Back to home page

OSCL-LXR
 
 

     

0001 // SPDX-License-Identifier: GPL-2.0-only
0002 /*
0003  * Copyright (C) 2011 Novell Inc.
0004  * Copyright (C) 2016 Red Hat, Inc.
0005  */
0006 
0007 #include <linux/fs.h>
0008 #include <linux/cred.h>
0009 #include <linux/ctype.h>
0010 #include <linux/namei.h>
0011 #include <linux/xattr.h>
0012 #include <linux/ratelimit.h>
0013 #include <linux/mount.h>
0014 #include <linux/exportfs.h>
0015 #include "overlayfs.h"
0016 
0017 struct ovl_lookup_data {
0018     struct super_block *sb;
0019     struct vfsmount *mnt;
0020     struct qstr name;
0021     bool is_dir;
0022     bool opaque;
0023     bool stop;
0024     bool last;
0025     char *redirect;
0026     bool metacopy;
0027 };
0028 
0029 static int ovl_check_redirect(struct path *path, struct ovl_lookup_data *d,
0030                   size_t prelen, const char *post)
0031 {
0032     int res;
0033     char *buf;
0034     struct ovl_fs *ofs = OVL_FS(d->sb);
0035 
0036     buf = ovl_get_redirect_xattr(ofs, path, prelen + strlen(post));
0037     if (IS_ERR_OR_NULL(buf))
0038         return PTR_ERR(buf);
0039 
0040     if (buf[0] == '/') {
0041         /*
0042          * One of the ancestor path elements in an absolute path
0043          * lookup in ovl_lookup_layer() could have been opaque and
0044          * that will stop further lookup in lower layers (d->stop=true)
0045          * But we have found an absolute redirect in descendant path
0046          * element and that should force continue lookup in lower
0047          * layers (reset d->stop).
0048          */
0049         d->stop = false;
0050     } else {
0051         res = strlen(buf) + 1;
0052         memmove(buf + prelen, buf, res);
0053         memcpy(buf, d->name.name, prelen);
0054     }
0055 
0056     strcat(buf, post);
0057     kfree(d->redirect);
0058     d->redirect = buf;
0059     d->name.name = d->redirect;
0060     d->name.len = strlen(d->redirect);
0061 
0062     return 0;
0063 }
0064 
0065 static int ovl_acceptable(void *ctx, struct dentry *dentry)
0066 {
0067     /*
0068      * A non-dir origin may be disconnected, which is fine, because
0069      * we only need it for its unique inode number.
0070      */
0071     if (!d_is_dir(dentry))
0072         return 1;
0073 
0074     /* Don't decode a deleted empty directory */
0075     if (d_unhashed(dentry))
0076         return 0;
0077 
0078     /* Check if directory belongs to the layer we are decoding from */
0079     return is_subdir(dentry, ((struct vfsmount *)ctx)->mnt_root);
0080 }
0081 
0082 /*
0083  * Check validity of an overlay file handle buffer.
0084  *
0085  * Return 0 for a valid file handle.
0086  * Return -ENODATA for "origin unknown".
0087  * Return <0 for an invalid file handle.
0088  */
0089 int ovl_check_fb_len(struct ovl_fb *fb, int fb_len)
0090 {
0091     if (fb_len < sizeof(struct ovl_fb) || fb_len < fb->len)
0092         return -EINVAL;
0093 
0094     if (fb->magic != OVL_FH_MAGIC)
0095         return -EINVAL;
0096 
0097     /* Treat larger version and unknown flags as "origin unknown" */
0098     if (fb->version > OVL_FH_VERSION || fb->flags & ~OVL_FH_FLAG_ALL)
0099         return -ENODATA;
0100 
0101     /* Treat endianness mismatch as "origin unknown" */
0102     if (!(fb->flags & OVL_FH_FLAG_ANY_ENDIAN) &&
0103         (fb->flags & OVL_FH_FLAG_BIG_ENDIAN) != OVL_FH_FLAG_CPU_ENDIAN)
0104         return -ENODATA;
0105 
0106     return 0;
0107 }
0108 
0109 static struct ovl_fh *ovl_get_fh(struct ovl_fs *ofs, struct dentry *upperdentry,
0110                  enum ovl_xattr ox)
0111 {
0112     int res, err;
0113     struct ovl_fh *fh = NULL;
0114 
0115     res = ovl_getxattr_upper(ofs, upperdentry, ox, NULL, 0);
0116     if (res < 0) {
0117         if (res == -ENODATA || res == -EOPNOTSUPP)
0118             return NULL;
0119         goto fail;
0120     }
0121     /* Zero size value means "copied up but origin unknown" */
0122     if (res == 0)
0123         return NULL;
0124 
0125     fh = kzalloc(res + OVL_FH_WIRE_OFFSET, GFP_KERNEL);
0126     if (!fh)
0127         return ERR_PTR(-ENOMEM);
0128 
0129     res = ovl_getxattr_upper(ofs, upperdentry, ox, fh->buf, res);
0130     if (res < 0)
0131         goto fail;
0132 
0133     err = ovl_check_fb_len(&fh->fb, res);
0134     if (err < 0) {
0135         if (err == -ENODATA)
0136             goto out;
0137         goto invalid;
0138     }
0139 
0140     return fh;
0141 
0142 out:
0143     kfree(fh);
0144     return NULL;
0145 
0146 fail:
0147     pr_warn_ratelimited("failed to get origin (%i)\n", res);
0148     goto out;
0149 invalid:
0150     pr_warn_ratelimited("invalid origin (%*phN)\n", res, fh);
0151     goto out;
0152 }
0153 
0154 struct dentry *ovl_decode_real_fh(struct ovl_fs *ofs, struct ovl_fh *fh,
0155                   struct vfsmount *mnt, bool connected)
0156 {
0157     struct dentry *real;
0158     int bytes;
0159 
0160     if (!capable(CAP_DAC_READ_SEARCH))
0161         return NULL;
0162 
0163     /*
0164      * Make sure that the stored uuid matches the uuid of the lower
0165      * layer where file handle will be decoded.
