// SPDX-License-Identifier: GPL-2.0-or-later

  /* Provide a way to create a superblock configuration context within the kernel
   * that allows a superblock to be set up prior to mounting.
   *
   * Copyright (C) 2017 Red Hat, Inc. All Rights Reserved.
   * Written by David Howells (dhowells@redhat.com)

   */
  
  #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

  #include <linux/module.h>

  #include <linux/fs_context.h>

  #include <linux/fs_parser.h>

  #include <linux/fs.h>
  #include <linux/mount.h>
  #include <linux/nsproxy.h>
  #include <linux/slab.h>
  #include <linux/magic.h>
  #include <linux/security.h>
  #include <linux/mnt_namespace.h>
  #include <linux/pid_namespace.h>
  #include <linux/user_namespace.h>
  #include <net/net_namespace.h>

  #include <asm/sections.h>

  #include "mount.h"
  #include "internal.h"

  enum legacy_fs_param {
  	LEGACY_FS_UNSET_PARAMS,
  	LEGACY_FS_MONOLITHIC_PARAMS,
  	LEGACY_FS_INDIVIDUAL_PARAMS,
  };

  struct legacy_fs_context {
  	char			*legacy_data;	/* Data page for legacy filesystems */
  	size_t			data_size;

  	enum legacy_fs_param	param_type;

  };
  
  static int legacy_init_fs_context(struct fs_context *fc);

  static const struct constant_table common_set_sb_flag[] = {
  	{ "dirsync",	SB_DIRSYNC },
  	{ "lazytime",	SB_LAZYTIME },
  	{ "mand",	SB_MANDLOCK },
  	{ "posixacl",	SB_POSIXACL },
  	{ "ro",		SB_RDONLY },
  	{ "sync",	SB_SYNCHRONOUS },
  };
  
  static const struct constant_table common_clear_sb_flag[] = {
  	{ "async",	SB_SYNCHRONOUS },
  	{ "nolazytime",	SB_LAZYTIME },
  	{ "nomand",	SB_MANDLOCK },
  	{ "rw",		SB_RDONLY },
  	{ "silent",	SB_SILENT },
  };
  
  static const char *const forbidden_sb_flag[] = {
  	"bind",
  	"dev",
  	"exec",
  	"move",
  	"noatime",
  	"nodev",
  	"nodiratime",
  	"noexec",
  	"norelatime",
  	"nostrictatime",
  	"nosuid",
  	"private",
  	"rec",
  	"relatime",
  	"remount",
  	"shared",
  	"slave",
  	"strictatime",
  	"suid",
  	"unbindable",
  };
  
  /*
   * Check for a common mount option that manipulates s_flags.
   */
  static int vfs_parse_sb_flag(struct fs_context *fc, const char *key)
  {
  	unsigned int token;
  	unsigned int i;
  
  	for (i = 0; i < ARRAY_SIZE(forbidden_sb_flag); i++)
  		if (strcmp(key, forbidden_sb_flag[i]) == 0)
  			return -EINVAL;
  
  	token = lookup_constant(common_set_sb_flag, key, 0);
  	if (token) {
  		fc->sb_flags |= token;
  		fc->sb_flags_mask |= token;
  		return 0;
  	}
  
  	token = lookup_constant(common_clear_sb_flag, key, 0);
  	if (token) {
  		fc->sb_flags &= ~token;
  		fc->sb_flags_mask |= token;
  		return 0;
  	}
  
  	return -ENOPARAM;
  }
  
  /**
   * vfs_parse_fs_param - Add a single parameter to a superblock config
   * @fc: The filesystem context to modify
   * @param: The parameter
   *
   * A single mount option in string form is applied to the filesystem context
   * being set up.  Certain standard options (for example "ro") are translated
   * into flag bits without going to the filesystem.  The active security module
   * is allowed to observe and poach options.  Any other options are passed over
   * to the filesystem to parse.
   *
   * This may be called multiple times for a context.
   *
   * Returns 0 on success and a negative error code on failure.  In the event of
   * failure, supplementary error information may have been set.
   */
  int vfs_parse_fs_param(struct fs_context *fc, struct fs_parameter *param)
  {
  	int ret;
  
  	if (!param->key)
  		return invalf(fc, "Unnamed parameter
  ");
  
  	ret = vfs_parse_sb_flag(fc, param->key);
  	if (ret != -ENOPARAM)
  		return ret;
  
  	ret = security_fs_context_parse_param(fc, param);
  	if (ret != -ENOPARAM)
  		/* Param belongs to the LSM or is disallowed by the LSM; so
  		 * don't pass to the FS.
  		 */
  		return ret;
  
  	if (fc->ops->parse_param) {
  		ret = fc->ops->parse_param(fc, param);
  		if (ret != -ENOPARAM)
  			return ret;
  	}
  
