; 2126 int symlink_ok = 0;
2127 if (nd->last.name[nd->last.len]) 2127 if (nd->last.name[nd->last.len])
2128 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 2128 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
2129 if (open_flag & O_PATH && !(nd->flags & LOOKUP_FOLLOW)) 2129 if (open_flag & O_PATH && !(nd->flags & LOOKUP_FOLLOW))
2130 symlink_ok = 1; 2130 symlink_ok = 1;
2131 /* we _can_ be in RCU mode here */ 2131 /* we _can_ be in RCU mode here */
2132 error = walk_component(nd, path, &nd->last, LAST_NORM, 2132 error = walk_component(nd, path, &nd->last, LAST_NORM,
2133 !symlink_ok); 2133 !symlink_ok);
2134 if (error < 0) 2134 if (error < 0)
2135 return ERR_PTR(error); 2135 return ERR_PTR(error);
2136 if (error) /* symlink */ 2136 if (error) /* symlink */
2137 return NULL; 2137 return NULL;
2138 /* sayonara */ 2138 /* sayonara */
2139 error = complete_walk(nd); 2139 error = complete_walk(nd);
2140 if (error) 2140 if (error)
2141 return ERR_PTR(-ECHILD); 2141 return ERR_PTR(-ECHILD);
2142 2142
2143 error = -ENOTDIR; 2143 error = -ENOTDIR;
2144 if (nd->flags & LOOKUP_DIRECTORY) { 2144 if (nd->flags & LOOKUP_DIRECTORY) {
2145 if (!nd->inode->i_op->lookup) 2145 if (!nd->inode->i_op->lookup)
2146 goto exit; 2146 goto exit;
2147 } 2147 }
2148 audit_inode(pathname, nd->path.dentry); 2148 audit_inode(pathname, nd->path.dentry);
2149 goto ok; 2149 goto ok;
2150 } 2150 }
2151 2151
2152 /* create side of things */ 2152 /* create side of things */
2153 error = complete_walk(nd); 2153 error = complete_walk(nd);
2154 if (error) 2154 if (error)
2155 return ERR_PTR(error); 2155 return ERR_PTR(error);
2156 2156
2157 audit_inode(pathname, dir); 2157 audit_inode(pathname, dir);
2158 error = -EISDIR; 2158 error = -EISDIR;
2159 /* trailing slashes? */ 2159 /* trailing slashes? */
2160 if (nd->last.name[nd->last.len]) 2160 if (nd->last.name[nd->last.len])
2161 goto exit; 2161 goto exit;
2162 2162
2163 mutex_lock(&dir->d_inode->i_mutex); 2163 mutex_lock(&dir->d_inode->i_mutex);
2164 2164
2165 dentry = lookup_hash(nd); 2165 dentry = lookup_hash(nd);
2166 error = PTR_ERR(dentry); 2166 error = PTR_ERR(dentry);
2167 if (IS_ERR(dentry)) { 2167 if (IS_ERR(dentry)) {
2168 mutex_unlock(&dir->d_inode->i_mutex); 2168 mutex_unlock(&dir->d_inode->i_mutex);
2169 goto exit; 2169 goto exit;
2170 } 2170 }
2171 2171
2172 path->dentry = dentry; 2172 path->dentry = dentry;
2173 path->mnt = nd->path.mnt; 2173 path->mnt = nd->path.mnt;
2174 2174
2175 /* Negative dentry, just create the file */ 2175 /* Negative dentry, just create the file */
2176 if (!dentry->d_inode) { 2176 if (!dentry->d_inode) {
2177 int mode = op->mode; 2177 int mode = op->mode;
2178 if (!IS_POSIXACL(dir->d_inode)) 2178 if (!IS_POSIXACL(dir->d_inode))
2179 mode &= ~current_umask(); 2179 mode &= ~current_umask();
2180 /* 2180 /*
2181 * This write is needed to ensure that a 2181 * This write is needed to ensure that a
2182 * rw->ro transition does not occur between 2182 * rw->ro transition does not occur between
2183 * the time when the file is created and when 2183 * the time when the file is created and when
2184 * a permanent write count is taken through 2184 * a permanent write count is taken through
2185 * the 'struct file' in nameidata_to_filp(). 2185 * the 'struct file' in nameidata_to_filp().
2186 */ 2186 */
2187 error = mnt_want_write(nd->path.mnt); 2187 error = mnt_want_write(nd->path.mnt);
2188 if (error) 2188 if (error)
2189 goto exit_mutex_unlock; 2189 goto exit_mutex_unlock;
2190 want_write = 1; 2190 want_write = 1;
2191 /* Don't check for write permission, don't truncate */ 2191 /* Don't check for write permission, don't truncate */
2192 open_flag &= ~O_TRUNC; 2192 open_flag &= ~O_TRUNC;
2193 will_truncate = 0; 2193 will_truncate = 0;
2194 acc_mode = MAY_OPEN; 2194 acc_mode = MAY_OPEN;
2195 error = security_path_mknod(&nd->path, dentry, mode, 0); 2195 error = security_path_mknod(&nd->path, dentry, mode, 0);
2196 if (error) 2196 if (error)
2197 goto exit_mutex_unlock; 2197 goto exit_mutex_unlock;
2198 error = vfs_create(dir->d_inode, dentry, mode, nd); 2198 error = vfs_create(dir->d_inode, dentry, mode, nd);
2199 if (error) 2199 if (error)
2200 goto exit_mutex_unlock; 2200 goto exit_mutex_unlock;
2201 mutex_unlock(&dir->d_inode->i_mutex); 2201 mutex_unlock(&dir->d_inode->i_mutex);
2202 dput(nd->path.dentry); 2202 dput(nd->path.dentry);
2203 nd->path.dentry = dentry; 2203 nd->path.dentry = dentry;
2204 goto common; 2204 goto common;
2205 } 2205 }
2206 2206
2207 /* 2207 /*
2208 * It already exists. 2208 * It already exists.
2209 */ 2209 */
2210 mutex_unlock(&dir->d_inode->i_mutex); 2210 mutex_unlock(&dir->d_inode->i_mutex);
2211 audit_inode(pathname, path->dentry); 2211 audit_inode(pathname, path->dentry);
2212 2212
2213 error = -EEXIST; 2213 error = -EEXIST;
2214 if (open_flag & O_EXCL) 2214 if (open_flag & O_EXCL)
2215 goto exit_dput; 2215 goto exit_dput;
2216 2216
2217 error = follow_managed(path, nd->flags); 2217 error = follow_managed(path, nd->flags);
2218 if (error < 0) 2218 if (error < 0)
2219 goto exit_dput; 2219 goto exit_dput;
2220 2220
2221 error = -ENOENT; 2221 error = -ENOENT;
2222 if (!path->dentry->d_inode) 2222 if (!path->dentry->d_inode)
2223 goto exit_dput; 2223 goto exit_dput;
2224 2224
2225 if (path->dentry->d_inode->i_op->follow_link) 2225 if (path->dentry->d_inode->i_op->follow_link)
2226 return NULL; 2226 return NULL;
2227 2227
2228 path_to_nameidata(path, nd); 2228 path_to_nameidata(path, nd);
2229 nd->inode = path->dentry->d_inode; 2229 nd->inode = path->dentry->d_inode;
2230 error = -EISDIR; 2230 error = -EISDIR;
2231 if (S_ISDIR(nd->inode->i_mode)) 2231 if (S_ISDIR(nd->inode->i_mode))
2232 goto exit; 2232 goto exit;
2233 ok: 2233 ok:
2234 if (!S_ISREG(nd->inode->i_mode)) 2234 if (!S_ISREG(nd->inode->i_mode))
2235 will_truncate = 0; 2235 will_truncate = 0;
2236 2236
2237 if (will_truncate) { 2237 if (will_truncate) {
2238 error = mnt_want_write(nd->path.mnt); 2238 error = mnt_want_write(nd->path.mnt);
2239 if (error) 2239 if (error)
2240 goto exit; 2240 goto exit;
2241 want_write = 1; 2241 want_write = 1;
2242 } 2242 }
2243 common: 2243 common:
2244 error = may_open(&nd->path, acc_mode, open_flag); 2244 error = may_open(&nd->path, acc_mode, open_flag);
2245 if (error) 2245 if (error)
2246 goto exit; 2246 goto exit;
2247 filp = nameidata_to_filp(nd); 2247 filp = nameidata_to_filp(nd);
2248 if (!IS_ERR(filp)) { 2248 if (!IS_ERR(filp)) {
2249 error = ima_file_check(filp, op->acc_mode); 2249 error = ima_file_check(filp, op->acc_mode);
2250 if (error) { 2250 if (error) {
2251 fput(filp); 2251 fput(filp);
2252 filp = ERR_PTR(error); 2252 filp = ERR_PTR(error);
2253 } 2253 }
2254 } 2254 }
2255 if (!IS_ERR(filp)) { 2255 if (!IS_ERR(filp)) {
2256 if (will_truncate) { 2256 if (will_truncate) {
2257 error = handle_truncate(filp); 2257 error = handle_truncate(filp);
2258 if (error) { 2258 if (error) {
2259 fput(filp); 2259 fput(filp);
2260 filp = ERR_PTR(error); 2260 filp = ERR_PTR(error);
2261 } 2261 }
2262 } 2262 }
2263 } 2263 }
2264 out: 2264 out:
2265 if (want_write) 2265 if (want_write)
2266 mnt_drop_write(nd->path.mnt); 2266 mnt_drop_write(nd->path.mnt);
2267 path_put(&nd->path); 2267 path_put(&nd->path);
2268 return filp; 2268 return filp;
2269 2269
2270 exit_mutex_unlock: 2270 exit_mutex_unlock:
2271 mutex_unlock(&dir->d_inode->i_mutex); 2271 mutex_unlock(&dir->d_inode->i_mutex);
2272 exit_dput: 2272 exit_dput:
2273 path_put_conditional(path, nd); 2273 path_put_conditional(path, nd);
2274 exit: 2274 exit:
2275 filp = ERR_PTR(error); 2275 filp = ERR_PTR(error);
2276 goto out; 2276 goto out;
2277 } 2277 }
2278 2278
