Back to home page

LXR

 
 

    


0001 /*
0002  *  linux/fs/namei.c
0003  *
0004  *  Copyright (C) 1991, 1992  Linus Torvalds
0005  */
0006 
0007 /*
0008  * Some corrections by tytso.
0009  */
0010 
0011 /* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname
0012  * lookup logic.
0013  */
0014 /* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture.
0015  */
0016 
0017 #include <linux/init.h>
0018 #include <linux/export.h>
0019 #include <linux/kernel.h>
0020 #include <linux/slab.h>
0021 #include <linux/fs.h>
0022 #include <linux/namei.h>
0023 #include <linux/pagemap.h>
0024 #include <linux/fsnotify.h>
0025 #include <linux/personality.h>
0026 #include <linux/security.h>
0027 #include <linux/ima.h>
0028 #include <linux/syscalls.h>
0029 #include <linux/mount.h>
0030 #include <linux/audit.h>
0031 #include <linux/capability.h>
0032 #include <linux/file.h>
0033 #include <linux/fcntl.h>
0034 #include <linux/device_cgroup.h>
0035 #include <linux/fs_struct.h>
0036 #include <linux/posix_acl.h>
0037 #include <linux/hash.h>
0038 #include <linux/bitops.h>
0039 #include <linux/init_task.h>
0040 #include <linux/uaccess.h>
0041 
0042 #include "internal.h"
0043 #include "mount.h"
0044 
0045 /* [Feb-1997 T. Schoebel-Theuer]
0046  * Fundamental changes in the pathname lookup mechanisms (namei)
0047  * were necessary because of omirr.  The reason is that omirr needs
0048  * to know the _real_ pathname, not the user-supplied one, in case
0049  * of symlinks (and also when transname replacements occur).
0050  *
0051  * The new code replaces the old recursive symlink resolution with
0052  * an iterative one (in case of non-nested symlink chains).  It does
0053  * this with calls to <fs>_follow_link().
0054  * As a side effect, dir_namei(), _namei() and follow_link() are now 
0055  * replaced with a single function lookup_dentry() that can handle all 
0056  * the special cases of the former code.
0057  *
0058  * With the new dcache, the pathname is stored at each inode, at least as
0059  * long as the refcount of the inode is positive.  As a side effect, the
0060  * size of the dcache depends on the inode cache and thus is dynamic.
0061  *
0062  * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink
0063  * resolution to correspond with current state of the code.
0064  *
0065  * Note that the symlink resolution is not *completely* iterative.
0066  * There is still a significant amount of tail- and mid- recursion in
0067  * the algorithm.  Also, note that <fs>_readlink() is not used in
0068  * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink()
0069  * may return different results than <fs>_follow_link().  Many virtual
0070  * filesystems (including /proc) exhibit this behavior.
0071  */
0072 
0073 /* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation:
0074  * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL
0075  * and the name already exists in form of a symlink, try to create the new
0076  * name indicated by the symlink. The old code always complained that the
0077  * name already exists, due to not following the symlink even if its target
0078  * is nonexistent.  The new semantics affects also mknod() and link() when
0079  * the name is a symlink pointing to a non-existent name.
0080  *
0081  * I don't know which semantics is the right one, since I have no access
0082  * to standards. But I found by trial that HP-UX 9.0 has the full "new"
0083  * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the
0084  * "old" one. Personally, I think the new semantics is much more logical.
0085  * Note that "ln old new" where "new" is a symlink pointing to a non-existing
0086  * file does succeed in both HP-UX and SunOs, but not in Solaris
0087  * and in the old Linux semantics.
0088  */
0089 
0090 /* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink
0091  * semantics.  See the comments in "open_namei" and "do_link" below.
0092  *
0093  * [10-Sep-98 Alan Modra] Another symlink change.
0094  */
0095 
0096 /* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks:
0097  *  inside the path - always follow.
0098  *  in the last component in creation/removal/renaming - never follow.
0099  *  if LOOKUP_FOLLOW passed - follow.
0100  *  if the pathname has trailing slashes - follow.
0101  *  otherwise - don't follow.
0102  * (applied in that order).
0103  *
0104  * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT
0105  * restored for 2.4. This is the last surviving part of old 4.2BSD bug.
0106  * During the 2.4 we need to fix the userland stuff depending on it -
0107  * hopefully we will be able to get rid of that wart in 2.5. So far only
0108  * XEmacs seems to be relying on it...
0109  */
0110 /*
0111  * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland)
0112  * implemented.  Let's see if raised priority of ->s_vfs_rename_mutex gives
0113  * any extra contention...
0114  */
0115 
0116 /* In order to reduce some races, while at the same time doing additional
0117  * checking and hopefully speeding things up, we copy filenames to the
0118  * kernel data space before using them..
0119  *
0120  * POSIX.1 2.4: an empty pathname is invalid (ENOENT).
0121  * PATH_MAX includes the nul terminator --RR.
0122  */
0123 
0124 #define EMBEDDED_NAME_MAX   (PATH_MAX - offsetof(struct filename, iname))
0125 
0126 struct filename *
0127 getname_flags(const char __user *filename, int flags, int *empty)
0128 {
0129     struct filename *result;
0130     char *kname;
0131     int len;
0132 
0133     result = audit_reusename(filename);
0134     if (result)
0135         return result;
0136 
0137     result = __getname();
0138     if (unlikely(!result))
0139         return ERR_PTR(-ENOMEM);
0140 
0141     /*
0142      * First, try to embed the struct filename inside the names_cache
0143      * allocation
0144      */
0145     kname = (char *)result->iname;
0146     result->name = kname;
0147 
0148     len = strncpy_from_user(kname, filename, EMBEDDED_NAME_MAX);
0149     if (unlikely(len < 0)) {
0150         __putname(result);
0151         return ERR_PTR(len);
0152     }
0153 
0154     /*
0155      * Uh-oh. We have a name that's approaching PATH_MAX. Allocate a
0156      * separate struct filename so we can dedicate the entire
0157      * names_cache allocation for the pathname, and re-do the copy from
0158      * userland.
0159      */
0160     if (unlikely(len == EMBEDDED_NAME_MAX)) {
0161         const size_t size = offsetof(struct filename, iname[1]);
0162         kname = (char *)result;
0163 
0164         /*
0165          * size is chosen that way we to guarantee that
0166          * result->iname[0] is within the same object and that
0167          * kname can't be equal to result->iname, no matter what.
0168          */
0169         result = kzalloc(size, GFP_KERNEL);
0170         if (unlikely(!result)) {
0171             __putname(kname);
0172             return ERR_PTR(-ENOMEM);
0173         }
0174         result->name = kname;
0175         len = strncpy_from_user(kname, filename, PATH_MAX);
0176         if (unlikely(len < 0)) {
0177             __putname(kname);
0178             kfree(result);
0179             return ERR_PTR(len);
0180         }
0181         if (unlikely(len == PATH_MAX)) {
0182             __putname(kname);
0183             kfree(result);
0184             return ERR_PTR(-ENAMETOOLONG);
0185         }
0186     }
0187 
0188     result->refcnt = 1;
0189     /* The empty path is special. */
0190     if (unlikely(!len)) {
0191         if (empty)
0192             *empty = 1;
0193         if (!(flags & LOOKUP_EMPTY)) {
0194             putname(result);
0195             return ERR_PTR(-ENOENT);
0196         }
0197     }
0198 
0199     result->uptr = filename;
0200     result->aname = NULL;
0201     audit_getname(result);
0202     return result;
0203 }
0204 
0205 struct filename *
0206 getname(const char __user * filename)
0207 {
0208     return getname_flags(filename, 0, NULL);
0209 }
0210 
0211 struct filename *
0212 getname_kernel(const char * filename)
0213 {
0214     struct filename *result;
0215     int len = strlen(filename) + 1;
0216 
0217     result = __getname();
0218     if (unlikely(!result))
0219         return ERR_PTR(-ENOMEM);
0220 
0221     if (len <= EMBEDDED_NAME_MAX) {
0222         result->name = (char *)result->iname;
0223     } else if (len <= PATH_MAX) {
0224         struct filename *tmp;
0225 
0226         tmp = kmalloc(sizeof(*tmp), GFP_KERNEL);
0227         if (unlikely(!tmp)) {
0228             __putname(result);
0229             return ERR_PTR(-ENOMEM);
0230         }
0231         tmp->name = (char *)result;
0232         result = tmp;
0233     } else {
0234         __putname(result);
0235         return ERR_PTR(-ENAMETOOLONG);
0236     }
0237     memcpy((char *)result->name, filename, len);
0238     result->uptr = NULL;
0239     result->aname = NULL;
0240     result->refcnt = 1;
0241     audit_getname(result);
0242 
0243     return result;
0244 }
0245 
0246 void putname(struct filename *name)
0247 {
0248     BUG_ON(name->refcnt <= 0);
0249 
0250     if (--name->refcnt > 0)
0251         return;
0252 
0253     if (name->name != name->iname) {
0254         __putname(name->name);
0255         kfree(name);
0256     } else
0257         __putname(name);
0258 }
0259 
0260 static int check_acl(struct inode *inode, int mask)
0261 {
0262 #ifdef CONFIG_FS_POSIX_ACL
0263     struct posix_acl *acl;
0264 
0265     if (mask & MAY_NOT_BLOCK) {
0266         acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS);
0267             if (!acl)
0268                     return -EAGAIN;
0269         /* no ->get_acl() calls in RCU mode... */
0270         if (is_uncached_acl(acl))
0271             return -ECHILD;
0272             return posix_acl_permission(inode, acl, mask & ~MAY_NOT_BLOCK);
0273     }
0274 
0275     acl = get_acl(inode, ACL_TYPE_ACCESS);
0276     if (IS_ERR(acl))
0277         return PTR_ERR(acl);
0278     if (acl) {
0279             int error = posix_acl_permission(inode, acl, mask);
0280             posix_acl_release(acl);
0281             return error;
0282     }
0283 #endif
0284 
0285     return -EAGAIN;
0286 }
0287 
0288 /*
0289  * This does the basic permission checking
0290  */
0291 static int acl_permission_check(struct inode *inode, int mask)
0292 {
0293     unsigned int mode = inode->i_mode;
0294 
0295     if (likely(uid_eq(current_fsuid(), inode->i_uid)))
0296         mode >>= 6;
0297     else {
0298         if (IS_POSIXACL(inode) && (mode & S_IRWXG)) {
0299             int error = check_acl(inode, mask);
0300             if (error != -EAGAIN)
0301                 return error;
0302         }
0303 
0304         if (in_group_p(inode->i_gid))
0305             mode >>= 3;
0306     }
0307 
0308     /*
0309      * If the DACs are ok we don't need any capability check.
0310      */
0311     if ((mask & ~mode & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0)
0312         return 0;
0313     return -EACCES;
0314 }
0315 
0316 /**
0317  * generic_permission -  check for access rights on a Posix-like filesystem
0318  * @inode:  inode to check access rights for
0319  * @mask:   right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC, ...)
0320  *
0321  * Used to check for read/write/execute permissions on a file.
0322  * We use "fsuid" for this, letting us set arbitrary permissions
0323  * for filesystem access without changing the "normal" uids which
0324  * are used for other things.
0325  *
0326  * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk
0327  * request cannot be satisfied (eg. requires blocking or too much complexity).
0328  * It would then be called again in ref-walk mode.
0329  */
0330 int generic_permission(struct inode *inode, int mask)
0331 {
0332     int ret;
0333 
0334     /*
0335      * Do the basic permission checks.
0336      */
0337     ret = acl_permission_check(inode, mask);
0338     if (ret != -EACCES)
0339         return ret;
0340 
0341     if (S_ISDIR(inode->i_mode)) {
0342         /* DACs are overridable for directories */
0343         if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
0344             return 0;
0345         if (!(mask & MAY_WRITE))
0346             if (capable_wrt_inode_uidgid(inode,
0347                              CAP_DAC_READ_SEARCH))
0348                 return 0;
0349         return -EACCES;
0350     }
0351     /*
0352      * Read/write DACs are always overridable.
0353      * Executable DACs are overridable when there is
0354      * at least one exec bit set.
0355      */
0356     if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
0357         if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
0358             return 0;
0359 
0360     /*
0361      * Searching includes executable on directories, else just read.
0362      */
0363     mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
0364     if (mask == MAY_READ)
0365         if (capable_wrt_inode_uidgid(inode, CAP_DAC_READ_SEARCH))
0366             return 0;
0367 
0368     return -EACCES;
0369 }
0370 EXPORT_SYMBOL(generic_permission);
0371 
0372 /*
0373  * We _really_ want to just do "generic_permission()" without
0374  * even looking at the inode->i_op values. So we keep a cache
0375  * flag in inode->i_opflags, that says "this has not special
0376  * permission function, use the fast case".
0377  */
0378 static inline int do_inode_permission(struct inode *inode, int mask)
0379 {
0380     if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) {
0381         if (likely(inode->i_op->permission))
0382             return inode->i_op->permission(inode, mask);
0383 
0384         /* This gets set once for the inode lifetime */
0385         spin_lock(&inode->i_lock);
0386         inode->i_opflags |= IOP_FASTPERM;
0387         spin_unlock(&inode->i_lock);
0388     }
0389     return generic_permission(inode, mask);
0390 }
0391 
0392 /**
0393  * __inode_permission - Check for access rights to a given inode
0394  * @inode: Inode to check permission on
0395  * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
0396  *
0397  * Check for read/write/execute permissions on an inode.
0398  *
0399  * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask.
0400  *
0401  * This does not check for a read-only file system.  You probably want
0402  * inode_permission().
0403  */
0404 int __inode_permission(struct inode *inode, int mask)
0405 {
0406     int retval;
0407 
0408     if (unlikely(mask & MAY_WRITE)) {
0409         /*
0410          * Nobody gets write access to an immutable file.
0411          */
0412         if (IS_IMMUTABLE(inode))
0413             return -EPERM;
0414 
0415         /*
0416          * Updating mtime will likely cause i_uid and i_gid to be
0417          * written back improperly if their true value is unknown
0418          * to the vfs.
0419          */
0420         if (HAS_UNMAPPED_ID(inode))
0421             return -EACCES;
0422     }
0423 
0424     retval = do_inode_permission(inode, mask);
0425     if (retval)
0426         return retval;
0427 
0428     retval = devcgroup_inode_permission(inode, mask);
0429     if (retval)
0430         return retval;
0431 
0432     return security_inode_permission(inode, mask);
0433 }
0434 EXPORT_SYMBOL(__inode_permission);
0435 
0436 /**
0437  * sb_permission - Check superblock-level permissions
0438  * @sb: Superblock of inode to check permission on
0439  * @inode: Inode to check permission on
0440  * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
0441  *
0442  * Separate out file-system wide checks from inode-specific permission checks.
0443  */
0444 static int sb_permission(struct super_block *sb, struct inode *inode, int mask)
0445 {
0446     if (unlikely(mask & MAY_WRITE)) {
0447         umode_t mode = inode->i_mode;
0448 
0449         /* Nobody gets write access to a read-only fs. */
0450         if ((sb->s_flags & MS_RDONLY) &&
0451             (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
0452             return -EROFS;
0453     }
0454     return 0;
0455 }
0456 
0457 /**
0458  * inode_permission - Check for access rights to a given inode
0459  * @inode: Inode to check permission on
0460  * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
0461  *
0462  * Check for read/write/execute permissions on an inode.  We use fs[ug]id for
0463  * this, letting us set arbitrary permissions for filesystem access without
0464  * changing the "normal" UIDs which are used for other things.
0465  *
0466  * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask.
0467  */
0468 int inode_permission(struct inode *inode, int mask)
0469 {
0470     int retval;
0471 
0472     retval = sb_permission(inode->i_sb, inode, mask);
0473     if (retval)
0474         return retval;
0475     return __inode_permission(inode, mask);
0476 }
0477 EXPORT_SYMBOL(inode_permission);
0478 
0479 /**
0480  * path_get - get a reference to a path
0481  * @path: path to get the reference to
0482  *
0483  * Given a path increment the reference count to the dentry and the vfsmount.
0484  */
0485 void path_get(const struct path *path)
0486 {
0487     mntget(path->mnt);
0488     dget(path->dentry);
0489 }
0490 EXPORT_SYMBOL(path_get);
0491 
0492 /**
0493  * path_put - put a reference to a path
0494  * @path: path to put the reference to
0495  *
0496  * Given a path decrement the reference count to the dentry and the vfsmount.
0497  */
0498 void path_put(const struct path *path)
0499 {
0500     dput(path->dentry);
0501     mntput(path->mnt);
0502 }
0503 EXPORT_SYMBOL(path_put);
0504 
0505 #define EMBEDDED_LEVELS 2
0506 struct nameidata {
0507     struct path path;
0508     struct qstr last;
0509     struct path root;
0510     struct inode    *inode; /* path.dentry.d_inode */
0511     unsigned int    flags;
0512     unsigned    seq, m_seq;
0513     int     last_type;
0514     unsigned    depth;
0515     int     total_link_count;
0516     struct saved {
0517         struct path link;
0518         struct delayed_call done;
0519         const char *name;
0520         unsigned seq;
0521     } *stack, internal[EMBEDDED_LEVELS];
0522     struct filename *name;
0523     struct nameidata *saved;
0524     struct inode    *link_inode;
0525     unsigned    root_seq;
0526     int     dfd;
0527 };
0528 
0529 static void set_nameidata(struct nameidata *p, int dfd, struct filename *name)
0530 {
0531     struct nameidata *old = current->nameidata;
0532     p->stack = p->internal;
0533     p->dfd = dfd;
0534     p->name = name;
0535     p->total_link_count = old ? old->total_link_count : 0;
0536     p->saved = old;
0537     current->nameidata = p;
0538 }
0539 
0540 static void restore_nameidata(void)
0541 {
0542     struct nameidata *now = current->nameidata, *old = now->saved;
0543 
0544     current->nameidata = old;
0545     if (old)
0546         old->total_link_count = now->total_link_count;
0547     if (now->stack != now->internal)
0548         kfree(now->stack);
0549 }
0550 
0551 static int __nd_alloc_stack(struct nameidata *nd)
0552 {
0553     struct saved *p;
0554 
0555     if (nd->flags & LOOKUP_RCU) {
0556         p= kmalloc(MAXSYMLINKS * sizeof(struct saved),
0557                   GFP_ATOMIC);
0558         if (unlikely(!p))
0559             return -ECHILD;
0560     } else {
0561         p= kmalloc(MAXSYMLINKS * sizeof(struct saved),
0562                   GFP_KERNEL);
0563         if (unlikely(!p))
0564             return -ENOMEM;
0565     }
0566     memcpy(p, nd->internal, sizeof(nd->internal));
0567     nd->stack = p;
0568     return 0;
0569 }
0570 
0571 /**
0572  * path_connected - Verify that a path->dentry is below path->mnt.mnt_root
0573  * @path: nameidate to verify
0574  *
0575  * Rename can sometimes move a file or directory outside of a bind
0576  * mount, path_connected allows those cases to be detected.