  	/* If the filesystem doesn't take any arguments, give it the
  	 * default handling of source.
  	 */
  	if (strcmp(param->key, "source") == 0) {
  		if (param->type != fs_value_is_string)
  			return invalf(fc, "VFS: Non-string source");
  		if (fc->source)
  			return invalf(fc, "VFS: Multiple sources");
  		fc->source = param->string;
  		param->string = NULL;
  		return 0;
  	}
  
  	return invalf(fc, "%s: Unknown parameter '%s'",
  		      fc->fs_type->name, param->key);
  }
  EXPORT_SYMBOL(vfs_parse_fs_param);
  
  /**
   * vfs_parse_fs_string - Convenience function to just parse a string.
   */
  int vfs_parse_fs_string(struct fs_context *fc, const char *key,
  			const char *value, size_t v_size)
  {
  	int ret;
  
  	struct fs_parameter param = {
  		.key	= key,
  		.type	= fs_value_is_string,
  		.size	= v_size,
  	};
  
  	if (v_size > 0) {
  		param.string = kmemdup_nul(value, v_size, GFP_KERNEL);
  		if (!param.string)
  			return -ENOMEM;
  	}
  
  	ret = vfs_parse_fs_param(fc, &param);
  	kfree(param.string);
  	return ret;
  }
  EXPORT_SYMBOL(vfs_parse_fs_string);
  
  /**
   * generic_parse_monolithic - Parse key[=val][,key[=val]]* mount data
   * @ctx: The superblock configuration to fill in.
   * @data: The data to parse
   *
   * Parse a blob of data that's in key[=val][,key[=val]]* form.  This can be
   * called from the ->monolithic_mount_data() fs_context operation.
   *
   * Returns 0 on success or the error returned by the ->parse_option() fs_context
   * operation on failure.
   */
  int generic_parse_monolithic(struct fs_context *fc, void *data)
  {
  	char *options = data, *key;
  	int ret = 0;
  
  	if (!options)
  		return 0;
  
  	ret = security_sb_eat_lsm_opts(options, &fc->security);
  	if (ret)
  		return ret;
  
  	while ((key = strsep(&options, ",")) != NULL) {
  		if (*key) {
  			size_t v_len = 0;
  			char *value = strchr(key, '=');
  
  			if (value) {
  				if (value == key)
  					continue;
  				*value++ = 0;
  				v_len = strlen(value);
  			}
  			ret = vfs_parse_fs_string(fc, key, value, v_len);
  			if (ret < 0)
  				break;
  		}
  	}
  
  	return ret;
  }
  EXPORT_SYMBOL(generic_parse_monolithic);

  /**
   * alloc_fs_context - Create a filesystem context.
   * @fs_type: The filesystem type.
   * @reference: The dentry from which this one derives (or NULL)
   * @sb_flags: Filesystem/superblock flags (SB_*)
   * @sb_flags_mask: Applicable members of @sb_flags
   * @purpose: The purpose that this configuration shall be used for.
   *
   * Open a filesystem and create a mount context.  The mount context is
   * initialised with the supplied flags and, if a submount/automount from
   * another superblock (referred to by @reference) is supplied, may have
   * parameters such as namespaces copied across from that superblock.
   */
  static struct fs_context *alloc_fs_context(struct file_system_type *fs_type,
  				      struct dentry *reference,
  				      unsigned int sb_flags,
  				      unsigned int sb_flags_mask,
  				      enum fs_context_purpose purpose)
  {

  	int (*init_fs_context)(struct fs_context *);

  	struct fs_context *fc;
  	int ret = -ENOMEM;
  