2279 static struct file *path_openat(int dfd, const char *pathname, 2279 static struct file *path_openat(int dfd, const char *pathname,
2280 struct nameidata *nd, const struct open_flags *op, int flags) 2280 struct nameidata *nd, const struct open_flags *op, int flags)
2281 { 2281 {
2282 struct file *base = NULL; 2282 struct file *base = NULL;
2283 struct file *filp; 2283 struct file *filp;
2284 struct path path; 2284 struct path path;
2285 int error; 2285 int error;
2286 2286
2287 filp = get_empty_filp(); 2287 filp = get_empty_filp();
2288 if (!filp) 2288 if (!filp)
2289 return ERR_PTR(-ENFILE); 2289 return ERR_PTR(-ENFILE);
2290 2290
2291 filp->f_flags = op->open_flag; 2291 filp->f_flags = op->open_flag;
2292 nd->intent.open.file = filp; 2292 nd->intent.open.file = filp;
2293 nd->intent.open.flags = open_to_namei_flags(op->open_flag); 2293 nd->intent.open.flags = open_to_namei_flags(op->open_flag);
2294 nd->intent.open.create_mode = op->mode; 2294 nd->intent.open.create_mode = op->mode;
2295 2295
2296 error = path_init(dfd, pathname, flags | LOOKUP_PARENT, nd, &base); 2296 error = path_init(dfd, pathname, flags | LOOKUP_PARENT, nd, &base);
2297 if (unlikely(error)) 2297 if (unlikely(error))
2298 goto out_filp; 2298 goto out_filp;
2299 2299
2300 current->total_link_count = 0; 2300 current->total_link_count = 0;
2301 error = link_path_walk(pathname, nd); 2301 error = link_path_walk(pathname, nd);
2302 if (unlikely(error)) 2302 if (unlikely(error))
2303 goto out_filp; 2303 goto out_filp;
2304 2304
2305 filp = do_last(nd, &path, op, pathname); 2305 filp = do_last(nd, &path, op, pathname);
2306 while (unlikely(!filp)) { /* trailing symlink */ 2306 while (unlikely(!filp)) { /* trailing symlink */
2307 struct path link = path; 2307 struct path link = path;
2308 void *cookie; 2308 void *cookie;
2309 if (!(nd->flags & LOOKUP_FOLLOW)) { 2309 if (!(nd->flags & LOOKUP_FOLLOW)) {
2310 path_put_conditional(&path, nd); 2310 path_put_conditional(&path, nd);
2311 path_put(&nd->path); 2311 path_put(&nd->path);
2312 filp = ERR_PTR(-ELOOP); 2312 filp = ERR_PTR(-ELOOP);
2313 break; 2313 break;
2314 } 2314 }
2315 nd->flags |= LOOKUP_PARENT; 2315 nd->flags |= LOOKUP_PARENT;
2316 nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL); 2316 nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL);
2317 error = follow_link(&link, nd, &cookie); 2317 error = follow_link(&link, nd, &cookie);
2318 if (unlikely(error)) 2318 if (unlikely(error))
2319 filp = ERR_PTR(error); 2319 filp = ERR_PTR(error);
2320 else 2320 else
2321 filp = do_last(nd, &path, op, pathname); 2321 filp = do_last(nd, &path, op, pathname);
2322 put_link(nd, &link, cookie); 2322 put_link(nd, &link, cookie);
2323 } 2323 }
2324 out: 2324 out:
2325 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) 2325 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT))
2326 path_put(&nd->root); 2326 path_put(&nd->root);
2327 if (base) 2327 if (base)
2328 fput(base); 2328 fput(base);
2329 release_open_intent(nd); 2329 release_open_intent(nd);
2330 return filp; 2330 return filp;
2331 2331
2332 out_filp: 2332 out_filp:
2333 filp = ERR_PTR(error); 2333 filp = ERR_PTR(error);
2334 goto out; 2334 goto out;
2335 } 2335 }
2336 2336
2337 struct file *do_filp_open(int dfd, const char *pathname, 2337 struct file *do_filp_open(int dfd, const char *pathname,
2338 const struct open_flags *op, int flags) 2338 const struct open_flags *op, int flags)
2339 { 2339 {
2340 struct nameidata nd; 2340 struct nameidata nd;
2341 struct file *filp; 2341 struct file *filp;
2342 2342
2343 filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_RCU); 2343 filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_RCU);
2344 if (unlikely(filp == ERR_PTR(-ECHILD))) 2344 if (unlikely(filp == ERR_PTR(-ECHILD)))
2345 filp = path_openat(dfd, pathname, &nd, op, flags); 2345 filp = path_openat(dfd, pathname, &nd, op, flags);
2346 if (unlikely(filp == ERR_PTR(-ESTALE))) 2346 if (unlikely(filp == ERR_PTR(-ESTALE)))
2347 filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_REVAL); 2347 filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_REVAL);
2348 return filp; 2348 return filp;
2349 } 2349 }
2350 2350
2351 struct file *do_file_open_root(struct dentry *dentry, struct vfsmount *mnt, 2351 struct file *do_file_open_root(struct dentry *dentry, struct vfsmount *mnt,
2352 const char *name, const struct open_flags *op, int flags) 2352 const char *name, const struct open_flags *op, int flags)
2353 { 2353 {
2354 struct nameidata nd; 2354 struct nameidata nd;
2355 struct file *file; 2355 struct file *file;
2356 2356
2357 nd.root.mnt = mnt; 2357 nd.root.mnt = mnt;
2358 nd.root.dentry = dentry; 2358 nd.root.dentry = dentry;
2359 2359
2360 flags |= LOOKUP_ROOT; 2360 flags |= LOOKUP_ROOT;
2361 2361
2362 if (dentry->d_inode->i_op->follow_link && op->intent & LOOKUP_OPEN) 2362 if (dentry->d_inode->i_op->follow_link && op->intent & LOOKUP_OPEN)
2363 return ERR_PTR(-ELOOP); 2363 return ERR_PTR(-ELOOP);
2364 2364
2365 file = path_openat(-1, name, &nd, op, flags | LOOKUP_RCU); 2365 file = path_openat(-1, name, &nd, op, flags | LOOKUP_RCU);
2366 if (unlikely(file == ERR_PTR(-ECHILD))) 2366 if (unlikely(file == ERR_PTR(-ECHILD)))
2367 file = path_openat(-1, name, &nd, op, flags); 2367 file = path_openat(-1, name, &nd, op, flags);
2368 if (unlikely(file == ERR_PTR(-ESTALE))) 2368 if (unlikely(file == ERR_PTR(-ESTALE)))
2369 file = path_openat(-1, name, &nd, op, flags | LOOKUP_REVAL); 2369 file = path_openat(-1, name, &nd, op, flags | LOOKUP_REVAL);
2370 return file; 2370 return file;
2371 } 2371 }
2372 2372
2373 struct dentry *kern_path_create(int dfd, const char *pathname, struct path *path, int is_dir) 2373 struct dentry *kern_path_create(int dfd, const char *pathname, struct path *path, int is_dir)
2374 { 2374 {
2375 struct dentry *dentry = ERR_PTR(-EEXIST); 2375 struct dentry *dentry = ERR_PTR(-EEXIST);
2376 struct nameidata nd; 2376 struct nameidata nd;
2377 int error = do_path_lookup(dfd, pathname, LOOKUP_PARENT, &nd); 2377 int error = do_path_lookup(dfd, pathname, LOOKUP_PARENT, &nd);
2378 if (error) 2378 if (error)
2379 return ERR_PTR(error); 2379 return ERR_PTR(error);
2380 2380
2381 /* 2381 /*
2382 * Yucky last component or no last component at all? 2382 * Yucky last component or no last component at all?
2383 * (foo/., foo/.., /////) 2383 * (foo/., foo/.., /////)
2384 */ 2384 */
2385 if (nd.last_type != LAST_NORM) 2385 if (nd.last_type != LAST_NORM)
2386 goto out; 2386 goto out;
2387 nd.flags &= ~LOOKUP_PARENT; 2387 nd.flags &= ~LOOKUP_PARENT;
2388 nd.flags |= LOOKUP_CREATE | LOOKUP_EXCL; 2388 nd.flags |= LOOKUP_CREATE | LOOKUP_EXCL;
2389 nd.intent.open.flags = O_EXCL; 2389 nd.intent.open.flags = O_EXCL;
2390 2390
2391 /* 2391 /*
2392 * Do the final lookup. 2392 * Do the final lookup.
2393 */ 2393 */
2394 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT); 2394 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
2395 dentry = lookup_hash(&nd); 2395 dentry = lookup_hash(&nd);
2396 if (IS_ERR(dentry)) 2396 if (IS_ERR(dentry))
2397 goto fail; 2397 goto fail;
2398 2398
2399 if (dentry->d_inode) 2399 if (dentry->d_inode)
2400 goto eexist; 2400 goto eexist;
2401 /* 2401 /*
2402 * Special case - lookup gave negative, but... we had foo/bar/ 2402 * Special case - lookup gave negative, but... we had foo/bar/
2403 * From the vfs_mknod() POV we just have a negative dentry - 2403 * From the vfs_mknod() POV we just have a negative dentry -
2404 * all is fine. Let's be bastards - you had / on the end, you've 2404 * all is fine. Let's be bastards - you had / on the end, you've
2405 * been asking for (non-existent) directory. -ENOENT for you. 2405 * been asking for (non-existent) directory. -ENOENT for you.