0166      * In case of uuid=off option just make sure that stored uuid is null.
0167      */
0168     if (ofs->config.uuid ? !uuid_equal(&fh->fb.uuid, &mnt->mnt_sb->s_uuid) :
0169                   !uuid_is_null(&fh->fb.uuid))
0170         return NULL;
0171 
0172     bytes = (fh->fb.len - offsetof(struct ovl_fb, fid));
0173     real = exportfs_decode_fh(mnt, (struct fid *)fh->fb.fid,
0174                   bytes >> 2, (int)fh->fb.type,
0175                   connected ? ovl_acceptable : NULL, mnt);
0176     if (IS_ERR(real)) {
0177         /*
0178          * Treat stale file handle to lower file as "origin unknown".
0179          * upper file handle could become stale when upper file is
0180          * unlinked and this information is needed to handle stale
0181          * index entries correctly.
0182          */
0183         if (real == ERR_PTR(-ESTALE) &&
0184             !(fh->fb.flags & OVL_FH_FLAG_PATH_UPPER))
0185             real = NULL;
0186         return real;
0187     }
0188 
0189     if (ovl_dentry_weird(real)) {
0190         dput(real);
0191         return NULL;
0192     }
0193 
0194     return real;
0195 }
0196 
0197 static bool ovl_is_opaquedir(struct ovl_fs *ofs, struct path *path)
0198 {
0199     return ovl_path_check_dir_xattr(ofs, path, OVL_XATTR_OPAQUE);
0200 }
0201 
0202 static struct dentry *ovl_lookup_positive_unlocked(struct ovl_lookup_data *d,
0203                            const char *name,
0204                            struct dentry *base, int len,
0205                            bool drop_negative)
0206 {
0207     struct dentry *ret = lookup_one_unlocked(mnt_user_ns(d->mnt), name, base, len);
0208 
0209     if (!IS_ERR(ret) && d_flags_negative(smp_load_acquire(&ret->d_flags))) {
0210         if (drop_negative && ret->d_lockref.count == 1) {
0211             spin_lock(&ret->d_lock);
0212             /* Recheck condition under lock */
0213             if (d_is_negative(ret) && ret->d_lockref.count == 1)
0214                 __d_drop(ret);
0215             spin_unlock(&ret->d_lock);
0216         }
0217         dput(ret);
0218         ret = ERR_PTR(-ENOENT);
0219     }
0220     return ret;
0221 }
0222 
0223 static int ovl_lookup_single(struct dentry *base, struct ovl_lookup_data *d,
0224                  const char *name, unsigned int namelen,
0225                  size_t prelen, const char *post,
0226                  struct dentry **ret, bool drop_negative)
0227 {
0228     struct dentry *this;
0229     struct path path;
0230     int err;
0231     bool last_element = !post[0];
0232 
0233     this = ovl_lookup_positive_unlocked(d, name, base, namelen, drop_negative);
0234     if (IS_ERR(this)) {
0235         err = PTR_ERR(this);
0236         this = NULL;
0237         if (err == -ENOENT || err == -ENAMETOOLONG)
0238             goto out;
0239         goto out_err;
0240     }
0241 
0242     if (ovl_dentry_weird(this)) {
0243         /* Don't support traversing automounts and other weirdness */
0244         err = -EREMOTE;
0245         goto out_err;
0246     }
0247     if (ovl_is_whiteout(this)) {
0248         d->stop = d->opaque = true;
0249         goto put_and_out;
0250     }
0251     /*
0252      * This dentry should be a regular file if previous layer lookup
0253      * found a metacopy dentry.
