1 | // SPDX-License-Identifier: GPL-2.0-only |
2 | /* |
3 | * |
4 | * Copyright (C) 2011 Novell Inc. |
5 | */ |
6 | |
7 | #include <linux/fs.h> |
8 | #include <linux/slab.h> |
9 | #include <linux/cred.h> |
10 | #include <linux/xattr.h> |
11 | #include <linux/posix_acl.h> |
12 | #include <linux/ratelimit.h> |
13 | #include <linux/fiemap.h> |
14 | #include <linux/fileattr.h> |
15 | #include <linux/security.h> |
16 | #include <linux/namei.h> |
17 | #include <linux/posix_acl.h> |
18 | #include <linux/posix_acl_xattr.h> |
19 | #include "overlayfs.h" |
20 | |
21 | |
22 | int ovl_setattr(struct mnt_idmap *idmap, struct dentry *dentry, |
23 | struct iattr *attr) |
24 | { |
25 | int err; |
26 | struct ovl_fs *ofs = OVL_FS(sb: dentry->d_sb); |
27 | bool full_copy_up = false; |
28 | struct dentry *upperdentry; |
29 | const struct cred *old_cred; |
30 | |
31 | err = setattr_prepare(&nop_mnt_idmap, dentry, attr); |
32 | if (err) |
33 | return err; |
34 | |
35 | if (attr->ia_valid & ATTR_SIZE) { |
36 | /* Truncate should trigger data copy up as well */ |
37 | full_copy_up = true; |
38 | } |
39 | |
40 | if (!full_copy_up) |
41 | err = ovl_copy_up(dentry); |
42 | else |
43 | err = ovl_copy_up_with_data(dentry); |
44 | if (!err) { |
45 | struct inode *winode = NULL; |
46 | |
47 | upperdentry = ovl_dentry_upper(dentry); |
48 | |
49 | if (attr->ia_valid & ATTR_SIZE) { |
50 | winode = d_inode(dentry: upperdentry); |
51 | err = get_write_access(inode: winode); |
52 | if (err) |
53 | goto out; |
54 | } |
55 | |
56 | if (attr->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) |
57 | attr->ia_valid &= ~ATTR_MODE; |
58 | |
59 | /* |
60 | * We might have to translate ovl file into real file object |
61 | * once use cases emerge. For now, simply don't let underlying |
62 | * filesystem rely on attr->ia_file |
63 | */ |
64 | attr->ia_valid &= ~ATTR_FILE; |
65 | |
66 | /* |
67 | * If open(O_TRUNC) is done, VFS calls ->setattr with ATTR_OPEN |
68 | * set. Overlayfs does not pass O_TRUNC flag to underlying |
69 | * filesystem during open -> do not pass ATTR_OPEN. This |
70 | * disables optimization in fuse which assumes open(O_TRUNC) |
71 | * already set file size to 0. But we never passed O_TRUNC to |
72 | * fuse. So by clearing ATTR_OPEN, fuse will be forced to send |
73 | * setattr request to server. |
74 | */ |
75 | attr->ia_valid &= ~ATTR_OPEN; |
76 | |
77 | err = ovl_want_write(dentry); |
78 | if (err) |
79 | goto out_put_write; |
80 | |
81 | inode_lock(inode: upperdentry->d_inode); |
82 | old_cred = ovl_override_creds(sb: dentry->d_sb); |
83 | err = ovl_do_notify_change(ofs, upperdentry, attr); |
84 | revert_creds(old_cred); |
85 | if (!err) |
86 | ovl_copyattr(to: dentry->d_inode); |
87 | inode_unlock(inode: upperdentry->d_inode); |
88 | ovl_drop_write(dentry); |
89 | |
90 | out_put_write: |
91 | if (winode) |
92 | put_write_access(inode: winode); |
93 | } |
94 | out: |
95 | return err; |
96 | } |
97 | |
98 | static void ovl_map_dev_ino(struct dentry *dentry, struct kstat *stat, int fsid) |
99 | { |
100 | struct ovl_fs *ofs = OVL_FS(sb: dentry->d_sb); |
101 | bool samefs = ovl_same_fs(ofs); |
102 | unsigned int xinobits = ovl_xino_bits(ofs); |
103 | unsigned int xinoshift = 64 - xinobits; |
104 | |
105 | if (samefs) { |
106 | /* |
107 | * When all layers are on the same fs, all real inode |
108 | * number are unique, so we use the overlay st_dev, |
109 | * which is friendly to du -x. |
110 | */ |
111 | stat->dev = dentry->d_sb->s_dev; |
112 | return; |
113 | } else if (xinobits) { |
114 | /* |
115 | * All inode numbers of underlying fs should not be using the |
116 | * high xinobits, so we use high xinobits to partition the |
117 | * overlay st_ino address space. The high bits holds the fsid |
118 | * (upper fsid is 0). The lowest xinobit is reserved for mapping |
119 | * the non-persistent inode numbers range in case of overflow. |
120 | * This way all overlay inode numbers are unique and use the |
121 | * overlay st_dev. |
122 | */ |
123 | if (likely(!(stat->ino >> xinoshift))) { |
124 | stat->ino |= ((u64)fsid) << (xinoshift + 1); |
125 | stat->dev = dentry->d_sb->s_dev; |
126 | return; |
127 | } else if (ovl_xino_warn(ofs)) { |
128 | pr_warn_ratelimited("inode number too big (%pd2, ino=%llu, xinobits=%d)\n" , |
129 | dentry, stat->ino, xinobits); |
130 | } |
131 | } |
132 | |
133 | /* The inode could not be mapped to a unified st_ino address space */ |
134 | if (S_ISDIR(dentry->d_inode->i_mode)) { |
135 | /* |
136 | * Always use the overlay st_dev for directories, so 'find |
137 | * -xdev' will scan the entire overlay mount and won't cross the |
138 | * overlay mount boundaries. |
139 | * |
140 | * If not all layers are on the same fs the pair {real st_ino; |