2406 */ 2406 */
2407 if (unlikely(!is_dir && nd.last.name[nd.last.len])) { 2407 if (unlikely(!is_dir && nd.last.name[nd.last.len])) {
2408 dput(dentry); 2408 dput(dentry);
2409 dentry = ERR_PTR(-ENOENT); 2409 dentry = ERR_PTR(-ENOENT);
2410 goto fail; 2410 goto fail;
2411 } 2411 }
2412 *path = nd.path; 2412 *path = nd.path;
2413 return dentry; 2413 return dentry;
2414 eexist: 2414 eexist:
2415 dput(dentry); 2415 dput(dentry);
2416 dentry = ERR_PTR(-EEXIST); 2416 dentry = ERR_PTR(-EEXIST);
2417 fail: 2417 fail:
2418 mutex_unlock(&nd.path.dentry->d_inode->i_mutex); 2418 mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
2419 out: 2419 out:
2420 path_put(&nd.path); 2420 path_put(&nd.path);
2421 return dentry; 2421 return dentry;
2422 } 2422 }
2423 EXPORT_SYMBOL(kern_path_create); 2423 EXPORT_SYMBOL(kern_path_create);
2424 2424
2425 struct dentry *user_path_create(int dfd, const char __user *pathname, struct path *path, int is_dir) 2425 struct dentry *user_path_create(int dfd, const char __user *pathname, struct path *path, int is_dir)
2426 { 2426 {
2427 char *tmp = getname(pathname); 2427 char *tmp = getname(pathname);
2428 struct dentry *res; 2428 struct dentry *res;
2429 if (IS_ERR(tmp)) 2429 if (IS_ERR(tmp))
2430 return ERR_CAST(tmp); 2430 return ERR_CAST(tmp);
2431 res = kern_path_create(dfd, tmp, path, is_dir); 2431 res = kern_path_create(dfd, tmp, path, is_dir);
2432 putname(tmp); 2432 putname(tmp);
2433 return res; 2433 return res;
2434 } 2434 }
2435 EXPORT_SYMBOL(user_path_create); 2435 EXPORT_SYMBOL(user_path_create);
2436 2436
2437 int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev) 2437 int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2438 { 2438 {
2439 int error = may_create(dir, dentry); 2439 int error = may_create(dir, dentry);
2440 2440
2441 if (error) 2441 if (error)
2442 return error; 2442 return error;
2443 2443
2444 if ((S_ISCHR(mode) || S_ISBLK(mode)) && 2444 if ((S_ISCHR(mode) || S_ISBLK(mode)) &&
2445 !ns_capable(inode_userns(dir), CAP_MKNOD)) 2445 !ns_capable(inode_userns(dir), CAP_MKNOD))
2446 return -EPERM; 2446 return -EPERM;
2447 2447
2448 if (!dir->i_op->mknod) 2448 if (!dir->i_op->mknod)
2449 return -EPERM; 2449 return -EPERM;
2450 2450
2451 error = devcgroup_inode_mknod(mode, dev); 2451 error = devcgroup_inode_mknod(mode, dev);
2452 if (error) 2452 if (error)
2453 return error; 2453 return error;
2454 2454
2455 error = security_inode_mknod(dir, dentry, mode, dev); 2455 error = security_inode_mknod(dir, dentry, mode, dev);
2456 if (error) 2456 if (error)
2457 return error; 2457 return error;
2458 2458
2459 error = dir->i_op->mknod(dir, dentry, mode, dev); 2459 error = dir->i_op->mknod(dir, dentry, mode, dev);
2460 if (!error) 2460 if (!error)
2461 fsnotify_create(dir, dentry); 2461 fsnotify_create(dir, dentry);
2462 return error; 2462 return error;
2463 } 2463 }
2464 2464
2465 static int may_mknod(mode_t mode) 2465 static int may_mknod(mode_t mode)
2466 { 2466 {
2467 switch (mode & S_IFMT) { 2467 switch (mode & S_IFMT) {
2468 case S_IFREG: 2468 case S_IFREG:
2469 case S_IFCHR: 2469 case S_IFCHR:
2470 case S_IFBLK: 2470 case S_IFBLK:
2471 case S_IFIFO: 2471 case S_IFIFO:
2472 case S_IFSOCK: 2472 case S_IFSOCK:
2473 case 0: /* zero mode translates to S_IFREG */ 2473 case 0: /* zero mode translates to S_IFREG */
2474 return 0; 2474 return 0;
2475 case S_IFDIR: 2475 case S_IFDIR:
2476 return -EPERM; 2476 return -EPERM;
2477 default: 2477 default:
2478 return -EINVAL; 2478 return -EINVAL;
2479 } 2479 }
2480 } 2480 }
2481 2481
2482 SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode, 2482 SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
2483 unsigned, dev) 2483 unsigned, dev)
2484 { 2484 {
2485 struct dentry *dentry; 2485 struct dentry *dentry;
2486 struct path path; 2486 struct path path;
2487 int error; 2487 int error;
2488 2488
2489 if (S_ISDIR(mode)) 2489 if (S_ISDIR(mode))
2490 return -EPERM; 2490 return -EPERM;
2491 2491
2492 dentry = user_path_create(dfd, filename, &path, 0); 2492 dentry = user_path_create(dfd, filename, &path, 0);
2493 if (IS_ERR(dentry)) 2493 if (IS_ERR(dentry))
2494 return PTR_ERR(dentry); 2494 return PTR_ERR(dentry);
2495 2495
2496 if (!IS_POSIXACL(path.dentry->d_inode)) 2496 if (!IS_POSIXACL(path.dentry->d_inode))
2497 mode &= ~current_umask(); 2497 mode &= ~current_umask();
2498 error = may_mknod(mode); 2498 error = may_mknod(mode);
2499 if (error) 2499 if (error)
2500 goto out_dput; 2500 goto out_dput;
2501 error = mnt_want_write(path.mnt); 2501 error = mnt_want_write(path.mnt);
2502 if (error) 2502 if (error)
2503 goto out_dput; 2503 goto out_dput;
2504 error = security_path_mknod(&path, dentry, mode, dev); 2504 error = security_path_mknod(&path, dentry, mode, dev);
2505 if (error) 2505 if (error)
2506 goto out_drop_write; 2506 goto out_drop_write;
2507 switch (mode & S_IFMT) { 2507 switch (mode & S_IFMT) {
2508 case 0: case S_IFREG: 2508 case 0: case S_IFREG:
2509 error = vfs_create(path.dentry->d_inode,dentry,mode,NULL); 2509 error = vfs_create(path.dentry->d_inode,dentry,mode,NULL);
2510 break; 2510 break;
2511 case S_IFCHR: case S_IFBLK: 2511 case S_IFCHR: case S_IFBLK:
2512 error = vfs_mknod(path.dentry->d_inode,dentry,mode, 2512 error = vfs_mknod(path.dentry->d_inode,dentry,mode,
2513 new_decode_dev(dev)); 2513 new_decode_dev(dev));
2514 break; 2514 break;
2515 case S_IFIFO: case S_IFSOCK: 2515 case S_IFIFO: case S_IFSOCK:
2516 error = vfs_mknod(path.dentry->d_inode,dentry,mode,0); 2516 error = vfs_mknod(path.dentry->d_inode,dentry,mode,0);
2517 break; 2517 break;
2518 } 2518 }
2519 out_drop_write: 2519 out_drop_write:
2520 mnt_drop_write(path.mnt); 2520 mnt_drop_write(path.mnt);
2521 out_dput: 2521 out_dput:
2522 dput(dentry); 2522 dput(dentry);
2523 mutex_unlock(&path.dentry->d_inode->i_mutex); 2523 mutex_unlock(&path.dentry->d_inode->i_mutex);
2524 path_put(&path); 2524 path_put(&path);
2525 2525
2526 return error; 2526 return error;
2527 } 2527 }
2528 2528
2529 SYSCALL_DEFINE3(mknod, const char __user *, filename, int, mode, unsigned, dev) 2529 SYSCALL_DEFINE3(mknod, const char __user *, filename, int, mode, unsigned, dev)
2530 { 2530 {
2531 return sys_mknodat(AT_FDCWD, filename, mode, dev); 2531 return sys_mknodat(AT_FDCWD, filename, mode, dev);
2532 } 2532 }
2533 2533
2534 int vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode) 2534 int vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
2535 { 2535 {
2536 int error = may_create(dir, dentry); 2536 int error = may_create(dir, dentry);
2537 2537
2538 if (error) 2538 if (error)
2539 return error; 2539 return error;
2540 2540
2541 if (!dir->i_op->mkdir) 2541 if (!dir->i_op->mkdir)
2542 return -EPERM; 2542 return -EPERM;
2543 2543
2544 mode &= (S_IRWXUGO|S_ISVTX); 2544 mode &= (S_IRWXUGO|S_ISVTX);
2545 error = security_inode_mkdir(dir, dentry, mode); 2545 error = security_inode_mkdir(dir, dentry, mode);
2546 if (error) 2546 if (error)
2547 return error; 2547 return error;
2548 2548
2549 error = dir->i_op->mkdir(dir, dentry, mode); 2549 error = dir->i_op->mkdir(dir, dentry, mode);
2550 if (!error) 2550 if (!error)
2551 fsnotify_mkdir(dir, dentry); 2551 fsnotify_mkdir(dir, dentry);
2552 return error; 2552 return error;
2553 } 2553 }
2554 2554
2555 SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, int, mode) 2555 SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, int, mode)
2556 { 2556 {
2557 struct dentry *dentry; 2557 struct dentry *dentry;
2558 struct path path; 2558 struct path path;
2559 int error; 2559 int error;
2560 2560
2561 dentry = user_path_create(dfd, pathname, &path, 1); 2561 dentry = user_path_create(dfd, pathname, &path, 1);
2562 if (IS_ERR(dentry)) 2562 if (IS_ERR(dentry))
2563 return PTR_ERR(dentry); 2563 return PTR_ERR(dentry);
2564 2564
2565 if (!IS_POSIXACL(path.dentry->d_inode)) 2565 if (!IS_POSIXACL(path.dentry->d_inode))
2566 mode &= ~current_umask(); 2566 mode &= ~current_umask();
2567 error = mnt_want_write(path.mnt); 2567 error = mnt_want_write(path.mnt);
2568 if (error) 2568 if (error)
2569 goto out_dput; 2569 goto out_dput;
2570 error = security_path_mkdir(&path, dentry, mode); 2570 error = security_path_mkdir(&path, dentry, mode);
2571 if (error) 2571 if (error)
2572 goto out_drop_write; 2572 goto out_drop_write;
2573 error = vfs_mkdir(path.dentry->d_inode, dentry, mode); 2573 error = vfs_mkdir(path.dentry->d_inode, dentry, mode);
2574 out_drop_write: 2574 out_drop_write:
2575 mnt_drop_write(path.mnt); 2575 mnt_drop_write(path.mnt);
2576 out_dput: 2576 out_dput:
2577 dput(dentry); 2577 dput(dentry);
2578 mutex_unlock(&path.dentry->d_inode->i_mutex); 2578 mutex_unlock(&path.dentry->d_inode->i_mutex);
2579 path_put(&path); 2579 path_put(&path);
2580 return error; 2580 return error;
2581 } 2581 }
2582 2582
2583 SYSCALL_DEFINE2(mkdir, const char __user *, pathname, int, mode) 2583 SYSCALL_DEFINE2(mkdir, const char __user *, pathname, int, mode)
2584 { 2584 {
2585 return sys_mkdirat(AT_FDCWD, pathname, mode); 2585 return sys_mkdirat(AT_FDCWD, pathname, mode);
2586 } 2586 }
2587 2587
2588 /* 2588 /*
2589 * The dentry_unhash() helper will try to drop the dentry early: we 2589 * The dentry_unhash() helper will try to drop the dentry early: we
2590 * should have a usage count of 2 if we're the only user of this 2590 * should have a usage count of 2 if we're the only user of this
2591 * dentry, and if that is true (possibly after pruning the dcache), 2591 * dentry, and if that is true (possibly after pruning the dcache),
2592 * then we drop the dentry now. 2592 * then we drop the dentry now.