0254      */
0255     if (last_element && d->metacopy && !d_is_reg(this)) {
0256         d->stop = true;
0257         goto put_and_out;
0258     }
0259 
0260     path.dentry = this;
0261     path.mnt = d->mnt;
0262     if (!d_can_lookup(this)) {
0263         if (d->is_dir || !last_element) {
0264             d->stop = true;
0265             goto put_and_out;
0266         }
0267         err = ovl_check_metacopy_xattr(OVL_FS(d->sb), &path);
0268         if (err < 0)
0269             goto out_err;
0270 
0271         d->metacopy = err;
0272         d->stop = !d->metacopy;
0273         if (!d->metacopy || d->last)
0274             goto out;
0275     } else {
0276         if (ovl_lookup_trap_inode(d->sb, this)) {
0277             /* Caught in a trap of overlapping layers */
0278             err = -ELOOP;
0279             goto out_err;
0280         }
0281 
0282         if (last_element)
0283             d->is_dir = true;
0284         if (d->last)
0285             goto out;
0286 
0287         if (ovl_is_opaquedir(OVL_FS(d->sb), &path)) {
0288             d->stop = true;
0289             if (last_element)
0290                 d->opaque = true;
0291             goto out;
0292         }
0293     }
0294     err = ovl_check_redirect(&path, d, prelen, post);
0295     if (err)
0296         goto out_err;
0297 out:
0298     *ret = this;
0299     return 0;
0300 
0301 put_and_out:
0302     dput(this);
0303     this = NULL;
0304     goto out;
0305 
0306 out_err:
0307     dput(this);
0308     return err;
0309 }
0310 
0311 static int ovl_lookup_layer(struct dentry *base, struct ovl_lookup_data *d,
0312                 struct dentry **ret, bool drop_negative)
0313 {
0314     /* Counting down from the end, since the prefix can change */
0315     size_t rem = d->name.len - 1;
0316     struct dentry *dentry = NULL;
0317     int err;
0318 
0319     if (d->name.name[0] != '/')
0320         return ovl_lookup_single(base, d, d->name.name, d->name.len,
0321                      0, "", ret, drop_negative);
0322 
0323     while (!IS_ERR_OR_NULL(base) && d_can_lookup(base)) {
0324         const char *s = d->name.name + d->name.len - rem;
0325         const char *next = strchrnul(s, '/');
0326         size_t thislen = next - s;
0327         bool end = !next[0];
0328 
0329         /* Verify we did not go off the rails */
0330         if (WARN_ON(s[-1] != '/'))
0331             return -EIO;
0332 
0333         err = ovl_lookup_single(base, d, s, thislen,
0334                     d->name.len - rem, next, &base,
0335                     drop_negative);
0336         dput(dentry);
0337         if (err)
0338             return err;
0339         dentry = base;
0340         if (end)
0341             break;
0342 
0343         rem -= thislen + 1;
0344 
0345         if (WARN_ON(rem >= d->name.len))
0346             return -EIO;
0347     }
0348     *ret = dentry;
0349     return 0;
0350 }
0351 
0352 
0353 int ovl_check_origin_fh(struct ovl_fs *ofs, struct ovl_fh *fh, bool connected,
0354             struct dentry *upperdentry, struct ovl_path **stackp)
0355 {
0356     struct dentry *origin = NULL;
0357     int i;
0358 
0359     for (i = 1; i < ofs->numlayer; i++) {
0360         /*
0361          * If lower fs uuid is not unique among lower fs we cannot match
0362          * fh->uuid to layer.
0363          */
0364         if (ofs->layers[i].fsid &&
0365             ofs->layers[i].fs->bad_uuid)
0366             continue;
0367 
0368         origin = ovl_decode_real_fh(ofs, fh, ofs->layers[i].mnt,
0369                         connected);
0370         if (origin)
0371             break;
0372     }
0373 
0374     if (!origin)
0375         return -ESTALE;
0376     else if (IS_ERR(origin))
0377         return PTR_ERR(origin);
0378 
0379     if (upperdentry && !ovl_is_whiteout(upperdentry) &&
0380         inode_wrong_type(d_inode(upperdentry), d_inode(origin)->i_mode))
0381         goto invalid;
0382 
0383     if (!*stackp)
0384         *stackp = kmalloc(sizeof(struct ovl_path), GFP_KERNEL);
0385     if (!*stackp) {
0386         dput(origin);
0387         return -ENOMEM;
0388     }
0389     **stackp = (struct ovl_path){
0390         .dentry = origin,
0391         .layer = &ofs->layers[i]
0392     };
0393 
0394     return 0;
0395 
0396 invalid:
0397     pr_warn_ratelimited("invalid origin (%pd2, ftype=%x, origin ftype=%x).\n",
0398                 upperdentry, d_inode(upperdentry)->i_mode & S_IFMT,
0399                 d_inode(origin)->i_mode & S_IFMT);
0400     dput(origin);
0401     return -ESTALE;
0402 }
0403 
0404 static int ovl_check_origin(struct ovl_fs *ofs, struct dentry *upperdentry,
0405                 struct ovl_path **stackp)
0406 {
0407     struct ovl_fh *fh = ovl_get_fh(ofs, upperdentry, OVL_XATTR_ORIGIN);
0408     int err;
0409 
0410     if (IS_ERR_OR_NULL(fh))
0411         return PTR_ERR(fh);
0412 
0413     err = ovl_check_origin_fh(ofs, fh, false, upperdentry, stackp);
0414     kfree(fh);
0415 
0416     if (err) {
0417         if (err == -ESTALE)
0418             return 0;
0419         return err;
0420     }
0421 
0422     return 0;
0423 }
0424 
0425 /*
0426  * Verify that @fh matches the file handle stored in xattr @name.
0427  * Return 0 on match, -ESTALE on mismatch, < 0 on error.
0428  */
0429 static int ovl_verify_fh(struct ovl_fs *ofs, struct dentry *dentry,
0430              enum ovl_xattr ox, const struct ovl_fh *fh)
0431 {
0432     struct ovl_fh *ofh = ovl_get_fh(ofs, dentry, ox);
0433     int err = 0;
0434 
0435     if (!ofh)
0436         return -ENODATA;
0437 
0438     if (IS_ERR(ofh))
0439         return PTR_ERR(ofh);
0440 
0441     if (fh->fb.len != ofh->fb.len || memcmp(&fh->fb, &ofh->fb, fh->fb.len))
0442         err = -ESTALE;
0443 
0444     kfree(ofh);
0445     return err;
0446 }
0447 
0448 /*
0449  * Verify that @real dentry matches the file handle stored in xattr @name.
0450  *
0451  * If @set is true and there is no stored file handle, encode @real and store
0452  * file handle in xattr @name.
0453  *
0454  * Return 0 on match, -ESTALE on mismatch, -ENODATA on no xattr, < 0 on error.