0577  */
0578 static bool path_connected(const struct path *path)
0579 {
0580     struct vfsmount *mnt = path->mnt;
0581 
0582     /* Only bind mounts can have disconnected paths */
0583     if (mnt->mnt_root == mnt->mnt_sb->s_root)
0584         return true;
0585 
0586     return is_subdir(path->dentry, mnt->mnt_root);
0587 }
0588 
0589 static inline int nd_alloc_stack(struct nameidata *nd)
0590 {
0591     if (likely(nd->depth != EMBEDDED_LEVELS))
0592         return 0;
0593     if (likely(nd->stack != nd->internal))
0594         return 0;
0595     return __nd_alloc_stack(nd);
0596 }
0597 
0598 static void drop_links(struct nameidata *nd)
0599 {
0600     int i = nd->depth;
0601     while (i--) {
0602         struct saved *last = nd->stack + i;
0603         do_delayed_call(&last->done);
0604         clear_delayed_call(&last->done);
0605     }
0606 }
0607 
0608 static void terminate_walk(struct nameidata *nd)
0609 {
0610     drop_links(nd);
0611     if (!(nd->flags & LOOKUP_RCU)) {
0612         int i;
0613         path_put(&nd->path);
0614         for (i = 0; i < nd->depth; i++)
0615             path_put(&nd->stack[i].link);
0616         if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
0617             path_put(&nd->root);
0618             nd->root.mnt = NULL;
0619         }
0620     } else {
0621         nd->flags &= ~LOOKUP_RCU;
0622         if (!(nd->flags & LOOKUP_ROOT))
0623             nd->root.mnt = NULL;
0624         rcu_read_unlock();
0625     }
0626     nd->depth = 0;
0627 }
0628 
0629 /* path_put is needed afterwards regardless of success or failure */
0630 static bool legitimize_path(struct nameidata *nd,
0631                 struct path *path, unsigned seq)
0632 {
0633     int res = __legitimize_mnt(path->mnt, nd->m_seq);
0634     if (unlikely(res)) {
0635         if (res > 0)
0636             path->mnt = NULL;
0637         path->dentry = NULL;
0638         return false;
0639     }
0640     if (unlikely(!lockref_get_not_dead(&path->dentry->d_lockref))) {
0641         path->dentry = NULL;
0642         return false;
0643     }
0644     return !read_seqcount_retry(&path->dentry->d_seq, seq);
0645 }
0646 
0647 static bool legitimize_links(struct nameidata *nd)
0648 {
0649     int i;
0650     for (i = 0; i < nd->depth; i++) {
0651         struct saved *last = nd->stack + i;
0652         if (unlikely(!legitimize_path(nd, &last->link, last->seq))) {
0653             drop_links(nd);
0654             nd->depth = i + 1;
0655             return false;
0656         }
0657     }
0658     return true;
0659 }
0660 
0661 /*
0662  * Path walking has 2 modes, rcu-walk and ref-walk (see
0663  * Documentation/filesystems/path-lookup.txt).  In situations when we can't
0664  * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab
0665  * normal reference counts on dentries and vfsmounts to transition to ref-walk
0666  * mode.  Refcounts are grabbed at the last known good point before rcu-walk
0667  * got stuck, so ref-walk may continue from there. If this is not successful
0668  * (eg. a seqcount has changed), then failure is returned and it's up to caller
0669  * to restart the path walk from the beginning in ref-walk mode.
0670  */
0671 
0672 /**
0673  * unlazy_walk - try to switch to ref-walk mode.
0674  * @nd: nameidata pathwalk data
0675  * @dentry: child of nd->path.dentry or NULL
0676  * @seq: seq number to check dentry against
0677  * Returns: 0 on success, -ECHILD on failure
0678  *
0679  * unlazy_walk attempts to legitimize the current nd->path, nd->root and dentry
0680  * for ref-walk mode.  @dentry must be a path found by a do_lookup call on
0681  * @nd or NULL.  Must be called from rcu-walk context.
0682  * Nothing should touch nameidata between unlazy_walk() failure and
0683  * terminate_walk().
0684  */
0685 static int unlazy_walk(struct nameidata *nd, struct dentry *dentry, unsigned seq)
0686 {
0687     struct dentry *parent = nd->path.dentry;
0688 
0689     BUG_ON(!(nd->flags & LOOKUP_RCU));
0690 
0691     nd->flags &= ~LOOKUP_RCU;
0692     if (unlikely(!legitimize_links(nd)))
0693         goto out2;
0694     if (unlikely(!legitimize_mnt(nd->path.mnt, nd->m_seq)))
0695         goto out2;
0696     if (unlikely(!lockref_get_not_dead(&parent->d_lockref)))
0697         goto out1;
0698 
0699     /*
0700      * For a negative lookup, the lookup sequence point is the parents
0701      * sequence point, and it only needs to revalidate the parent dentry.
0702      *
0703      * For a positive lookup, we need to move both the parent and the
0704      * dentry from the RCU domain to be properly refcounted. And the
0705      * sequence number in the dentry validates *both* dentry counters,
0706      * since we checked the sequence number of the parent after we got
0707      * the child sequence number. So we know the parent must still
0708      * be valid if the child sequence number is still valid.
0709      */
0710     if (!dentry) {
0711         if (read_seqcount_retry(&parent->d_seq, nd->seq))
0712             goto out;
0713         BUG_ON(nd->inode != parent->d_inode);
0714     } else {
0715         if (!lockref_get_not_dead(&dentry->d_lockref))
0716             goto out;
0717         if (read_seqcount_retry(&dentry->d_seq, seq))
0718             goto drop_dentry;
0719     }
0720 
0721     /*
0722      * Sequence counts matched. Now make sure that the root is
0723      * still valid and get it if required.
0724      */
0725     if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
0726         if (unlikely(!legitimize_path(nd, &nd->root, nd->root_seq))) {
0727             rcu_read_unlock();
0728             dput(dentry);
0729             return -ECHILD;
0730         }
0731     }
0732 
0733     rcu_read_unlock();
0734     return 0;
0735 
0736 drop_dentry:
0737     rcu_read_unlock();
0738     dput(dentry);
0739     goto drop_root_mnt;
0740 out2:
0741     nd->path.mnt = NULL;
0742 out1:
0743     nd->path.dentry = NULL;
0744 out:
0745     rcu_read_unlock();
0746 drop_root_mnt:
0747     if (!(nd->flags & LOOKUP_ROOT))
0748         nd->root.mnt = NULL;
0749     return -ECHILD;
0750 }
0751 
0752 static int unlazy_link(struct nameidata *nd, struct path *link, unsigned seq)
0753 {
0754     if (unlikely(!legitimize_path(nd, link, seq))) {
0755         drop_links(nd);
0756         nd->depth = 0;
0757         nd->flags &= ~LOOKUP_RCU;
0758         nd->path.mnt = NULL;
0759         nd->path.dentry = NULL;
0760         if (!(nd->flags & LOOKUP_ROOT))
0761             nd->root.mnt = NULL;
0762         rcu_read_unlock();
0763     } else if (likely(unlazy_walk(nd, NULL, 0)) == 0) {
0764         return 0;
0765     }
0766     path_put(link);
0767     return -ECHILD;
0768 }
0769 
0770 static inline int d_revalidate(struct dentry *dentry, unsigned int flags)
0771 {
0772     return dentry->d_op->d_revalidate(dentry, flags);
0773 }
0774 
0775 /**
0776  * complete_walk - successful completion of path walk
0777  * @nd:  pointer nameidata
0778  *
0779  * If we had been in RCU mode, drop out of it and legitimize nd->path.
0780  * Revalidate the final result, unless we'd already done that during
0781  * the path walk or the filesystem doesn't ask for it.  Return 0 on
0782  * success, -error on failure.  In case of failure caller does not
0783  * need to drop nd->path.
0784  */
0785 static int complete_walk(struct nameidata *nd)
0786 {
0787     struct dentry *dentry = nd->path.dentry;
0788     int status;
0789 
0790     if (nd->flags & LOOKUP_RCU) {
0791         if (!(nd->flags & LOOKUP_ROOT))
0792             nd->root.mnt = NULL;
0793         if (unlikely(unlazy_walk(nd, NULL, 0)))
0794             return -ECHILD;
0795     }
0796 
0797     if (likely(!(nd->flags & LOOKUP_JUMPED)))
0798         return 0;
0799 
0800     if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE)))
0801         return 0;
0802 
0803     status = dentry->d_op->d_weak_revalidate(dentry, nd->flags);
0804     if (status > 0)
0805         return 0;
0806 
0807     if (!status)
0808         status = -ESTALE;
0809 
0810     return status;
0811 }
0812 
0813 static void set_root(struct nameidata *nd)
0814 {
0815     struct fs_struct *fs = current->fs;
0816 
0817     if (nd->flags & LOOKUP_RCU) {
0818         unsigned seq;
0819 
0820         do {
0821             seq = read_seqcount_begin(&fs->seq);
0822             nd->root = fs->root;
0823             nd->root_seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
0824         } while (read_seqcount_retry(&fs->seq, seq));
0825     } else {
0826         get_fs_root(fs, &nd->root);
0827     }
0828 }
0829 
0830 static void path_put_conditional(struct path *path, struct nameidata *nd)
0831 {
0832     dput(path->dentry);
0833     if (path->mnt != nd->path.mnt)
0834         mntput(path->mnt);
0835 }
0836 
0837 static inline void path_to_nameidata(const struct path *path,
0838                     struct nameidata *nd)
0839 {
0840     if (!(nd->flags & LOOKUP_RCU)) {
0841         dput(nd->path.dentry);
0842         if (nd->path.mnt != path->mnt)
0843             mntput(nd->path.mnt);
0844     }
0845     nd->path.mnt = path->mnt;
0846     nd->path.dentry = path->dentry;
0847 }
0848 
0849 static int nd_jump_root(struct nameidata *nd)
0850 {
0851     if (nd->flags & LOOKUP_RCU) {
0852         struct dentry *d;
0853         nd->path = nd->root;
0854         d = nd->path.dentry;
0855         nd->inode = d->d_inode;
0856         nd->seq = nd->root_seq;
0857         if (unlikely(read_seqcount_retry(&d->d_seq, nd->seq)))
0858             return -ECHILD;
0859     } else {
0860         path_put(&nd->path);
0861         nd->path = nd->root;
0862         path_get(&nd->path);
0863         nd->inode = nd->path.dentry->d_inode;
0864     }
0865     nd->flags |= LOOKUP_JUMPED;
0866     return 0;
0867 }
0868 
0869 /*
0870  * Helper to directly jump to a known parsed path from ->get_link,
0871  * caller must have taken a reference to path beforehand.
0872  */
0873 void nd_jump_link(struct path *path)
0874 {
0875     struct nameidata *nd = current->nameidata;
0876     path_put(&nd->path);
0877 
0878     nd->path = *path;
0879     nd->inode = nd->path.dentry->d_inode;
0880     nd->flags |= LOOKUP_JUMPED;
0881 }
0882 
0883 static inline void put_link(struct nameidata *nd)
0884 {
0885     struct saved *last = nd->stack + --nd->depth;
0886     do_delayed_call(&last->done);
0887     if (!(nd->flags & LOOKUP_RCU))
0888         path_put(&last->link);
0889 }
0890 
0891 int sysctl_protected_symlinks __read_mostly = 0;
0892 int sysctl_protected_hardlinks __read_mostly = 0;
0893 
0894 /**
0895  * may_follow_link - Check symlink following for unsafe situations
0896  * @nd: nameidata pathwalk data
0897  *
0898  * In the case of the sysctl_protected_symlinks sysctl being enabled,
0899  * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is
0900  * in a sticky world-writable directory. This is to protect privileged
0901  * processes from failing races against path names that may change out
0902  * from under them by way of other users creating malicious symlinks.
0903  * It will permit symlinks to be followed only when outside a sticky
0904  * world-writable directory, or when the uid of the symlink and follower
0905  * match, or when the directory owner matches the symlink's owner.
0906  *
0907  * Returns 0 if following the symlink is allowed, -ve on error.
0908  */
0909 static inline int may_follow_link(struct nameidata *nd)
0910 {
0911     const struct inode *inode;
0912     const struct inode *parent;
0913     kuid_t puid;
0914 
0915     if (!sysctl_protected_symlinks)
0916         return 0;
0917 
0918     /* Allowed if owner and follower match. */
0919     inode = nd->link_inode;
0920     if (uid_eq(current_cred()->fsuid, inode->i_uid))
0921         return 0;
0922 
0923     /* Allowed if parent directory not sticky and world-writable. */
0924     parent = nd->inode;
0925     if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
0926         return 0;
0927 
0928     /* Allowed if parent directory and link owner match. */
0929     puid = parent->i_uid;
0930     if (uid_valid(puid) && uid_eq(puid, inode->i_uid))
0931         return 0;
0932 
0933     if (nd->flags & LOOKUP_RCU)
0934         return -ECHILD;
0935 
0936     audit_log_link_denied("follow_link", &nd->stack[0].link);
0937     return -EACCES;
0938 }
0939 
0940 /**
0941  * safe_hardlink_source - Check for safe hardlink conditions
0942  * @inode: the source inode to hardlink from
0943  *
0944  * Return false if at least one of the following conditions:
0945  *    - inode is not a regular file
0946  *    - inode is setuid
0947  *    - inode is setgid and group-exec
0948  *    - access failure for read and write
0949  *
0950  * Otherwise returns true.
0951  */
0952 static bool safe_hardlink_source(struct inode *inode)
0953 {
0954     umode_t mode = inode->i_mode;
0955 
0956     /* Special files should not get pinned to the filesystem. */
0957     if (!S_ISREG(mode))
0958         return false;
0959 
0960     /* Setuid files should not get pinned to the filesystem. */
0961     if (mode & S_ISUID)
0962         return false;
0963 
0964     /* Executable setgid files should not get pinned to the filesystem. */
0965     if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
0966         return false;
0967 
0968     /* Hardlinking to unreadable or unwritable sources is dangerous. */
0969     if (inode_permission(inode, MAY_READ | MAY_WRITE))
0970         return false;
0971 
0972     return true;
0973 }
0974 
0975 /**
0976  * may_linkat - Check permissions for creating a hardlink
0977  * @link: the source to hardlink from
0978  *
0979  * Block hardlink when all of:
0980  *  - sysctl_protected_hardlinks enabled
0981  *  - fsuid does not match inode
0982  *  - hardlink source is unsafe (see safe_hardlink_source() above)
0983  *  - not CAP_FOWNER in a namespace with the inode owner uid mapped
0984  *
0985  * Returns 0 if successful, -ve on error.
0986  */
0987 static int may_linkat(struct path *link)
0988 {
0989     struct inode *inode;
0990 
0991     if (!sysctl_protected_hardlinks)
0992         return 0;
0993 
0994     inode = link->dentry->d_inode;
0995 
0996     /* Source inode owner (or CAP_FOWNER) can hardlink all they like,
0997      * otherwise, it must be a safe source.
0998      */
0999     if (inode_owner_or_capable(inode) || safe_hardlink_source(inode))
1000         return 0;
1001 
1002     audit_log_link_denied("linkat", link);
1003     return -EPERM;
1004 }
1005 
1006 static __always_inline
1007 const char *get_link(struct nameidata *nd)
1008 {
1009     struct saved *last = nd->stack + nd->depth - 1;
1010     struct dentry *dentry = last->link.dentry;
1011     struct inode *inode = nd->link_inode;
1012     int error;
1013     const char *res;
1014 
1015     if (!(nd->flags & LOOKUP_RCU)) {
1016         touch_atime(&last->link);
1017         cond_resched();
1018     } else if (atime_needs_update_rcu(&last->link, inode)) {
1019         if (unlikely(unlazy_walk(nd, NULL, 0)))
1020             return ERR_PTR(-ECHILD);
1021         touch_atime(&last->link);
1022     }
1023 
1024     error = security_inode_follow_link(dentry, inode,
1025                        nd->flags & LOOKUP_RCU);
1026     if (unlikely(error))
1027         return ERR_PTR(error);
1028 
1029     nd->last_type = LAST_BIND;
1030     res = inode->i_link;
1031     if (!res) {
1032         const char * (*get)(struct dentry *, struct inode *,
1033                 struct delayed_call *);
1034         get = inode->i_op->get_link;
1035         if (nd->flags & LOOKUP_RCU) {
1036             res = get(NULL, inode, &last->done);
1037             if (res == ERR_PTR(-ECHILD)) {
1038                 if (unlikely(unlazy_walk(nd, NULL, 0)))
1039                     return ERR_PTR(-ECHILD);
1040                 res = get(dentry, inode, &last->done);
1041             }
1042         } else {
1043             res = get(dentry, inode, &last->done);
1044         }
1045         if (IS_ERR_OR_NULL(res))
1046             return res;
1047     }
1048     if (*res == '/') {
1049         if (!nd->root.mnt)
1050             set_root(nd);
1051         if (unlikely(nd_jump_root(nd)))
1052             return ERR_PTR(-ECHILD);
1053         while (unlikely(*++res == '/'))
1054             ;
1055     }
1056     if (!*res)
1057         res = NULL;
1058     return res;
1059 }
1060 
1061 /*
1062  * follow_up - Find the mountpoint of path's vfsmount
1063  *
1064  * Given a path, find the mountpoint of its source file system.
1065  * Replace @path with the path of the mountpoint in the parent mount.
1066  * Up is towards /.
1067  *
1068  * Return 1 if we went up a level and 0 if we were already at the
1069  * root.
1070  */
1071 int follow_up(struct path *path)
1072 {
1073     struct mount *mnt = real_mount(path->mnt);
1074     struct mount *parent;
1075     struct dentry *mountpoint;
1076 
1077     read_seqlock_excl(&mount_lock);
1078     parent = mnt->mnt_parent;
1079     if (parent == mnt) {
1080         read_sequnlock_excl(&mount_lock);
1081         return 0;
1082     }
1083     mntget(&parent->mnt);
1084     mountpoint = dget(mnt->mnt_mountpoint);
1085     read_sequnlock_excl(&mount_lock);
1086     dput(path->dentry);
1087     path->dentry = mountpoint;
1088     mntput(path->mnt);
1089     path->mnt = &parent->mnt;
1090     return 1;
1091 }
1092 EXPORT_SYMBOL(follow_up);
1093 
1094 /*
1095  * Perform an automount
1096  * - return -EISDIR to tell follow_managed() to stop and return the path we
1097  *   were called with.
1098  */
1099 static int follow_automount(struct path *path, struct nameidata *nd,
1100                 bool *need_mntput)
1101 {
1102     struct vfsmount *mnt;
1103     const struct cred *old_cred;
1104     int err;
1105 
1106     if (!path->dentry->d_op || !path->dentry->d_op->d_automount)
1107         return -EREMOTE;
1108 
1109     /* We don't want to mount if someone's just doing a stat -
1110      * unless they're stat'ing a directory and appended a '/' to
1111      * the name.
1112      *
1113      * We do, however, want to mount if someone wants to open or
1114      * create a file of any type under the mountpoint, wants to
1115      * traverse through the mountpoint or wants to open the
1116      * mounted directory.  Also, autofs may mark negative dentries
1117      * as being automount points.  These will need the attentions
1118      * of the daemon to instantiate them before they can be used.
1119      */
1120     if (!(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
1121                LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
1122         path->dentry->d_inode)
1123         return -EISDIR;
1124 
1125     if (path->dentry->d_sb->s_user_ns != &init_user_ns)
1126         return -EACCES;
1127 
1128     nd->total_link_count++;
1129     if (nd->total_link_count >= 40)
1130         return -ELOOP;
1131 
1132     old_cred = override_creds(&init_cred);
1133     mnt = path->dentry->d_op->d_automount(path);
1134     revert_creds(old_cred);
1135     if (IS_ERR(mnt)) {
1136         /*
1137          * The filesystem is allowed to return -EISDIR here to indicate
1138          * it doesn't want to automount.  For instance, autofs would do
1139          * this so that its userspace daemon can mount on this dentry.
1140          *
1141          * However, we can only permit this if it's a terminal point in
1142          * the path being looked up; if it wasn't then the remainder of
1143          * the path is inaccessible and we should say so.
1144          */
1145         if (PTR_ERR(mnt) == -EISDIR && (nd->flags & LOOKUP_PARENT))
1146             return -EREMOTE;
1147         return PTR_ERR(mnt);
1148     }
1149 
1150     if (!mnt) /* mount collision */
1151         return 0;
1152 
1153     if (!*need_mntput) {
1154         /* lock_mount() may release path->mnt on error */
1155         mntget(path->mnt);
1156         *need_mntput = true;
1157     }
1158     err = finish_automount(mnt, path);
1159 
1160     switch (err) {
1161     case -EBUSY:
1162         /* Someone else made a mount here whilst we were busy */
1163         return 0;
1164     case 0:
1165         path_put(path);
1166         path->mnt = mnt;
1167         path->dentry = dget(mnt->mnt_root);
1168         return 0;
1169     default:
1170         return err;
1171     }
1172 
1173 }
1174 
1175 /*
1176  * Handle a dentry that is managed in some way.
1177  * - Flagged for transit management (autofs)
1178  * - Flagged as mountpoint
1179  * - Flagged as automount point
1180  *
1181  * This may only be called in refwalk mode.