141 | * overlay st_dev} is not unique, so use the non persistent |
142 | * overlay st_ino for directories. |
143 | */ |
144 | stat->dev = dentry->d_sb->s_dev; |
145 | stat->ino = dentry->d_inode->i_ino; |
146 | } else { |
147 | /* |
148 | * For non-samefs setup, if we cannot map all layers st_ino |
149 | * to a unified address space, we need to make sure that st_dev |
150 | * is unique per underlying fs, so we use the unique anonymous |
151 | * bdev assigned to the underlying fs. |
152 | */ |
153 | stat->dev = ofs->fs[fsid].pseudo_dev; |
154 | } |
155 | } |
156 | |
157 | int ovl_getattr(struct mnt_idmap *idmap, const struct path *path, |
158 | struct kstat *stat, u32 request_mask, unsigned int flags) |
159 | { |
160 | struct dentry *dentry = path->dentry; |
161 | enum ovl_path_type type; |
162 | struct path realpath; |
163 | const struct cred *old_cred; |
164 | struct inode *inode = d_inode(dentry); |
165 | bool is_dir = S_ISDIR(inode->i_mode); |
166 | int fsid = 0; |
167 | int err; |
168 | bool metacopy_blocks = false; |
169 | |
170 | metacopy_blocks = ovl_is_metacopy_dentry(dentry); |
171 | |
172 | type = ovl_path_real(dentry, path: &realpath); |
173 | old_cred = ovl_override_creds(sb: dentry->d_sb); |
174 | err = vfs_getattr(&realpath, stat, request_mask, flags); |
175 | if (err) |
176 | goto out; |
177 | |
178 | /* Report the effective immutable/append-only STATX flags */ |
179 | generic_fill_statx_attr(inode, stat); |
180 | |
181 | /* |
182 | * For non-dir or same fs, we use st_ino of the copy up origin. |
183 | * This guaranties constant st_dev/st_ino across copy up. |
184 | * With xino feature and non-samefs, we use st_ino of the copy up |
185 | * origin masked with high bits that represent the layer id. |
186 | * |
187 | * If lower filesystem supports NFS file handles, this also guaranties |
188 | * persistent st_ino across mount cycle. |
189 | */ |
190 | if (!is_dir || ovl_same_dev(ofs: OVL_FS(sb: dentry->d_sb))) { |
191 | if (!OVL_TYPE_UPPER(type)) { |
192 | fsid = ovl_layer_lower(dentry)->fsid; |
193 | } else if (OVL_TYPE_ORIGIN(type)) { |
194 | struct kstat lowerstat; |
195 | u32 lowermask = STATX_INO | STATX_BLOCKS | |
196 | (!is_dir ? STATX_NLINK : 0); |
197 | |
198 | ovl_path_lower(dentry, path: &realpath); |
199 | err = vfs_getattr(&realpath, &lowerstat, |
200 | lowermask, flags); |
201 | if (err) |
202 | goto out; |
203 | |
204 | /* |
205 | * Lower hardlinks may be broken on copy up to different |
206 | * upper files, so we cannot use the lower origin st_ino |
207 | * for those different files, even for the same fs case. |
208 | * |
209 | * Similarly, several redirected dirs can point to the |
210 | * same dir on a lower layer. With the "verify_lower" |
211 | * feature, we do not use the lower origin st_ino, if |
212 | * we haven't verified that this redirect is unique. |
213 | * |
214 | * With inodes index enabled, it is safe to use st_ino |
215 | * of an indexed origin. The index validates that the |
216 | * upper hardlink is not broken and that a redirected |
217 | * dir is the only redirect to that origin. |
218 | */ |
219 | if (ovl_test_flag(flag: OVL_INDEX, inode: d_inode(dentry)) || |
220 | (!ovl_verify_lower(sb: dentry->d_sb) && |
221 | (is_dir || lowerstat.nlink == 1))) { |
222 | fsid = ovl_layer_lower(dentry)->fsid; |
223 | stat->ino = lowerstat.ino; |
224 | } |
225 | |
226 | /* |
227 | * If we are querying a metacopy dentry and lower |
228 | * dentry is data dentry, then use the blocks we |
229 | * queried just now. We don't have to do additional |
230 | * vfs_getattr(). If lower itself is metacopy, then |
231 | * additional vfs_getattr() is unavoidable. |
232 | */ |
233 | if (metacopy_blocks && |
234 | realpath.dentry == ovl_dentry_lowerdata(dentry)) { |
235 | stat->blocks = lowerstat.blocks; |
236 | metacopy_blocks = false; |
237 | } |
238 | } |
239 | |
240 | if (metacopy_blocks) { |
241 | /* |
242 | * If lower is not same as lowerdata or if there was |
243 | * no origin on upper, we can end up here. |
244 | * With lazy lowerdata lookup, guess lowerdata blocks |
245 | * from size to avoid lowerdata lookup on stat(2). |
246 | */ |
247 | struct kstat lowerdatastat; |
248 | u32 lowermask = STATX_BLOCKS; |
249 | |
250 | ovl_path_lowerdata(dentry, path: &realpath); |
251 | if (realpath.dentry) { |
252 | err = vfs_getattr(&realpath, &lowerdatastat, |
253 | lowermask, flags); |
254 | if (err) |
255 | goto out; |
256 | } else { |
257 | lowerdatastat.blocks = |
258 | round_up(stat->size, stat->blksize) >> 9; |
259 | } |
260 | stat->blocks = lowerdatastat.blocks; |
261 | } |
262 | } |
263 | |
264 | ovl_map_dev_ino(dentry, stat, fsid); |
265 | |
266 | /* |
267 | * It's probably not worth it to count subdirs to get the |
268 | * correct link count. nlink=1 seems to pacify 'find' and |