  	fc = kzalloc(sizeof(struct fs_context), GFP_KERNEL);
  	if (!fc)
  		return ERR_PTR(-ENOMEM);
  
  	fc->purpose	= purpose;
  	fc->sb_flags	= sb_flags;
  	fc->sb_flags_mask = sb_flags_mask;
  	fc->fs_type	= get_filesystem(fs_type);
  	fc->cred	= get_current_cred();
  	fc->net_ns	= get_net(current->nsproxy->net_ns);

  	mutex_init(&fc->uapi_mutex);

  	switch (purpose) {
  	case FS_CONTEXT_FOR_MOUNT:
  		fc->user_ns = get_user_ns(fc->cred->user_ns);
  		break;

  	case FS_CONTEXT_FOR_SUBMOUNT:
  		fc->user_ns = get_user_ns(reference->d_sb->s_user_ns);
  		break;

  	case FS_CONTEXT_FOR_RECONFIGURE:

  		atomic_inc(&reference->d_sb->s_active);

  		fc->user_ns = get_user_ns(reference->d_sb->s_user_ns);

  		fc->root = dget(reference);
  		break;

  	}

  	/* TODO: Make all filesystems support this unconditionally */
  	init_fs_context = fc->fs_type->init_fs_context;
  	if (!init_fs_context)
  		init_fs_context = legacy_init_fs_context;
  
  	ret = init_fs_context(fc);

  	if (ret < 0)
  		goto err_fc;
  	fc->need_free = true;
  	return fc;
  
  err_fc:
  	put_fs_context(fc);
  	return ERR_PTR(ret);
  }
  
  struct fs_context *fs_context_for_mount(struct file_system_type *fs_type,
  					unsigned int sb_flags)
  {
  	return alloc_fs_context(fs_type, NULL, sb_flags, 0,
  					FS_CONTEXT_FOR_MOUNT);
  }
  EXPORT_SYMBOL(fs_context_for_mount);

  struct fs_context *fs_context_for_reconfigure(struct dentry *dentry,
  					unsigned int sb_flags,
  					unsigned int sb_flags_mask)
  {
  	return alloc_fs_context(dentry->d_sb->s_type, dentry, sb_flags,
  				sb_flags_mask, FS_CONTEXT_FOR_RECONFIGURE);
  }
  EXPORT_SYMBOL(fs_context_for_reconfigure);

  struct fs_context *fs_context_for_submount(struct file_system_type *type,
  					   struct dentry *reference)
  {
  	return alloc_fs_context(type, reference, 0, 0, FS_CONTEXT_FOR_SUBMOUNT);
  }
  EXPORT_SYMBOL(fs_context_for_submount);

  void fc_drop_locked(struct fs_context *fc)
  {
  	struct super_block *sb = fc->root->d_sb;
  	dput(fc->root);
  	fc->root = NULL;
  	deactivate_locked_super(sb);
  }

  static void legacy_fs_context_free(struct fs_context *fc);

  /**

   * vfs_dup_fc_config: Duplicate a filesystem context.
   * @src_fc: The context to copy.
   */
  struct fs_context *vfs_dup_fs_context(struct fs_context *src_fc)
  {
  	struct fs_context *fc;
  	int ret;
  
  	if (!src_fc->ops->dup)
  		return ERR_PTR(-EOPNOTSUPP);
  
  	fc = kmemdup(src_fc, sizeof(struct fs_context), GFP_KERNEL);
  	if (!fc)
  		return ERR_PTR(-ENOMEM);

  	mutex_init(&fc->uapi_mutex);

  	fc->fs_private	= NULL;
  	fc->s_fs_info	= NULL;
  	fc->source	= NULL;
  	fc->security	= NULL;
  	get_filesystem(fc->fs_type);
  	get_net(fc->net_ns);
  	get_user_ns(fc->user_ns);
  	get_cred(fc->cred);

  	if (fc->log)
  		refcount_inc(&fc->log->usage);