2593 * 2593 *
2594 * A low-level filesystem can, if it choses, legally 2594 * A low-level filesystem can, if it choses, legally
2595 * do a 2595 * do a
2596 * 2596 *
2597 * if (!d_unhashed(dentry)) 2597 * if (!d_unhashed(dentry))
2598 * return -EBUSY; 2598 * return -EBUSY;
2599 * 2599 *
2600 * if it cannot handle the case of removing a directory 2600 * if it cannot handle the case of removing a directory
2601 * that is still in use by something else.. 2601 * that is still in use by something else..
2602 */ 2602 */
2603 void dentry_unhash(struct dentry *dentry) 2603 void dentry_unhash(struct dentry *dentry)
2604 { 2604 {
2605 shrink_dcache_parent(dentry); 2605 shrink_dcache_parent(dentry);
2606 spin_lock(&dentry->d_lock); 2606 spin_lock(&dentry->d_lock);
2607 if (dentry->d_count == 1) 2607 if (dentry->d_count == 1)
2608 __d_drop(dentry); 2608 __d_drop(dentry);
2609 spin_unlock(&dentry->d_lock); 2609 spin_unlock(&dentry->d_lock);
2610 } 2610 }
2611 2611
2612 int vfs_rmdir(struct inode *dir, struct dentry *dentry) 2612 int vfs_rmdir(struct inode *dir, struct dentry *dentry)
2613 { 2613 {
2614 int error = may_delete(dir, dentry, 1); 2614 int error = may_delete(dir, dentry, 1);
2615 2615
2616 if (error) 2616 if (error)
2617 return error; 2617 return error;
2618 2618
2619 if (!dir->i_op->rmdir) 2619 if (!dir->i_op->rmdir)
2620 return -EPERM; 2620 return -EPERM;
2621 2621
2622 mutex_lock(&dentry->d_inode->i_mutex); 2622 mutex_lock(&dentry->d_inode->i_mutex);
2623 2623
2624 error = -EBUSY; 2624 error = -EBUSY;
2625 if (d_mountpoint(dentry)) 2625 if (d_mountpoint(dentry))
2626 goto out; 2626 goto out;
2627 2627
2628 error = security_inode_rmdir(dir, dentry); 2628 error = security_inode_rmdir(dir, dentry);
2629 if (error) 2629 if (error)
2630 goto out; 2630 goto out;
2631 2631
2632 shrink_dcache_parent(dentry); 2632 shrink_dcache_parent(dentry);
2633 error = dir->i_op->rmdir(dir, dentry); 2633 error = dir->i_op->rmdir(dir, dentry);
2634 if (error) 2634 if (error)
2635 goto out; 2635 goto out;
2636 2636
2637 dentry->d_inode->i_flags |= S_DEAD; 2637 dentry->d_inode->i_flags |= S_DEAD;
2638 dont_mount(dentry); 2638 dont_mount(dentry);
2639 2639
2640 out: 2640 out:
2641 mutex_unlock(&dentry->d_inode->i_mutex); 2641 mutex_unlock(&dentry->d_inode->i_mutex);
2642 if (!error) 2642 if (!error)
2643 d_delete(dentry); 2643 d_delete(dentry);
2644 return error; 2644 return error;
2645 } 2645 }
2646 2646
2647 static long do_rmdir(int dfd, const char __user *pathname) 2647 static long do_rmdir(int dfd, const char __user *pathname)
2648 { 2648 {
2649 int error = 0; 2649 int error = 0;
2650 char * name; 2650 char * name;
2651 struct dentry *dentry; 2651 struct dentry *dentry;
2652 struct nameidata nd; 2652 struct nameidata nd;
2653 2653
2654 error = user_path_parent(dfd, pathname, &nd, &name); 2654 error = user_path_parent(dfd, pathname, &nd, &name);
2655 if (error) 2655 if (error)
2656 return error; 2656 return error;
2657 2657
2658 switch(nd.last_type) { 2658 switch(nd.last_type) {
2659 case LAST_DOTDOT: 2659 case LAST_DOTDOT:
2660 error = -ENOTEMPTY; 2660 error = -ENOTEMPTY;
2661 goto exit1; 2661 goto exit1;
2662 case LAST_DOT: 2662 case LAST_DOT:
2663 error = -EINVAL; 2663 error = -EINVAL;
2664 goto exit1; 2664 goto exit1;
2665 case LAST_ROOT: 2665 case LAST_ROOT:
2666 error = -EBUSY; 2666 error = -EBUSY;
2667 goto exit1; 2667 goto exit1;
2668 } 2668 }
2669 2669
2670 nd.flags &= ~LOOKUP_PARENT; 2670 nd.flags &= ~LOOKUP_PARENT;
2671 2671
2672 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT); 2672 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
2673 dentry = lookup_hash(&nd); 2673 dentry = lookup_hash(&nd);
2674 error = PTR_ERR(dentry); 2674 error = PTR_ERR(dentry);
2675 if (IS_ERR(dentry)) 2675 if (IS_ERR(dentry))
2676 goto exit2; 2676 goto exit2;
2677 if (!dentry->d_inode) { 2677 if (!dentry->d_inode) {
2678 error = -ENOENT; 2678 error = -ENOENT;
2679 goto exit3; 2679 goto exit3;
2680 } 2680 }
2681 error = mnt_want_write(nd.path.mnt); 2681 error = mnt_want_write(nd.path.mnt);
2682 if (error) 2682 if (error)
2683 goto exit3; 2683 goto exit3;
2684 error = security_path_rmdir(&nd.path, dentry); 2684 error = security_path_rmdir(&nd.path, dentry);
2685 if (error) 2685 if (error)
2686 goto exit4; 2686 goto exit4;
2687 error = vfs_rmdir(nd.path.dentry->d_inode, dentry); 2687 error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
2688 exit4: 2688 exit4:
2689 mnt_drop_write(nd.path.mnt); 2689 mnt_drop_write(nd.path.mnt);
2690 exit3: 2690 exit3:
2691 dput(dentry); 2691 dput(dentry);
2692 exit2: 2692 exit2:
2693 mutex_unlock(&nd.path.dentry->d_inode->i_mutex); 2693 mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
2694 exit1: 2694 exit1:
2695 path_put(&nd.path); 2695 path_put(&nd.path);
2696 putname(name); 2696 putname(name);
2697 return error; 2697 return error;
2698 } 2698 }
2699 2699
2700 SYSCALL_DEFINE1(rmdir, const char __user *, pathname) 2700 SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
2701 { 2701 {
2702 return do_rmdir(AT_FDCWD, pathname); 2702 return do_rmdir(AT_FDCWD, pathname);
2703 } 2703 }
2704 2704
2705 int vfs_unlink(struct inode *dir, struct dentry *dentry) 2705 int vfs_unlink(struct inode *dir, struct dentry *dentry)
2706 { 2706 {
2707 int error = may_delete(dir, dentry, 0); 2707 int error = may_delete(dir, dentry, 0);
2708 2708
2709 if (error) 2709 if (error)
2710 return error; 2710 return error;
2711 2711
2712 if (!dir->i_op->unlink) 2712 if (!dir->i_op->unlink)
2713 return -EPERM; 2713 return -EPERM;
2714 2714
2715 mutex_lock(&dentry->d_inode->i_mutex); 2715 mutex_lock(&dentry->d_inode->i_mutex);
2716 if (d_mountpoint(dentry)) 2716 if (d_mountpoint(dentry))
2717 error = -EBUSY; 2717 error = -EBUSY;
2718 else { 2718 else {
2719 error = security_inode_unlink(dir, dentry); 2719 error = security_inode_unlink(dir, dentry);
2720 if (!error) { 2720 if (!error) {
2721 error = dir->i_op->unlink(dir, dentry); 2721 error = dir->i_op->unlink(dir, dentry);
2722 if (!error) 2722 if (!error)
2723 dont_mount(dentry); 2723 dont_mount(dentry);
2724 } 2724 }
2725 } 2725 }
2726 mutex_unlock(&dentry->d_inode->i_mutex); 2726 mutex_unlock(&dentry->d_inode->i_mutex);
2727 2727
2728 /* We don't d_delete() NFS sillyrenamed files--they still exist. */ 2728 /* We don't d_delete() NFS sillyrenamed files--they still exist. */
2729 if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) { 2729 if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) {
2730 fsnotify_link_count(dentry->d_inode); 2730 fsnotify_link_count(dentry->d_inode);
2731 d_delete(dentry); 2731 d_delete(dentry);
2732 } 2732 }
2733 2733
2734 return error; 2734 return error;
2735 } 2735 }
2736 2736
2737 /* 2737 /*
2738 * Make sure that the actual truncation of the file will occur outside its 2738 * Make sure that the actual truncation of the file will occur outside its
2739 * directory's i_mutex. Truncate can take a long time if there is a lot of 2739 * directory's i_mutex. Truncate can take a long time if there is a lot of
2740 * writeout happening, and we don't want to prevent access to the directory 2740 * writeout happening, and we don't want to prevent access to the directory
2741 * while waiting on the I/O. 2741 * while waiting on the I/O.