1182  *
1183  * Serialization is taken care of in namespace.c
1184  */
1185 static int follow_managed(struct path *path, struct nameidata *nd)
1186 {
1187     struct vfsmount *mnt = path->mnt; /* held by caller, must be left alone */
1188     unsigned managed;
1189     bool need_mntput = false;
1190     int ret = 0;
1191 
1192     /* Given that we're not holding a lock here, we retain the value in a
1193      * local variable for each dentry as we look at it so that we don't see
1194      * the components of that value change under us */
1195     while (managed = ACCESS_ONCE(path->dentry->d_flags),
1196            managed &= DCACHE_MANAGED_DENTRY,
1197            unlikely(managed != 0)) {
1198         /* Allow the filesystem to manage the transit without i_mutex
1199          * being held. */
1200         if (managed & DCACHE_MANAGE_TRANSIT) {
1201             BUG_ON(!path->dentry->d_op);
1202             BUG_ON(!path->dentry->d_op->d_manage);
1203             ret = path->dentry->d_op->d_manage(path, false);
1204             if (ret < 0)
1205                 break;
1206         }
1207 
1208         /* Transit to a mounted filesystem. */
1209         if (managed & DCACHE_MOUNTED) {
1210             struct vfsmount *mounted = lookup_mnt(path);
1211             if (mounted) {
1212                 dput(path->dentry);
1213                 if (need_mntput)
1214                     mntput(path->mnt);
1215                 path->mnt = mounted;
1216                 path->dentry = dget(mounted->mnt_root);
1217                 need_mntput = true;
1218                 continue;
1219             }
1220 
1221             /* Something is mounted on this dentry in another
1222              * namespace and/or whatever was mounted there in this
1223              * namespace got unmounted before lookup_mnt() could
1224              * get it */
1225         }
1226 
1227         /* Handle an automount point */
1228         if (managed & DCACHE_NEED_AUTOMOUNT) {
1229             ret = follow_automount(path, nd, &need_mntput);
1230             if (ret < 0)
1231                 break;
1232             continue;
1233         }
1234 
1235         /* We didn't change the current path point */
1236         break;
1237     }
1238 
1239     if (need_mntput && path->mnt == mnt)
1240         mntput(path->mnt);
1241     if (ret == -EISDIR || !ret)
1242         ret = 1;
1243     if (need_mntput)
1244         nd->flags |= LOOKUP_JUMPED;
1245     if (unlikely(ret < 0))
1246         path_put_conditional(path, nd);
1247     return ret;
1248 }
1249 
1250 int follow_down_one(struct path *path)
1251 {
1252     struct vfsmount *mounted;
1253 
1254     mounted = lookup_mnt(path);
1255     if (mounted) {
1256         dput(path->dentry);
1257         mntput(path->mnt);
1258         path->mnt = mounted;
1259         path->dentry = dget(mounted->mnt_root);
1260         return 1;
1261     }
1262     return 0;
1263 }
1264 EXPORT_SYMBOL(follow_down_one);
1265 
1266 static inline int managed_dentry_rcu(const struct path *path)
1267 {
1268     return (path->dentry->d_flags & DCACHE_MANAGE_TRANSIT) ?
1269         path->dentry->d_op->d_manage(path, true) : 0;
1270 }
1271 
1272 /*
1273  * Try to skip to top of mountpoint pile in rcuwalk mode.  Fail if
1274  * we meet a managed dentry that would need blocking.
1275  */
1276 static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
1277                    struct inode **inode, unsigned *seqp)
1278 {
1279     for (;;) {
1280         struct mount *mounted;
1281         /*
1282          * Don't forget we might have a non-mountpoint managed dentry
1283          * that wants to block transit.
1284          */
1285         switch (managed_dentry_rcu(path)) {
1286         case -ECHILD:
1287         default:
1288             return false;
1289         case -EISDIR:
1290             return true;
1291         case 0:
1292             break;
1293         }
1294 
1295         if (!d_mountpoint(path->dentry))
1296             return !(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT);
1297 
1298         mounted = __lookup_mnt(path->mnt, path->dentry);
1299         if (!mounted)
1300             break;
1301         path->mnt = &mounted->mnt;
1302         path->dentry = mounted->mnt.mnt_root;
1303         nd->flags |= LOOKUP_JUMPED;
1304         *seqp = read_seqcount_begin(&path->dentry->d_seq);
1305         /*
1306          * Update the inode too. We don't need to re-check the
1307          * dentry sequence number here after this d_inode read,
1308          * because a mount-point is always pinned.
1309          */
1310         *inode = path->dentry->d_inode;
1311     }
1312     return !read_seqretry(&mount_lock, nd->m_seq) &&
1313         !(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT);
1314 }
1315 
1316 static int follow_dotdot_rcu(struct nameidata *nd)
1317 {
1318     struct inode *inode = nd->inode;
1319 
1320     while (1) {
1321         if (path_equal(&nd->path, &nd->root))
1322             break;
1323         if (nd->path.dentry != nd->path.mnt->mnt_root) {
1324             struct dentry *old = nd->path.dentry;
1325             struct dentry *parent = old->d_parent;
1326             unsigned seq;
1327 
1328             inode = parent->d_inode;
1329             seq = read_seqcount_begin(&parent->d_seq);
1330             if (unlikely(read_seqcount_retry(&old->d_seq, nd->seq)))
1331                 return -ECHILD;
1332             nd->path.dentry = parent;
1333             nd->seq = seq;
1334             if (unlikely(!path_connected(&nd->path)))
1335                 return -ENOENT;
1336             break;
1337         } else {
1338             struct mount *mnt = real_mount(nd->path.mnt);
1339             struct mount *mparent = mnt->mnt_parent;
1340             struct dentry *mountpoint = mnt->mnt_mountpoint;
1341             struct inode *inode2 = mountpoint->d_inode;
1342             unsigned seq = read_seqcount_begin(&mountpoint->d_seq);
1343             if (unlikely(read_seqretry(&mount_lock, nd->m_seq)))
1344                 return -ECHILD;
1345             if (&mparent->mnt == nd->path.mnt)
1346                 break;
1347             /* we know that mountpoint was pinned */
1348             nd->path.dentry = mountpoint;
1349             nd->path.mnt = &mparent->mnt;
1350             inode = inode2;
1351             nd->seq = seq;
1352         }
1353     }
1354     while (unlikely(d_mountpoint(nd->path.dentry))) {
1355         struct mount *mounted;
1356         mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry);
1357         if (unlikely(read_seqretry(&mount_lock, nd->m_seq)))
1358             return -ECHILD;
1359         if (!mounted)
1360             break;
1361         nd->path.mnt = &mounted->mnt;
1362         nd->path.dentry = mounted->mnt.mnt_root;
1363         inode = nd->path.dentry->d_inode;
1364         nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
1365     }
1366     nd->inode = inode;
1367     return 0;
1368 }
1369 
1370 /*
1371  * Follow down to the covering mount currently visible to userspace.  At each
1372  * point, the filesystem owning that dentry may be queried as to whether the
1373  * caller is permitted to proceed or not.
1374  */
1375 int follow_down(struct path *path)
1376 {
1377     unsigned managed;
1378     int ret;
1379 
1380     while (managed = ACCESS_ONCE(path->dentry->d_flags),
1381            unlikely(managed & DCACHE_MANAGED_DENTRY)) {
1382         /* Allow the filesystem to manage the transit without i_mutex
1383          * being held.
1384          *
1385          * We indicate to the filesystem if someone is trying to mount
1386          * something here.  This gives autofs the chance to deny anyone
1387          * other than its daemon the right to mount on its
1388          * superstructure.
1389          *
1390          * The filesystem may sleep at this point.
1391          */
1392         if (managed & DCACHE_MANAGE_TRANSIT) {
1393             BUG_ON(!path->dentry->d_op);
1394             BUG_ON(!path->dentry->d_op->d_manage);
1395             ret = path->dentry->d_op->d_manage(path, false);
1396             if (ret < 0)
1397                 return ret == -EISDIR ? 0 : ret;
1398         }
1399 
1400         /* Transit to a mounted filesystem. */
1401         if (managed & DCACHE_MOUNTED) {
1402             struct vfsmount *mounted = lookup_mnt(path);
1403             if (!mounted)
1404                 break;
1405             dput(path->dentry);
1406             mntput(path->mnt);
1407             path->mnt = mounted;
1408             path->dentry = dget(mounted->mnt_root);
1409             continue;
1410         }
1411 
1412         /* Don't handle automount points here */
1413         break;
1414     }
1415     return 0;
1416 }
1417 EXPORT_SYMBOL(follow_down);
1418 
1419 /*
1420  * Skip to top of mountpoint pile in refwalk mode for follow_dotdot()
1421  */
1422 static void follow_mount(struct path *path)
1423 {
1424     while (d_mountpoint(path->dentry)) {
1425         struct vfsmount *mounted = lookup_mnt(path);
1426         if (!mounted)
1427             break;
1428         dput(path->dentry);
1429         mntput(path->mnt);
1430         path->mnt = mounted;
1431         path->dentry = dget(mounted->mnt_root);
1432     }
1433 }
1434 
1435 static int path_parent_directory(struct path *path)
1436 {
1437     struct dentry *old = path->dentry;
1438     /* rare case of legitimate dget_parent()... */
1439     path->dentry = dget_parent(path->dentry);
1440     dput(old);
1441     if (unlikely(!path_connected(path)))
1442         return -ENOENT;
1443     return 0;
1444 }
1445 
1446 static int follow_dotdot(struct nameidata *nd)
1447 {
1448     while(1) {
1449         if (nd->path.dentry == nd->root.dentry &&
1450             nd->path.mnt == nd->root.mnt) {
1451             break;
1452         }
1453         if (nd->path.dentry != nd->path.mnt->mnt_root) {
1454             int ret = path_parent_directory(&nd->path);
1455             if (ret)
1456                 return ret;
1457             break;
1458         }
1459         if (!follow_up(&nd->path))
1460             break;
1461     }
1462     follow_mount(&nd->path);
1463     nd->inode = nd->path.dentry->d_inode;
1464     return 0;
1465 }
1466 
1467 /*
1468  * This looks up the name in dcache and possibly revalidates the found dentry.
1469  * NULL is returned if the dentry does not exist in the cache.
1470  */
1471 static struct dentry *lookup_dcache(const struct qstr *name,
1472                     struct dentry *dir,
1473                     unsigned int flags)
1474 {
1475     struct dentry *dentry;
1476     int error;
1477 
1478     dentry = d_lookup(dir, name);
1479     if (dentry) {
1480         if (dentry->d_flags & DCACHE_OP_REVALIDATE) {
1481             error = d_revalidate(dentry, flags);
1482             if (unlikely(error <= 0)) {
1483                 if (!error)
1484                     d_invalidate(dentry);
1485                 dput(dentry);
1486                 return ERR_PTR(error);
1487             }
1488         }
1489     }
1490     return dentry;
1491 }
1492 
1493 /*
1494  * Call i_op->lookup on the dentry.  The dentry must be negative and
1495  * unhashed.
1496  *
1497  * dir->d_inode->i_mutex must be held
1498  */
1499 static struct dentry *lookup_real(struct inode *dir, struct dentry *dentry,
1500                   unsigned int flags)
1501 {
1502     struct dentry *old;
1503 
1504     /* Don't create child dentry for a dead directory. */
1505     if (unlikely(IS_DEADDIR(dir))) {
1506         dput(dentry);
1507         return ERR_PTR(-ENOENT);
1508     }
1509 
1510     old = dir->i_op->lookup(dir, dentry, flags);
1511     if (unlikely(old)) {
1512         dput(dentry);
1513         dentry = old;
1514     }
1515     return dentry;
1516 }
1517 
1518 static struct dentry *__lookup_hash(const struct qstr *name,
1519         struct dentry *base, unsigned int flags)
1520 {
1521     struct dentry *dentry = lookup_dcache(name, base, flags);
1522 
1523     if (dentry)
1524         return dentry;
1525 
1526     dentry = d_alloc(base, name);
1527     if (unlikely(!dentry))
1528         return ERR_PTR(-ENOMEM);
1529 
1530     return lookup_real(base->d_inode, dentry, flags);
1531 }
1532 
1533 static int lookup_fast(struct nameidata *nd,
1534                struct path *path, struct inode **inode,
1535                unsigned *seqp)
1536 {
1537     struct vfsmount *mnt = nd->path.mnt;
1538     struct dentry *dentry, *parent = nd->path.dentry;
1539     int status = 1;
1540     int err;
1541 
1542     /*
1543      * Rename seqlock is not required here because in the off chance
1544      * of a false negative due to a concurrent rename, the caller is
1545      * going to fall back to non-racy lookup.
1546      */
1547     if (nd->flags & LOOKUP_RCU) {
1548         unsigned seq;
1549         bool negative;
1550         dentry = __d_lookup_rcu(parent, &nd->last, &seq);
1551         if (unlikely(!dentry)) {
1552             if (unlazy_walk(nd, NULL, 0))
1553                 return -ECHILD;
1554             return 0;
1555         }
1556 
1557         /*
1558          * This sequence count validates that the inode matches
1559          * the dentry name information from lookup.
1560          */
1561         *inode = d_backing_inode(dentry);
1562         negative = d_is_negative(dentry);
1563         if (unlikely(read_seqcount_retry(&dentry->d_seq, seq)))
1564             return -ECHILD;
1565 
1566         /*
1567          * This sequence count validates that the parent had no
1568          * changes while we did the lookup of the dentry above.
1569          *
1570          * The memory barrier in read_seqcount_begin of child is
1571          *  enough, we can use __read_seqcount_retry here.
1572          */
1573         if (unlikely(__read_seqcount_retry(&parent->d_seq, nd->seq)))
1574             return -ECHILD;
1575 
1576         *seqp = seq;
1577         if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE))
1578             status = d_revalidate(dentry, nd->flags);
1579         if (unlikely(status <= 0)) {
1580             if (unlazy_walk(nd, dentry, seq))
1581                 return -ECHILD;
1582             if (status == -ECHILD)
1583                 status = d_revalidate(dentry, nd->flags);
1584         } else {
1585             /*
1586              * Note: do negative dentry check after revalidation in
1587              * case that drops it.
1588              */
1589             if (unlikely(negative))
1590                 return -ENOENT;
1591             path->mnt = mnt;
1592             path->dentry = dentry;
1593             if (likely(__follow_mount_rcu(nd, path, inode, seqp)))
1594                 return 1;
1595             if (unlazy_walk(nd, dentry, seq))
1596                 return -ECHILD;
1597         }
1598     } else {
1599         dentry = __d_lookup(parent, &nd->last);
1600         if (unlikely(!dentry))
1601             return 0;
1602         if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE))
1603             status = d_revalidate(dentry, nd->flags);
1604     }
1605     if (unlikely(status <= 0)) {
1606         if (!status)
1607             d_invalidate(dentry);
1608         dput(dentry);
1609         return status;
1610     }
1611     if (unlikely(d_is_negative(dentry))) {
1612         dput(dentry);
1613         return -ENOENT;
1614     }
1615 
1616     path->mnt = mnt;
1617     path->dentry = dentry;
1618     err = follow_managed(path, nd);
1619     if (likely(err > 0))
1620         *inode = d_backing_inode(path->dentry);
1621     return err;
1622 }
1623 
1624 /* Fast lookup failed, do it the slow way */
1625 static struct dentry *lookup_slow(const struct qstr *name,
1626                   struct dentry *dir,
1627                   unsigned int flags)
1628 {
1629     struct dentry *dentry = ERR_PTR(-ENOENT), *old;
1630     struct inode *inode = dir->d_inode;
1631     DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
1632 
1633     inode_lock_shared(inode);
1634     /* Don't go there if it's already dead */
1635     if (unlikely(IS_DEADDIR(inode)))
1636         goto out;
1637 again:
1638     dentry = d_alloc_parallel(dir, name, &wq);
1639     if (IS_ERR(dentry))
1640         goto out;
1641     if (unlikely(!d_in_lookup(dentry))) {
1642         if ((dentry->d_flags & DCACHE_OP_REVALIDATE) &&
1643             !(flags & LOOKUP_NO_REVAL)) {
1644             int error = d_revalidate(dentry, flags);
1645             if (unlikely(error <= 0)) {
1646                 if (!error) {
1647                     d_invalidate(dentry);
1648                     dput(dentry);
1649                     goto again;
1650                 }
1651                 dput(dentry);
1652                 dentry = ERR_PTR(error);
1653             }
1654         }
1655     } else {
1656         old = inode->i_op->lookup(inode, dentry, flags);
1657         d_lookup_done(dentry);
1658         if (unlikely(old)) {
1659             dput(dentry);
1660             dentry = old;
1661         }
1662     }
1663 out:
1664     inode_unlock_shared(inode);
1665     return dentry;
1666 }
1667 
1668 static inline int may_lookup(struct nameidata *nd)
1669 {
1670     if (nd->flags & LOOKUP_RCU) {
1671         int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK);
1672         if (err != -ECHILD)
1673             return err;
1674         if (unlazy_walk(nd, NULL, 0))
1675             return -ECHILD;
1676     }
1677     return inode_permission(nd->inode, MAY_EXEC);
1678 }
1679 
1680 static inline int handle_dots(struct nameidata *nd, int type)
1681 {
1682     if (type == LAST_DOTDOT) {
1683         if (!nd->root.mnt)
1684             set_root(nd);
1685         if (nd->flags & LOOKUP_RCU) {
1686             return follow_dotdot_rcu(nd);
1687         } else
1688             return follow_dotdot(nd);
1689     }
1690     return 0;
1691 }
1692 
1693 static int pick_link(struct nameidata *nd, struct path *link,
1694              struct inode *inode, unsigned seq)
1695 {
1696     int error;
1697     struct saved *last;
1698     if (unlikely(nd->total_link_count++ >= MAXSYMLINKS)) {
1699         path_to_nameidata(link, nd);
1700         return -ELOOP;
1701     }
1702     if (!(nd->flags & LOOKUP_RCU)) {
1703         if (link->mnt == nd->path.mnt)
1704             mntget(link->mnt);
1705     }
1706     error = nd_alloc_stack(nd);
1707     if (unlikely(error)) {
1708         if (error == -ECHILD) {
1709             if (unlikely(unlazy_link(nd, link, seq)))
1710                 return -ECHILD;
1711             error = nd_alloc_stack(nd);
1712         }
1713         if (error) {
1714             path_put(link);
1715             return error;
1716         }
1717     }
1718 
1719     last = nd->stack + nd->depth++;
1720     last->link = *link;
1721     clear_delayed_call(&last->done);
1722     nd->link_inode = inode;
1723     last->seq = seq;
1724     return 1;
1725 }
1726 
1727 enum {WALK_FOLLOW = 1, WALK_MORE = 2};
1728 
1729 /*
1730  * Do we need to follow links? We _really_ want to be able
1731  * to do this check without having to look at inode->i_op,
1732  * so we keep a cache of "no, this doesn't need follow_link"
1733  * for the common case.
1734  */
1735 static inline int step_into(struct nameidata *nd, struct path *path,
1736                 int flags, struct inode *inode, unsigned seq)
1737 {
1738     if (!(flags & WALK_MORE) && nd->depth)
1739         put_link(nd);
1740     if (likely(!d_is_symlink(path->dentry)) ||
1741        !(flags & WALK_FOLLOW || nd->flags & LOOKUP_FOLLOW)) {
1742         /* not a symlink or should not follow */
1743         path_to_nameidata(path, nd);
1744         nd->inode = inode;
1745         nd->seq = seq;
1746         return 0;
1747     }
1748     /* make sure that d_is_symlink above matches inode */
1749     if (nd->flags & LOOKUP_RCU) {
1750         if (read_seqcount_retry(&path->dentry->d_seq, seq))
1751             return -ECHILD;
1752     }
1753     return pick_link(nd, path, inode, seq);
1754 }
1755 
1756 static int walk_component(struct nameidata *nd, int flags)
1757 {
1758     struct path path;
1759     struct inode *inode;
1760     unsigned seq;
1761     int err;
1762     /*
1763      * "." and ".." are special - ".." especially so because it has
1764      * to be able to know about the current root directory and
1765      * parent relationships.
1766      */
1767     if (unlikely(nd->last_type != LAST_NORM)) {
1768         err = handle_dots(nd, nd->last_type);
1769         if (!(flags & WALK_MORE) && nd->depth)
1770             put_link(nd);
1771         return err;
1772     }
1773     err = lookup_fast(nd, &path, &inode, &seq);
1774     if (unlikely(err <= 0)) {
1775         if (err < 0)
1776             return err;
1777         path.dentry = lookup_slow(&nd->last, nd->path.dentry,
1778                       nd->flags);
1779         if (IS_ERR(path.dentry))
1780             return PTR_ERR(path.dentry);
1781 
1782         path.mnt = nd->path.mnt;
1783         err = follow_managed(&path, nd);
1784         if (unlikely(err < 0))
1785             return err;
1786 
1787         if (unlikely(d_is_negative(path.dentry))) {
1788             path_to_nameidata(&path, nd);
1789             return -ENOENT;
1790         }
1791 
1792         seq = 0;    /* we are already out of RCU mode */
1793         inode = d_backing_inode(path.dentry);
1794     }
1795 
1796     return step_into(nd, &path, flags, inode, seq);
1797 }
1798 
1799 /*
1800  * We can do the critical dentry name comparison and hashing
1801  * operations one word at a time, but we are limited to:
1802  *
1803  * - Architectures with fast unaligned word accesses. We could
1804  *   do a "get_unaligned()" if this helps and is sufficiently
1805  *   fast.