0455  */
0456 int ovl_verify_set_fh(struct ovl_fs *ofs, struct dentry *dentry,
0457               enum ovl_xattr ox, struct dentry *real, bool is_upper,
0458               bool set)
0459 {
0460     struct inode *inode;
0461     struct ovl_fh *fh;
0462     int err;
0463 
0464     fh = ovl_encode_real_fh(ofs, real, is_upper);
0465     err = PTR_ERR(fh);
0466     if (IS_ERR(fh)) {
0467         fh = NULL;
0468         goto fail;
0469     }
0470 
0471     err = ovl_verify_fh(ofs, dentry, ox, fh);
0472     if (set && err == -ENODATA)
0473         err = ovl_setxattr(ofs, dentry, ox, fh->buf, fh->fb.len);
0474     if (err)
0475         goto fail;
0476 
0477 out:
0478     kfree(fh);
0479     return err;
0480 
0481 fail:
0482     inode = d_inode(real);
0483     pr_warn_ratelimited("failed to verify %s (%pd2, ino=%lu, err=%i)\n",
0484                 is_upper ? "upper" : "origin", real,
0485                 inode ? inode->i_ino : 0, err);
0486     goto out;
0487 }
0488 
0489 /* Get upper dentry from index */
0490 struct dentry *ovl_index_upper(struct ovl_fs *ofs, struct dentry *index)
0491 {
0492     struct ovl_fh *fh;
0493     struct dentry *upper;
0494 
0495     if (!d_is_dir(index))
0496         return dget(index);
0497 
0498     fh = ovl_get_fh(ofs, index, OVL_XATTR_UPPER);
0499     if (IS_ERR_OR_NULL(fh))
0500         return ERR_CAST(fh);
0501 
0502     upper = ovl_decode_real_fh(ofs, fh, ovl_upper_mnt(ofs), true);
0503     kfree(fh);
0504 
0505     if (IS_ERR_OR_NULL(upper))
0506         return upper ?: ERR_PTR(-ESTALE);
0507 
0508     if (!d_is_dir(upper)) {
0509         pr_warn_ratelimited("invalid index upper (%pd2, upper=%pd2).\n",
0510                     index, upper);
0511         dput(upper);
0512         return ERR_PTR(-EIO);
0513     }
0514 
0515     return upper;
0516 }
0517 
0518 /*
0519  * Verify that an index entry name matches the origin file handle stored in
0520  * OVL_XATTR_ORIGIN and that origin file handle can be decoded to lower path.
0521  * Return 0 on match, -ESTALE on mismatch or stale origin, < 0 on error.
0522  */
0523 int ovl_verify_index(struct ovl_fs *ofs, struct dentry *index)
0524 {
0525     struct ovl_fh *fh = NULL;
0526     size_t len;
0527     struct ovl_path origin = { };
0528     struct ovl_path *stack = &origin;
0529     struct dentry *upper = NULL;
0530     int err;
0531 
0532     if (!d_inode(index))
0533         return 0;
0534 
0535     err = -EINVAL;
0536     if (index->d_name.len < sizeof(struct ovl_fb)*2)
0537         goto fail;
0538 
0539     err = -ENOMEM;
0540     len = index->d_name.len / 2;
0541     fh = kzalloc(len + OVL_FH_WIRE_OFFSET, GFP_KERNEL);
0542     if (!fh)
0543         goto fail;
0544 
0545     err = -EINVAL;
0546     if (hex2bin(fh->buf, index->d_name.name, len))
0547         goto fail;
0548 
0549     err = ovl_check_fb_len(&fh->fb, len);
0550     if (err)
0551         goto fail;
0552 
0553     /*
0554      * Whiteout index entries are used as an indication that an exported
0555      * overlay file handle should be treated as stale (i.e. after unlink
0556      * of the overlay inode). These entries contain no origin xattr.
0557      */
0558     if (ovl_is_whiteout(index))
0559         goto out;
0560 
0561     /*
0562      * Verifying directory index entries are not stale is expensive, so
0563      * only verify stale dir index if NFS export is enabled.
0564      */
0565     if (d_is_dir(index) && !ofs->config.nfs_export)
0566         goto out;
0567 
0568     /*
0569      * Directory index entries should have 'upper' xattr pointing to the
0570      * real upper dir. Non-dir index entries are hardlinks to the upper
0571      * real inode. For non-dir index, we can read the copy up origin xattr
0572      * directly from the index dentry, but for dir index we first need to
0573      * decode the upper directory.
0574      */
0575     upper = ovl_index_upper(ofs, index);
0576     if (IS_ERR_OR_NULL(upper)) {
0577         err = PTR_ERR(upper);
0578         /*
0579          * Directory index entries with no 'upper' xattr need to be
0580          * removed. When dir index entry has a stale 'upper' xattr,
0581          * we assume that upper dir was removed and we treat the dir
0582          * index as orphan entry that needs to be whited out.