269 | * other utilities. |
270 | */ |
271 | if (is_dir && OVL_TYPE_MERGE(type)) |
272 | stat->nlink = 1; |
273 | |
274 | /* |
275 | * Return the overlay inode nlinks for indexed upper inodes. |
276 | * Overlay inode nlink counts the union of the upper hardlinks |
277 | * and non-covered lower hardlinks. It does not include the upper |
278 | * index hardlink. |
279 | */ |
280 | if (!is_dir && ovl_test_flag(flag: OVL_INDEX, inode: d_inode(dentry))) |
281 | stat->nlink = dentry->d_inode->i_nlink; |
282 | |
283 | out: |
284 | revert_creds(old_cred); |
285 | |
286 | return err; |
287 | } |
288 | |
289 | int ovl_permission(struct mnt_idmap *idmap, |
290 | struct inode *inode, int mask) |
291 | { |
292 | struct inode *upperinode = ovl_inode_upper(inode); |
293 | struct inode *realinode; |
294 | struct path realpath; |
295 | const struct cred *old_cred; |
296 | int err; |
297 | |
298 | /* Careful in RCU walk mode */ |
299 | realinode = ovl_i_path_real(inode, path: &realpath); |
300 | if (!realinode) { |
301 | WARN_ON(!(mask & MAY_NOT_BLOCK)); |
302 | return -ECHILD; |
303 | } |
304 | |
305 | /* |
306 | * Check overlay inode with the creds of task and underlying inode |
307 | * with creds of mounter |
308 | */ |
309 | err = generic_permission(&nop_mnt_idmap, inode, mask); |
310 | if (err) |
311 | return err; |
312 | |
313 | old_cred = ovl_override_creds(sb: inode->i_sb); |
314 | if (!upperinode && |
315 | !special_file(realinode->i_mode) && mask & MAY_WRITE) { |
316 | mask &= ~(MAY_WRITE | MAY_APPEND); |
317 | /* Make sure mounter can read file for copy up later */ |
318 | mask |= MAY_READ; |
319 | } |
320 | err = inode_permission(mnt_idmap(mnt: realpath.mnt), realinode, mask); |
321 | revert_creds(old_cred); |
322 | |
323 | return err; |
324 | } |
325 | |
326 | static const char *ovl_get_link(struct dentry *dentry, |
327 | struct inode *inode, |
328 | struct delayed_call *done) |
329 | { |
330 | const struct cred *old_cred; |
331 | const char *p; |
332 | |
333 | if (!dentry) |
334 | return ERR_PTR(error: -ECHILD); |
335 | |
336 | old_cred = ovl_override_creds(sb: dentry->d_sb); |
337 | p = vfs_get_link(ovl_dentry_real(dentry), done); |
338 | revert_creds(old_cred); |
339 | return p; |
340 | } |
341 | |
342 | #ifdef CONFIG_FS_POSIX_ACL |
343 | /* |
344 | * Apply the idmapping of the layer to POSIX ACLs. The caller must pass a clone |
345 | * of the POSIX ACLs retrieved from the lower layer to this function to not |
346 | * alter the POSIX ACLs for the underlying filesystem. |
347 | */ |
348 | static void ovl_idmap_posix_acl(const struct inode *realinode, |
349 | struct mnt_idmap *idmap, |
350 | struct posix_acl *acl) |
351 | { |
352 | struct user_namespace *fs_userns = i_user_ns(inode: realinode); |
353 | |
354 | for (unsigned int i = 0; i < acl->a_count; i++) { |
355 | vfsuid_t vfsuid; |
356 | vfsgid_t vfsgid; |
357 | |
358 | struct posix_acl_entry *e = &acl->a_entries[i]; |
359 | switch (e->e_tag) { |
360 | case ACL_USER: |
361 | vfsuid = make_vfsuid(idmap, fs_userns, kuid: e->e_uid); |
362 | e->e_uid = vfsuid_into_kuid(vfsuid); |
363 | break; |
364 | case ACL_GROUP: |
365 | vfsgid = make_vfsgid(idmap, fs_userns, kgid: e->e_gid); |
366 | e->e_gid = vfsgid_into_kgid(vfsgid); |
367 | break; |
368 | } |
369 | } |
370 | } |
371 | |
372 | /* |
373 | * The @noperm argument is used to skip permission checking and is a temporary |
374 | * measure. Quoting Miklos from an earlier discussion: |
375 | * |
376 | * > So there are two paths to getting an acl: |
377 | * > 1) permission checking and 2) retrieving the value via getxattr(2). |
378 | * > This is a similar situation as reading a symlink vs. following it. |
379 | * > When following a symlink overlayfs always reads the link on the |
380 | * > underlying fs just as if it was a readlink(2) call, calling |
381 | * > security_inode_readlink() instead of security_inode_follow_link(). |
382 | * > This is logical: we are reading the link from the underlying storage, |
383 | * > and following it on overlayfs. |
384 | * > |
385 | * > Applying the same logic to acl: we do need to call the |
386 | * > security_inode_getxattr() on the underlying fs, even if just want to |
387 | * > check permissions on overlay. This is currently not done, which is an |
388 | * > inconsistency. |
389 | * > |
390 | * > Maybe adding the check to ovl_get_acl() is the right way to go, but |
391 | * > I'm a little afraid of a performance regression. Will look into that. |
392 | * |
393 | * Until we have made a decision allow this helper to take the @noperm |
394 | * argument. We should hopefully be able to remove it soon. |
395 | */ |
396 | struct posix_acl *ovl_get_acl_path(const struct path *path, |
397 | const char *acl_name, bool noperm) |
398 | { |