1806  *
1807  * - non-CONFIG_DEBUG_PAGEALLOC configurations (so that we
1808  *   do not trap on the (extremely unlikely) case of a page
1809  *   crossing operation.
1810  *
1811  * - Furthermore, we need an efficient 64-bit compile for the
1812  *   64-bit case in order to generate the "number of bytes in
1813  *   the final mask". Again, that could be replaced with a
1814  *   efficient population count instruction or similar.
1815  */
1816 #ifdef CONFIG_DCACHE_WORD_ACCESS
1817 
1818 #include <asm/word-at-a-time.h>
1819 
1820 #ifdef HASH_MIX
1821 
1822 /* Architecture provides HASH_MIX and fold_hash() in <asm/hash.h> */
1823 
1824 #elif defined(CONFIG_64BIT)
1825 /*
1826  * Register pressure in the mixing function is an issue, particularly
1827  * on 32-bit x86, but almost any function requires one state value and
1828  * one temporary.  Instead, use a function designed for two state values
1829  * and no temporaries.
1830  *
1831  * This function cannot create a collision in only two iterations, so
1832  * we have two iterations to achieve avalanche.  In those two iterations,
1833  * we have six layers of mixing, which is enough to spread one bit's
1834  * influence out to 2^6 = 64 state bits.
1835  *
1836  * Rotate constants are scored by considering either 64 one-bit input
1837  * deltas or 64*63/2 = 2016 two-bit input deltas, and finding the
1838  * probability of that delta causing a change to each of the 128 output
1839  * bits, using a sample of random initial states.
1840  *
1841  * The Shannon entropy of the computed probabilities is then summed
1842  * to produce a score.  Ideally, any input change has a 50% chance of
1843  * toggling any given output bit.
1844  *
1845  * Mixing scores (in bits) for (12,45):
1846  * Input delta: 1-bit      2-bit
1847  * 1 round:     713.3    42542.6
1848  * 2 rounds:   2753.7   140389.8
1849  * 3 rounds:   5954.1   233458.2
1850  * 4 rounds:   7862.6   256672.2
1851  * Perfect:    8192     258048
1852  *            (64*128) (64*63/2 * 128)
1853  */
1854 #define HASH_MIX(x, y, a)   \
1855     (   x ^= (a),   \
1856     y ^= x, x = rol64(x,12),\
1857     x += y, y = rol64(y,45),\
1858     y *= 9          )
1859 
1860 /*
1861  * Fold two longs into one 32-bit hash value.  This must be fast, but
1862  * latency isn't quite as critical, as there is a fair bit of additional
1863  * work done before the hash value is used.
1864  */
1865 static inline unsigned int fold_hash(unsigned long x, unsigned long y)
1866 {
1867     y ^= x * GOLDEN_RATIO_64;
1868     y *= GOLDEN_RATIO_64;
1869     return y >> 32;
1870 }
1871 
1872 #else   /* 32-bit case */
1873 
1874 /*
1875  * Mixing scores (in bits) for (7,20):
1876  * Input delta: 1-bit      2-bit
1877  * 1 round:     330.3     9201.6
1878  * 2 rounds:   1246.4    25475.4
1879  * 3 rounds:   1907.1    31295.1
1880  * 4 rounds:   2042.3    31718.6
1881  * Perfect:    2048      31744
1882  *            (32*64)   (32*31/2 * 64)
1883  */
1884 #define HASH_MIX(x, y, a)   \
1885     (   x ^= (a),   \
1886     y ^= x, x = rol32(x, 7),\
1887     x += y, y = rol32(y,20),\
1888     y *= 9          )
1889 
1890 static inline unsigned int fold_hash(unsigned long x, unsigned long y)
1891 {
1892     /* Use arch-optimized multiply if one exists */
1893     return __hash_32(y ^ __hash_32(x));
1894 }
1895 
1896 #endif
1897 
1898 /*
1899  * Return the hash of a string of known length.  This is carfully
1900  * designed to match hash_name(), which is the more critical function.
1901  * In particular, we must end by hashing a final word containing 0..7
1902  * payload bytes, to match the way that hash_name() iterates until it
1903  * finds the delimiter after the name.
1904  */
1905 unsigned int full_name_hash(const void *salt, const char *name, unsigned int len)
1906 {
1907     unsigned long a, x = 0, y = (unsigned long)salt;
1908 
1909     for (;;) {
1910         if (!len)
1911             goto done;
1912         a = load_unaligned_zeropad(name);
1913         if (len < sizeof(unsigned long))
1914             break;
1915         HASH_MIX(x, y, a);
1916         name += sizeof(unsigned long);
1917         len -= sizeof(unsigned long);
1918     }
1919     x ^= a & bytemask_from_count(len);
1920 done:
1921     return fold_hash(x, y);
1922 }
1923 EXPORT_SYMBOL(full_name_hash);
1924 
1925 /* Return the "hash_len" (hash and length) of a null-terminated string */
1926 u64 hashlen_string(const void *salt, const char *name)
1927 {
1928     unsigned long a = 0, x = 0, y = (unsigned long)salt;
1929     unsigned long adata, mask, len;
1930     const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
1931 
1932     len = 0;
1933     goto inside;
1934 
1935     do {
1936         HASH_MIX(x, y, a);
1937         len += sizeof(unsigned long);
1938 inside:
1939         a = load_unaligned_zeropad(name+len);
1940     } while (!has_zero(a, &adata, &constants));
1941 
1942     adata = prep_zero_mask(a, adata, &constants);
1943     mask = create_zero_mask(adata);
1944     x ^= a & zero_bytemask(mask);
1945 
1946     return hashlen_create(fold_hash(x, y), len + find_zero(mask));
1947 }
1948 EXPORT_SYMBOL(hashlen_string);
1949 
1950 /*
1951  * Calculate the length and hash of the path component, and
1952  * return the "hash_len" as the result.
1953  */
1954 static inline u64 hash_name(const void *salt, const char *name)
1955 {
1956     unsigned long a = 0, b, x = 0, y = (unsigned long)salt;
1957     unsigned long adata, bdata, mask, len;
1958     const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
1959 
1960     len = 0;
1961     goto inside;
1962 
1963     do {
1964         HASH_MIX(x, y, a);
1965         len += sizeof(unsigned long);
1966 inside:
1967         a = load_unaligned_zeropad(name+len);
1968         b = a ^ REPEAT_BYTE('/');
1969     } while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants)));
1970 
1971     adata = prep_zero_mask(a, adata, &constants);
1972     bdata = prep_zero_mask(b, bdata, &constants);
1973     mask = create_zero_mask(adata | bdata);
1974     x ^= a & zero_bytemask(mask);
1975 
1976     return hashlen_create(fold_hash(x, y), len + find_zero(mask));
1977 }
1978 
1979 #else   /* !CONFIG_DCACHE_WORD_ACCESS: Slow, byte-at-a-time version */
1980 
1981 /* Return the hash of a string of known length */
1982 unsigned int full_name_hash(const void *salt, const char *name, unsigned int len)
1983 {
1984     unsigned long hash = init_name_hash(salt);
1985     while (len--)
1986         hash = partial_name_hash((unsigned char)*name++, hash);
1987     return end_name_hash(hash);
1988 }
1989 EXPORT_SYMBOL(full_name_hash);
1990 
1991 /* Return the "hash_len" (hash and length) of a null-terminated string */
1992 u64 hashlen_string(const void *salt, const char *name)
1993 {
1994     unsigned long hash = init_name_hash(salt);
1995     unsigned long len = 0, c;
1996 
1997     c = (unsigned char)*name;
1998     while (c) {
1999         len++;
2000         hash = partial_name_hash(c, hash);
2001         c = (unsigned char)name[len];
2002     }
2003     return hashlen_create(end_name_hash(hash), len);
2004 }
2005 EXPORT_SYMBOL(hashlen_string);
2006 
2007 /*
2008  * We know there's a real path component here of at least
2009  * one character.
2010  */
2011 static inline u64 hash_name(const void *salt, const char *name)
2012 {
2013     unsigned long hash = init_name_hash(salt);
2014     unsigned long len = 0, c;
2015 
2016     c = (unsigned char)*name;
2017     do {
2018         len++;
2019         hash = partial_name_hash(c, hash);
2020         c = (unsigned char)name[len];
2021     } while (c && c != '/');
2022     return hashlen_create(end_name_hash(hash), len);
2023 }
2024 
2025 #endif
2026 
2027 /*
2028  * Name resolution.
2029  * This is the basic name resolution function, turning a pathname into
2030  * the final dentry. We expect 'base' to be positive and a directory.
2031  *
2032  * Returns 0 and nd will have valid dentry and mnt on success.
2033  * Returns error and drops reference to input namei data on failure.
2034  */
2035 static int link_path_walk(const char *name, struct nameidata *nd)
2036 {
2037     int err;
2038 
2039     while (*name=='/')
2040         name++;
2041     if (!*name)
2042         return 0;
2043 
2044     /* At this point we know we have a real path component. */
2045     for(;;) {
2046         u64 hash_len;
2047         int type;
2048 
2049         err = may_lookup(nd);
2050         if (err)
2051             return err;
2052 
2053         hash_len = hash_name(nd->path.dentry, name);
2054 
2055         type = LAST_NORM;
2056         if (name[0] == '.') switch (hashlen_len(hash_len)) {
2057             case 2:
2058                 if (name[1] == '.') {
2059                     type = LAST_DOTDOT;
2060                     nd->flags |= LOOKUP_JUMPED;
2061                 }
2062                 break;
2063             case 1:
2064                 type = LAST_DOT;
2065         }
2066         if (likely(type == LAST_NORM)) {
2067             struct dentry *parent = nd->path.dentry;
2068             nd->flags &= ~LOOKUP_JUMPED;
2069             if (unlikely(parent->d_flags & DCACHE_OP_HASH)) {
2070                 struct qstr this = { { .hash_len = hash_len }, .name = name };
2071                 err = parent->d_op->d_hash(parent, &this);
2072                 if (err < 0)
2073                     return err;
2074                 hash_len = this.hash_len;
2075                 name = this.name;
2076             }
2077         }
2078 
2079         nd->last.hash_len = hash_len;
2080         nd->last.name = name;
2081         nd->last_type = type;
2082 
2083         name += hashlen_len(hash_len);
2084         if (!*name)
2085             goto OK;
2086         /*
2087          * If it wasn't NUL, we know it was '/'. Skip that
2088          * slash, and continue until no more slashes.
2089          */
2090         do {
2091             name++;
2092         } while (unlikely(*name == '/'));
2093         if (unlikely(!*name)) {
2094 OK:
2095             /* pathname body, done */
2096             if (!nd->depth)
2097                 return 0;
2098             name = nd->stack[nd->depth - 1].name;
2099             /* trailing symlink, done */
2100             if (!name)
2101                 return 0;
2102             /* last component of nested symlink */
2103             err = walk_component(nd, WALK_FOLLOW);
2104         } else {
2105             /* not the last component */
2106             err = walk_component(nd, WALK_FOLLOW | WALK_MORE);
2107         }
2108         if (err < 0)
2109             return err;
2110 
2111         if (err) {
2112             const char *s = get_link(nd);
2113 
2114             if (IS_ERR(s))
2115                 return PTR_ERR(s);
2116             err = 0;
2117             if (unlikely(!s)) {
2118                 /* jumped */
2119                 put_link(nd);
2120             } else {
2121                 nd->stack[nd->depth - 1].name = name;
2122                 name = s;
2123                 continue;
2124             }
2125         }
2126         if (unlikely(!d_can_lookup(nd->path.dentry))) {
2127             if (nd->flags & LOOKUP_RCU) {
2128                 if (unlazy_walk(nd, NULL, 0))
2129                     return -ECHILD;
2130             }
2131             return -ENOTDIR;
2132         }
2133     }
2134 }
2135 
2136 static const char *path_init(struct nameidata *nd, unsigned flags)
2137 {
2138     int retval = 0;
2139     const char *s = nd->name->name;
2140 
2141     nd->last_type = LAST_ROOT; /* if there are only slashes... */
2142     nd->flags = flags | LOOKUP_JUMPED | LOOKUP_PARENT;
2143     nd->depth = 0;
2144     if (flags & LOOKUP_ROOT) {
2145         struct dentry *root = nd->root.dentry;
2146         struct inode *inode = root->d_inode;
2147         if (*s) {
2148             if (!d_can_lookup(root))
2149                 return ERR_PTR(-ENOTDIR);
2150             retval = inode_permission(inode, MAY_EXEC);
2151             if (retval)
2152                 return ERR_PTR(retval);
2153         }
2154         nd->path = nd->root;
2155         nd->inode = inode;
2156         if (flags & LOOKUP_RCU) {
2157             rcu_read_lock();
2158             nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
2159             nd->root_seq = nd->seq;
2160             nd->m_seq = read_seqbegin(&mount_lock);
2161         } else {
2162             path_get(&nd->path);
2163         }
2164         return s;
2165     }
2166 
2167     nd->root.mnt = NULL;
2168     nd->path.mnt = NULL;
2169     nd->path.dentry = NULL;
2170 
2171     nd->m_seq = read_seqbegin(&mount_lock);
2172     if (*s == '/') {
2173         if (flags & LOOKUP_RCU)
2174             rcu_read_lock();
2175         set_root(nd);
2176         if (likely(!nd_jump_root(nd)))
2177             return s;
2178         nd->root.mnt = NULL;
2179         rcu_read_unlock();
2180         return ERR_PTR(-ECHILD);
2181     } else if (nd->dfd == AT_FDCWD) {
2182         if (flags & LOOKUP_RCU) {
2183             struct fs_struct *fs = current->fs;
2184             unsigned seq;
2185 
2186             rcu_read_lock();
2187 
2188             do {
2189                 seq = read_seqcount_begin(&fs->seq);
2190                 nd->path = fs->pwd;
2191                 nd->inode = nd->path.dentry->d_inode;
2192                 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
2193             } while (read_seqcount_retry(&fs->seq, seq));
2194         } else {
2195             get_fs_pwd(current->fs, &nd->path);
2196             nd->inode = nd->path.dentry->d_inode;
2197         }
2198         return s;
2199     } else {
2200         /* Caller must check execute permissions on the starting path component */
2201         struct fd f = fdget_raw(nd->dfd);
2202         struct dentry *dentry;
2203 
2204         if (!f.file)
2205             return ERR_PTR(-EBADF);
2206 
2207         dentry = f.file->f_path.dentry;
2208 
2209         if (*s) {
2210             if (!d_can_lookup(dentry)) {
2211                 fdput(f);
2212                 return ERR_PTR(-ENOTDIR);
2213             }
2214         }
2215 
2216         nd->path = f.file->f_path;
2217         if (flags & LOOKUP_RCU) {
2218             rcu_read_lock();
2219             nd->inode = nd->path.dentry->d_inode;
2220             nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
2221         } else {
2222             path_get(&nd->path);
2223             nd->inode = nd->path.dentry->d_inode;
2224         }
2225         fdput(f);
2226         return s;
2227     }
2228 }
2229 
2230 static const char *trailing_symlink(struct nameidata *nd)
2231 {
2232     const char *s;
2233     int error = may_follow_link(nd);
2234     if (unlikely(error))
2235         return ERR_PTR(error);
2236     nd->flags |= LOOKUP_PARENT;
2237     nd->stack[0].name = NULL;
2238     s = get_link(nd);
2239     return s ? s : "";
2240 }
2241 
2242 static inline int lookup_last(struct nameidata *nd)
2243 {
2244     if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len])
2245         nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
2246 
2247     nd->flags &= ~LOOKUP_PARENT;
2248     return walk_component(nd, 0);
2249 }
2250 
2251 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
2252 static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path)
2253 {
2254     const char *s = path_init(nd, flags);
2255     int err;
2256 
2257     if (IS_ERR(s))
2258         return PTR_ERR(s);
2259     while (!(err = link_path_walk(s, nd))
2260         && ((err = lookup_last(nd)) > 0)) {
2261         s = trailing_symlink(nd);
2262         if (IS_ERR(s)) {
2263             err = PTR_ERR(s);
2264             break;
2265         }
2266     }
2267     if (!err)
2268         err = complete_walk(nd);
2269 
2270     if (!err && nd->flags & LOOKUP_DIRECTORY)
2271         if (!d_can_lookup(nd->path.dentry))
2272             err = -ENOTDIR;
2273     if (!err) {
2274         *path = nd->path;
2275         nd->path.mnt = NULL;
2276         nd->path.dentry = NULL;
2277     }
2278     terminate_walk(nd);
2279     return err;
2280 }
2281 
2282 static int filename_lookup(int dfd, struct filename *name, unsigned flags,
2283                struct path *path, struct path *root)
2284 {
2285     int retval;
2286     struct nameidata nd;
2287     if (IS_ERR(name))
2288         return PTR_ERR(name);
2289     if (unlikely(root)) {
2290         nd.root = *root;
2291         flags |= LOOKUP_ROOT;
2292     }
2293     set_nameidata(&nd, dfd, name);
2294     retval = path_lookupat(&nd, flags | LOOKUP_RCU, path);
2295     if (unlikely(retval == -ECHILD))
2296         retval = path_lookupat(&nd, flags, path);
2297     if (unlikely(retval == -ESTALE))
2298         retval = path_lookupat(&nd, flags | LOOKUP_REVAL, path);
2299 
2300     if (likely(!retval))
2301         audit_inode(name, path->dentry, flags & LOOKUP_PARENT);
2302     restore_nameidata();
2303     putname(name);
2304     return retval;
2305 }
2306 
2307 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
2308 static int path_parentat(struct nameidata *nd, unsigned flags,
2309                 struct path *parent)
2310 {
2311     const char *s = path_init(nd, flags);
2312     int err;
2313     if (IS_ERR(s))
2314         return PTR_ERR(s);
2315     err = link_path_walk(s, nd);
2316     if (!err)
2317         err = complete_walk(nd);
2318     if (!err) {
2319         *parent = nd->path;
2320         nd->path.mnt = NULL;
2321         nd->path.dentry = NULL;
2322     }
2323     terminate_walk(nd);
2324     return err;
2325 }
2326 
2327 static struct filename *filename_parentat(int dfd, struct filename *name,
2328                 unsigned int flags, struct path *parent,
2329                 struct qstr *last, int *type)
2330 {
2331     int retval;
2332     struct nameidata nd;
2333 
2334     if (IS_ERR(name))
2335         return name;
2336     set_nameidata(&nd, dfd, name);
2337     retval = path_parentat(&nd, flags | LOOKUP_RCU, parent);
2338     if (unlikely(retval == -ECHILD))
2339         retval = path_parentat(&nd, flags, parent);
2340     if (unlikely(retval == -ESTALE))
2341         retval = path_parentat(&nd, flags | LOOKUP_REVAL, parent);
2342     if (likely(!retval)) {
2343         *last = nd.last;
2344         *type = nd.last_type;
2345         audit_inode(name, parent->dentry, LOOKUP_PARENT);
2346     } else {
2347         putname(name);
2348         name = ERR_PTR(retval);
2349     }
2350     restore_nameidata();
2351     return name;
2352 }
2353 
2354 /* does lookup, returns the object with parent locked */
2355 struct dentry *kern_path_locked(const char *name, struct path *path)
2356 {
2357     struct filename *filename;
2358     struct dentry *d;
2359     struct qstr last;
2360     int type;
2361 
2362     filename = filename_parentat(AT_FDCWD, getname_kernel(name), 0, path,
2363                     &last, &type);
2364     if (IS_ERR(filename))
2365         return ERR_CAST(filename);
2366     if (unlikely(type != LAST_NORM)) {
2367         path_put(path);
2368         putname(filename);
2369         return ERR_PTR(-EINVAL);
2370     }
2371     inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
2372     d = __lookup_hash(&last, path->dentry, 0);
2373     if (IS_ERR(d)) {
2374         inode_unlock(path->dentry->d_inode);
2375         path_put(path);
2376     }
2377     putname(filename);
2378     return d;
2379 }
2380 
2381 int kern_path(const char *name, unsigned int flags, struct path *path)
2382 {
2383     return filename_lookup(AT_FDCWD, getname_kernel(name),
2384                    flags, path, NULL);
2385 }
2386 EXPORT_SYMBOL(kern_path);
2387 
2388 /**
2389  * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair
2390  * @dentry:  pointer to dentry of the base directory
2391  * @mnt: pointer to vfs mount of the base directory
2392  * @name: pointer to file name
2393  * @flags: lookup flags
2394  * @path: pointer to struct path to fill
2395  */
2396 int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
2397             const char *name, unsigned int flags,
2398             struct path *path)
2399 {
2400     struct path root = {.mnt = mnt, .dentry = dentry};
2401     /* the first argument of filename_lookup() is ignored with root */
2402     return filename_lookup(AT_FDCWD, getname_kernel(name),
2403                    flags , path, &root);
2404 }
2405 EXPORT_SYMBOL(vfs_path_lookup);
2406 
2407 /**
2408  * lookup_one_len - filesystem helper to lookup single pathname component
2409  * @name:   pathname component to lookup
2410  * @base:   base directory to lookup from
2411  * @len:    maximum length @len should be interpreted to
2412  *
2413  * Note that this routine is purely a helper for filesystem usage and should
2414  * not be called by generic code.