  
  	/* Can't call put until we've called ->dup */
  	ret = fc->ops->dup(fc, src_fc);
  	if (ret < 0)
  		goto err_fc;
  
  	ret = security_fs_context_dup(fc, src_fc);
  	if (ret < 0)
  		goto err_fc;
  	return fc;
  
  err_fc:
  	put_fs_context(fc);
  	return ERR_PTR(ret);
  }
  EXPORT_SYMBOL(vfs_dup_fs_context);

  /**
   * logfc - Log a message to a filesystem context
   * @fc: The filesystem context to log to.
   * @fmt: The format of the buffer.
   */
  void logfc(struct fs_context *fc, const char *fmt, ...)
  {

  	static const char store_failure[] = "OOM: Can't store error string";
  	struct fc_log *log = fc ? fc->log : NULL;
  	const char *p;

  	va_list va;

  	char *q;
  	u8 freeable;

  
  	va_start(va, fmt);

  	if (!strchr(fmt, '%')) {
  		p = fmt;
  		goto unformatted_string;

  	}

  	if (strcmp(fmt, "%s") == 0) {
  		p = va_arg(va, const char *);
  		goto unformatted_string;
  	}
  
  	q = kvasprintf(GFP_KERNEL, fmt, va);
  copied_string:
  	if (!q)
  		goto store_failure;
  	freeable = 1;
  	goto store_string;
  
  unformatted_string:
  	if ((unsigned long)p >= (unsigned long)__start_rodata &&
  	    (unsigned long)p <  (unsigned long)__end_rodata)
  		goto const_string;
  	if (log && within_module_core((unsigned long)p, log->owner))
  		goto const_string;
  	q = kstrdup(p, GFP_KERNEL);
  	goto copied_string;
  
  store_failure:
  	p = store_failure;
  const_string:
  	q = (char *)p;
  	freeable = 0;
  store_string:
  	if (!log) {
  		switch (fmt[0]) {
  		case 'w':
  			printk(KERN_WARNING "%s
  ", q + 2);
  			break;
  		case 'e':
  			printk(KERN_ERR "%s
  ", q + 2);
  			break;
  		default:
  			printk(KERN_NOTICE "%s
  ", q + 2);
  			break;
  		}
  		if (freeable)
  			kfree(q);
  	} else {
  		unsigned int logsize = ARRAY_SIZE(log->buffer);
  		u8 index;
  
  		index = log->head & (logsize - 1);
  		BUILD_BUG_ON(sizeof(log->head) != sizeof(u8) ||
  			     sizeof(log->tail) != sizeof(u8));
  		if ((u8)(log->head - log->tail) == logsize) {
  			/* The buffer is full, discard the oldest message */
  			if (log->need_free & (1 << index))
  				kfree(log->buffer[index]);
  			log->tail++;
  		}

  		log->buffer[index] = q;
  		log->need_free &= ~(1 << index);
  		log->need_free |= freeable << index;
  		log->head++;
  	}

  	va_end(va);
  }
  EXPORT_SYMBOL(logfc);

  
  /*
   * Free a logging structure.
   */
  static void put_fc_log(struct fs_context *fc)
  {
  	struct fc_log *log = fc->log;
  	int i;
  
  	if (log) {
  		if (refcount_dec_and_test(&log->usage)) {
  			fc->log = NULL;
  			for (i = 0; i <= 7; i++)
  				if (log->need_free & (1 << i))
  					kfree(log->buffer[i]);
  			kfree(log);
  		}
  	}
  }

  /**

   * put_fs_context - Dispose of a superblock configuration context.
   * @fc: The context to dispose of.
   */
  void put_fs_context(struct fs_context *fc)
  {
  	struct super_block *sb;
  
  	if (fc->root) {
  		sb = fc->root->d_sb;
  		dput(fc->root);
  		fc->root = NULL;
  		deactivate_super(sb);
  	}

  	if (fc->need_free && fc->ops && fc->ops->free)
  		fc->ops->free(fc);

  
  	security_free_mnt_opts(&fc->security);

  	put_net(fc->net_ns);

  	put_user_ns(fc->user_ns);
  	put_cred(fc->cred);

  	put_fc_log(fc);

  	put_filesystem(fc->fs_type);
  	kfree(fc->source);
  	kfree(fc);
  }
  EXPORT_SYMBOL(put_fs_context);
  