2742 */ 2742 */
2743 static long do_unlinkat(int dfd, const char __user *pathname) 2743 static long do_unlinkat(int dfd, const char __user *pathname)
2744 { 2744 {
2745 int error; 2745 int error;
2746 char *name; 2746 char *name;
2747 struct dentry *dentry; 2747 struct dentry *dentry;
2748 struct nameidata nd; 2748 struct nameidata nd;
2749 struct inode *inode = NULL; 2749 struct inode *inode = NULL;
2750 2750
2751 error = user_path_parent(dfd, pathname, &nd, &name); 2751 error = user_path_parent(dfd, pathname, &nd, &name);
2752 if (error) 2752 if (error)
2753 return error; 2753 return error;
2754 2754
2755 error = -EISDIR; 2755 error = -EISDIR;
2756 if (nd.last_type != LAST_NORM) 2756 if (nd.last_type != LAST_NORM)
2757 goto exit1; 2757 goto exit1;
2758 2758
2759 nd.flags &= ~LOOKUP_PARENT; 2759 nd.flags &= ~LOOKUP_PARENT;
2760 2760
2761 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT); 2761 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
2762 dentry = lookup_hash(&nd); 2762 dentry = lookup_hash(&nd);
2763 error = PTR_ERR(dentry); 2763 error = PTR_ERR(dentry);
2764 if (!IS_ERR(dentry)) { 2764 if (!IS_ERR(dentry)) {
2765 /* Why not before? Because we want correct error value */ 2765 /* Why not before? Because we want correct error value */
2766 if (nd.last.name[nd.last.len]) 2766 if (nd.last.name[nd.last.len])
2767 goto slashes; 2767 goto slashes;
2768 inode = dentry->d_inode; 2768 inode = dentry->d_inode;
2769 if (!inode) 2769 if (!inode)
2770 goto slashes; 2770 goto slashes;
2771 ihold(inode); 2771 ihold(inode);
2772 error = mnt_want_write(nd.path.mnt); 2772 error = mnt_want_write(nd.path.mnt);
2773 if (error) 2773 if (error)
2774 goto exit2; 2774 goto exit2;
2775 error = security_path_unlink(&nd.path, dentry); 2775 error = security_path_unlink(&nd.path, dentry);
2776 if (error) 2776 if (error)
2777 goto exit3; 2777 goto exit3;
2778 error = vfs_unlink(nd.path.dentry->d_inode, dentry); 2778 error = vfs_unlink(nd.path.dentry->d_inode, dentry);
2779 exit3: 2779 exit3:
2780 mnt_drop_write(nd.path.mnt); 2780 mnt_drop_write(nd.path.mnt);
2781 exit2: 2781 exit2:
2782 dput(dentry); 2782 dput(dentry);
2783 } 2783 }
2784 mutex_unlock(&nd.path.dentry->d_inode->i_mutex); 2784 mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
2785 if (inode) 2785 if (inode)
2786 iput(inode); /* truncate the inode here */ 2786 iput(inode); /* truncate the inode here */
2787 exit1: 2787 exit1:
2788 path_put(&nd.path); 2788 path_put(&nd.path);
2789 putname(name); 2789 putname(name);
2790 return error; 2790 return error;
2791 2791
2792 slashes: 2792 slashes:
2793 error = !dentry->d_inode ? -ENOENT : 2793 error = !dentry->d_inode ? -ENOENT :
2794 S_ISDIR(dentry->d_inode->i_mode) ? -EISDIR : -ENOTDIR; 2794 S_ISDIR(dentry->d_inode->i_mode) ? -EISDIR : -ENOTDIR;
2795 goto exit2; 2795 goto exit2;
2796 } 2796 }
2797 2797
2798 SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag) 2798 SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
2799 { 2799 {
2800 if ((flag & ~AT_REMOVEDIR) != 0) 2800 if ((flag & ~AT_REMOVEDIR) != 0)
2801 return -EINVAL; 2801 return -EINVAL;
2802 2802
2803 if (flag & AT_REMOVEDIR) 2803 if (flag & AT_REMOVEDIR)
2804 return do_rmdir(dfd, pathname); 2804 return do_rmdir(dfd, pathname);
2805 2805
2806 return do_unlinkat(dfd, pathname); 2806 return do_unlinkat(dfd, pathname);
2807 } 2807 }
2808 2808
2809 SYSCALL_DEFINE1(unlink, const char __user *, pathname) 2809 SYSCALL_DEFINE1(unlink, const char __user *, pathname)
2810 { 2810 {
2811 return do_unlinkat(AT_FDCWD, pathname); 2811 return do_unlinkat(AT_FDCWD, pathname);
2812 } 2812 }
2813 2813
2814 int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname) 2814 int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname)
2815 { 2815 {
2816 int error = may_create(dir, dentry); 2816 int error = may_create(dir, dentry);
2817 2817
2818 if (error) 2818 if (error)
2819 return error; 2819 return error;
2820 2820
2821 if (!dir->i_op->symlink) 2821 if (!dir->i_op->symlink)
2822 return -EPERM; 2822 return -EPERM;
2823 2823
2824 error = security_inode_symlink(dir, dentry, oldname); 2824 error = security_inode_symlink(dir, dentry, oldname);
2825 if (error) 2825 if (error)
2826 return error; 2826 return error;
2827 2827
2828 error = dir->i_op->symlink(dir, dentry, oldname); 2828 error = dir->i_op->symlink(dir, dentry, oldname);
2829 if (!error) 2829 if (!error)
2830 fsnotify_create(dir, dentry); 2830 fsnotify_create(dir, dentry);
2831 return error; 2831 return error;
2832 } 2832 }
2833 2833
2834 SYSCALL_DEFINE3(symlinkat, const char __user *, oldname, 2834 SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
2835 int, newdfd, const char __user *, newname) 2835 int, newdfd, const char __user *, newname)
2836 { 2836 {
2837 int error; 2837 int error;
2838 char *from; 2838 char *from;
2839 struct dentry *dentry; 2839 struct dentry *dentry;
2840 struct path path; 2840 struct path path;
2841 2841
2842 from = getname(oldname); 2842 from = getname(oldname);
2843 if (IS_ERR(from)) 2843 if (IS_ERR(from))
2844 return PTR_ERR(from); 2844 return PTR_ERR(from);
2845 2845
2846 dentry = user_path_create(newdfd, newname, &path, 0); 2846 dentry = user_path_create(newdfd, newname, &path, 0);
2847 error = PTR_ERR(dentry); 2847 error = PTR_ERR(dentry);
2848 if (IS_ERR(dentry)) 2848 if (IS_ERR(dentry))
2849 goto out_putname; 2849 goto out_putname;
2850 2850
2851 error = mnt_want_write(path.mnt); 2851 error = mnt_want_write(path.mnt);
2852 if (error) 2852 if (error)
2853 goto out_dput; 2853 goto out_dput;
2854 error = security_path_symlink(&path, dentry, from); 2854 error = security_path_symlink(&path, dentry, from);
2855 if (error) 2855 if (error)
2856 goto out_drop_write; 2856 goto out_drop_write;
2857 error = vfs_symlink(path.dentry->d_inode, dentry, from); 2857 error = vfs_symlink(path.dentry->d_inode, dentry, from);
2858 out_drop_write: 2858 out_drop_write:
2859 mnt_drop_write(path.mnt); 2859 mnt_drop_write(path.mnt);
2860 out_dput: 2860 out_dput:
2861 dput(dentry); 2861 dput(dentry);
2862 mutex_unlock(&path.dentry->d_inode->i_mutex); 2862 mutex_unlock(&path.dentry->d_inode->i_mutex);
2863 path_put(&path); 2863 path_put(&path);
2864 out_putname: 2864 out_putname:
2865 putname(from); 2865 putname(from);
2866 return error; 2866 return error;
2867 } 2867 }
2868 2868
2869 SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname) 2869 SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname)
2870 { 2870 {
2871 return sys_symlinkat(oldname, AT_FDCWD, newname); 2871 return sys_symlinkat(oldname, AT_FDCWD, newname);
2872 } 2872 }
2873 2873
2874 int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry) 2874 int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2875 { 2875 {
2876 struct inode *inode = old_dentry->d_inode; 2876 struct inode *inode = old_dentry->d_inode;
2877 int error; 2877 int error;
2878 2878
2879 if (!inode) 2879 if (!inode)
2880 return -ENOENT; 2880 return -ENOENT;
2881 2881
2882 error = may_create(dir, new_dentry); 2882 error = may_create(dir, new_dentry);
2883 if (error) 2883 if (error)
2884 return error; 2884 return error;
2885 2885
2886 if (dir->i_sb != inode->i_sb) 2886 if (dir->i_sb != inode->i_sb)
2887 return -EXDEV; 2887 return -EXDEV;
2888 2888
2889 /* 2889 /*
2890 * A link to an append-only or immutable file cannot be created. 2890 * A link to an append-only or immutable file cannot be created.
2891 */ 2891 */
2892 if (IS_APPEND(inode) || IS_IMMUTABLE(inode)) 2892 if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
2893 return -EPERM; 2893 return -EPERM;
2894 if (!dir->i_op->link) 2894 if (!dir->i_op->link)
2895 return -EPERM; 2895 return -EPERM;
2896 if (S_ISDIR(inode->i_mode)) 2896 if (S_ISDIR(inode->i_mode))
2897 return -EPERM; 2897 return -EPERM;
2898 2898
2899 error = security_inode_link(old_dentry, dir, new_dentry); 2899 error = security_inode_link(old_dentry, dir, new_dentry);
2900 if (error) 2900 if (error)
2901 return error; 2901 return error;
2902 2902
2903 mutex_lock(&inode->i_mutex); 2903 mutex_lock(&inode->i_mutex);
2904 /* Make sure we don't allow creating hardlink to an unlinked file */ 2904 /* Make sure we don't allow creating hardlink to an unlinked file */
2905 if (inode->i_nlink == 0) 2905 if (inode->i_nlink == 0)
2906 error = -ENOENT; 2906 error = -ENOENT;
2907 else 2907 else
2908 error = dir->i_op->link(old_dentry, dir, new_dentry); 2908 error = dir->i_op->link(old_dentry, dir, new_dentry);
2909 mutex_unlock(&inode->i_mutex); 2909 mutex_unlock(&inode->i_mutex);
2910 if (!error) 2910 if (!error)
2911 fsnotify_link(dir, inode, new_dentry); 2911 fsnotify_link(dir, inode, new_dentry);
2912 return error; 2912 return error;
2913 } 2913 }
2914 2914
2915 /* 2915 /*
2916 * Hardlinks are often used in delicate situations. We avoid 2916 * Hardlinks are often used in delicate situations. We avoid
2917 * security-related surprises by not following symlinks on the 2917 * security-related surprises by not following symlinks on the
2918 * newname. --KAB 2918 * newname. --KAB
2919 * 2919 *
2920 * We don't follow them on the oldname either to be compatible 2920 * We don't follow them on the oldname either to be compatible
2921 * with linux 2.0, and to avoid hard-linking to directories 2921 * with linux 2.0, and to avoid hard-linking to directories
2922 * and other special files. --ADM 2922 * and other special files. --ADM
2923 */ 2923 */
2924 SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname, 2924 SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
2925 int, newdfd, const char __user *, newname, int, flags) 2925 int, newdfd, const char __user *, newname, int, flags)
2926 { 2926 {
2927 struct dentry *new_dentry; 2927 struct dentry *new_dentry;
2928 struct path old_path, new_path; 2928 struct path old_path, new_path;
2929 int how = 0; 2929 int how = 0;
2930 int error; 2930 int error;
2931 2931
2932 if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0) 2932 if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
2933 return -EINVAL; 2933 return -EINVAL;
2934 /* 2934 /*
2935 * To use null names we require CAP_DAC_READ_SEARCH 2935 * To use null names we require CAP_DAC_READ_SEARCH
2936 * This ensures that not everyone will be able to create 2936 * This ensures that not everyone will be able to create
2937 * handlink using the passed filedescriptor. 2937 * handlink using the passed filedescriptor.