0583          */
0584         if (err == -ESTALE)
0585             goto orphan;
0586         else if (!err)
0587             err = -ESTALE;
0588         goto fail;
0589     }
0590 
0591     err = ovl_verify_fh(ofs, upper, OVL_XATTR_ORIGIN, fh);
0592     dput(upper);
0593     if (err)
0594         goto fail;
0595 
0596     /* Check if non-dir index is orphan and don't warn before cleaning it */
0597     if (!d_is_dir(index) && d_inode(index)->i_nlink == 1) {
0598         err = ovl_check_origin_fh(ofs, fh, false, index, &stack);
0599         if (err)
0600             goto fail;
0601 
0602         if (ovl_get_nlink(ofs, origin.dentry, index, 0) == 0)
0603             goto orphan;
0604     }
0605 
0606 out:
0607     dput(origin.dentry);
0608     kfree(fh);
0609     return err;
0610 
0611 fail:
0612     pr_warn_ratelimited("failed to verify index (%pd2, ftype=%x, err=%i)\n",
0613                 index, d_inode(index)->i_mode & S_IFMT, err);
0614     goto out;
0615 
0616 orphan:
0617     pr_warn_ratelimited("orphan index entry (%pd2, ftype=%x, nlink=%u)\n",
0618                 index, d_inode(index)->i_mode & S_IFMT,
0619                 d_inode(index)->i_nlink);
0620     err = -ENOENT;
0621     goto out;
0622 }
0623 
0624 static int ovl_get_index_name_fh(struct ovl_fh *fh, struct qstr *name)
0625 {
0626     char *n, *s;
0627 
0628     n = kcalloc(fh->fb.len, 2, GFP_KERNEL);
0629     if (!n)
0630         return -ENOMEM;
0631 
0632     s  = bin2hex(n, fh->buf, fh->fb.len);
0633     *name = (struct qstr) QSTR_INIT(n, s - n);
0634 
0635     return 0;
0636 
0637 }
0638 
0639 /*
0640  * Lookup in indexdir for the index entry of a lower real inode or a copy up
0641  * origin inode. The index entry name is the hex representation of the lower
0642  * inode file handle.
0643  *
0644  * If the index dentry in negative, then either no lower aliases have been
0645  * copied up yet, or aliases have been copied up in older kernels and are
0646  * not indexed.
0647  *
0648  * If the index dentry for a copy up origin inode is positive, but points
0649  * to an inode different than the upper inode, then either the upper inode
0650  * has been copied up and not indexed or it was indexed, but since then
0651  * index dir was cleared. Either way, that index cannot be used to identify
0652  * the overlay inode.
0653  */
0654 int ovl_get_index_name(struct ovl_fs *ofs, struct dentry *origin,
0655                struct qstr *name)
0656 {
0657     struct ovl_fh *fh;
0658     int err;
0659 
0660     fh = ovl_encode_real_fh(ofs, origin, false);
0661     if (IS_ERR(fh))
0662         return PTR_ERR(fh);
0663 
0664     err = ovl_get_index_name_fh(fh, name);
0665 
0666     kfree(fh);
0667     return err;
0668 }
0669 
0670 /* Lookup index by file handle for NFS export */
0671 struct dentry *ovl_get_index_fh(struct ovl_fs *ofs, struct ovl_fh *fh)
0672 {
0673     struct dentry *index;
0674     struct qstr name;
0675     int err;
0676 
0677     err = ovl_get_index_name_fh(fh, &name);
0678     if (err)
0679         return ERR_PTR(err);
0680 
0681     index = lookup_positive_unlocked(name.name, ofs->indexdir, name.len);
0682     kfree(name.name);
0683     if (IS_ERR(index)) {
0684         if (PTR_ERR(index) == -ENOENT)
0685             index = NULL;
0686         return index;
0687     }
0688 
0689     if (ovl_is_whiteout(index))
0690         err = -ESTALE;
0691     else if (ovl_dentry_weird(index))
0692         err = -EIO;
0693     else
0694         return index;
0695 
0696     dput(index);
0697     return ERR_PTR(err);
0698 }
0699 
0700 struct dentry *ovl_lookup_index(struct ovl_fs *ofs, struct dentry *upper,
0701                 struct dentry *origin, bool verify)
0702 {
0703     struct dentry *index;
0704     struct inode *inode;
0705     struct qstr name;
0706     bool is_dir = d_is_dir(origin);
0707     int err;
0708 
0709     err = ovl_get_index_name(ofs, origin, &name);
0710     if (err)
0711         return ERR_PTR(err);
0712 
0713     index = lookup_one_positive_unlocked(ovl_upper_mnt_userns(ofs), name.name,
0714                          ofs->indexdir, name.len);
0715     if (IS_ERR(index)) {
0716         err = PTR_ERR(index);
0717         if (err == -ENOENT) {
0718             index = NULL;
0719             goto out;
0720         }
0721         pr_warn_ratelimited("failed inode index lookup (ino=%lu, key=%.*s, err=%i);\n"
0722                     "overlayfs: mount with '-o index=off' to disable inodes index.\n",
0723                     d_inode(origin)->i_ino, name.len, name.name,
0724                     err);
0725         goto out;
0726     }
0727 
0728     inode = d_inode(index);
0729     if (ovl_is_whiteout(index) && !verify) {
0730         /*
0731          * When index lookup is called with !verify for decoding an
0732          * overlay file handle, a whiteout index implies that decode
0733          * should treat file handle as stale and no need to print a
0734          * warning about it.
0735          */
0736         dput(index);
0737         index = ERR_PTR(-ESTALE);
0738         goto out;
0739     } else if (ovl_dentry_weird(index) || ovl_is_whiteout(index) ||
0740            inode_wrong_type(inode, d_inode(origin)->i_mode)) {
0741         /*
0742          * Index should always be of the same file type as origin
0743          * except for the case of a whiteout index. A whiteout
0744          * index should only exist if all lower aliases have been
0745          * unlinked, which means that finding a lower origin on lookup
0746          * whose index is a whiteout should be treated as an error.