  /*
   * Free the config for a filesystem that doesn't support fs_context.
   */
  static void legacy_fs_context_free(struct fs_context *fc)
  {

  	struct legacy_fs_context *ctx = fc->fs_private;
  
  	if (ctx) {
  		if (ctx->param_type == LEGACY_FS_INDIVIDUAL_PARAMS)
  			kfree(ctx->legacy_data);
  		kfree(ctx);
  	}
  }
  
  /*

   * Duplicate a legacy config.
   */
  static int legacy_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc)
  {
  	struct legacy_fs_context *ctx;
  	struct legacy_fs_context *src_ctx = src_fc->fs_private;
  
  	ctx = kmemdup(src_ctx, sizeof(*src_ctx), GFP_KERNEL);
  	if (!ctx)
  		return -ENOMEM;
  
  	if (ctx->param_type == LEGACY_FS_INDIVIDUAL_PARAMS) {
  		ctx->legacy_data = kmemdup(src_ctx->legacy_data,
  					   src_ctx->data_size, GFP_KERNEL);
  		if (!ctx->legacy_data) {
  			kfree(ctx);
  			return -ENOMEM;
  		}
  	}
  
  	fc->fs_private = ctx;
  	return 0;
  }
  
  /*

   * Add a parameter to a legacy config.  We build up a comma-separated list of
   * options.
   */
  static int legacy_parse_param(struct fs_context *fc, struct fs_parameter *param)
  {
  	struct legacy_fs_context *ctx = fc->fs_private;
  	unsigned int size = ctx->data_size;
  	size_t len = 0;
  
  	if (strcmp(param->key, "source") == 0) {
  		if (param->type != fs_value_is_string)
  			return invalf(fc, "VFS: Legacy: Non-string source");
  		if (fc->source)
  			return invalf(fc, "VFS: Legacy: Multiple sources");
  		fc->source = param->string;
  		param->string = NULL;
  		return 0;
  	}

  	if (ctx->param_type == LEGACY_FS_MONOLITHIC_PARAMS)
  		return invalf(fc, "VFS: Legacy: Can't mix monolithic and individual options");
  
  	switch (param->type) {
  	case fs_value_is_string:
  		len = 1 + param->size;
  		/* Fall through */
  	case fs_value_is_flag:
  		len += strlen(param->key);
  		break;
  	default:
  		return invalf(fc, "VFS: Legacy: Parameter type for '%s' not supported",
  			      param->key);
  	}
  
  	if (len > PAGE_SIZE - 2 - size)
  		return invalf(fc, "VFS: Legacy: Cumulative options too large");
  	if (strchr(param->key, ',') ||
  	    (param->type == fs_value_is_string &&
  	     memchr(param->string, ',', param->size)))
  		return invalf(fc, "VFS: Legacy: Option '%s' contained comma",
  			      param->key);
  	if (!ctx->legacy_data) {
  		ctx->legacy_data = kmalloc(PAGE_SIZE, GFP_KERNEL);
  		if (!ctx->legacy_data)
  			return -ENOMEM;
  	}
  
  	ctx->legacy_data[size++] = ',';
  	len = strlen(param->key);
  	memcpy(ctx->legacy_data + size, param->key, len);
  	size += len;
  	if (param->type == fs_value_is_string) {
  		ctx->legacy_data[size++] = '=';
  		memcpy(ctx->legacy_data + size, param->string, param->size);
  		size += param->size;
  	}
  	ctx->legacy_data[size] = '\0';
  	ctx->data_size = size;
  	ctx->param_type = LEGACY_FS_INDIVIDUAL_PARAMS;
  	return 0;

  }
  
  /*
   * Add monolithic mount data.
   */
  static int legacy_parse_monolithic(struct fs_context *fc, void *data)
  {
  	struct legacy_fs_context *ctx = fc->fs_private;

  
  	if (ctx->param_type != LEGACY_FS_UNSET_PARAMS) {
  		pr_warn("VFS: Can't mix monolithic and individual options
  ");
  		return -EINVAL;
  	}

  	ctx->legacy_data = data;

  	ctx->param_type = LEGACY_FS_MONOLITHIC_PARAMS;

  	if (!ctx->legacy_data)
  		return 0;

  	if (fc->fs_type->fs_flags & FS_BINARY_MOUNTDATA)
  		return 0;
  	return security_sb_eat_lsm_opts(ctx->legacy_data, &fc->security);
  }
  