2415  *
2416  * The caller must hold base->i_mutex.
2417  */
2418 struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
2419 {
2420     struct qstr this;
2421     unsigned int c;
2422     int err;
2423 
2424     WARN_ON_ONCE(!inode_is_locked(base->d_inode));
2425 
2426     this.name = name;
2427     this.len = len;
2428     this.hash = full_name_hash(base, name, len);
2429     if (!len)
2430         return ERR_PTR(-EACCES);
2431 
2432     if (unlikely(name[0] == '.')) {
2433         if (len < 2 || (len == 2 && name[1] == '.'))
2434             return ERR_PTR(-EACCES);
2435     }
2436 
2437     while (len--) {
2438         c = *(const unsigned char *)name++;
2439         if (c == '/' || c == '\0')
2440             return ERR_PTR(-EACCES);
2441     }
2442     /*
2443      * See if the low-level filesystem might want
2444      * to use its own hash..
2445      */
2446     if (base->d_flags & DCACHE_OP_HASH) {
2447         int err = base->d_op->d_hash(base, &this);
2448         if (err < 0)
2449             return ERR_PTR(err);
2450     }
2451 
2452     err = inode_permission(base->d_inode, MAY_EXEC);
2453     if (err)
2454         return ERR_PTR(err);
2455 
2456     return __lookup_hash(&this, base, 0);
2457 }
2458 EXPORT_SYMBOL(lookup_one_len);
2459 
2460 /**
2461  * lookup_one_len_unlocked - filesystem helper to lookup single pathname component
2462  * @name:   pathname component to lookup
2463  * @base:   base directory to lookup from
2464  * @len:    maximum length @len should be interpreted to
2465  *
2466  * Note that this routine is purely a helper for filesystem usage and should
2467  * not be called by generic code.
2468  *
2469  * Unlike lookup_one_len, it should be called without the parent
2470  * i_mutex held, and will take the i_mutex itself if necessary.
2471  */
2472 struct dentry *lookup_one_len_unlocked(const char *name,
2473                        struct dentry *base, int len)
2474 {
2475     struct qstr this;
2476     unsigned int c;
2477     int err;
2478     struct dentry *ret;
2479 
2480     this.name = name;
2481     this.len = len;
2482     this.hash = full_name_hash(base, name, len);
2483     if (!len)
2484         return ERR_PTR(-EACCES);
2485 
2486     if (unlikely(name[0] == '.')) {
2487         if (len < 2 || (len == 2 && name[1] == '.'))
2488             return ERR_PTR(-EACCES);
2489     }
2490 
2491     while (len--) {
2492         c = *(const unsigned char *)name++;
2493         if (c == '/' || c == '\0')
2494             return ERR_PTR(-EACCES);
2495     }
2496     /*
2497      * See if the low-level filesystem might want
2498      * to use its own hash..
2499      */
2500     if (base->d_flags & DCACHE_OP_HASH) {
2501         int err = base->d_op->d_hash(base, &this);
2502         if (err < 0)
2503             return ERR_PTR(err);
2504     }
2505 
2506     err = inode_permission(base->d_inode, MAY_EXEC);
2507     if (err)
2508         return ERR_PTR(err);
2509 
2510     ret = lookup_dcache(&this, base, 0);
2511     if (!ret)
2512         ret = lookup_slow(&this, base, 0);
2513     return ret;
2514 }
2515 EXPORT_SYMBOL(lookup_one_len_unlocked);
2516 
2517 #ifdef CONFIG_UNIX98_PTYS
2518 int path_pts(struct path *path)
2519 {
2520     /* Find something mounted on "pts" in the same directory as
2521      * the input path.
2522      */
2523     struct dentry *child, *parent;
2524     struct qstr this;
2525     int ret;
2526 
2527     ret = path_parent_directory(path);
2528     if (ret)
2529         return ret;
2530 
2531     parent = path->dentry;
2532     this.name = "pts";
2533     this.len = 3;
2534     child = d_hash_and_lookup(parent, &this);
2535     if (!child)
2536         return -ENOENT;
2537 
2538     path->dentry = child;
2539     dput(parent);
2540     follow_mount(path);
2541     return 0;
2542 }
2543 #endif
2544 
2545 int user_path_at_empty(int dfd, const char __user *name, unsigned flags,
2546          struct path *path, int *empty)
2547 {
2548     return filename_lookup(dfd, getname_flags(name, flags, empty),
2549                    flags, path, NULL);
2550 }
2551 EXPORT_SYMBOL(user_path_at_empty);
2552 
2553 /**
2554  * mountpoint_last - look up last component for umount
2555  * @nd:   pathwalk nameidata - currently pointing at parent directory of "last"
2556  *
2557  * This is a special lookup_last function just for umount. In this case, we
2558  * need to resolve the path without doing any revalidation.
2559  *
2560  * The nameidata should be the result of doing a LOOKUP_PARENT pathwalk. Since
2561  * mountpoints are always pinned in the dcache, their ancestors are too. Thus,
2562  * in almost all cases, this lookup will be served out of the dcache. The only
2563  * cases where it won't are if nd->last refers to a symlink or the path is
2564  * bogus and it doesn't exist.
2565  *
2566  * Returns:
2567  * -error: if there was an error during lookup. This includes -ENOENT if the
2568  *         lookup found a negative dentry.
2569  *
2570  * 0:      if we successfully resolved nd->last and found it to not to be a
2571  *         symlink that needs to be followed.
2572  *
2573  * 1:      if we successfully resolved nd->last and found it to be a symlink
2574  *         that needs to be followed.
2575  */
2576 static int
2577 mountpoint_last(struct nameidata *nd)
2578 {
2579     int error = 0;
2580     struct dentry *dir = nd->path.dentry;
2581     struct path path;
2582 
2583     /* If we're in rcuwalk, drop out of it to handle last component */
2584     if (nd->flags & LOOKUP_RCU) {
2585         if (unlazy_walk(nd, NULL, 0))
2586             return -ECHILD;
2587     }
2588 
2589     nd->flags &= ~LOOKUP_PARENT;
2590 
2591     if (unlikely(nd->last_type != LAST_NORM)) {
2592         error = handle_dots(nd, nd->last_type);
2593         if (error)
2594             return error;
2595         path.dentry = dget(nd->path.dentry);
2596     } else {
2597         path.dentry = d_lookup(dir, &nd->last);
2598         if (!path.dentry) {
2599             /*
2600              * No cached dentry. Mounted dentries are pinned in the
2601              * cache, so that means that this dentry is probably
2602              * a symlink or the path doesn't actually point
2603              * to a mounted dentry.
2604              */
2605             path.dentry = lookup_slow(&nd->last, dir,
2606                          nd->flags | LOOKUP_NO_REVAL);
2607             if (IS_ERR(path.dentry))
2608                 return PTR_ERR(path.dentry);
2609         }
2610     }
2611     if (d_is_negative(path.dentry)) {
2612         dput(path.dentry);
2613         return -ENOENT;
2614     }
2615     path.mnt = nd->path.mnt;
2616     return step_into(nd, &path, 0, d_backing_inode(path.dentry), 0);
2617 }
2618 
2619 /**
2620  * path_mountpoint - look up a path to be umounted
2621  * @nd:     lookup context
2622  * @flags:  lookup flags
2623  * @path:   pointer to container for result
2624  *
2625  * Look up the given name, but don't attempt to revalidate the last component.
2626  * Returns 0 and "path" will be valid on success; Returns error otherwise.
2627  */
2628 static int
2629 path_mountpoint(struct nameidata *nd, unsigned flags, struct path *path)
2630 {
2631     const char *s = path_init(nd, flags);
2632     int err;
2633     if (IS_ERR(s))
2634         return PTR_ERR(s);
2635     while (!(err = link_path_walk(s, nd)) &&
2636         (err = mountpoint_last(nd)) > 0) {
2637         s = trailing_symlink(nd);
2638         if (IS_ERR(s)) {
2639             err = PTR_ERR(s);
2640             break;
2641         }
2642     }
2643     if (!err) {
2644         *path = nd->path;
2645         nd->path.mnt = NULL;
2646         nd->path.dentry = NULL;
2647         follow_mount(path);
2648     }
2649     terminate_walk(nd);
2650     return err;
2651 }
2652 
2653 static int
2654 filename_mountpoint(int dfd, struct filename *name, struct path *path,
2655             unsigned int flags)
2656 {
2657     struct nameidata nd;
2658     int error;
2659     if (IS_ERR(name))
2660         return PTR_ERR(name);
2661     set_nameidata(&nd, dfd, name);
2662     error = path_mountpoint(&nd, flags | LOOKUP_RCU, path);
2663     if (unlikely(error == -ECHILD))
2664         error = path_mountpoint(&nd, flags, path);
2665     if (unlikely(error == -ESTALE))
2666         error = path_mountpoint(&nd, flags | LOOKUP_REVAL, path);
2667     if (likely(!error))
2668         audit_inode(name, path->dentry, 0);
2669     restore_nameidata();
2670     putname(name);
2671     return error;
2672 }
2673 
2674 /**
2675  * user_path_mountpoint_at - lookup a path from userland in order to umount it
2676  * @dfd:    directory file descriptor
2677  * @name:   pathname from userland
2678  * @flags:  lookup flags
2679  * @path:   pointer to container to hold result
2680  *
2681  * A umount is a special case for path walking. We're not actually interested
2682  * in the inode in this situation, and ESTALE errors can be a problem. We
2683  * simply want track down the dentry and vfsmount attached at the mountpoint
2684  * and avoid revalidating the last component.
2685  *
2686  * Returns 0 and populates "path" on success.
2687  */
2688 int
2689 user_path_mountpoint_at(int dfd, const char __user *name, unsigned int flags,
2690             struct path *path)
2691 {
2692     return filename_mountpoint(dfd, getname(name), path, flags);
2693 }
2694 
2695 int
2696 kern_path_mountpoint(int dfd, const char *name, struct path *path,
2697             unsigned int flags)
2698 {
2699     return filename_mountpoint(dfd, getname_kernel(name), path, flags);
2700 }
2701 EXPORT_SYMBOL(kern_path_mountpoint);
2702 
2703 int __check_sticky(struct inode *dir, struct inode *inode)
2704 {
2705     kuid_t fsuid = current_fsuid();
2706 
2707     if (uid_eq(inode->i_uid, fsuid))
2708         return 0;
2709     if (uid_eq(dir->i_uid, fsuid))
2710         return 0;
2711     return !capable_wrt_inode_uidgid(inode, CAP_FOWNER);
2712 }
2713 EXPORT_SYMBOL(__check_sticky);
2714 
2715 /*
2716  *  Check whether we can remove a link victim from directory dir, check
2717  *  whether the type of victim is right.
2718  *  1. We can't do it if dir is read-only (done in permission())
2719  *  2. We should have write and exec permissions on dir
2720  *  3. We can't remove anything from append-only dir
2721  *  4. We can't do anything with immutable dir (done in permission())
2722  *  5. If the sticky bit on dir is set we should either
2723  *  a. be owner of dir, or
2724  *  b. be owner of victim, or
2725  *  c. have CAP_FOWNER capability
2726  *  6. If the victim is append-only or immutable we can't do antyhing with
2727  *     links pointing to it.
2728  *  7. If the victim has an unknown uid or gid we can't change the inode.
2729  *  8. If we were asked to remove a directory and victim isn't one - ENOTDIR.
2730  *  9. If we were asked to remove a non-directory and victim isn't one - EISDIR.
2731  * 10. We can't remove a root or mountpoint.
2732  * 11. We don't allow removal of NFS sillyrenamed files; it's handled by
2733  *     nfs_async_unlink().
2734  */
2735 static int may_delete(struct inode *dir, struct dentry *victim, bool isdir)
2736 {
2737     struct inode *inode = d_backing_inode(victim);
2738     int error;
2739 
2740     if (d_is_negative(victim))
2741         return -ENOENT;
2742     BUG_ON(!inode);
2743 
2744     BUG_ON(victim->d_parent->d_inode != dir);
2745     audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE);
2746 
2747     error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
2748     if (error)
2749         return error;
2750     if (IS_APPEND(dir))
2751         return -EPERM;
2752 
2753     if (check_sticky(dir, inode) || IS_APPEND(inode) ||
2754         IS_IMMUTABLE(inode) || IS_SWAPFILE(inode) || HAS_UNMAPPED_ID(inode))
2755         return -EPERM;
2756     if (isdir) {
2757         if (!d_is_dir(victim))
2758             return -ENOTDIR;
2759         if (IS_ROOT(victim))
2760             return -EBUSY;
2761     } else if (d_is_dir(victim))
2762         return -EISDIR;
2763     if (IS_DEADDIR(dir))
2764         return -ENOENT;
2765     if (victim->d_flags & DCACHE_NFSFS_RENAMED)
2766         return -EBUSY;
2767     return 0;
2768 }
2769 
2770 /*  Check whether we can create an object with dentry child in directory
2771  *  dir.
2772  *  1. We can't do it if child already exists (open has special treatment for
2773  *     this case, but since we are inlined it's OK)
2774  *  2. We can't do it if dir is read-only (done in permission())
2775  *  3. We can't do it if the fs can't represent the fsuid or fsgid.
2776  *  4. We should have write and exec permissions on dir
2777  *  5. We can't do it if dir is immutable (done in permission())
2778  */
2779 static inline int may_create(struct inode *dir, struct dentry *child)
2780 {
2781     struct user_namespace *s_user_ns;
2782     audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE);
2783     if (child->d_inode)
2784         return -EEXIST;
2785     if (IS_DEADDIR(dir))
2786         return -ENOENT;
2787     s_user_ns = dir->i_sb->s_user_ns;
2788     if (!kuid_has_mapping(s_user_ns, current_fsuid()) ||
2789         !kgid_has_mapping(s_user_ns, current_fsgid()))
2790         return -EOVERFLOW;
2791     return inode_permission(dir, MAY_WRITE | MAY_EXEC);
2792 }
2793 
2794 /*
2795  * p1 and p2 should be directories on the same fs.
2796  */
2797 struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
2798 {
2799     struct dentry *p;
2800 
2801     if (p1 == p2) {
2802         inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
2803         return NULL;
2804     }
2805 
2806     mutex_lock(&p1->d_sb->s_vfs_rename_mutex);
2807 
2808     p = d_ancestor(p2, p1);
2809     if (p) {
2810         inode_lock_nested(p2->d_inode, I_MUTEX_PARENT);
2811         inode_lock_nested(p1->d_inode, I_MUTEX_CHILD);
2812         return p;
2813     }
2814 
2815     p = d_ancestor(p1, p2);
2816     if (p) {
2817         inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
2818         inode_lock_nested(p2->d_inode, I_MUTEX_CHILD);
2819         return p;
2820     }
2821 
2822     inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
2823     inode_lock_nested(p2->d_inode, I_MUTEX_PARENT2);
2824     return NULL;
2825 }
2826 EXPORT_SYMBOL(lock_rename);
2827 
2828 void unlock_rename(struct dentry *p1, struct dentry *p2)
2829 {
2830     inode_unlock(p1->d_inode);
2831     if (p1 != p2) {
2832         inode_unlock(p2->d_inode);
2833         mutex_unlock(&p1->d_sb->s_vfs_rename_mutex);
2834     }
2835 }
2836 EXPORT_SYMBOL(unlock_rename);
2837 
2838 int vfs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
2839         bool want_excl)
2840 {
2841     int error = may_create(dir, dentry);
2842     if (error)
2843         return error;
2844 
2845     if (!dir->i_op->create)
2846         return -EACCES; /* shouldn't it be ENOSYS? */
2847     mode &= S_IALLUGO;
2848     mode |= S_IFREG;
2849     error = security_inode_create(dir, dentry, mode);
2850     if (error)
2851         return error;
2852     error = dir->i_op->create(dir, dentry, mode, want_excl);
2853     if (!error)
2854         fsnotify_create(dir, dentry);
2855     return error;
2856 }
2857 EXPORT_SYMBOL(vfs_create);
2858 
2859 bool may_open_dev(const struct path *path)
2860 {
2861     return !(path->mnt->mnt_flags & MNT_NODEV) &&
2862         !(path->mnt->mnt_sb->s_iflags & SB_I_NODEV);
2863 }
2864 
2865 static int may_open(const struct path *path, int acc_mode, int flag)
2866 {
2867     struct dentry *dentry = path->dentry;
2868     struct inode *inode = dentry->d_inode;
2869     int error;
2870 
2871     if (!inode)
2872         return -ENOENT;
2873 
2874     switch (inode->i_mode & S_IFMT) {
2875     case S_IFLNK:
2876         return -ELOOP;
2877     case S_IFDIR:
2878         if (acc_mode & MAY_WRITE)
2879             return -EISDIR;
2880         break;
2881     case S_IFBLK:
2882     case S_IFCHR:
2883         if (!may_open_dev(path))
2884             return -EACCES;
2885         /*FALLTHRU*/
2886     case S_IFIFO:
2887     case S_IFSOCK:
2888         flag &= ~O_TRUNC;
2889         break;
2890     }
2891 
2892     error = inode_permission(inode, MAY_OPEN | acc_mode);
2893     if (error)
2894         return error;
2895 
2896     /*
2897      * An append-only file must be opened in append mode for writing.
2898      */
2899     if (IS_APPEND(inode)) {
2900         if  ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND))
2901             return -EPERM;
2902         if (flag & O_TRUNC)
2903             return -EPERM;
2904     }
2905 
2906     /* O_NOATIME can only be set by the owner or superuser */
2907     if (flag & O_NOATIME && !inode_owner_or_capable(inode))
2908         return -EPERM;
2909 
2910     return 0;
2911 }
2912 
2913 static int handle_truncate(struct file *filp)
2914 {
2915     const struct path *path = &filp->f_path;
2916     struct inode *inode = path->dentry->d_inode;
2917     int error = get_write_access(inode);
2918     if (error)
2919         return error;
2920     /*
2921      * Refuse to truncate files with mandatory locks held on them.
2922      */
2923     error = locks_verify_locked(filp);
2924     if (!error)
2925         error = security_path_truncate(path);
2926     if (!error) {
2927         error = do_truncate(path->dentry, 0,
2928                     ATTR_MTIME|ATTR_CTIME|ATTR_OPEN,
2929                     filp);
2930     }
2931     put_write_access(inode);
2932     return error;
2933 }
2934 
2935 static inline int open_to_namei_flags(int flag)
2936 {
2937     if ((flag & O_ACCMODE) == 3)
2938         flag--;
2939     return flag;
2940 }
2941 
2942 static int may_o_create(const struct path *dir, struct dentry *dentry, umode_t mode)
2943 {
2944     int error = security_path_mknod(dir, dentry, mode, 0);
2945     if (error)
2946         return error;
2947 
2948     error = inode_permission(dir->dentry->d_inode, MAY_WRITE | MAY_EXEC);
2949     if (error)
2950         return error;
2951 
2952     return security_inode_create(dir->dentry->d_inode, dentry, mode);
2953 }
2954 
2955 /*
2956  * Attempt to atomically look up, create and open a file from a negative
2957  * dentry.
2958  *
2959  * Returns 0 if successful.  The file will have been created and attached to
2960  * @file by the filesystem calling finish_open().
2961  *
2962  * Returns 1 if the file was looked up only or didn't need creating.  The
2963  * caller will need to perform the open themselves.  @path will have been
2964  * updated to point to the new dentry.  This may be negative.
2965  *
2966  * Returns an error code otherwise.