399 | struct posix_acl *real_acl, *clone; |
400 | struct mnt_idmap *idmap; |
401 | struct inode *realinode = d_inode(dentry: path->dentry); |
402 | |
403 | idmap = mnt_idmap(mnt: path->mnt); |
404 | |
405 | if (noperm) |
406 | real_acl = get_inode_acl(inode: realinode, type: posix_acl_type(name: acl_name)); |
407 | else |
408 | real_acl = vfs_get_acl(idmap, dentry: path->dentry, acl_name); |
409 | if (IS_ERR_OR_NULL(ptr: real_acl)) |
410 | return real_acl; |
411 | |
412 | if (!is_idmapped_mnt(mnt: path->mnt)) |
413 | return real_acl; |
414 | |
415 | /* |
416 | * We cannot alter the ACLs returned from the relevant layer as that |
417 | * would alter the cached values filesystem wide for the lower |
418 | * filesystem. Instead we can clone the ACLs and then apply the |
419 | * relevant idmapping of the layer. |
420 | */ |
421 | clone = posix_acl_clone(acl: real_acl, GFP_KERNEL); |
422 | posix_acl_release(acl: real_acl); /* release original acl */ |
423 | if (!clone) |
424 | return ERR_PTR(error: -ENOMEM); |
425 | |
426 | ovl_idmap_posix_acl(realinode, idmap, acl: clone); |
427 | return clone; |
428 | } |
429 | |
430 | /* |
431 | * When the relevant layer is an idmapped mount we need to take the idmapping |
432 | * of the layer into account and translate any ACL_{GROUP,USER} values |
433 | * according to the idmapped mount. |
434 | * |
435 | * We cannot alter the ACLs returned from the relevant layer as that would |
436 | * alter the cached values filesystem wide for the lower filesystem. Instead we |
437 | * can clone the ACLs and then apply the relevant idmapping of the layer. |
438 | * |
439 | * This is obviously only relevant when idmapped layers are used. |
440 | */ |
441 | struct posix_acl *do_ovl_get_acl(struct mnt_idmap *idmap, |
442 | struct inode *inode, int type, |
443 | bool rcu, bool noperm) |
444 | { |
445 | struct inode *realinode; |
446 | struct posix_acl *acl; |
447 | struct path realpath; |
448 | |
449 | /* Careful in RCU walk mode */ |
450 | realinode = ovl_i_path_real(inode, path: &realpath); |
451 | if (!realinode) { |
452 | WARN_ON(!rcu); |
453 | return ERR_PTR(error: -ECHILD); |
454 | } |
455 | |
456 | if (!IS_POSIXACL(realinode)) |
457 | return NULL; |
458 | |
459 | if (rcu) { |
460 | /* |
461 | * If the layer is idmapped drop out of RCU path walk |
462 | * so we can clone the ACLs. |
463 | */ |
464 | if (is_idmapped_mnt(mnt: realpath.mnt)) |
465 | return ERR_PTR(error: -ECHILD); |
466 | |
467 | acl = get_cached_acl_rcu(inode: realinode, type); |
468 | } else { |
469 | const struct cred *old_cred; |
470 | |
471 | old_cred = ovl_override_creds(sb: inode->i_sb); |
472 | acl = ovl_get_acl_path(path: &realpath, acl_name: posix_acl_xattr_name(type), noperm); |
473 | revert_creds(old_cred); |
474 | } |
475 | |
476 | return acl; |
477 | } |
478 | |
479 | static int ovl_set_or_remove_acl(struct dentry *dentry, struct inode *inode, |
480 | struct posix_acl *acl, int type) |
481 | { |
482 | int err; |
483 | struct path realpath; |
484 | const char *acl_name; |
485 | const struct cred *old_cred; |
486 | struct ovl_fs *ofs = OVL_FS(sb: dentry->d_sb); |
487 | struct dentry *upperdentry = ovl_dentry_upper(dentry); |
488 | struct dentry *realdentry = upperdentry ?: ovl_dentry_lower(dentry); |
489 | |
490 | /* |
491 | * If ACL is to be removed from a lower file, check if it exists in |
492 | * the first place before copying it up. |
493 | */ |
494 | acl_name = posix_acl_xattr_name(type); |
495 | if (!acl && !upperdentry) { |
496 | struct posix_acl *real_acl; |
497 | |
498 | ovl_path_lower(dentry, path: &realpath); |
499 | old_cred = ovl_override_creds(sb: dentry->d_sb); |
500 | real_acl = vfs_get_acl(idmap: mnt_idmap(mnt: realpath.mnt), dentry: realdentry, |
501 | acl_name); |
502 | revert_creds(old_cred); |
503 | if (IS_ERR(ptr: real_acl)) { |
504 | err = PTR_ERR(ptr: real_acl); |
505 | goto out; |
506 | } |
507 | posix_acl_release(acl: real_acl); |
508 | } |
509 | |
510 | if (!upperdentry) { |
511 | err = ovl_copy_up(dentry); |
512 | if (err) |
513 | goto out; |
514 | |
515 | realdentry = ovl_dentry_upper(dentry); |
516 | } |
517 | |
518 | err = ovl_want_write(dentry); |
519 | if (err) |
520 | goto out; |
521 | |
522 | old_cred = ovl_override_creds(sb: dentry->d_sb); |
523 | if (acl) |
524 | err = ovl_do_set_acl(ofs, dentry: realdentry, acl_name, acl); |
525 | else |
526 | err = ovl_do_remove_acl(ofs, dentry: realdentry, acl_name); |
527 | revert_creds(old_cred); |
528 | ovl_drop_write(dentry); |
529 | |
530 | /* copy c/mtime */ |
531 | ovl_copyattr(to: inode); |
532 | out: |
533 | return err; |
534 | } |
535 | |
536 | int ovl_set_acl(struct mnt_idmap *idmap, struct dentry *dentry, |
537 | struct posix_acl *acl, int type) |
538 | { |
539 | int err; |
540 | struct inode *inode = d_inode(dentry); |