2938 */ 2938 */
2939 if (flags & AT_EMPTY_PATH) { 2939 if (flags & AT_EMPTY_PATH) {
2940 if (!capable(CAP_DAC_READ_SEARCH)) 2940 if (!capable(CAP_DAC_READ_SEARCH))
2941 return -ENOENT; 2941 return -ENOENT;
2942 how = LOOKUP_EMPTY; 2942 how = LOOKUP_EMPTY;
2943 } 2943 }
2944 2944
2945 if (flags & AT_SYMLINK_FOLLOW) 2945 if (flags & AT_SYMLINK_FOLLOW)
2946 how |= LOOKUP_FOLLOW; 2946 how |= LOOKUP_FOLLOW;
2947 2947
2948 error = user_path_at(olddfd, oldname, how, &old_path); 2948 error = user_path_at(olddfd, oldname, how, &old_path);
2949 if (error) 2949 if (error)
2950 return error; 2950 return error;
2951 2951
2952 new_dentry = user_path_create(newdfd, newname, &new_path, 0); 2952 new_dentry = user_path_create(newdfd, newname, &new_path, 0);
2953 error = PTR_ERR(new_dentry); 2953 error = PTR_ERR(new_dentry);
2954 if (IS_ERR(new_dentry)) 2954 if (IS_ERR(new_dentry))
2955 goto out; 2955 goto out;
2956 2956
2957 error = -EXDEV; 2957 error = -EXDEV;
2958 if (old_path.mnt != new_path.mnt) 2958 if (old_path.mnt != new_path.mnt)
2959 goto out_dput; 2959 goto out_dput;
2960 error = mnt_want_write(new_path.mnt); 2960 error = mnt_want_write(new_path.mnt);
2961 if (error) 2961 if (error)
2962 goto out_dput; 2962 goto out_dput;
2963 error = security_path_link(old_path.dentry, &new_path, new_dentry); 2963 error = security_path_link(old_path.dentry, &new_path, new_dentry);
2964 if (error) 2964 if (error)
2965 goto out_drop_write; 2965 goto out_drop_write;
2966 error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry); 2966 error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry);
2967 out_drop_write: 2967 out_drop_write:
2968 mnt_drop_write(new_path.mnt); 2968 mnt_drop_write(new_path.mnt);
2969 out_dput: 2969 out_dput:
2970 dput(new_dentry); 2970 dput(new_dentry);
2971 mutex_unlock(&new_path.dentry->d_inode->i_mutex); 2971 mutex_unlock(&new_path.dentry->d_inode->i_mutex);
2972 path_put(&new_path); 2972 path_put(&new_path);
2973 out: 2973 out:
2974 path_put(&old_path); 2974 path_put(&old_path);
2975 2975
2976 return error; 2976 return error;
2977 } 2977 }
2978 2978
2979 SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname) 2979 SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname)
2980 { 2980 {
2981 return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0); 2981 return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
2982 } 2982 }
2983 2983
2984 /* 2984 /*
2985 * The worst of all namespace operations - renaming directory. "Perverted" 2985 * The worst of all namespace operations - renaming directory. "Perverted"
2986 * doesn't even start to describe it. Somebody in UCB had a heck of a trip... 2986 * doesn't even start to describe it. Somebody in UCB had a heck of a trip...
2987 * Problems: 2987 * Problems:
2988 * a) we can get into loop creation. Check is done in is_subdir(). 2988 * a) we can get into loop creation. Check is done in is_subdir().
2989 * b) race potential - two innocent renames can create a loop together. 2989 * b) race potential - two innocent renames can create a loop together.
2990 * That's where 4.4 screws up. Current fix: serialization on 2990 * That's where 4.4 screws up. Current fix: serialization on
2991 * sb->s_vfs_rename_mutex. We might be more accurate, but that's another 2991 * sb->s_vfs_rename_mutex. We might be more accurate, but that's another
2992 * story. 2992 * story.
2993 * c) we have to lock _three_ objects - parents and victim (if it exists). 2993 * c) we have to lock _three_ objects - parents and victim (if it exists).
2994 * And that - after we got ->i_mutex on parents (until then we don't know 2994 * And that - after we got ->i_mutex on parents (until then we don't know
2995 * whether the target exists). Solution: try to be smart with locking 2995 * whether the target exists). Solution: try to be smart with locking
2996 * order for inodes. We rely on the fact that tree topology may change 2996 * order for inodes. We rely on the fact that tree topology may change
2997 * only under ->s_vfs_rename_mutex _and_ that parent of the object we 2997 * only under ->s_vfs_rename_mutex _and_ that parent of the object we
2998 * move will be locked. Thus we can rank directories by the tree 2998 * move will be locked. Thus we can rank directories by the tree
2999 * (ancestors first) and rank all non-directories after them. 2999 * (ancestors first) and rank all non-directories after them.
3000 * That works since everybody except rename does "lock parent, lookup, 3000 * That works since everybody except rename does "lock parent, lookup,
3001 * lock child" and rename is under ->s_vfs_rename_mutex. 3001 * lock child" and rename is under ->s_vfs_rename_mutex.
3002 * HOWEVER, it relies on the assumption that any object with ->lookup() 3002 * HOWEVER, it relies on the assumption that any object with ->lookup()
3003 * has no more than 1 dentry. If "hybrid" objects will ever appear, 3003 * has no more than 1 dentry. If "hybrid" objects will ever appear,
3004 * we'd better make sure that there's no link(2) for them. 3004 * we'd better make sure that there's no link(2) for them.
3005 * d) conversion from fhandle to dentry may come in the wrong moment - when 3005 * d) conversion from fhandle to dentry may come in the wrong moment - when
3006 * we are removing the target. Solution: we will have to grab ->i_mutex 3006 * we are removing the target. Solution: we will have to grab ->i_mutex
3007 * in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on 3007 * in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on
3008 * ->i_mutex on parents, which works but leads to some truly excessive 3008 * ->i_mutex on parents, which works but leads to some truly excessive
3009 * locking]. 3009 * locking].
3010 */ 3010 */
3011 static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry, 3011 static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
3012 struct inode *new_dir, struct dentry *new_dentry) 3012 struct inode *new_dir, struct dentry *new_dentry)
3013 { 3013 {
3014 int error = 0; 3014 int error = 0;
3015 struct inode *target = new_dentry->d_inode; 3015 struct inode *target = new_dentry->d_inode;
3016 3016
3017 /* 3017 /*
3018 * If we are going to change the parent - check write permissions, 3018 * If we are going to change the parent - check write permissions,
3019 * we'll need to flip '..'. 3019 * we'll need to flip '..'.
3020 */ 3020 */
3021 if (new_dir != old_dir) { 3021 if (new_dir != old_dir) {
3022 error = inode_permission(old_dentry->d_inode, MAY_WRITE); 3022 error = inode_permission(old_dentry->d_inode, MAY_WRITE);
3023 if (error) 3023 if (error)
3024 return error; 3024 return error;
3025 } 3025 }
3026 3026
3027 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry); 3027 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry);
3028 if (error) 3028 if (error)
3029 return error; 3029 return error;
3030 3030
3031 if (target) 3031 if (target)
3032 mutex_lock(&target->i_mutex); 3032 mutex_lock(&target->i_mutex);
3033 3033
3034 error = -EBUSY; 3034 error = -EBUSY;
3035 if (d_mountpoint(old_dentry) || d_mountpoint(new_dentry)) 3035 if (d_mountpoint(old_dentry) || d_mountpoint(new_dentry))
3036 goto out; 3036 goto out;
3037 3037
3038 if (target) 3038 if (target)
3039 shrink_dcache_parent(new_dentry); 3039 shrink_dcache_parent(new_dentry);
3040 error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry); 3040 error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
3041 if (error) 3041 if (error)
3042 goto out; 3042 goto out;
3043 3043
3044 if (target) { 3044 if (target) {
3045 target->i_flags |= S_DEAD; 3045 target->i_flags |= S_DEAD;
3046 dont_mount(new_dentry); 3046 dont_mount(new_dentry);
3047 } 3047 }
3048 out: 3048 out:
3049 if (target) 3049 if (target)
3050 mutex_unlock(&target->i_mutex); 3050 mutex_unlock(&target->i_mutex);
3051 if (!error) 3051 if (!error)
3052 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) 3052 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
3053 d_move(old_dentry,new_dentry); 3053 d_move(old_dentry,new_dentry);
3054 return error; 3054 return error;
3055 } 3055 }
3056 3056
3057 static int vfs_rename_other(struct inode *old_dir, struct dentry *old_dentry, 3057 static int vfs_rename_other(struct inode *old_dir, struct dentry *old_dentry,
3058 struct inode *new_dir, struct dentry *new_dentry) 3058 struct inode *new_dir, struct dentry *new_dentry)
3059 { 3059 {
3060 struct inode *target = new_dentry->d_inode; 3060 struct inode *target = new_dentry->d_inode;
3061 int error; 3061 int error;
3062 3062
3063 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry); 3063 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry);
3064 if (error) 3064 if (error)
3065 return error; 3065 return error;
3066 3066
3067 dget(new_dentry); 3067 dget(new_dentry);
3068 if (target) 3068 if (target)
3069 mutex_lock(&target->i_mutex); 3069 mutex_lock(&target->i_mutex);
3070 3070
3071 error = -EBUSY; 3071 error = -EBUSY;
3072 if (d_mountpoint(old_dentry)||d_mountpoint(new_dentry)) 3072 if (d_mountpoint(old_dentry)||d_mountpoint(new_dentry))
3073 goto out; 3073 goto out;
3074 3074