2967  */
2968 static int atomic_open(struct nameidata *nd, struct dentry *dentry,
2969             struct path *path, struct file *file,
2970             const struct open_flags *op,
2971             int open_flag, umode_t mode,
2972             int *opened)
2973 {
2974     struct dentry *const DENTRY_NOT_SET = (void *) -1UL;
2975     struct inode *dir =  nd->path.dentry->d_inode;
2976     int error;
2977 
2978     if (!(~open_flag & (O_EXCL | O_CREAT))) /* both O_EXCL and O_CREAT */
2979         open_flag &= ~O_TRUNC;
2980 
2981     if (nd->flags & LOOKUP_DIRECTORY)
2982         open_flag |= O_DIRECTORY;
2983 
2984     file->f_path.dentry = DENTRY_NOT_SET;
2985     file->f_path.mnt = nd->path.mnt;
2986     error = dir->i_op->atomic_open(dir, dentry, file,
2987                        open_to_namei_flags(open_flag),
2988                        mode, opened);
2989     d_lookup_done(dentry);
2990     if (!error) {
2991         /*
2992          * We didn't have the inode before the open, so check open
2993          * permission here.
2994          */
2995         int acc_mode = op->acc_mode;
2996         if (*opened & FILE_CREATED) {
2997             WARN_ON(!(open_flag & O_CREAT));
2998             fsnotify_create(dir, dentry);
2999             acc_mode = 0;
3000         }
3001         error = may_open(&file->f_path, acc_mode, open_flag);
3002         if (WARN_ON(error > 0))
3003             error = -EINVAL;
3004     } else if (error > 0) {
3005         if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) {
3006             error = -EIO;
3007         } else {
3008             if (file->f_path.dentry) {
3009                 dput(dentry);
3010                 dentry = file->f_path.dentry;
3011             }
3012             if (*opened & FILE_CREATED)
3013                 fsnotify_create(dir, dentry);
3014             if (unlikely(d_is_negative(dentry))) {
3015                 error = -ENOENT;
3016             } else {
3017                 path->dentry = dentry;
3018                 path->mnt = nd->path.mnt;
3019                 return 1;
3020             }
3021         }
3022     }
3023     dput(dentry);
3024     return error;
3025 }
3026 
3027 /*
3028  * Look up and maybe create and open the last component.
3029  *
3030  * Must be called with i_mutex held on parent.
3031  *
3032  * Returns 0 if the file was successfully atomically created (if necessary) and
3033  * opened.  In this case the file will be returned attached to @file.
3034  *
3035  * Returns 1 if the file was not completely opened at this time, though lookups
3036  * and creations will have been performed and the dentry returned in @path will
3037  * be positive upon return if O_CREAT was specified.  If O_CREAT wasn't
3038  * specified then a negative dentry may be returned.
3039  *
3040  * An error code is returned otherwise.
3041  *
3042  * FILE_CREATE will be set in @*opened if the dentry was created and will be
3043  * cleared otherwise prior to returning.
3044  */
3045 static int lookup_open(struct nameidata *nd, struct path *path,
3046             struct file *file,
3047             const struct open_flags *op,
3048             bool got_write, int *opened)
3049 {
3050     struct dentry *dir = nd->path.dentry;
3051     struct inode *dir_inode = dir->d_inode;
3052     int open_flag = op->open_flag;
3053     struct dentry *dentry;
3054     int error, create_error = 0;
3055     umode_t mode = op->mode;
3056     DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
3057 
3058     if (unlikely(IS_DEADDIR(dir_inode)))
3059         return -ENOENT;
3060 
3061     *opened &= ~FILE_CREATED;
3062     dentry = d_lookup(dir, &nd->last);
3063     for (;;) {
3064         if (!dentry) {
3065             dentry = d_alloc_parallel(dir, &nd->last, &wq);
3066             if (IS_ERR(dentry))
3067                 return PTR_ERR(dentry);
3068         }
3069         if (d_in_lookup(dentry))
3070             break;
3071 
3072         if (!(dentry->d_flags & DCACHE_OP_REVALIDATE))
3073             break;
3074 
3075         error = d_revalidate(dentry, nd->flags);
3076         if (likely(error > 0))
3077             break;
3078         if (error)
3079             goto out_dput;
3080         d_invalidate(dentry);
3081         dput(dentry);
3082         dentry = NULL;
3083     }
3084     if (dentry->d_inode) {
3085         /* Cached positive dentry: will open in f_op->open */
3086         goto out_no_open;
3087     }
3088 
3089     /*
3090      * Checking write permission is tricky, bacuse we don't know if we are
3091      * going to actually need it: O_CREAT opens should work as long as the
3092      * file exists.  But checking existence breaks atomicity.  The trick is
3093      * to check access and if not granted clear O_CREAT from the flags.
3094      *
3095      * Another problem is returing the "right" error value (e.g. for an
3096      * O_EXCL open we want to return EEXIST not EROFS).
3097      */
3098     if (open_flag & O_CREAT) {
3099         if (!IS_POSIXACL(dir->d_inode))
3100             mode &= ~current_umask();
3101         if (unlikely(!got_write)) {
3102             create_error = -EROFS;
3103             open_flag &= ~O_CREAT;
3104             if (open_flag & (O_EXCL | O_TRUNC))
3105                 goto no_open;
3106             /* No side effects, safe to clear O_CREAT */
3107         } else {
3108             create_error = may_o_create(&nd->path, dentry, mode);
3109             if (create_error) {
3110                 open_flag &= ~O_CREAT;
3111                 if (open_flag & O_EXCL)
3112                     goto no_open;
3113             }
3114         }
3115     } else if ((open_flag & (O_TRUNC|O_WRONLY|O_RDWR)) &&
3116            unlikely(!got_write)) {
3117         /*
3118          * No O_CREATE -> atomicity not a requirement -> fall
3119          * back to lookup + open
3120          */
3121         goto no_open;
3122     }
3123 
3124     if (dir_inode->i_op->atomic_open) {
3125         error = atomic_open(nd, dentry, path, file, op, open_flag,
3126                     mode, opened);
3127         if (unlikely(error == -ENOENT) && create_error)
3128             error = create_error;
3129         return error;
3130     }
3131 
3132 no_open:
3133     if (d_in_lookup(dentry)) {
3134         struct dentry *res = dir_inode->i_op->lookup(dir_inode, dentry,
3135                                  nd->flags);
3136         d_lookup_done(dentry);
3137         if (unlikely(res)) {
3138             if (IS_ERR(res)) {
3139                 error = PTR_ERR(res);
3140                 goto out_dput;
3141             }
3142             dput(dentry);
3143             dentry = res;
3144         }
3145     }
3146 
3147     /* Negative dentry, just create the file */
3148     if (!dentry->d_inode && (open_flag & O_CREAT)) {
3149         *opened |= FILE_CREATED;
3150         audit_inode_child(dir_inode, dentry, AUDIT_TYPE_CHILD_CREATE);
3151         if (!dir_inode->i_op->create) {
3152             error = -EACCES;
3153             goto out_dput;
3154         }
3155         error = dir_inode->i_op->create(dir_inode, dentry, mode,
3156                         open_flag & O_EXCL);
3157         if (error)
3158             goto out_dput;
3159         fsnotify_create(dir_inode, dentry);
3160     }
3161     if (unlikely(create_error) && !dentry->d_inode) {
3162         error = create_error;
3163         goto out_dput;
3164     }
3165 out_no_open:
3166     path->dentry = dentry;
3167     path->mnt = nd->path.mnt;
3168     return 1;
3169 
3170 out_dput:
3171     dput(dentry);
3172     return error;
3173 }
3174 
3175 /*
3176  * Handle the last step of open()
3177  */
3178 static int do_last(struct nameidata *nd,
3179            struct file *file, const struct open_flags *op,
3180            int *opened)
3181 {
3182     struct dentry *dir = nd->path.dentry;
3183     int open_flag = op->open_flag;
3184     bool will_truncate = (open_flag & O_TRUNC) != 0;
3185     bool got_write = false;
3186     int acc_mode = op->acc_mode;
3187     unsigned seq;
3188     struct inode *inode;
3189     struct path path;
3190     int error;
3191 
3192     nd->flags &= ~LOOKUP_PARENT;
3193     nd->flags |= op->intent;
3194 
3195     if (nd->last_type != LAST_NORM) {
3196         error = handle_dots(nd, nd->last_type);
3197         if (unlikely(error))
3198             return error;
3199         goto finish_open;
3200     }
3201 
3202     if (!(open_flag & O_CREAT)) {
3203         if (nd->last.name[nd->last.len])
3204             nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
3205         /* we _can_ be in RCU mode here */
3206         error = lookup_fast(nd, &path, &inode, &seq);
3207         if (likely(error > 0))
3208             goto finish_lookup;
3209 
3210         if (error < 0)
3211             return error;
3212 
3213         BUG_ON(nd->inode != dir->d_inode);
3214         BUG_ON(nd->flags & LOOKUP_RCU);
3215     } else {
3216         /* create side of things */
3217         /*
3218          * This will *only* deal with leaving RCU mode - LOOKUP_JUMPED
3219          * has been cleared when we got to the last component we are
3220          * about to look up
3221          */
3222         error = complete_walk(nd);
3223         if (error)
3224             return error;
3225 
3226         audit_inode(nd->name, dir, LOOKUP_PARENT);
3227         /* trailing slashes? */
3228         if (unlikely(nd->last.name[nd->last.len]))
3229             return -EISDIR;
3230     }
3231 
3232     if (open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) {
3233         error = mnt_want_write(nd->path.mnt);
3234         if (!error)
3235             got_write = true;
3236         /*
3237          * do _not_ fail yet - we might not need that or fail with
3238          * a different error; let lookup_open() decide; we'll be
3239          * dropping this one anyway.
3240          */
3241     }
3242     if (open_flag & O_CREAT)
3243         inode_lock(dir->d_inode);
3244     else
3245         inode_lock_shared(dir->d_inode);
3246     error = lookup_open(nd, &path, file, op, got_write, opened);
3247     if (open_flag & O_CREAT)
3248         inode_unlock(dir->d_inode);
3249     else
3250         inode_unlock_shared(dir->d_inode);
3251 
3252     if (error <= 0) {
3253         if (error)
3254             goto out;
3255 
3256         if ((*opened & FILE_CREATED) ||
3257             !S_ISREG(file_inode(file)->i_mode))
3258             will_truncate = false;
3259 
3260         audit_inode(nd->name, file->f_path.dentry, 0);
3261         goto opened;
3262     }
3263 
3264     if (*opened & FILE_CREATED) {
3265         /* Don't check for write permission, don't truncate */
3266         open_flag &= ~O_TRUNC;
3267         will_truncate = false;
3268         acc_mode = 0;
3269         path_to_nameidata(&path, nd);
3270         goto finish_open_created;
3271     }
3272 
3273     /*
3274      * If atomic_open() acquired write access it is dropped now due to
3275      * possible mount and symlink following (this might be optimized away if
3276      * necessary...)
3277      */
3278     if (got_write) {
3279         mnt_drop_write(nd->path.mnt);
3280         got_write = false;
3281     }
3282 
3283     error = follow_managed(&path, nd);
3284     if (unlikely(error < 0))
3285         return error;
3286 
3287     if (unlikely(d_is_negative(path.dentry))) {
3288         path_to_nameidata(&path, nd);
3289         return -ENOENT;
3290     }
3291 
3292     /*
3293      * create/update audit record if it already exists.
3294      */
3295     audit_inode(nd->name, path.dentry, 0);
3296 
3297     if (unlikely((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT))) {
3298         path_to_nameidata(&path, nd);
3299         return -EEXIST;
3300     }
3301 
3302     seq = 0;    /* out of RCU mode, so the value doesn't matter */
3303     inode = d_backing_inode(path.dentry);
3304 finish_lookup:
3305     error = step_into(nd, &path, 0, inode, seq);
3306     if (unlikely(error))
3307         return error;
3308 finish_open:
3309     /* Why this, you ask?  _Now_ we might have grown LOOKUP_JUMPED... */
3310     error = complete_walk(nd);
3311     if (error)
3312         return error;
3313     audit_inode(nd->name, nd->path.dentry, 0);
3314     error = -EISDIR;
3315     if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry))
3316         goto out;
3317     error = -ENOTDIR;
3318     if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry))
3319         goto out;
3320     if (!d_is_reg(nd->path.dentry))
3321         will_truncate = false;
3322 
3323     if (will_truncate) {
3324         error = mnt_want_write(nd->path.mnt);
3325         if (error)
3326             goto out;
3327         got_write = true;
3328     }
3329 finish_open_created:
3330     error = may_open(&nd->path, acc_mode, open_flag);
3331     if (error)
3332         goto out;
3333     BUG_ON(*opened & FILE_OPENED); /* once it's opened, it's opened */
3334     error = vfs_open(&nd->path, file, current_cred());
3335     if (error)
3336         goto out;
3337     *opened |= FILE_OPENED;
3338 opened:
3339     error = open_check_o_direct(file);
3340     if (!error)
3341         error = ima_file_check(file, op->acc_mode, *opened);
3342     if (!error && will_truncate)
3343         error = handle_truncate(file);
3344 out:
3345     if (unlikely(error) && (*opened & FILE_OPENED))
3346         fput(file);
3347     if (unlikely(error > 0)) {
3348         WARN_ON(1);
3349         error = -EINVAL;
3350     }
3351     if (got_write)
3352         mnt_drop_write(nd->path.mnt);
3353     return error;
3354 }
3355 
3356 static int do_tmpfile(struct nameidata *nd, unsigned flags,
3357         const struct open_flags *op,
3358         struct file *file, int *opened)
3359 {
3360     static const struct qstr name = QSTR_INIT("/", 1);
3361     struct dentry *child;
3362     struct inode *dir;
3363     struct path path;
3364     int error = path_lookupat(nd, flags | LOOKUP_DIRECTORY, &path);
3365     if (unlikely(error))
3366         return error;
3367     error = mnt_want_write(path.mnt);
3368     if (unlikely(error))
3369         goto out;
3370     dir = path.dentry->d_inode;
3371     /* we want directory to be writable */
3372     error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
3373     if (error)
3374         goto out2;
3375     if (!dir->i_op->tmpfile) {
3376         error = -EOPNOTSUPP;
3377         goto out2;
3378     }
3379     child = d_alloc(path.dentry, &name);
3380     if (unlikely(!child)) {
3381         error = -ENOMEM;
3382         goto out2;
3383     }
3384     dput(path.dentry);
3385     path.dentry = child;
3386     error = dir->i_op->tmpfile(dir, child, op->mode);
3387     if (error)
3388         goto out2;
3389     audit_inode(nd->name, child, 0);
3390     /* Don't check for other permissions, the inode was just created */
3391     error = may_open(&path, 0, op->open_flag);
3392     if (error)
3393         goto out2;
3394     file->f_path.mnt = path.mnt;
3395     error = finish_open(file, child, NULL, opened);
3396     if (error)
3397         goto out2;
3398     error = open_check_o_direct(file);
3399     if (error) {
3400         fput(file);
3401     } else if (!(op->open_flag & O_EXCL)) {
3402         struct inode *inode = file_inode(file);
3403         spin_lock(&inode->i_lock);
3404         inode->i_state |= I_LINKABLE;
3405         spin_unlock(&inode->i_lock);
3406     }
3407 out2:
3408     mnt_drop_write(path.mnt);
3409 out:
3410     path_put(&path);
3411     return error;
3412 }
3413 
3414 static int do_o_path(struct nameidata *nd, unsigned flags, struct file *file)
3415 {
3416     struct path path;
3417     int error = path_lookupat(nd, flags, &path);
3418     if (!error) {
3419         audit_inode(nd->name, path.dentry, 0);
3420         error = vfs_open(&path, file, current_cred());
3421         path_put(&path);
3422     }
3423     return error;
3424 }
3425 
3426 static struct file *path_openat(struct nameidata *nd,
3427             const struct open_flags *op, unsigned flags)
3428 {
3429     const char *s;
3430     struct file *file;
3431     int opened = 0;
3432     int error;
3433 
3434     file = get_empty_filp();
3435     if (IS_ERR(file))
3436         return file;
3437 
3438     file->f_flags = op->open_flag;
3439 
3440     if (unlikely(file->f_flags & __O_TMPFILE)) {
3441         error = do_tmpfile(nd, flags, op, file, &opened);
3442         goto out2;
3443     }
3444 
3445     if (unlikely(file->f_flags & O_PATH)) {
3446         error = do_o_path(nd, flags, file);
3447         if (!error)
3448             opened |= FILE_OPENED;
3449         goto out2;
3450     }
3451 
3452     s = path_init(nd, flags);
3453     if (IS_ERR(s)) {
3454         put_filp(file);
3455         return ERR_CAST(s);
3456     }
3457     while (!(error = link_path_walk(s, nd)) &&
3458         (error = do_last(nd, file, op, &opened)) > 0) {
3459         nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL);
3460         s = trailing_symlink(nd);
3461         if (IS_ERR(s)) {
3462             error = PTR_ERR(s);
3463             break;
3464         }
3465     }
3466     terminate_walk(nd);
3467 out2:
3468     if (!(opened & FILE_OPENED)) {
3469         BUG_ON(!error);
3470         put_filp(file);
3471     }
3472     if (unlikely(error)) {
3473         if (error == -EOPENSTALE) {
3474             if (flags & LOOKUP_RCU)
3475                 error = -ECHILD;
3476             else
3477                 error = -ESTALE;
3478         }
3479         file = ERR_PTR(error);
3480     }
3481     return file;
3482 }
3483 
3484 struct file *do_filp_open(int dfd, struct filename *pathname,
3485         const struct open_flags *op)
3486 {
3487     struct nameidata nd;
3488     int flags = op->lookup_flags;
3489     struct file *filp;
3490 
3491     set_nameidata(&nd, dfd, pathname);
3492     filp = path_openat(&nd, op, flags | LOOKUP_RCU);
3493     if (unlikely(filp == ERR_PTR(-ECHILD)))
3494         filp = path_openat(&nd, op, flags);
3495     if (unlikely(filp == ERR_PTR(-ESTALE)))
3496         filp = path_openat(&nd, op, flags | LOOKUP_REVAL);
3497     restore_nameidata();
3498     return filp;
3499 }
3500 
3501 struct file *do_file_open_root(struct dentry *dentry, struct vfsmount *mnt,
3502         const char *name, const struct open_flags *op)
3503 {
3504     struct nameidata nd;
3505     struct file *file;
3506     struct filename *filename;
3507     int flags = op->lookup_flags | LOOKUP_ROOT;
3508 
3509     nd.root.mnt = mnt;
3510     nd.root.dentry = dentry;
3511 
3512     if (d_is_symlink(dentry) && op->intent & LOOKUP_OPEN)
3513         return ERR_PTR(-ELOOP);
3514 
3515     filename = getname_kernel(name);
3516     if (IS_ERR(filename))
3517         return ERR_CAST(filename);
3518 
3519     set_nameidata(&nd, -1, filename);
3520     file = path_openat(&nd, op, flags | LOOKUP_RCU);
3521     if (unlikely(file == ERR_PTR(-ECHILD)))
3522         file = path_openat(&nd, op, flags);
3523     if (unlikely(file == ERR_PTR(-ESTALE)))
3524         file = path_openat(&nd, op, flags | LOOKUP_REVAL);
3525     restore_nameidata();
3526     putname(filename);
3527     return file;
3528 }
3529 
3530 static struct dentry *filename_create(int dfd, struct filename *name,
3531                 struct path *path, unsigned int lookup_flags)
3532 {
3533     struct dentry *dentry = ERR_PTR(-EEXIST);
3534     struct qstr last;
3535     int type;
3536     int err2;
3537     int error;
3538     bool is_dir = (lookup_flags & LOOKUP_DIRECTORY);
3539 
3540     /*
3541      * Note that only LOOKUP_REVAL and LOOKUP_DIRECTORY matter here. Any
3542      * other flags passed in are ignored!
3543      */
3544     lookup_flags &= LOOKUP_REVAL;
3545 
3546     name = filename_parentat(dfd, name, lookup_flags, path, &last, &type);
3547     if (IS_ERR(name))
3548         return ERR_CAST(name);
3549 
3550     /*
3551      * Yucky last component or no last component at all?
3552      * (foo/., foo/.., /////)
3553      */
3554     if (unlikely(type != LAST_NORM))
3555         goto out;
3556 
3557     /* don't fail immediately if it's r/o, at least try to report other errors */
3558     err2 = mnt_want_write(path->mnt);
3559     /*
3560      * Do the final lookup.