541 | struct dentry *workdir = ovl_workdir(dentry); |
542 | struct inode *realinode = ovl_inode_real(inode); |
543 | |
544 | if (!IS_POSIXACL(d_inode(workdir))) |
545 | return -EOPNOTSUPP; |
546 | if (!realinode->i_op->set_acl) |
547 | return -EOPNOTSUPP; |
548 | if (type == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode)) |
549 | return acl ? -EACCES : 0; |
550 | if (!inode_owner_or_capable(idmap: &nop_mnt_idmap, inode)) |
551 | return -EPERM; |
552 | |
553 | /* |
554 | * Check if sgid bit needs to be cleared (actual setacl operation will |
555 | * be done with mounter's capabilities and so that won't do it for us). |
556 | */ |
557 | if (unlikely(inode->i_mode & S_ISGID) && type == ACL_TYPE_ACCESS && |
558 | !in_group_p(inode->i_gid) && |
559 | !capable_wrt_inode_uidgid(idmap: &nop_mnt_idmap, inode, CAP_FSETID)) { |
560 | struct iattr iattr = { .ia_valid = ATTR_KILL_SGID }; |
561 | |
562 | err = ovl_setattr(idmap: &nop_mnt_idmap, dentry, attr: &iattr); |
563 | if (err) |
564 | return err; |
565 | } |
566 | |
567 | return ovl_set_or_remove_acl(dentry, inode, acl, type); |
568 | } |
569 | #endif |
570 | |
571 | int ovl_update_time(struct inode *inode, int flags) |
572 | { |
573 | if (flags & S_ATIME) { |
574 | struct ovl_fs *ofs = OVL_FS(sb: inode->i_sb); |
575 | struct path upperpath = { |
576 | .mnt = ovl_upper_mnt(ofs), |
577 | .dentry = ovl_upperdentry_dereference(oi: OVL_I(inode)), |
578 | }; |
579 | |
580 | if (upperpath.dentry) { |
581 | touch_atime(&upperpath); |
582 | inode_set_atime_to_ts(inode, |
583 | ts: inode_get_atime(inode: d_inode(dentry: upperpath.dentry))); |
584 | } |
585 | } |
586 | return 0; |
587 | } |
588 | |
589 | static int ovl_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, |
590 | u64 start, u64 len) |
591 | { |
592 | int err; |
593 | struct inode *realinode = ovl_inode_realdata(inode); |
594 | const struct cred *old_cred; |
595 | |
596 | if (!realinode) |
597 | return -EIO; |
598 | |
599 | if (!realinode->i_op->fiemap) |
600 | return -EOPNOTSUPP; |
601 | |
602 | old_cred = ovl_override_creds(sb: inode->i_sb); |
603 | err = realinode->i_op->fiemap(realinode, fieinfo, start, len); |
604 | revert_creds(old_cred); |
605 | |
606 | return err; |
607 | } |
608 | |
609 | /* |
610 | * Work around the fact that security_file_ioctl() takes a file argument. |
611 | * Introducing security_inode_fileattr_get/set() hooks would solve this issue |
612 | * properly. |
613 | */ |
614 | static int ovl_security_fileattr(const struct path *realpath, struct fileattr *fa, |
615 | bool set) |
616 | { |
617 | struct file *file; |
618 | unsigned int cmd; |
619 | int err; |
620 | |
621 | file = dentry_open(path: realpath, O_RDONLY, current_cred()); |
622 | if (IS_ERR(ptr: file)) |
623 | return PTR_ERR(ptr: file); |
624 | |
625 | if (set) |
626 | cmd = fa->fsx_valid ? FS_IOC_FSSETXATTR : FS_IOC_SETFLAGS; |
627 | else |
628 | cmd = fa->fsx_valid ? FS_IOC_FSGETXATTR : FS_IOC_GETFLAGS; |
629 | |
630 | err = security_file_ioctl(file, cmd, arg: 0); |
631 | fput(file); |
632 | |
633 | return err; |
634 | } |
635 | |
636 | int ovl_real_fileattr_set(const struct path *realpath, struct fileattr *fa) |
637 | { |
638 | int err; |
639 | |
640 | err = ovl_security_fileattr(realpath, fa, set: true); |
641 | if (err) |
642 | return err; |
643 | |
644 | return vfs_fileattr_set(idmap: mnt_idmap(mnt: realpath->mnt), dentry: realpath->dentry, fa); |
645 | } |
646 | |
647 | int ovl_fileattr_set(struct mnt_idmap *idmap, |
648 | struct dentry *dentry, struct fileattr *fa) |
649 | { |
650 | struct inode *inode = d_inode(dentry); |
651 | struct path upperpath; |
652 | const struct cred *old_cred; |
653 | unsigned int flags; |
654 | int err; |
655 | |
656 | err = ovl_copy_up(dentry); |
657 | if (!err) { |
658 | ovl_path_real(dentry, path: &upperpath); |
659 | |
660 | err = ovl_want_write(dentry); |
661 | if (err) |
662 | goto out; |
663 | |
664 | old_cred = ovl_override_creds(sb: inode->i_sb); |
665 | /* |
666 | * Store immutable/append-only flags in xattr and clear them |
667 | * in upper fileattr (in case they were set by older kernel) |
668 | * so children of "ovl-immutable" directories lower aliases of |
669 | * "ovl-immutable" hardlinks could be copied up. |
670 | * Clear xattr when flags are cleared. |
671 | */ |
672 | err = ovl_set_protattr(inode, upper: upperpath.dentry, fa); |
673 | if (!err) |
674 | err = ovl_real_fileattr_set(realpath: &upperpath, fa); |
675 | revert_creds(old_cred); |
676 | ovl_drop_write(dentry); |
677 | |
678 | /* |
679 | * Merge real inode flags with inode flags read from |
680 | * overlay.protattr xattr |
681 | */ |
682 | flags = ovl_inode_real(inode)->i_flags & OVL_COPY_I_FLAGS_MASK; |
683 | |