  /*
   * Get a mountable root with the legacy mount command.
   */

  static int legacy_get_tree(struct fs_context *fc)

  {
  	struct legacy_fs_context *ctx = fc->fs_private;
  	struct super_block *sb;
  	struct dentry *root;
  
  	root = fc->fs_type->mount(fc->fs_type, fc->sb_flags,
  				      fc->source, ctx->legacy_data);
  	if (IS_ERR(root))
  		return PTR_ERR(root);
  
  	sb = root->d_sb;
  	BUG_ON(!sb);
  
  	fc->root = root;
  	return 0;
  }
  
  /*

   * Handle remount.
   */

  static int legacy_reconfigure(struct fs_context *fc)

  {
  	struct legacy_fs_context *ctx = fc->fs_private;
  	struct super_block *sb = fc->root->d_sb;
  
  	if (!sb->s_op->remount_fs)
  		return 0;
  
  	return sb->s_op->remount_fs(sb, &fc->sb_flags,
  				    ctx ? ctx->legacy_data : NULL);
  }

  const struct fs_context_operations legacy_fs_context_ops = {
  	.free			= legacy_fs_context_free,

  	.dup			= legacy_fs_context_dup,

  	.parse_param		= legacy_parse_param,

  	.parse_monolithic	= legacy_parse_monolithic,
  	.get_tree		= legacy_get_tree,
  	.reconfigure		= legacy_reconfigure,
  };

  /*

   * Initialise a legacy context for a filesystem that doesn't support
   * fs_context.
   */
  static int legacy_init_fs_context(struct fs_context *fc)
  {
  	fc->fs_private = kzalloc(sizeof(struct legacy_fs_context), GFP_KERNEL);
  	if (!fc->fs_private)
  		return -ENOMEM;

  	fc->ops = &legacy_fs_context_ops;

  	return 0;
  }
  
  int parse_monolithic_mount_data(struct fs_context *fc, void *data)
  {

  	int (*monolithic_mount_data)(struct fs_context *, void *);

  	monolithic_mount_data = fc->ops->parse_monolithic;

  	if (!monolithic_mount_data)
  		monolithic_mount_data = generic_parse_monolithic;

  	return monolithic_mount_data(fc, data);

  }

  
  /*
   * Clean up a context after performing an action on it and put it into a state
   * from where it can be used to reconfigure a superblock.
   *
   * Note that here we do only the parts that can't fail; the rest is in
   * finish_clean_context() below and in between those fs_context is marked
   * FS_CONTEXT_AWAITING_RECONF.  The reason for splitup is that after
   * successful mount or remount we need to report success to userland.
   * Trying to do full reinit (for the sake of possible subsequent remount)
   * and failing to allocate memory would've put us into a nasty situation.
   * So here we only discard the old state and reinitialization is left
   * until we actually try to reconfigure.
   */
  void vfs_clean_context(struct fs_context *fc)
  {
  	if (fc->need_free && fc->ops && fc->ops->free)
  		fc->ops->free(fc);
  	fc->need_free = false;
  	fc->fs_private = NULL;
  	fc->s_fs_info = NULL;
  	fc->sb_flags = 0;
  	security_free_mnt_opts(&fc->security);

  	kfree(fc->source);
  	fc->source = NULL;
  
  	fc->purpose = FS_CONTEXT_FOR_RECONFIGURE;
  	fc->phase = FS_CONTEXT_AWAITING_RECONF;
  }
  
  int finish_clean_context(struct fs_context *fc)
  {
  	int error;
  
  	if (fc->phase != FS_CONTEXT_AWAITING_RECONF)
  		return 0;
  
  	if (fc->fs_type->init_fs_context)
  		error = fc->fs_type->init_fs_context(fc);
  	else
  		error = legacy_init_fs_context(fc);
  	if (unlikely(error)) {
  		fc->phase = FS_CONTEXT_FAILED;
  		return error;
  	}
  	fc->need_free = true;
  	fc->phase = FS_CONTEXT_RECONF_PARAMS;
  	return 0;
  }