3561      */
3562     lookup_flags |= LOOKUP_CREATE | LOOKUP_EXCL;
3563     inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
3564     dentry = __lookup_hash(&last, path->dentry, lookup_flags);
3565     if (IS_ERR(dentry))
3566         goto unlock;
3567 
3568     error = -EEXIST;
3569     if (d_is_positive(dentry))
3570         goto fail;
3571 
3572     /*
3573      * Special case - lookup gave negative, but... we had foo/bar/
3574      * From the vfs_mknod() POV we just have a negative dentry -
3575      * all is fine. Let's be bastards - you had / on the end, you've
3576      * been asking for (non-existent) directory. -ENOENT for you.
3577      */
3578     if (unlikely(!is_dir && last.name[last.len])) {
3579         error = -ENOENT;
3580         goto fail;
3581     }
3582     if (unlikely(err2)) {
3583         error = err2;
3584         goto fail;
3585     }
3586     putname(name);
3587     return dentry;
3588 fail:
3589     dput(dentry);
3590     dentry = ERR_PTR(error);
3591 unlock:
3592     inode_unlock(path->dentry->d_inode);
3593     if (!err2)
3594         mnt_drop_write(path->mnt);
3595 out:
3596     path_put(path);
3597     putname(name);
3598     return dentry;
3599 }
3600 
3601 struct dentry *kern_path_create(int dfd, const char *pathname,
3602                 struct path *path, unsigned int lookup_flags)
3603 {
3604     return filename_create(dfd, getname_kernel(pathname),
3605                 path, lookup_flags);
3606 }
3607 EXPORT_SYMBOL(kern_path_create);
3608 
3609 void done_path_create(struct path *path, struct dentry *dentry)
3610 {
3611     dput(dentry);
3612     inode_unlock(path->dentry->d_inode);
3613     mnt_drop_write(path->mnt);
3614     path_put(path);
3615 }
3616 EXPORT_SYMBOL(done_path_create);
3617 
3618 inline struct dentry *user_path_create(int dfd, const char __user *pathname,
3619                 struct path *path, unsigned int lookup_flags)
3620 {
3621     return filename_create(dfd, getname(pathname), path, lookup_flags);
3622 }
3623 EXPORT_SYMBOL(user_path_create);
3624 
3625 int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3626 {
3627     int error = may_create(dir, dentry);
3628 
3629     if (error)
3630         return error;
3631 
3632     if ((S_ISCHR(mode) || S_ISBLK(mode)) && !capable(CAP_MKNOD))
3633         return -EPERM;
3634 
3635     if (!dir->i_op->mknod)
3636         return -EPERM;
3637 
3638     error = devcgroup_inode_mknod(mode, dev);
3639     if (error)
3640         return error;
3641 
3642     error = security_inode_mknod(dir, dentry, mode, dev);
3643     if (error)
3644         return error;
3645 
3646     error = dir->i_op->mknod(dir, dentry, mode, dev);
3647     if (!error)
3648         fsnotify_create(dir, dentry);
3649     return error;
3650 }
3651 EXPORT_SYMBOL(vfs_mknod);
3652 
3653 static int may_mknod(umode_t mode)
3654 {
3655     switch (mode & S_IFMT) {
3656     case S_IFREG:
3657     case S_IFCHR:
3658     case S_IFBLK:
3659     case S_IFIFO:
3660     case S_IFSOCK:
3661     case 0: /* zero mode translates to S_IFREG */
3662         return 0;
3663     case S_IFDIR:
3664         return -EPERM;
3665     default:
3666         return -EINVAL;
3667     }
3668 }
3669 
3670 SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode,
3671         unsigned, dev)
3672 {
3673     struct dentry *dentry;
3674     struct path path;
3675     int error;
3676     unsigned int lookup_flags = 0;
3677 
3678     error = may_mknod(mode);
3679     if (error)
3680         return error;
3681 retry:
3682     dentry = user_path_create(dfd, filename, &path, lookup_flags);
3683     if (IS_ERR(dentry))
3684         return PTR_ERR(dentry);
3685 
3686     if (!IS_POSIXACL(path.dentry->d_inode))
3687         mode &= ~current_umask();
3688     error = security_path_mknod(&path, dentry, mode, dev);
3689     if (error)
3690         goto out;
3691     switch (mode & S_IFMT) {
3692         case 0: case S_IFREG:
3693             error = vfs_create(path.dentry->d_inode,dentry,mode,true);
3694             if (!error)
3695                 ima_post_path_mknod(dentry);
3696             break;
3697         case S_IFCHR: case S_IFBLK:
3698             error = vfs_mknod(path.dentry->d_inode,dentry,mode,
3699                     new_decode_dev(dev));
3700             break;
3701         case S_IFIFO: case S_IFSOCK:
3702             error = vfs_mknod(path.dentry->d_inode,dentry,mode,0);
3703             break;
3704     }
3705 out:
3706     done_path_create(&path, dentry);
3707     if (retry_estale(error, lookup_flags)) {
3708         lookup_flags |= LOOKUP_REVAL;
3709         goto retry;
3710     }
3711     return error;
3712 }
3713 
3714 SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev)
3715 {
3716     return sys_mknodat(AT_FDCWD, filename, mode, dev);
3717 }
3718 
3719 int vfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
3720 {
3721     int error = may_create(dir, dentry);
3722     unsigned max_links = dir->i_sb->s_max_links;
3723 
3724     if (error)
3725         return error;
3726 
3727     if (!dir->i_op->mkdir)
3728         return -EPERM;
3729 
3730     mode &= (S_IRWXUGO|S_ISVTX);
3731     error = security_inode_mkdir(dir, dentry, mode);
3732     if (error)
3733         return error;
3734 
3735     if (max_links && dir->i_nlink >= max_links)
3736         return -EMLINK;
3737 
3738     error = dir->i_op->mkdir(dir, dentry, mode);
3739     if (!error)
3740         fsnotify_mkdir(dir, dentry);
3741     return error;
3742 }
3743 EXPORT_SYMBOL(vfs_mkdir);
3744 
3745 SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode)
3746 {
3747     struct dentry *dentry;
3748     struct path path;
3749     int error;
3750     unsigned int lookup_flags = LOOKUP_DIRECTORY;
3751 
3752 retry:
3753     dentry = user_path_create(dfd, pathname, &path, lookup_flags);
3754     if (IS_ERR(dentry))
3755         return PTR_ERR(dentry);
3756 
3757     if (!IS_POSIXACL(path.dentry->d_inode))
3758         mode &= ~current_umask();
3759     error = security_path_mkdir(&path, dentry, mode);
3760     if (!error)
3761         error = vfs_mkdir(path.dentry->d_inode, dentry, mode);
3762     done_path_create(&path, dentry);
3763     if (retry_estale(error, lookup_flags)) {
3764         lookup_flags |= LOOKUP_REVAL;
3765         goto retry;
3766     }
3767     return error;
3768 }
3769 
3770 SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode)
3771 {
3772     return sys_mkdirat(AT_FDCWD, pathname, mode);
3773 }
3774 
3775 int vfs_rmdir(struct inode *dir, struct dentry *dentry)
3776 {
3777     int error = may_delete(dir, dentry, 1);
3778 
3779     if (error)
3780         return error;
3781 
3782     if (!dir->i_op->rmdir)
3783         return -EPERM;
3784 
3785     dget(dentry);
3786     inode_lock(dentry->d_inode);
3787 
3788     error = -EBUSY;
3789     if (is_local_mountpoint(dentry))
3790         goto out;
3791 
3792     error = security_inode_rmdir(dir, dentry);
3793     if (error)
3794         goto out;
3795 
3796     shrink_dcache_parent(dentry);
3797     error = dir->i_op->rmdir(dir, dentry);
3798     if (error)
3799         goto out;
3800 
3801     dentry->d_inode->i_flags |= S_DEAD;
3802     dont_mount(dentry);
3803     detach_mounts(dentry);
3804 
3805 out:
3806     inode_unlock(dentry->d_inode);
3807     dput(dentry);
3808     if (!error)
3809         d_delete(dentry);
3810     return error;
3811 }
3812 EXPORT_SYMBOL(vfs_rmdir);
3813 
3814 static long do_rmdir(int dfd, const char __user *pathname)
3815 {
3816     int error = 0;
3817     struct filename *name;
3818     struct dentry *dentry;
3819     struct path path;
3820     struct qstr last;
3821     int type;
3822     unsigned int lookup_flags = 0;
3823 retry:
3824     name = filename_parentat(dfd, getname(pathname), lookup_flags,
3825                 &path, &last, &type);
3826     if (IS_ERR(name))
3827         return PTR_ERR(name);
3828 
3829     switch (type) {
3830     case LAST_DOTDOT:
3831         error = -ENOTEMPTY;
3832         goto exit1;
3833     case LAST_DOT:
3834         error = -EINVAL;
3835         goto exit1;
3836     case LAST_ROOT:
3837         error = -EBUSY;
3838         goto exit1;
3839     }
3840 
3841     error = mnt_want_write(path.mnt);
3842     if (error)
3843         goto exit1;
3844 
3845     inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
3846     dentry = __lookup_hash(&last, path.dentry, lookup_flags);
3847     error = PTR_ERR(dentry);
3848     if (IS_ERR(dentry))
3849         goto exit2;
3850     if (!dentry->d_inode) {
3851         error = -ENOENT;
3852         goto exit3;
3853     }
3854     error = security_path_rmdir(&path, dentry);
3855     if (error)
3856         goto exit3;
3857     error = vfs_rmdir(path.dentry->d_inode, dentry);
3858 exit3:
3859     dput(dentry);
3860 exit2:
3861     inode_unlock(path.dentry->d_inode);
3862     mnt_drop_write(path.mnt);
3863 exit1:
3864     path_put(&path);
3865     putname(name);
3866     if (retry_estale(error, lookup_flags)) {
3867         lookup_flags |= LOOKUP_REVAL;
3868         goto retry;
3869     }
3870     return error;
3871 }
3872 
3873 SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
3874 {
3875     return do_rmdir(AT_FDCWD, pathname);
3876 }
3877 
3878 /**
3879  * vfs_unlink - unlink a filesystem object
3880  * @dir:    parent directory
3881  * @dentry: victim
3882  * @delegated_inode: returns victim inode, if the inode is delegated.
3883  *
3884  * The caller must hold dir->i_mutex.
3885  *
3886  * If vfs_unlink discovers a delegation, it will return -EWOULDBLOCK and
3887  * return a reference to the inode in delegated_inode.  The caller
3888  * should then break the delegation on that inode and retry.  Because
3889  * breaking a delegation may take a long time, the caller should drop
3890  * dir->i_mutex before doing so.
3891  *
3892  * Alternatively, a caller may pass NULL for delegated_inode.  This may
3893  * be appropriate for callers that expect the underlying filesystem not
3894  * to be NFS exported.
3895  */
3896 int vfs_unlink(struct inode *dir, struct dentry *dentry, struct inode **delegated_inode)
3897 {
3898     struct inode *target = dentry->d_inode;
3899     int error = may_delete(dir, dentry, 0);
3900 
3901     if (error)
3902         return error;
3903 
3904     if (!dir->i_op->unlink)
3905         return -EPERM;
3906 
3907     inode_lock(target);
3908     if (is_local_mountpoint(dentry))
3909         error = -EBUSY;
3910     else {
3911         error = security_inode_unlink(dir, dentry);
3912         if (!error) {
3913             error = try_break_deleg(target, delegated_inode);
3914             if (error)
3915                 goto out;
3916             error = dir->i_op->unlink(dir, dentry);
3917             if (!error) {
3918                 dont_mount(dentry);
3919                 detach_mounts(dentry);
3920             }
3921         }
3922     }
3923 out:
3924     inode_unlock(target);
3925 
3926     /* We don't d_delete() NFS sillyrenamed files--they still exist. */
3927     if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) {
3928         fsnotify_link_count(target);
3929         d_delete(dentry);
3930     }
3931 
3932     return error;
3933 }
3934 EXPORT_SYMBOL(vfs_unlink);
3935 
3936 /*
3937  * Make sure that the actual truncation of the file will occur outside its
3938  * directory's i_mutex.  Truncate can take a long time if there is a lot of
3939  * writeout happening, and we don't want to prevent access to the directory
3940  * while waiting on the I/O.
3941  */
3942 static long do_unlinkat(int dfd, const char __user *pathname)
3943 {
3944     int error;
3945     struct filename *name;
3946     struct dentry *dentry;
3947     struct path path;
3948     struct qstr last;
3949     int type;
3950     struct inode *inode = NULL;
3951     struct inode *delegated_inode = NULL;
3952     unsigned int lookup_flags = 0;
3953 retry:
3954     name = filename_parentat(dfd, getname(pathname), lookup_flags,
3955                 &path, &last, &type);
3956     if (IS_ERR(name))
3957         return PTR_ERR(name);
3958 
3959     error = -EISDIR;
3960     if (type != LAST_NORM)
3961         goto exit1;
3962 
3963     error = mnt_want_write(path.mnt);
3964     if (error)
3965         goto exit1;
3966 retry_deleg:
3967     inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
3968     dentry = __lookup_hash(&last, path.dentry, lookup_flags);
3969     error = PTR_ERR(dentry);
3970     if (!IS_ERR(dentry)) {
3971         /* Why not before? Because we want correct error value */
3972         if (last.name[last.len])
3973             goto slashes;
3974         inode = dentry->d_inode;
3975         if (d_is_negative(dentry))
3976             goto slashes;
3977         ihold(inode);
3978         error = security_path_unlink(&path, dentry);
3979         if (error)
3980             goto exit2;
3981         error = vfs_unlink(path.dentry->d_inode, dentry, &delegated_inode);
3982 exit2:
3983         dput(dentry);
3984     }
3985     inode_unlock(path.dentry->d_inode);
3986     if (inode)
3987         iput(inode);    /* truncate the inode here */
3988     inode = NULL;
3989     if (delegated_inode) {
3990         error = break_deleg_wait(&delegated_inode);
3991         if (!error)
3992             goto retry_deleg;
3993     }
3994     mnt_drop_write(path.mnt);
3995 exit1:
3996     path_put(&path);
3997     putname(name);
3998     if (retry_estale(error, lookup_flags)) {
3999         lookup_flags |= LOOKUP_REVAL;
4000         inode = NULL;
4001         goto retry;
4002     }
4003     return error;
4004 
4005 slashes:
4006     if (d_is_negative(dentry))
4007         error = -ENOENT;
4008     else if (d_is_dir(dentry))
4009         error = -EISDIR;
4010     else
4011         error = -ENOTDIR;
4012     goto exit2;
4013 }
4014 
4015 SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
4016 {
4017     if ((flag & ~AT_REMOVEDIR) != 0)
4018         return -EINVAL;
4019 
4020     if (flag & AT_REMOVEDIR)
4021         return do_rmdir(dfd, pathname);
4022 
4023     return do_unlinkat(dfd, pathname);
4024 }
4025 
4026 SYSCALL_DEFINE1(unlink, const char __user *, pathname)
4027 {
4028     return do_unlinkat(AT_FDCWD, pathname);
4029 }
4030 
4031 int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname)
4032 {
4033     int error = may_create(dir, dentry);
4034 
4035     if (error)
4036         return error;
4037 
4038     if (!dir->i_op->symlink)
4039         return -EPERM;
4040 
4041     error = security_inode_symlink(dir, dentry, oldname);
4042     if (error)
4043         return error;
4044 
4045     error = dir->i_op->symlink(dir, dentry, oldname);
4046     if (!error)
4047         fsnotify_create(dir, dentry);
4048     return error;
4049 }
4050 EXPORT_SYMBOL(vfs_symlink);
4051 
4052 SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
4053         int, newdfd, const char __user *, newname)
4054 {
4055     int error;
4056     struct filename *from;
4057     struct dentry *dentry;
4058     struct path path;
4059     unsigned int lookup_flags = 0;
4060 
4061     from = getname(oldname);
4062     if (IS_ERR(from))
4063         return PTR_ERR(from);
4064 retry:
4065     dentry = user_path_create(newdfd, newname, &path, lookup_flags);
4066     error = PTR_ERR(dentry);
4067     if (IS_ERR(dentry))
4068         goto out_putname;
4069 
4070     error = security_path_symlink(&path, dentry, from->name);
4071     if (!error)
4072         error = vfs_symlink(path.dentry->d_inode, dentry, from->name);
4073     done_path_create(&path, dentry);
4074     if (retry_estale(error, lookup_flags)) {
4075         lookup_flags |= LOOKUP_REVAL;
4076         goto retry;
4077     }
4078 out_putname:
4079     putname(from);
4080     return error;
4081 }
4082 
4083 SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname)
4084 {
4085     return sys_symlinkat(oldname, AT_FDCWD, newname);
4086 }
4087 
4088 /**
4089  * vfs_link - create a new link
4090  * @old_dentry: object to be linked
4091  * @dir:    new parent
4092  * @new_dentry: where to create the new link
4093  * @delegated_inode: returns inode needing a delegation break
4094  *
4095  * The caller must hold dir->i_mutex
4096  *
4097  * If vfs_link discovers a delegation on the to-be-linked file in need
4098  * of breaking, it will return -EWOULDBLOCK and return a reference to the
4099  * inode in delegated_inode.  The caller should then break the delegation
4100  * and retry.  Because breaking a delegation may take a long time, the
4101  * caller should drop the i_mutex before doing so.
4102  *
4103  * Alternatively, a caller may pass NULL for delegated_inode.  This may
4104  * be appropriate for callers that expect the underlying filesystem not
4105  * to be NFS exported.
4106  */
4107 int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry, struct inode **delegated_inode)
4108 {
4109     struct inode *inode = old_dentry->d_inode;
4110     unsigned max_links = dir->i_sb->s_max_links;
4111     int error;
4112 
4113     if (!inode)
4114         return -ENOENT;
4115 
4116     error = may_create(dir, new_dentry);
4117     if (error)
4118         return error;
4119 
4120     if (dir->i_sb != inode->i_sb)
4121         return -EXDEV;
4122 
4123     /*
4124      * A link to an append-only or immutable file cannot be created.
4125      */
4126     if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
4127         return -EPERM;
4128     /*
4129      * Updating the link count will likely cause i_uid and i_gid to
4130      * be writen back improperly if their true value is unknown to
4131      * the vfs.
4132      */
4133     if (HAS_UNMAPPED_ID(inode))
4134         return -EPERM;
4135     if (!dir->i_op->link)
4136         return -EPERM;
4137     if (S_ISDIR(inode->i_mode))
4138         return -EPERM;
4139 
4140     error = security_inode_link(old_dentry, dir, new_dentry);
4141     if (error)
4142         return error;
4143 
4144     inode_lock(inode);
4145     /* Make sure we don't allow creating hardlink to an unlinked file */
4146     if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE))
4147         error =  -ENOENT;
4148     else if (max_links && inode->i_nlink >= max_links)
4149         error = -EMLINK;
4150     else {
4151         error = try_break_deleg(inode, delegated_inode);
4152         if (!error)
4153             error = dir->i_op->link(old_dentry, dir, new_dentry);
4154     }
4155 
4156     if (!error && (inode->i_state & I_LINKABLE)) {
4157         spin_lock(&inode->i_lock);
4158         inode->i_state &= ~I_LINKABLE;
4159         spin_unlock(&inode->i_lock);
4160     }
4161     inode_unlock(inode);
4162     if (!error)
4163         fsnotify_link(dir, inode, new_dentry);
4164     return error;
4165 }
4166 EXPORT_SYMBOL(vfs_link);
4167 
4168 /*
4169  * Hardlinks are often used in delicate situations.  We avoid
4170  * security-related surprises by not following symlinks on the
4171  * newname.  --KAB
4172  *
4173  * We don't follow them on the oldname either to be compatible
4174  * with linux 2.0, and to avoid hard-linking to directories
4175  * and other special files.  --ADM
4176  */
4177 SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
4178         int, newdfd, const char __user *, newname, int, flags)
4179 {
4180     struct dentry *new_dentry;
4181     struct path old_path, new_path;
4182     struct inode *delegated_inode = NULL;
4183     int how = 0;
4184     int error;
4185 
4186     if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
4187         return -EINVAL;
4188     /*
4189      * To use null names we require CAP_DAC_READ_SEARCH
4190      * This ensures that not everyone will be able to create
4191      * handlink using the passed filedescriptor.