684 | BUILD_BUG_ON(OVL_PROT_I_FLAGS_MASK & ~OVL_COPY_I_FLAGS_MASK); |
685 | flags |= inode->i_flags & OVL_PROT_I_FLAGS_MASK; |
686 | inode_set_flags(inode, flags, OVL_COPY_I_FLAGS_MASK); |
687 | |
688 | /* Update ctime */ |
689 | ovl_copyattr(to: inode); |
690 | } |
691 | out: |
692 | return err; |
693 | } |
694 | |
695 | /* Convert inode protection flags to fileattr flags */ |
696 | static void ovl_fileattr_prot_flags(struct inode *inode, struct fileattr *fa) |
697 | { |
698 | BUILD_BUG_ON(OVL_PROT_FS_FLAGS_MASK & ~FS_COMMON_FL); |
699 | BUILD_BUG_ON(OVL_PROT_FSX_FLAGS_MASK & ~FS_XFLAG_COMMON); |
700 | |
701 | if (inode->i_flags & S_APPEND) { |
702 | fa->flags |= FS_APPEND_FL; |
703 | fa->fsx_xflags |= FS_XFLAG_APPEND; |
704 | } |
705 | if (inode->i_flags & S_IMMUTABLE) { |
706 | fa->flags |= FS_IMMUTABLE_FL; |
707 | fa->fsx_xflags |= FS_XFLAG_IMMUTABLE; |
708 | } |
709 | } |
710 | |
711 | int ovl_real_fileattr_get(const struct path *realpath, struct fileattr *fa) |
712 | { |
713 | int err; |
714 | |
715 | err = ovl_security_fileattr(realpath, fa, set: false); |
716 | if (err) |
717 | return err; |
718 | |
719 | err = vfs_fileattr_get(dentry: realpath->dentry, fa); |
720 | if (err == -ENOIOCTLCMD) |
721 | err = -ENOTTY; |
722 | return err; |
723 | } |
724 | |
725 | int ovl_fileattr_get(struct dentry *dentry, struct fileattr *fa) |
726 | { |
727 | struct inode *inode = d_inode(dentry); |
728 | struct path realpath; |
729 | const struct cred *old_cred; |
730 | int err; |
731 | |
732 | ovl_path_real(dentry, path: &realpath); |
733 | |
734 | old_cred = ovl_override_creds(sb: inode->i_sb); |
735 | err = ovl_real_fileattr_get(realpath: &realpath, fa); |
736 | ovl_fileattr_prot_flags(inode, fa); |
737 | revert_creds(old_cred); |
738 | |
739 | return err; |
740 | } |
741 | |
742 | static const struct inode_operations ovl_file_inode_operations = { |
743 | .setattr = ovl_setattr, |
744 | .permission = ovl_permission, |
745 | .getattr = ovl_getattr, |
746 | .listxattr = ovl_listxattr, |
747 | .get_inode_acl = ovl_get_inode_acl, |
748 | .get_acl = ovl_get_acl, |
749 | .set_acl = ovl_set_acl, |
750 | .update_time = ovl_update_time, |
751 | .fiemap = ovl_fiemap, |
752 | .fileattr_get = ovl_fileattr_get, |
753 | .fileattr_set = ovl_fileattr_set, |
754 | }; |
755 | |
756 | static const struct inode_operations ovl_symlink_inode_operations = { |
757 | .setattr = ovl_setattr, |
758 | .get_link = ovl_get_link, |
759 | .getattr = ovl_getattr, |
760 | .listxattr = ovl_listxattr, |
761 | .update_time = ovl_update_time, |
762 | }; |
763 | |
764 | static const struct inode_operations ovl_special_inode_operations = { |
765 | .setattr = ovl_setattr, |
766 | .permission = ovl_permission, |
767 | .getattr = ovl_getattr, |
768 | .listxattr = ovl_listxattr, |
769 | .get_inode_acl = ovl_get_inode_acl, |
770 | .get_acl = ovl_get_acl, |
771 | .set_acl = ovl_set_acl, |
772 | .update_time = ovl_update_time, |
773 | }; |
774 | |
775 | static const struct address_space_operations ovl_aops = { |
776 | /* For O_DIRECT dentry_open() checks f_mapping->a_ops->direct_IO */ |
777 | .direct_IO = noop_direct_IO, |
778 | }; |
779 | |
780 | /* |
781 | * It is possible to stack overlayfs instance on top of another |
782 | * overlayfs instance as lower layer. We need to annotate the |
783 | * stackable i_mutex locks according to stack level of the super |
784 | * block instance. An overlayfs instance can never be in stack |
785 | * depth 0 (there is always a real fs below it). An overlayfs |
786 | * inode lock will use the lockdep annotation ovl_i_mutex_key[depth]. |
787 | * |
788 | * For example, here is a snip from /proc/lockdep_chains after |
789 | * dir_iterate of nested overlayfs: |
790 | * |
791 | * [...] &ovl_i_mutex_dir_key[depth] (stack_depth=2) |
792 | * [...] &ovl_i_mutex_dir_key[depth]#2 (stack_depth=1) |
793 | * [...] &type->i_mutex_dir_key (stack_depth=0) |
794 | * |
795 | * Locking order w.r.t ovl_want_write() is important for nested overlayfs. |
796 | * |
797 | * This chain is valid: |
798 | * - inode->i_rwsem (inode_lock[2]) |
799 | * - upper_mnt->mnt_sb->s_writers (ovl_want_write[0]) |
800 | * - OVL_I(inode)->lock (ovl_inode_lock[2]) |
801 | * - OVL_I(lowerinode)->lock (ovl_inode_lock[1]) |
802 | * |
803 | * And this chain is valid: |
804 | * - inode->i_rwsem (inode_lock[2]) |
805 | * - OVL_I(inode)->lock (ovl_inode_lock[2]) |
806 | * - lowerinode->i_rwsem (inode_lock[1]) |
807 | * - OVL_I(lowerinode)->lock (ovl_inode_lock[1]) |
808 | * |
809 | * But lowerinode->i_rwsem SHOULD NOT be acquired while ovl_want_write() is |
810 | * held, because it is in reverse order of the non-nested case using the same |
811 | * upper fs: |
812 | * - inode->i_rwsem (inode_lock[1]) |
813 | * - upper_mnt->mnt_sb->s_writers (ovl_want_write[0]) |