3075 error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry); 3075 error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
3076 if (error) 3076 if (error)
3077 goto out; 3077 goto out;
3078 3078
3079 if (target) 3079 if (target)
3080 dont_mount(new_dentry); 3080 dont_mount(new_dentry);
3081 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) 3081 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
3082 d_move(old_dentry, new_dentry); 3082 d_move(old_dentry, new_dentry);
3083 out: 3083 out:
3084 if (target) 3084 if (target)
3085 mutex_unlock(&target->i_mutex); 3085 mutex_unlock(&target->i_mutex);
3086 dput(new_dentry); 3086 dput(new_dentry);
3087 return error; 3087 return error;
3088 } 3088 }
3089 3089
3090 int vfs_rename(struct inode *old_dir, struct dentry *old_dentry, 3090 int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
3091 struct inode *new_dir, struct dentry *new_dentry) 3091 struct inode *new_dir, struct dentry *new_dentry)
3092 { 3092 {
3093 int error; 3093 int error;
3094 int is_dir = S_ISDIR(old_dentry->d_inode->i_mode); 3094 int is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
3095 const unsigned char *old_name; 3095 const unsigned char *old_name;
3096 3096
3097 if (old_dentry->d_inode == new_dentry->d_inode) 3097 if (old_dentry->d_inode == new_dentry->d_inode)
3098 return 0; 3098 return 0;
3099 3099
3100 error = may_delete(old_dir, old_dentry, is_dir); 3100 error = may_delete(old_dir, old_dentry, is_dir);
3101 if (error) 3101 if (error)
3102 return error; 3102 return error;
3103 3103
3104 if (!new_dentry->d_inode) 3104 if (!new_dentry->d_inode)
3105 error = may_create(new_dir, new_dentry); 3105 error = may_create(new_dir, new_dentry);
3106 else 3106 else
3107 error = may_delete(new_dir, new_dentry, is_dir); 3107 error = may_delete(new_dir, new_dentry, is_dir);
3108 if (error) 3108 if (error)
3109 return error; 3109 return error;
3110 3110
3111 if (!old_dir->i_op->rename) 3111 if (!old_dir->i_op->rename)
3112 return -EPERM; 3112 return -EPERM;
3113 3113
3114 old_name = fsnotify_oldname_init(old_dentry->d_name.name); 3114 old_name = fsnotify_oldname_init(old_dentry->d_name.name);
3115 3115
3116 if (is_dir) 3116 if (is_dir)
3117 error = vfs_rename_dir(old_dir,old_dentry,new_dir,new_dentry); 3117 error = vfs_rename_dir(old_dir,old_dentry,new_dir,new_dentry);
3118 else 3118 else
3119 error = vfs_rename_other(old_dir,old_dentry,new_dir,new_dentry); 3119 error = vfs_rename_other(old_dir,old_dentry,new_dir,new_dentry);
3120 if (!error) 3120 if (!error)
3121 fsnotify_move(old_dir, new_dir, old_name, is_dir, 3121 fsnotify_move(old_dir, new_dir, old_name, is_dir,
3122 new_dentry->d_inode, old_dentry); 3122 new_dentry->d_inode, old_dentry);
3123 fsnotify_oldname_free(old_name); 3123 fsnotify_oldname_free(old_name);
3124 3124
3125 return error; 3125 return error;
3126 } 3126 }
3127 3127
3128 SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname, 3128 SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
3129 int, newdfd, const char __user *, newname) 3129 int, newdfd, const char __user *, newname)
3130 { 3130 {
3131 struct dentry *old_dir, *new_dir; 3131 struct dentry *old_dir, *new_dir;
3132 struct dentry *old_dentry, *new_dentry; 3132 struct dentry *old_dentry, *new_dentry;
3133 struct dentry *trap; 3133 struct dentry *trap;
3134 struct nameidata oldnd, newnd; 3134 struct nameidata oldnd, newnd;
3135 char *from; 3135 char *from;
3136 char *to; 3136 char *to;
3137 int error; 3137 int error;
3138 3138
3139 error = user_path_parent(olddfd, oldname, &oldnd, &from); 3139 error = user_path_parent(olddfd, oldname, &oldnd, &from);
3140 if (error) 3140 if (error)
3141 goto exit; 3141 goto exit;
3142 3142
3143 error = user_path_parent(newdfd, newname, &newnd, &to); 3143 error = user_path_parent(newdfd, newname, &newnd, &to);
3144 if (error) 3144 if (error)
3145 goto exit1; 3145 goto exit1;
3146 3146
3147 error = -EXDEV; 3147 error = -EXDEV;
3148 if (oldnd.path.mnt != newnd.path.mnt) 3148 if (oldnd.path.mnt != newnd.path.mnt)
3149 goto exit2; 3149 goto exit2;
3150 3150
3151 old_dir = oldnd.path.dentry; 3151 old_dir = oldnd.path.dentry;
3152 error = -EBUSY; 3152 error = -EBUSY;
3153 if (oldnd.last_type != LAST_NORM) 3153 if (oldnd.last_type != LAST_NORM)
3154 goto exit2; 3154 goto exit2;
3155 3155
3156 new_dir = newnd.path.dentry; 3156 new_dir = newnd.path.dentry;
3157 if (newnd.last_type != LAST_NORM) 3157 if (newnd.last_type != LAST_NORM)
3158 goto exit2; 3158 goto exit2;
3159 3159
3160 oldnd.flags &= ~LOOKUP_PARENT; 3160 oldnd.flags &= ~LOOKUP_PARENT;
3161 newnd.flags &= ~LOOKUP_PARENT; 3161 newnd.flags &= ~LOOKUP_PARENT;
3162 newnd.flags |= LOOKUP_RENAME_TARGET; 3162 newnd.flags |= LOOKUP_RENAME_TARGET;
3163 3163
3164 trap = lock_rename(new_dir, old_dir); 3164 trap = lock_rename(new_dir, old_dir);
3165 3165
3166 old_dentry = lookup_hash(&oldnd); 3166 old_dentry = lookup_hash(&oldnd);
3167 error = PTR_ERR(old_dentry); 3167 error = PTR_ERR(old_dentry);
3168 if (IS_ERR(old_dentry)) 3168 if (IS_ERR(old_dentry))
3169 goto exit3; 3169 goto exit3;
3170 /* source must exist */ 3170 /* source must exist */
3171 error = -ENOENT; 3171 error = -ENOENT;
3172 if (!old_dentry->d_inode) 3172 if (!old_dentry->d_inode)
3173 goto exit4; 3173 goto exit4;
3174 /* unless the source is a directory trailing slashes give -ENOTDIR */ 3174 /* unless the source is a directory trailing slashes give -ENOTDIR */
3175 if (!S_ISDIR(old_dentry->d_inode->i_mode)) { 3175 if (!S_ISDIR(old_dentry->d_inode->i_mode)) {
3176 error = -ENOTDIR; 3176 error = -ENOTDIR;
3177 if (oldnd.last.name[oldnd.last.len]) 3177 if (oldnd.last.name[oldnd.last.len])
3178 goto exit4; 3178 goto exit4;
3179 if (newnd.last.name[newnd.last.len]) 3179 if (newnd.last.name[newnd.last.len])
3180 goto exit4; 3180 goto exit4;
3181 } 3181 }
3182 /* source should not be ancestor of target */ 3182 /* source should not be ancestor of target */
3183 error = -EINVAL; 3183 error = -EINVAL;
3184 if (old_dentry == trap) 3184 if (old_dentry == trap)
3185 goto exit4; 3185 goto exit4;
3186 new_dentry = lookup_hash(&newnd); 3186 new_dentry = lookup_hash(&newnd);
3187 error = PTR_ERR(new_dentry); 3187 error = PTR_ERR(new_dentry);
3188 if (IS_ERR(new_dentry)) 3188 if (IS_ERR(new_dentry))
3189 goto exit4; 3189 goto exit4;
3190 /* target should not be an ancestor of source */ 3190 /* target should not be an ancestor of source */
3191 error = -ENOTEMPTY; 3191 error = -ENOTEMPTY;
3192 if (new_dentry == trap) 3192 if (new_dentry == trap)
3193 goto exit5; 3193 goto exit5;
3194 3194
3195 error = mnt_want_write(oldnd.path.mnt); 3195 error = mnt_want_write(oldnd.path.mnt);
3196 if (error) 3196 if (error)
3197 goto exit5; 3197 goto exit5;
3198 error = security_path_rename(&oldnd.path, old_dentry, 3198 error = security_path_rename(&oldnd.path, old_dentry,
3199 &newnd.path, new_dentry); 3199 &newnd.path, new_dentry);
3200 if (error) 3200 if (error)
3201 goto exit6; 3201 goto exit6;
3202 error = vfs_rename(old_dir->d_inode, old_dentry, 3202 error = vfs_rename(old_dir->d_inode, old_dentry,
3203 new_dir->d_inode, new_dentry); 3203 new_dir->d_inode, new_dentry);
3204 exit6: 3204 exit6:
3205 mnt_drop_write(oldnd.path.mnt); 3205 mnt_drop_write(oldnd.path.mnt);
3206 exit5: 3206 exit5:
3207 dput(new_dentry); 3207 dput(new_dentry);
3208 exit4: 3208 exit4:
3209 dput(old_dentry); 3209 dput(old_dentry);
3210 exit3: 3210 exit3:
3211 unlock_rename(new_dir, old_dir); 3211 unlock_rename(new_dir, old_dir);
3212 exit2: 3212 exit2:
3213 path_put(&newnd.path); 3213 path_put(&newnd.path);
3214 putname(to); 3214 putname(to);
3215 exit1: 3215 exit1:
3216 path_put(&oldnd.path); 3216 path_put(&oldnd.path);
3217 putname(from); 3217 putname(from);
3218 exit: 3218 exit:
3219 return error; 3219 return error;
3220 } 3220 }
3221 3221
3222 SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname) 3222 SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname)
3223 { 3223 {
3224 return sys_renameat(AT_FDCWD, oldname, AT_FDCWD, newname); 3224 return sys_renameat(AT_FDCWD, oldname, AT_FDCWD, newname);
3225 } 3225 }
3226 3226
3227 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link) 3227 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
3228 { 3228 {
3229 int len; 3229 int len;
3230 3230
3231 len = PTR_ERR(link); 3231 len = PTR_ERR(link);
3232 if (IS_ERR(link)) 3232 if (IS_ERR(link))
3233 goto out; 3233 goto out;
3234 3234
3235 len = strlen(link); 3235 len = strlen(link);
3236 if (len > (unsigned) buflen) 3236 if (len > (unsigned) buflen)
3237 len = buflen; 3237 len = buflen;
3238 if (copy_to_user(buffer, link, len)) 3238 if (copy_to_user(buffer, link, len))
3239 len = -EFAULT; 3239 len = -EFAULT;
3240 out: 3240 out:
3241 return len; 3241 return len;
3242 } 3242 }
3243 3243
3244 /* 3244 /*
3245 * A helper for ->readlink(). This should be used *ONLY* for symlinks that 3245 * A helper for ->readlink(). This should be used *ONLY* for symlinks that
3246 * have ->follow_link() touching nd only in nd_set_link(). Using (or not 3246 * have ->follow_link() touching nd only in nd_set_link(). Using (or not
3247 * using) it for any given inode is up to filesystem. 3247 * using) it for any given inode is up to filesystem.