4192      */
4193     if (flags & AT_EMPTY_PATH) {
4194         if (!capable(CAP_DAC_READ_SEARCH))
4195             return -ENOENT;
4196         how = LOOKUP_EMPTY;
4197     }
4198 
4199     if (flags & AT_SYMLINK_FOLLOW)
4200         how |= LOOKUP_FOLLOW;
4201 retry:
4202     error = user_path_at(olddfd, oldname, how, &old_path);
4203     if (error)
4204         return error;
4205 
4206     new_dentry = user_path_create(newdfd, newname, &new_path,
4207                     (how & LOOKUP_REVAL));
4208     error = PTR_ERR(new_dentry);
4209     if (IS_ERR(new_dentry))
4210         goto out;
4211 
4212     error = -EXDEV;
4213     if (old_path.mnt != new_path.mnt)
4214         goto out_dput;
4215     error = may_linkat(&old_path);
4216     if (unlikely(error))
4217         goto out_dput;
4218     error = security_path_link(old_path.dentry, &new_path, new_dentry);
4219     if (error)
4220         goto out_dput;
4221     error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry, &delegated_inode);
4222 out_dput:
4223     done_path_create(&new_path, new_dentry);
4224     if (delegated_inode) {
4225         error = break_deleg_wait(&delegated_inode);
4226         if (!error) {
4227             path_put(&old_path);
4228             goto retry;
4229         }
4230     }
4231     if (retry_estale(error, how)) {
4232         path_put(&old_path);
4233         how |= LOOKUP_REVAL;
4234         goto retry;
4235     }
4236 out:
4237     path_put(&old_path);
4238 
4239     return error;
4240 }
4241 
4242 SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname)
4243 {
4244     return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
4245 }
4246 
4247 /**
4248  * vfs_rename - rename a filesystem object
4249  * @old_dir:    parent of source
4250  * @old_dentry: source
4251  * @new_dir:    parent of destination
4252  * @new_dentry: destination
4253  * @delegated_inode: returns an inode needing a delegation break
4254  * @flags:  rename flags
4255  *
4256  * The caller must hold multiple mutexes--see lock_rename()).
4257  *
4258  * If vfs_rename discovers a delegation in need of breaking at either
4259  * the source or destination, it will return -EWOULDBLOCK and return a
4260  * reference to the inode in delegated_inode.  The caller should then
4261  * break the delegation and retry.  Because breaking a delegation may
4262  * take a long time, the caller should drop all locks before doing
4263  * so.
4264  *
4265  * Alternatively, a caller may pass NULL for delegated_inode.  This may
4266  * be appropriate for callers that expect the underlying filesystem not
4267  * to be NFS exported.
4268  *
4269  * The worst of all namespace operations - renaming directory. "Perverted"
4270  * doesn't even start to describe it. Somebody in UCB had a heck of a trip...
4271  * Problems:
4272  *  a) we can get into loop creation.
4273  *  b) race potential - two innocent renames can create a loop together.
4274  *     That's where 4.4 screws up. Current fix: serialization on
4275  *     sb->s_vfs_rename_mutex. We might be more accurate, but that's another
4276  *     story.
4277  *  c) we have to lock _four_ objects - parents and victim (if it exists),
4278  *     and source (if it is not a directory).
4279  *     And that - after we got ->i_mutex on parents (until then we don't know
4280  *     whether the target exists).  Solution: try to be smart with locking
4281  *     order for inodes.  We rely on the fact that tree topology may change
4282  *     only under ->s_vfs_rename_mutex _and_ that parent of the object we
4283  *     move will be locked.  Thus we can rank directories by the tree
4284  *     (ancestors first) and rank all non-directories after them.
4285  *     That works since everybody except rename does "lock parent, lookup,
4286  *     lock child" and rename is under ->s_vfs_rename_mutex.
4287  *     HOWEVER, it relies on the assumption that any object with ->lookup()
4288  *     has no more than 1 dentry.  If "hybrid" objects will ever appear,
4289  *     we'd better make sure that there's no link(2) for them.
4290  *  d) conversion from fhandle to dentry may come in the wrong moment - when
4291  *     we are removing the target. Solution: we will have to grab ->i_mutex
4292  *     in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on
4293  *     ->i_mutex on parents, which works but leads to some truly excessive
4294  *     locking].
4295  */
4296 int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
4297            struct inode *new_dir, struct dentry *new_dentry,
4298            struct inode **delegated_inode, unsigned int flags)
4299 {
4300     int error;
4301     bool is_dir = d_is_dir(old_dentry);
4302     const unsigned char *old_name;
4303     struct inode *source = old_dentry->d_inode;
4304     struct inode *target = new_dentry->d_inode;
4305     bool new_is_dir = false;
4306     unsigned max_links = new_dir->i_sb->s_max_links;
4307 
4308     if (source == target)
4309         return 0;
4310 
4311     error = may_delete(old_dir, old_dentry, is_dir);
4312     if (error)
4313         return error;
4314 
4315     if (!target) {
4316         error = may_create(new_dir, new_dentry);
4317     } else {
4318         new_is_dir = d_is_dir(new_dentry);
4319 
4320         if (!(flags & RENAME_EXCHANGE))
4321             error = may_delete(new_dir, new_dentry, is_dir);
4322         else
4323             error = may_delete(new_dir, new_dentry, new_is_dir);
4324     }
4325     if (error)
4326         return error;
4327 
4328     if (!old_dir->i_op->rename)
4329         return -EPERM;
4330 
4331     /*
4332      * If we are going to change the parent - check write permissions,
4333      * we'll need to flip '..'.
4334      */
4335     if (new_dir != old_dir) {
4336         if (is_dir) {
4337             error = inode_permission(source, MAY_WRITE);
4338             if (error)
4339                 return error;
4340         }
4341         if ((flags & RENAME_EXCHANGE) && new_is_dir) {
4342             error = inode_permission(target, MAY_WRITE);
4343             if (error)
4344                 return error;
4345         }
4346     }
4347 
4348     error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry,
4349                       flags);
4350     if (error)
4351         return error;
4352 
4353     old_name = fsnotify_oldname_init(old_dentry->d_name.name);
4354     dget(new_dentry);
4355     if (!is_dir || (flags & RENAME_EXCHANGE))
4356         lock_two_nondirectories(source, target);
4357     else if (target)
4358         inode_lock(target);
4359 
4360     error = -EBUSY;
4361     if (is_local_mountpoint(old_dentry) || is_local_mountpoint(new_dentry))
4362         goto out;
4363 
4364     if (max_links && new_dir != old_dir) {
4365         error = -EMLINK;
4366         if (is_dir && !new_is_dir && new_dir->i_nlink >= max_links)
4367             goto out;
4368         if ((flags & RENAME_EXCHANGE) && !is_dir && new_is_dir &&
4369             old_dir->i_nlink >= max_links)
4370             goto out;
4371     }
4372     if (is_dir && !(flags & RENAME_EXCHANGE) && target)
4373         shrink_dcache_parent(new_dentry);
4374     if (!is_dir) {
4375         error = try_break_deleg(source, delegated_inode);
4376         if (error)
4377             goto out;
4378     }
4379     if (target && !new_is_dir) {
4380         error = try_break_deleg(target, delegated_inode);
4381         if (error)
4382             goto out;
4383     }
4384     error = old_dir->i_op->rename(old_dir, old_dentry,
4385                        new_dir, new_dentry, flags);
4386     if (error)
4387         goto out;
4388 
4389     if (!(flags & RENAME_EXCHANGE) && target) {
4390         if (is_dir)
4391             target->i_flags |= S_DEAD;
4392         dont_mount(new_dentry);
4393         detach_mounts(new_dentry);
4394     }
4395     if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) {
4396         if (!(flags & RENAME_EXCHANGE))
4397             d_move(old_dentry, new_dentry);
4398         else
4399             d_exchange(old_dentry, new_dentry);
4400     }
4401 out:
4402     if (!is_dir || (flags & RENAME_EXCHANGE))
4403         unlock_two_nondirectories(source, target);
4404     else if (target)
4405         inode_unlock(target);
4406     dput(new_dentry);
4407     if (!error) {
4408         fsnotify_move(old_dir, new_dir, old_name, is_dir,
4409                   !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry);
4410         if (flags & RENAME_EXCHANGE) {
4411             fsnotify_move(new_dir, old_dir, old_dentry->d_name.name,
4412                       new_is_dir, NULL, new_dentry);
4413         }
4414     }
4415     fsnotify_oldname_free(old_name);
4416 
4417     return error;
4418 }
4419 EXPORT_SYMBOL(vfs_rename);
4420 
4421 SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname,
4422         int, newdfd, const char __user *, newname, unsigned int, flags)
4423 {
4424     struct dentry *old_dentry, *new_dentry;
4425     struct dentry *trap;
4426     struct path old_path, new_path;
4427     struct qstr old_last, new_last;
4428     int old_type, new_type;
4429     struct inode *delegated_inode = NULL;
4430     struct filename *from;
4431     struct filename *to;
4432     unsigned int lookup_flags = 0, target_flags = LOOKUP_RENAME_TARGET;
4433     bool should_retry = false;
4434     int error;
4435 
4436     if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT))
4437         return -EINVAL;
4438 
4439     if ((flags & (RENAME_NOREPLACE | RENAME_WHITEOUT)) &&
4440         (flags & RENAME_EXCHANGE))
4441         return -EINVAL;
4442 
4443     if ((flags & RENAME_WHITEOUT) && !capable(CAP_MKNOD))
4444         return -EPERM;
4445 
4446     if (flags & RENAME_EXCHANGE)
4447         target_flags = 0;
4448 
4449 retry:
4450     from = filename_parentat(olddfd, getname(oldname), lookup_flags,
4451                 &old_path, &old_last, &old_type);
4452     if (IS_ERR(from)) {
4453         error = PTR_ERR(from);
4454         goto exit;
4455     }
4456 
4457     to = filename_parentat(newdfd, getname(newname), lookup_flags,
4458                 &new_path, &new_last, &new_type);
4459     if (IS_ERR(to)) {
4460         error = PTR_ERR(to);
4461         goto exit1;
4462     }
4463 
4464     error = -EXDEV;
4465     if (old_path.mnt != new_path.mnt)
4466         goto exit2;
4467 
4468     error = -EBUSY;
4469     if (old_type != LAST_NORM)
4470         goto exit2;
4471 
4472     if (flags & RENAME_NOREPLACE)
4473         error = -EEXIST;
4474     if (new_type != LAST_NORM)
4475         goto exit2;
4476 
4477     error = mnt_want_write(old_path.mnt);
4478     if (error)
4479         goto exit2;
4480 
4481 retry_deleg:
4482     trap = lock_rename(new_path.dentry, old_path.dentry);
4483 
4484     old_dentry = __lookup_hash(&old_last, old_path.dentry, lookup_flags);
4485     error = PTR_ERR(old_dentry);
4486     if (IS_ERR(old_dentry))
4487         goto exit3;
4488     /* source must exist */
4489     error = -ENOENT;
4490     if (d_is_negative(old_dentry))
4491         goto exit4;
4492     new_dentry = __lookup_hash(&new_last, new_path.dentry, lookup_flags | target_flags);
4493     error = PTR_ERR(new_dentry);
4494     if (IS_ERR(new_dentry))
4495         goto exit4;
4496     error = -EEXIST;
4497     if ((flags & RENAME_NOREPLACE) && d_is_positive(new_dentry))
4498         goto exit5;
4499     if (flags & RENAME_EXCHANGE) {
4500         error = -ENOENT;
4501         if (d_is_negative(new_dentry))
4502             goto exit5;
4503 
4504         if (!d_is_dir(new_dentry)) {
4505             error = -ENOTDIR;
4506             if (new_last.name[new_last.len])
4507                 goto exit5;
4508         }
4509     }
4510     /* unless the source is a directory trailing slashes give -ENOTDIR */
4511     if (!d_is_dir(old_dentry)) {
4512         error = -ENOTDIR;
4513         if (old_last.name[old_last.len])
4514             goto exit5;
4515         if (!(flags & RENAME_EXCHANGE) && new_last.name[new_last.len])
4516             goto exit5;
4517     }
4518     /* source should not be ancestor of target */
4519     error = -EINVAL;
4520     if (old_dentry == trap)
4521         goto exit5;
4522     /* target should not be an ancestor of source */
4523     if (!(flags & RENAME_EXCHANGE))
4524         error = -ENOTEMPTY;
4525     if (new_dentry == trap)
4526         goto exit5;
4527 
4528     error = security_path_rename(&old_path, old_dentry,
4529                      &new_path, new_dentry, flags);
4530     if (error)
4531         goto exit5;
4532     error = vfs_rename(old_path.dentry->d_inode, old_dentry,
4533                new_path.dentry->d_inode, new_dentry,
4534                &delegated_inode, flags);
4535 exit5:
4536     dput(new_dentry);
4537 exit4:
4538     dput(old_dentry);
4539 exit3:
4540     unlock_rename(new_path.dentry, old_path.dentry);
4541     if (delegated_inode) {
4542         error = break_deleg_wait(&delegated_inode);
4543         if (!error)
4544             goto retry_deleg;
4545     }
4546     mnt_drop_write(old_path.mnt);
4547 exit2:
4548     if (retry_estale(error, lookup_flags))
4549         should_retry = true;
4550     path_put(&new_path);
4551     putname(to);
4552 exit1:
4553     path_put(&old_path);
4554     putname(from);
4555     if (should_retry) {
4556         should_retry = false;
4557         lookup_flags |= LOOKUP_REVAL;
4558         goto retry;
4559     }
4560 exit:
4561     return error;
4562 }
4563 
4564 SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
4565         int, newdfd, const char __user *, newname)
4566 {
4567     return sys_renameat2(olddfd, oldname, newdfd, newname, 0);
4568 }
4569 
4570 SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname)
4571 {
4572     return sys_renameat2(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
4573 }
4574 
4575 int vfs_whiteout(struct inode *dir, struct dentry *dentry)
4576 {
4577     int error = may_create(dir, dentry);
4578     if (error)
4579         return error;
4580 
4581     if (!dir->i_op->mknod)
4582         return -EPERM;
4583 
4584     return dir->i_op->mknod(dir, dentry,
4585                 S_IFCHR | WHITEOUT_MODE, WHITEOUT_DEV);
4586 }
4587 EXPORT_SYMBOL(vfs_whiteout);
4588 
4589 int readlink_copy(char __user *buffer, int buflen, const char *link)
4590 {
4591     int len = PTR_ERR(link);
4592     if (IS_ERR(link))
4593         goto out;
4594 
4595     len = strlen(link);
4596     if (len > (unsigned) buflen)
4597         len = buflen;
4598     if (copy_to_user(buffer, link, len))
4599         len = -EFAULT;
4600 out:
4601     return len;
4602 }
4603 
4604 /*
4605  * A helper for ->readlink().  This should be used *ONLY* for symlinks that
4606  * have ->get_link() not calling nd_jump_link().  Using (or not using) it
4607  * for any given inode is up to filesystem.
4608  */
4609 static int generic_readlink(struct dentry *dentry, char __user *buffer,
4610                 int buflen)
4611 {
4612     DEFINE_DELAYED_CALL(done);
4613     struct inode *inode = d_inode(dentry);
4614     const char *link = inode->i_link;
4615     int res;
4616 
4617     if (!link) {
4618         link = inode->i_op->get_link(dentry, inode, &done);
4619         if (IS_ERR(link))
4620             return PTR_ERR(link);
4621     }
4622     res = readlink_copy(buffer, buflen, link);
4623     do_delayed_call(&done);
4624     return res;
4625 }
4626 
4627 /**
4628  * vfs_readlink - copy symlink body into userspace buffer
4629  * @dentry: dentry on which to get symbolic link
4630  * @buffer: user memory pointer
4631  * @buflen: size of buffer
4632  *
4633  * Does not touch atime.  That's up to the caller if necessary
4634  *
4635  * Does not call security hook.
4636  */
4637 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen)
4638 {
4639     struct inode *inode = d_inode(dentry);
4640 
4641     if (unlikely(!(inode->i_opflags & IOP_DEFAULT_READLINK))) {
4642         if (unlikely(inode->i_op->readlink))
4643             return inode->i_op->readlink(dentry, buffer, buflen);
4644 
4645         if (!d_is_symlink(dentry))
4646             return -EINVAL;
4647 
4648         spin_lock(&inode->i_lock);
4649         inode->i_opflags |= IOP_DEFAULT_READLINK;
4650         spin_unlock(&inode->i_lock);
4651     }
4652 
4653     return generic_readlink(dentry, buffer, buflen);
4654 }
4655 EXPORT_SYMBOL(vfs_readlink);
4656 
4657 /**
4658  * vfs_get_link - get symlink body
4659  * @dentry: dentry on which to get symbolic link
4660  * @done: caller needs to free returned data with this
4661  *
4662  * Calls security hook and i_op->get_link() on the supplied inode.
4663  *
4664  * It does not touch atime.  That's up to the caller if necessary.
4665  *
4666  * Does not work on "special" symlinks like /proc/$$/fd/N
4667  */
4668 const char *vfs_get_link(struct dentry *dentry, struct delayed_call *done)
4669 {
4670     const char *res = ERR_PTR(-EINVAL);
4671     struct inode *inode = d_inode(dentry);
4672 
4673     if (d_is_symlink(dentry)) {
4674         res = ERR_PTR(security_inode_readlink(dentry));
4675         if (!res)
4676             res = inode->i_op->get_link(dentry, inode, done);
4677     }
4678     return res;
4679 }
4680 EXPORT_SYMBOL(vfs_get_link);
4681 
4682 /* get the link contents into pagecache */
4683 const char *page_get_link(struct dentry *dentry, struct inode *inode,
4684               struct delayed_call *callback)
4685 {
4686     char *kaddr;
4687     struct page *page;
4688     struct address_space *mapping = inode->i_mapping;
4689 
4690     if (!dentry) {
4691         page = find_get_page(mapping, 0);
4692         if (!page)
4693             return ERR_PTR(-ECHILD);
4694         if (!PageUptodate(page)) {
4695             put_page(page);
4696             return ERR_PTR(-ECHILD);
4697         }
4698     } else {
4699         page = read_mapping_page(mapping, 0, NULL);
4700         if (IS_ERR(page))
4701             return (char*)page;
4702     }
4703     set_delayed_call(callback, page_put_link, page);
4704     BUG_ON(mapping_gfp_mask(mapping) & __GFP_HIGHMEM);
4705     kaddr = page_address(page);
4706     nd_terminate_link(kaddr, inode->i_size, PAGE_SIZE - 1);
4707     return kaddr;
4708 }
4709 
4710 EXPORT_SYMBOL(page_get_link);
4711 
4712 void page_put_link(void *arg)
4713 {
4714     put_page(arg);
4715 }
4716 EXPORT_SYMBOL(page_put_link);
4717 
4718 int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
4719 {
4720     DEFINE_DELAYED_CALL(done);
4721     int res = readlink_copy(buffer, buflen,
4722                 page_get_link(dentry, d_inode(dentry),
4723                           &done));
4724     do_delayed_call(&done);
4725     return res;
4726 }
4727 EXPORT_SYMBOL(page_readlink);
4728 
4729 /*
4730  * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS
4731  */
4732 int __page_symlink(struct inode *inode, const char *symname, int len, int nofs)
4733 {
4734     struct address_space *mapping = inode->i_mapping;
4735     struct page *page;
4736     void *fsdata;
4737     int err;
4738     unsigned int flags = AOP_FLAG_UNINTERRUPTIBLE;
4739     if (nofs)
4740         flags |= AOP_FLAG_NOFS;
4741 
4742 retry:
4743     err = pagecache_write_begin(NULL, mapping, 0, len-1,
4744                 flags, &page, &fsdata);
4745     if (err)
4746         goto fail;
4747 
4748     memcpy(page_address(page), symname, len-1);
4749 
4750     err = pagecache_write_end(NULL, mapping, 0, len-1, len-1,
4751                             page, fsdata);
4752     if (err < 0)
4753         goto fail;
4754     if (err < len-1)
4755         goto retry;
4756 
4757     mark_inode_dirty(inode);
4758     return 0;
4759 fail:
4760     return err;
4761 }
4762 EXPORT_SYMBOL(__page_symlink);
4763 
4764 int page_symlink(struct inode *inode, const char *symname, int len)
4765 {
4766     return __page_symlink(inode, symname, len,
4767             !mapping_gfp_constraint(inode->i_mapping, __GFP_FS));
4768 }
4769 EXPORT_SYMBOL(page_symlink);
4770 
4771 const struct inode_operations page_symlink_inode_operations = {
4772     .get_link   = page_get_link,
4773 };
4774 EXPORT_SYMBOL(page_symlink_inode_operations);