0747          */
0748         pr_warn_ratelimited("bad index found (index=%pd2, ftype=%x, origin ftype=%x).\n",
0749                     index, d_inode(index)->i_mode & S_IFMT,
0750                     d_inode(origin)->i_mode & S_IFMT);
0751         goto fail;
0752     } else if (is_dir && verify) {
0753         if (!upper) {
0754             pr_warn_ratelimited("suspected uncovered redirected dir found (origin=%pd2, index=%pd2).\n",
0755                         origin, index);
0756             goto fail;
0757         }
0758 
0759         /* Verify that dir index 'upper' xattr points to upper dir */
0760         err = ovl_verify_upper(ofs, index, upper, false);
0761         if (err) {
0762             if (err == -ESTALE) {
0763                 pr_warn_ratelimited("suspected multiply redirected dir found (upper=%pd2, origin=%pd2, index=%pd2).\n",
0764                             upper, origin, index);
0765             }
0766             goto fail;
0767         }
0768     } else if (upper && d_inode(upper) != inode) {
0769         goto out_dput;
0770     }
0771 out:
0772     kfree(name.name);
0773     return index;
0774 
0775 out_dput:
0776     dput(index);
0777     index = NULL;
0778     goto out;
0779 
0780 fail:
0781     dput(index);
0782     index = ERR_PTR(-EIO);
0783     goto out;
0784 }
0785 
0786 /*
0787  * Returns next layer in stack starting from top.
0788  * Returns -1 if this is the last layer.
0789  */
0790 int ovl_path_next(int idx, struct dentry *dentry, struct path *path)
0791 {
0792     struct ovl_entry *oe = dentry->d_fsdata;
0793 
0794     BUG_ON(idx < 0);
0795     if (idx == 0) {
0796         ovl_path_upper(dentry, path);
0797         if (path->dentry)
0798             return oe->numlower ? 1 : -1;
0799         idx++;
0800     }
0801     BUG_ON(idx > oe->numlower);
0802     path->dentry = oe->lowerstack[idx - 1].dentry;
0803     path->mnt = oe->lowerstack[idx - 1].layer->mnt;
0804 
0805     return (idx < oe->numlower) ? idx + 1 : -1;
0806 }
0807 
0808 /* Fix missing 'origin' xattr */
0809 static int ovl_fix_origin(struct ovl_fs *ofs, struct dentry *dentry,
0810               struct dentry *lower, struct dentry *upper)
0811 {
0812     int err;
0813 
0814     if (ovl_check_origin_xattr(ofs, upper))
0815         return 0;
0816 
0817     err = ovl_want_write(dentry);
0818     if (err)
0819         return err;
0820 
0821     err = ovl_set_origin(ofs, lower, upper);
0822     if (!err)
0823         err = ovl_set_impure(dentry->d_parent, upper->d_parent);
0824 
0825     ovl_drop_write(dentry);
0826     return err;
0827 }
0828 
0829 struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
0830               unsigned int flags)
0831 {
0832     struct ovl_entry *oe;
0833     const struct cred *old_cred;
0834     struct ovl_fs *ofs = dentry->d_sb->s_fs_info;
0835     struct ovl_entry *poe = dentry->d_parent->d_fsdata;
0836     struct ovl_entry *roe = dentry->d_sb->s_root->d_fsdata;
0837     struct ovl_path *stack = NULL, *origin_path = NULL;
0838     struct dentry *upperdir, *upperdentry = NULL;
0839     struct dentry *origin = NULL;
0840     struct dentry *index = NULL;
0841     unsigned int ctr = 0;
0842     struct inode *inode = NULL;
0843     bool upperopaque = false;
0844     char *upperredirect = NULL;
0845     struct dentry *this;
0846     unsigned int i;
0847     int err;
0848     bool uppermetacopy = false;
0849     struct ovl_lookup_data d = {
0850         .sb = dentry->d_sb,
0851         .name = dentry->d_name,
0852         .is_dir = false,
0853         .opaque = false,
0854         .stop = false,
0855         .last = ofs->config.redirect_follow ? false : !poe->numlower,
0856         .redirect = NULL,
0857         .metacopy = false,
0858     };
0859 
0860     if (dentry->d_name.len > ofs->namelen)
0861         return ERR_PTR(-ENAMETOOLONG);
0862 
0863     old_cred = ovl_override_creds(dentry->d_sb);
0864     upperdir = ovl_dentry_upper(dentry->d_parent);
0865     if (upperdir) {
0866         d.mnt = ovl_upper_mnt(ofs);
0867         err = ovl_lookup_layer(upperdir, &d, &upperdentry, true);
0868         if (err)
0869             goto out;
0870 
0871         if (upperdentry && upperdentry->d_flags & DCACHE_OP_REAL) {
0872             dput(upperdentry);
0873             err = -EREMOTE;
0874             goto out;
0875         }
0876         if (upperdentry && !d.is_dir) {
0877             /*
0878              * Lookup copy up origin by decoding origin file handle.
0879              * We may get a disconnected dentry, which is fine,
0880              * because we only need to hold the origin inode in
0881              * cache and use its inode number.  We may even get a
0882              * connected dentry, that is not under any of the lower
0883              * layers root.  That is also fine for using it's inode
0884              * number - it's the same as if we held a reference
0885              * to a dentry in lower layer that was moved under us.