814 | * - OVL_I(inode)->lock (ovl_inode_lock[1]) |
815 | */ |
816 | #define OVL_MAX_NESTING FILESYSTEM_MAX_STACK_DEPTH |
817 | |
818 | static inline void ovl_lockdep_annotate_inode_mutex_key(struct inode *inode) |
819 | { |
820 | #ifdef CONFIG_LOCKDEP |
821 | static struct lock_class_key ovl_i_mutex_key[OVL_MAX_NESTING]; |
822 | static struct lock_class_key ovl_i_mutex_dir_key[OVL_MAX_NESTING]; |
823 | static struct lock_class_key ovl_i_lock_key[OVL_MAX_NESTING]; |
824 | |
825 | int depth = inode->i_sb->s_stack_depth - 1; |
826 | |
827 | if (WARN_ON_ONCE(depth < 0 || depth >= OVL_MAX_NESTING)) |
828 | depth = 0; |
829 | |
830 | if (S_ISDIR(inode->i_mode)) |
831 | lockdep_set_class(&inode->i_rwsem, &ovl_i_mutex_dir_key[depth]); |
832 | else |
833 | lockdep_set_class(&inode->i_rwsem, &ovl_i_mutex_key[depth]); |
834 | |
835 | lockdep_set_class(&OVL_I(inode)->lock, &ovl_i_lock_key[depth]); |
836 | #endif |
837 | } |
838 | |
839 | static void ovl_next_ino(struct inode *inode) |
840 | { |
841 | struct ovl_fs *ofs = OVL_FS(sb: inode->i_sb); |
842 | |
843 | inode->i_ino = atomic_long_inc_return(v: &ofs->last_ino); |
844 | if (unlikely(!inode->i_ino)) |
845 | inode->i_ino = atomic_long_inc_return(v: &ofs->last_ino); |
846 | } |
847 | |
848 | static void ovl_map_ino(struct inode *inode, unsigned long ino, int fsid) |
849 | { |
850 | struct ovl_fs *ofs = OVL_FS(sb: inode->i_sb); |
851 | int xinobits = ovl_xino_bits(ofs); |
852 | unsigned int xinoshift = 64 - xinobits; |
853 | |
854 | /* |
855 | * When d_ino is consistent with st_ino (samefs or i_ino has enough |
856 | * bits to encode layer), set the same value used for st_ino to i_ino, |
857 | * so inode number exposed via /proc/locks and a like will be |
858 | * consistent with d_ino and st_ino values. An i_ino value inconsistent |
859 | * with d_ino also causes nfsd readdirplus to fail. |
860 | */ |
861 | inode->i_ino = ino; |
862 | if (ovl_same_fs(ofs)) { |
863 | return; |
864 | } else if (xinobits && likely(!(ino >> xinoshift))) { |
865 | inode->i_ino |= (unsigned long)fsid << (xinoshift + 1); |
866 | return; |
867 | } |
868 | |
869 | /* |
870 | * For directory inodes on non-samefs with xino disabled or xino |
871 | * overflow, we allocate a non-persistent inode number, to be used for |
872 | * resolving st_ino collisions in ovl_map_dev_ino(). |
873 | * |
874 | * To avoid ino collision with legitimate xino values from upper |
875 | * layer (fsid 0), use the lowest xinobit to map the non |
876 | * persistent inode numbers to the unified st_ino address space. |
877 | */ |
878 | if (S_ISDIR(inode->i_mode)) { |
879 | ovl_next_ino(inode); |
880 | if (xinobits) { |
881 | inode->i_ino &= ~0UL >> xinobits; |
882 | inode->i_ino |= 1UL << xinoshift; |
883 | } |
884 | } |
885 | } |
886 | |
887 | void ovl_inode_init(struct inode *inode, struct ovl_inode_params *oip, |
888 | unsigned long ino, int fsid) |
889 | { |
890 | struct inode *realinode; |
891 | struct ovl_inode *oi = OVL_I(inode); |
892 | |
893 | oi->__upperdentry = oip->upperdentry; |
894 | oi->oe = oip->oe; |
895 | oi->redirect = oip->redirect; |
896 | oi->lowerdata_redirect = oip->lowerdata_redirect; |
897 | |
898 | realinode = ovl_inode_real(inode); |
899 | ovl_copyattr(to: inode); |
900 | ovl_copyflags(from: realinode, to: inode); |
901 | ovl_map_ino(inode, ino, fsid); |
902 | } |
903 | |
904 | static void ovl_fill_inode(struct inode *inode, umode_t mode, dev_t rdev) |
905 | { |
906 | inode->i_mode = mode; |
907 | inode->i_flags |= S_NOCMTIME; |
908 | #ifdef CONFIG_FS_POSIX_ACL |
909 | inode->i_acl = inode->i_default_acl = ACL_DONT_CACHE; |
910 | #endif |
911 | |
912 | ovl_lockdep_annotate_inode_mutex_key(inode); |
913 | |
914 | switch (mode & S_IFMT) { |
915 | case S_IFREG: |
916 | inode->i_op = &ovl_file_inode_operations; |
917 | inode->i_fop = &ovl_file_operations; |
918 | inode->i_mapping->a_ops = &ovl_aops; |
919 | break; |
920 | |
921 | case S_IFDIR: |
922 | inode->i_op = &ovl_dir_inode_operations; |
923 | inode->i_fop = &ovl_dir_operations; |
924 | break; |
925 | |
926 | case S_IFLNK: |
927 | inode->i_op = &ovl_symlink_inode_operations; |
928 | break; |
929 | |
930 | default: |
931 | inode->i_op = &ovl_special_inode_operations; |
932 | init_special_inode(inode, mode, rdev); |
933 | break; |
934 | } |
935 | } |
936 | |
937 | /* |
938 | * With inodes index enabled, an overlay inode nlink counts the union of upper |
939 | * hardlinks and non-covered lower hardlinks. During the lifetime of a non-pure |
940 | * upper inode, the following nlink modifying operations can happen: |
941 | * |
942 | * 1. Lower hardlink copy up |
943 | * 2. Upper hardlink created, unlinked or renamed over |
944 | * 3. Lower hardlink whiteout or renamed over |
945 | * |