3248 */ 3248 */
3249 int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen) 3249 int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen)
3250 { 3250 {
3251 struct nameidata nd; 3251 struct nameidata nd;
3252 void *cookie; 3252 void *cookie;
3253 int res; 3253 int res;
3254 3254
3255 nd.depth = 0; 3255 nd.depth = 0;
3256 cookie = dentry->d_inode->i_op->follow_link(dentry, &nd); 3256 cookie = dentry->d_inode->i_op->follow_link(dentry, &nd);
3257 if (IS_ERR(cookie)) 3257 if (IS_ERR(cookie))
3258 return PTR_ERR(cookie); 3258 return PTR_ERR(cookie);
3259 3259
3260 res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd)); 3260 res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd));
3261 if (dentry->d_inode->i_op->put_link) 3261 if (dentry->d_inode->i_op->put_link)
3262 dentry->d_inode->i_op->put_link(dentry, &nd, cookie); 3262 dentry->d_inode->i_op->put_link(dentry, &nd, cookie);
3263 return res; 3263 return res;
3264 } 3264 }
3265 3265
3266 int vfs_follow_link(struct nameidata *nd, const char *link) 3266 int vfs_follow_link(struct nameidata *nd, const char *link)
3267 { 3267 {
3268 return __vfs_follow_link(nd, link); 3268 return __vfs_follow_link(nd, link);
3269 } 3269 }
3270 3270
3271 /* get the link contents into pagecache */ 3271 /* get the link contents into pagecache */
3272 static char *page_getlink(struct dentry * dentry, struct page **ppage) 3272 static char *page_getlink(struct dentry * dentry, struct page **ppage)
3273 { 3273 {
3274 char *kaddr; 3274 char *kaddr;
3275 struct page *page; 3275 struct page *page;
3276 struct address_space *mapping = dentry->d_inode->i_mapping; 3276 struct address_space *mapping = dentry->d_inode->i_mapping;
3277 page = read_mapping_page(mapping, 0, NULL); 3277 page = read_mapping_page(mapping, 0, NULL);
3278 if (IS_ERR(page)) 3278 if (IS_ERR(page))
3279 return (char*)page; 3279 return (char*)page;
3280 *ppage = page; 3280 *ppage = page;
3281 kaddr = kmap(page); 3281 kaddr = kmap(page);
3282 nd_terminate_link(kaddr, dentry->d_inode->i_size, PAGE_SIZE - 1); 3282 nd_terminate_link(kaddr, dentry->d_inode->i_size, PAGE_SIZE - 1);
3283 return kaddr; 3283 return kaddr;
3284 } 3284 }
3285 3285
3286 int page_readlink(struct dentry *dentry, char __user *buffer, int buflen) 3286 int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
3287 { 3287 {
3288 struct page *page = NULL; 3288 struct page *page = NULL;
3289 char *s = page_getlink(dentry, &page); 3289 char *s = page_getlink(dentry, &page);
3290 int res = vfs_readlink(dentry,buffer,buflen,s); 3290 int res = vfs_readlink(dentry,buffer,buflen,s);
3291 if (page) { 3291 if (page) {
3292 kunmap(page); 3292 kunmap(page);
3293 page_cache_release(page); 3293 page_cache_release(page);
3294 } 3294 }
3295 return res; 3295 return res;
3296 } 3296 }
3297 3297
3298 void *page_follow_link_light(struct dentry *dentry, struct nameidata *nd) 3298 void *page_follow_link_light(struct dentry *dentry, struct nameidata *nd)
3299 { 3299 {
3300 struct page *page = NULL; 3300 struct page *page = NULL;
3301 nd_set_link(nd, page_getlink(dentry, &page)); 3301 nd_set_link(nd, page_getlink(dentry, &page));
3302 return page; 3302 return page;
3303 } 3303 }
3304 3304
3305 void page_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie) 3305 void page_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
3306 { 3306 {
3307 struct page *page = cookie; 3307 struct page *page = cookie;
3308 3308
3309 if (page) { 3309 if (page) {
3310 kunmap(page); 3310 kunmap(page);
3311 page_cache_release(page); 3311 page_cache_release(page);
3312 } 3312 }
3313 } 3313 }
3314 3314
3315 /* 3315 /*
3316 * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS 3316 * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS
3317 */ 3317 */
3318 int __page_symlink(struct inode *inode, const char *symname, int len, int nofs) 3318 int __page_symlink(struct inode *inode, const char *symname, int len, int nofs)
3319 { 3319 {
3320 struct address_space *mapping = inode->i_mapping; 3320 struct address_space *mapping = inode->i_mapping;
3321 struct page *page; 3321 struct page *page;
3322 void *fsdata; 3322 void *fsdata;
3323 int err; 3323 int err;
3324 char *kaddr; 3324 char *kaddr;
3325 unsigned int flags = AOP_FLAG_UNINTERRUPTIBLE; 3325 unsigned int flags = AOP_FLAG_UNINTERRUPTIBLE;
3326 if (nofs) 3326 if (nofs)
3327 flags |= AOP_FLAG_NOFS; 3327 flags |= AOP_FLAG_NOFS;
3328 3328
3329 retry: 3329 retry:
3330 err = pagecache_write_begin(NULL, mapping, 0, len-1, 3330 err = pagecache_write_begin(NULL, mapping, 0, len-1,
3331 flags, &page, &fsdata); 3331 flags, &page, &fsdata);
3332 if (err) 3332 if (err)
3333 goto fail; 3333 goto fail;
3334 3334
3335 kaddr = kmap_atomic(page, KM_USER0); 3335 kaddr = kmap_atomic(page, KM_USER0);
3336 memcpy(kaddr, symname, len-1); 3336 memcpy(kaddr, symname, len-1);
3337 kunmap_atomic(kaddr, KM_USER0); 3337 kunmap_atomic(kaddr, KM_USER0);
3338 3338
3339 err = pagecache_write_end(NULL, mapping, 0, len-1, len-1, 3339 err = pagecache_write_end(NULL, mapping, 0, len-1, len-1,
3340 page, fsdata); 3340 page, fsdata);
3341 if (err < 0) 3341 if (err < 0)
3342 goto fail; 3342 goto fail;
3343 if (err < len-1) 3343 if (err < len-1)
3344 goto retry; 3344 goto retry;
3345 3345
3346 mark_inode_dirty(inode); 3346 mark_inode_dirty(inode);
3347 return 0; 3347 return 0;
3348 fail: 3348 fail:
3349 return err; 3349 return err;
3350 } 3350 }
3351 3351
3352 int page_symlink(struct inode *inode, const char *symname, int len) 3352 int page_symlink(struct inode *inode, const char *symname, int len)
3353 { 3353 {
3354 return __page_symlink(inode, symname, len, 3354 return __page_symlink(inode, symname, len,
3355 !(mapping_gfp_mask(inode->i_mapping) & __GFP_FS)); 3355 !(mapping_gfp_mask(inode->i_mapping) & __GFP_FS));
3356 } 3356 }
3357 3357
3358 const struct inode_operations page_symlink_inode_operations = { 3358 const struct inode_operations page_symlink_inode_operations = {
3359 .readlink = generic_readlink, 3359 .readlink = generic_readlink,
3360 .follow_link = page_follow_link_light, 3360 .follow_link = page_follow_link_light,
3361 .put_link = page_put_link, 3361 .put_link = page_put_link,
3362 }; 3362 };
3363 3363
3364 EXPORT_SYMBOL(user_path_at); 3364 EXPORT_SYMBOL(user_path_at);
3365 EXPORT_SYMBOL(follow_down_one); 3365 EXPORT_SYMBOL(follow_down_one);
3366 EXPORT_SYMBOL(follow_down); 3366 EXPORT_SYMBOL(follow_down);
3367 EXPORT_SYMBOL(follow_up); 3367 EXPORT_SYMBOL(follow_up);
3368 EXPORT_SYMBOL(get_write_access); /* binfmt_aout */ 3368 EXPORT_SYMBOL(get_write_access); /* binfmt_aout */
3369 EXPORT_SYMBOL(getname); 3369 EXPORT_SYMBOL(getname);
3370 EXPORT_SYMBOL(lock_rename); 3370 EXPORT_SYMBOL(lock_rename);
3371 EXPORT_SYMBOL(lookup_one_len); 3371 EXPORT_SYMBOL(lookup_one_len);
3372 EXPORT_SYMBOL(page_follow_link_light); 3372 EXPORT_SYMBOL(page_follow_link_light);
3373 EXPORT_SYMBOL(page_put_link); 3373 EXPORT_SYMBOL(page_put_link);
3374 EXPORT_SYMBOL(page_readlink); 3374 EXPORT_SYMBOL(page_readlink);
3375 EXPORT_SYMBOL(__page_symlink); 3375 EXPORT_SYMBOL(__page_symlink);
3376 EXPORT_SYMBOL(page_symlink); 3376 EXPORT_SYMBOL(page_symlink);
3377 EXPORT_SYMBOL(page_symlink_inode_operations); 3377 EXPORT_SYMBOL(page_symlink_inode_operations);
3378 EXPORT_SYMBOL(kern_path); 3378 EXPORT_SYMBOL(kern_path);
3379 EXPORT_SYMBOL(vfs_path_lookup); 3379 EXPORT_SYMBOL(vfs_path_lookup);
3380 EXPORT_SYMBOL(inode_permission); 3380 EXPORT_SYMBOL(inode_permission);
3381 EXPORT_SYMBOL(unlock_rename); 3381 EXPORT_SYMBOL(unlock_rename);
3382 EXPORT_SYMBOL(vfs_create); 3382 EXPORT_SYMBOL(vfs_create);
3383 EXPORT_SYMBOL(vfs_follow_link); 3383 EXPORT_SYMBOL(vfs_follow_link);
3384 EXPORT_SYMBOL(vfs_link); 3384 EXPORT_SYMBOL(vfs_link);
3385 EXPORT_SYMBOL(vfs_mkdir); 3385 EXPORT_SYMBOL(vfs_mkdir);
3386 EXPORT_SYMBOL(vfs_mknod); 3386 EXPORT_SYMBOL(vfs_mknod);
3387 EXPORT_SYMBOL(generic_permission); 3387 EXPORT_SYMBOL(generic_permission);
3388 EXPORT_SYMBOL(vfs_readlink); 3388 EXPORT_SYMBOL(vfs_readlink);
3389 EXPORT_SYMBOL(vfs_rename); 3389 EXPORT_SYMBOL(vfs_rename);
3390 EXPORT_SYMBOL(vfs_rmdir); 3390 EXPORT_SYMBOL(vfs_rmdir);
3391 EXPORT_SYMBOL(vfs_symlink); 3391 EXPORT_SYMBOL(vfs_symlink);
3392 EXPORT_SYMBOL(vfs_unlink); 3392 EXPORT_SYMBOL(vfs_unlink);
3393 EXPORT_SYMBOL(dentry_unhash); 3393 EXPORT_SYMBOL(dentry_unhash);
3394 EXPORT_SYMBOL(generic_readlink); 3394 EXPORT_SYMBOL(generic_readlink);
3395 3395