0886              */
0887             err = ovl_check_origin(ofs, upperdentry, &origin_path);
0888             if (err)
0889                 goto out_put_upper;
0890 
0891             if (d.metacopy)
0892                 uppermetacopy = true;
0893         }
0894 
0895         if (d.redirect) {
0896             err = -ENOMEM;
0897             upperredirect = kstrdup(d.redirect, GFP_KERNEL);
0898             if (!upperredirect)
0899                 goto out_put_upper;
0900             if (d.redirect[0] == '/')
0901                 poe = roe;
0902         }
0903         upperopaque = d.opaque;
0904     }
0905 
0906     if (!d.stop && poe->numlower) {
0907         err = -ENOMEM;
0908         stack = kcalloc(ofs->numlayer - 1, sizeof(struct ovl_path),
0909                 GFP_KERNEL);
0910         if (!stack)
0911             goto out_put_upper;
0912     }
0913 
0914     for (i = 0; !d.stop && i < poe->numlower; i++) {
0915         struct ovl_path lower = poe->lowerstack[i];
0916 
0917         if (!ofs->config.redirect_follow)
0918             d.last = i == poe->numlower - 1;
0919         else
0920             d.last = lower.layer->idx == roe->numlower;
0921 
0922         d.mnt = lower.layer->mnt;
0923         err = ovl_lookup_layer(lower.dentry, &d, &this, false);
0924         if (err)
0925             goto out_put;
0926 
0927         if (!this)
0928             continue;
0929 
0930         if ((uppermetacopy || d.metacopy) && !ofs->config.metacopy) {
0931             dput(this);
0932             err = -EPERM;
0933             pr_warn_ratelimited("refusing to follow metacopy origin for (%pd2)\n", dentry);
0934             goto out_put;
0935         }
0936 
0937         /*
0938          * If no origin fh is stored in upper of a merge dir, store fh
0939          * of lower dir and set upper parent "impure".
0940          */
0941         if (upperdentry && !ctr && !ofs->noxattr && d.is_dir) {
0942             err = ovl_fix_origin(ofs, dentry, this, upperdentry);
0943             if (err) {
0944                 dput(this);
0945                 goto out_put;
0946             }
0947         }
0948 
0949         /*
0950          * When "verify_lower" feature is enabled, do not merge with a
0951          * lower dir that does not match a stored origin xattr. In any
0952          * case, only verified origin is used for index lookup.
0953          *
0954          * For non-dir dentry, if index=on, then ensure origin
0955          * matches the dentry found using path based lookup,
0956          * otherwise error out.
0957          */
0958         if (upperdentry && !ctr &&
0959             ((d.is_dir && ovl_verify_lower(dentry->d_sb)) ||
0960              (!d.is_dir && ofs->config.index && origin_path))) {
0961             err = ovl_verify_origin(ofs, upperdentry, this, false);
0962             if (err) {
0963                 dput(this);
0964                 if (d.is_dir)
0965                     break;
0966                 goto out_put;
0967             }
0968             origin = this;
0969         }
0970 
0971         if (d.metacopy && ctr) {
0972             /*
0973              * Do not store intermediate metacopy dentries in
0974              * lower chain, except top most lower metacopy dentry.
0975              * Continue the loop so that if there is an absolute
0976              * redirect on this dentry, poe can be reset to roe.
0977              */
0978             dput(this);
0979             this = NULL;
0980         } else {
0981             stack[ctr].dentry = this;
0982             stack[ctr].layer = lower.layer;
0983             ctr++;
0984         }
0985 
0986         /*
0987          * Following redirects can have security consequences: it's like
0988          * a symlink into the lower layer without the permission checks.
0989          * This is only a problem if the upper layer is untrusted (e.g
0990          * comes from an USB drive).  This can allow a non-readable file
0991          * or directory to become readable.
0992          *
0993          * Only following redirects when redirects are enabled disables
0994          * this attack vector when not necessary.
0995          */
0996         err = -EPERM;
0997         if (d.redirect && !ofs->config.redirect_follow) {
0998             pr_warn_ratelimited("refusing to follow redirect for (%pd2)\n",
0999                         dentry);
1000             goto out_put;
1001         }
1002 
1003         if (d.stop)
1004             break;
1005 
1006         if (d.redirect && d.redirect[0] == '/' && poe != roe) {
1007             poe = roe;
1008             /* Find the current layer on the root dentry */
1009             i = lower.layer->idx - 1;
1010         }
1011     }
1012 
1013     /*
1014      * For regular non-metacopy upper dentries, there is no lower
1015      * path based lookup, hence ctr will be zero. If a dentry is found
1016      * using ORIGIN xattr on upper, install it in stack.
1017      *
1018      * For metacopy dentry, path based lookup will find lower dentries.
1019      * Just make sure a corresponding data dentry has been found.
1020      */
1021     if (d.metacopy || (uppermetacopy && !ctr)) {
1022         pr_warn_ratelimited("metacopy with no lower data found - abort lookup (%pd2)\n",
1023                     dentry);
1024         err = -EIO;
1025         goto out_put;
1026     } else if (!d.is_dir && upperdentry && !ctr && origin_path) {
1027         if (WARN_ON(stack != NULL)) {
1028             err = -EIO;
1029             goto out_put;
1030         }
1031         stack = origin_path;
1032         ctr = 1;
1033         origin = origin_path->dentry;
1034         origin_path = NULL;
1035     }
1036 
1037     /*
1038      * Always lookup index if there is no-upperdentry.
1039      *
1040      * For the case of upperdentry, we have set origin by now if it
1041      * needed to be set. There are basically three cases.
1042      *
1043      * For directories, lookup index by lower inode and verify it matches
1044      * upper inode. We only trust dir index if we verified that lower dir
1045      * matches origin, otherwise dir index entries may be inconsistent
1046      * and we ignore them.
1047      *
1048      * For regular upper, we already set origin if upper had ORIGIN
1049      * xattr. There is no verification though as there is no path
1050      * based dentry lookup in lower in this case.
1051      *
1052      * For metacopy upper, we set a verified origin already if index
1053      * is enabled and if upper had an ORIGIN xattr.
1054      *
1055      */
1056     if (!upperdentry && ctr)
1057         origin = stack[0].dentry;
1058 
1059     if (origin && ovl_indexdir(dentry->d_sb) &&
1060         (!d.is_dir || ovl_index_all(dentry->d_sb))) {
1061         index = ovl_lookup_index(ofs, upperdentry, origin, true);
1062         if (IS_ERR(index)) {
1063             err = PTR_ERR(index);
1064             index = NULL;
1065             goto out_put;
1066         }
1067     }
1068 
1069     oe = ovl_alloc_entry(ctr);
1070     err = -ENOMEM;
1071     if (!oe)
1072         goto out_put;
1073 
1074     memcpy(oe->lowerstack, stack, sizeof(struct ovl_path) * ctr);
1075     dentry->d_fsdata = oe;
1076 
1077     if (upperopaque)
1078         ovl_dentry_set_opaque(dentry);
1079 
1080     if (upperdentry)
1081         ovl_dentry_set_upper_alias(dentry);
1082     else if (index) {
1083         struct path upperpath = {
1084             .dentry = upperdentry = dget(index),
1085             .mnt = ovl_upper_mnt(ofs),
1086         };
1087 
1088         upperredirect = ovl_get_redirect_xattr(ofs, &upperpath, 0);
1089         if (IS_ERR(upperredirect)) {
1090             err = PTR_ERR(upperredirect);
1091             upperredirect = NULL;
1092             goto out_free_oe;
1093         }
1094         err = ovl_check_metacopy_xattr(ofs, &upperpath);
1095         if (err < 0)
1096             goto out_free_oe;
1097         uppermetacopy = err;
1098     }
1099 
1100     if (upperdentry || ctr) {
1101         struct ovl_inode_params oip = {
1102             .upperdentry = upperdentry,
1103             .lowerpath = stack,
1104             .index = index,
1105             .numlower = ctr,
1106             .redirect = upperredirect,
1107             .lowerdata = (ctr > 1 && !d.is_dir) ?
1108                       stack[ctr - 1].dentry : NULL,
1109         };
1110 
1111         inode = ovl_get_inode(dentry->d_sb, &oip);
1112         err = PTR_ERR(inode);
1113         if (IS_ERR(inode))
1114             goto out_free_oe;
1115         if (upperdentry && !uppermetacopy)
1116             ovl_set_flag(OVL_UPPERDATA, inode);
1117     }
1118 
1119     ovl_dentry_update_reval(dentry, upperdentry,
1120             DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE);
1121 
1122     revert_creds(old_cred);
1123     if (origin_path) {
1124         dput(origin_path->dentry);
1125         kfree(origin_path);
1126     }
1127     dput(index);
1128     kfree(stack);
1129     kfree(d.redirect);
1130     return d_splice_alias(inode, dentry);
1131 
1132 out_free_oe:
1133     dentry->d_fsdata = NULL;
1134     kfree(oe);
1135 out_put:
1136     dput(index);
1137     for (i = 0; i < ctr; i++)
1138         dput(stack[i].dentry);
1139     kfree(stack);
1140 out_put_upper:
1141     if (origin_path) {
1142         dput(origin_path->dentry);
1143         kfree(origin_path);
1144     }
1145     dput(upperdentry);
1146     kfree(upperredirect);
1147 out:
1148     kfree(d.redirect);
1149     revert_creds(old_cred);
1150     return ERR_PTR(err);
1151 }
1152 
1153 bool ovl_lower_positive(struct dentry *dentry)
1154 {
1155     struct ovl_entry *poe = dentry->d_parent->d_fsdata;
1156     const struct qstr *name = &dentry->d_name;
1157     const struct cred *old_cred;
1158     unsigned int i;
1159     bool positive = false;
1160     bool done = false;
1161 
1162     /*
1163      * If dentry is negative, then lower is positive iff this is a
1164      * whiteout.
1165      */
1166     if (!dentry->d_inode)
1167         return ovl_dentry_is_opaque(dentry);
1168 
1169     /* Negative upper -> positive lower */
1170     if (!ovl_dentry_upper(dentry))
1171         return true;
1172 
1173     old_cred = ovl_override_creds(dentry->d_sb);
1174     /* Positive upper -> have to look up lower to see whether it exists */
1175     for (i = 0; !done && !positive && i < poe->numlower; i++) {
1176         struct dentry *this;
1177         struct dentry *lowerdir = poe->lowerstack[i].dentry;
1178 
1179         this = lookup_one_positive_unlocked(mnt_user_ns(poe->lowerstack[i].layer->mnt),
1180                            name->name, lowerdir, name->len);
1181         if (IS_ERR(this)) {
1182             switch (PTR_ERR(this)) {
1183             case -ENOENT:
1184             case -ENAMETOOLONG:
1185                 break;
1186 
1187             default:
1188                 /*
1189                  * Assume something is there, we just couldn't
1190                  * access it.
1191                  */
1192                 positive = true;
1193                 break;
1194             }
1195         } else {
1196             positive = !ovl_is_whiteout(this);
1197             done = true;
1198             dput(this);
1199         }
1200     }
1201     revert_creds(old_cred);
1202 
1203     return positive;
1204 }
[ Source navigation ] [ Diff markup ] [ Identifier search ] [ general search ]

This page was automatically generated by the 2.1.0 LXR engine.

The LXR team
Valid CSS 2.1! Valid HTML 4.01!