946 | * For the first, copy up case, the union nlink does not change, whether the |
947 | * operation succeeds or fails, but the upper inode nlink may change. |
948 | * Therefore, before copy up, we store the union nlink value relative to the |
949 | * lower inode nlink in the index inode xattr .overlay.nlink. |
950 | * |
951 | * For the second, upper hardlink case, the union nlink should be incremented |
952 | * or decremented IFF the operation succeeds, aligned with nlink change of the |
953 | * upper inode. Therefore, before link/unlink/rename, we store the union nlink |
954 | * value relative to the upper inode nlink in the index inode. |
955 | * |
956 | * For the last, lower cover up case, we simplify things by preceding the |
957 | * whiteout or cover up with copy up. This makes sure that there is an index |
958 | * upper inode where the nlink xattr can be stored before the copied up upper |
959 | * entry is unlink. |
960 | */ |
961 | #define OVL_NLINK_ADD_UPPER (1 << 0) |
962 | |
963 | /* |
964 | * On-disk format for indexed nlink: |
965 | * |
966 | * nlink relative to the upper inode - "U[+-]NUM" |
967 | * nlink relative to the lower inode - "L[+-]NUM" |
968 | */ |
969 | |
970 | static int ovl_set_nlink_common(struct dentry *dentry, |
971 | struct dentry *realdentry, const char *format) |
972 | { |
973 | struct inode *inode = d_inode(dentry); |
974 | struct inode *realinode = d_inode(dentry: realdentry); |
975 | char buf[13]; |
976 | int len; |
977 | |
978 | len = snprintf(buf, size: sizeof(buf), fmt: format, |
979 | (int) (inode->i_nlink - realinode->i_nlink)); |
980 | |
981 | if (WARN_ON(len >= sizeof(buf))) |
982 | return -EIO; |
983 | |
984 | return ovl_setxattr(ofs: OVL_FS(sb: inode->i_sb), dentry: ovl_dentry_upper(dentry), |
985 | ox: OVL_XATTR_NLINK, value: buf, size: len); |
986 | } |
987 | |
988 | int ovl_set_nlink_upper(struct dentry *dentry) |
989 | { |
990 | return ovl_set_nlink_common(dentry, realdentry: ovl_dentry_upper(dentry), format: "U%+i" ); |
991 | } |
992 | |
993 | int ovl_set_nlink_lower(struct dentry *dentry) |
994 | { |
995 | return ovl_set_nlink_common(dentry, realdentry: ovl_dentry_lower(dentry), format: "L%+i" ); |
996 | } |
997 | |
998 | unsigned int ovl_get_nlink(struct ovl_fs *ofs, struct dentry *lowerdentry, |
999 | struct dentry *upperdentry, |
1000 | unsigned int fallback) |
1001 | { |
1002 | int nlink_diff; |
1003 | int nlink; |
1004 | char buf[13]; |
1005 | int err; |
1006 | |
1007 | if (!lowerdentry || !upperdentry || d_inode(dentry: lowerdentry)->i_nlink == 1) |
1008 | return fallback; |
1009 | |
1010 | err = ovl_getxattr_upper(ofs, upperdentry, ox: OVL_XATTR_NLINK, |
1011 | value: &buf, size: sizeof(buf) - 1); |
1012 | if (err < 0) |
1013 | goto fail; |
1014 | |
1015 | buf[err] = '\0'; |
1016 | if ((buf[0] != 'L' && buf[0] != 'U') || |
1017 | (buf[1] != '+' && buf[1] != '-')) |
1018 | goto fail; |
1019 | |
1020 | err = kstrtoint(s: buf + 1, base: 10, res: &nlink_diff); |
1021 | if (err < 0) |
1022 | goto fail; |
1023 | |
1024 | nlink = d_inode(dentry: buf[0] == 'L' ? lowerdentry : upperdentry)->i_nlink; |
1025 | nlink += nlink_diff; |
1026 | |
1027 | if (nlink <= 0) |
1028 | goto fail; |
1029 | |
1030 | return nlink; |
1031 | |
1032 | fail: |
1033 | pr_warn_ratelimited("failed to get index nlink (%pd2, err=%i)\n" , |
1034 | upperdentry, err); |
1035 | return fallback; |
1036 | } |
1037 | |
1038 | struct inode *ovl_new_inode(struct super_block *sb, umode_t mode, dev_t rdev) |
1039 | { |
1040 | struct inode *inode; |
1041 | |
1042 | inode = new_inode(sb); |
1043 | if (inode) |
1044 | ovl_fill_inode(inode, mode, rdev); |
1045 | |
1046 | return inode; |
1047 | } |
1048 | |
1049 | static int ovl_inode_test(struct inode *inode, void *data) |
1050 | { |
1051 | return inode->i_private == data; |
1052 | } |
1053 | |
1054 | static int ovl_inode_set(struct inode *inode, void *data) |
1055 | { |
1056 | inode->i_private = data; |
1057 | return 0; |
1058 | } |
1059 | |
1060 | static bool ovl_verify_inode(struct inode *inode, struct dentry *lowerdentry, |
1061 | struct dentry *upperdentry, bool strict) |
1062 | { |
1063 | /* |
1064 | * For directories, @strict verify from lookup path performs consistency |
1065 | * checks, so NULL lower/upper in dentry must match NULL lower/upper in |
1066 | * inode. Non @strict verify from NFS handle decode path passes NULL for |
1067 | * 'unknown' lower/upper. |
1068 | */ |
1069 | if (S_ISDIR(inode->i_mode) && strict) { |
1070 | /* Real lower dir moved to upper layer under us? */ |
1071 | if (!lowerdentry && ovl_inode_lower(inode)) |
1072 | return false; |
1073 | |
1074 | /* Lookup of an uncovered redirect origin? */ |
1075 | if (!upperdentry && ovl_inode_upper(inode)) |
1076 | return false; |
1077 | } |
1078 | |
1079 | /* |
1080 | * Allow non-NULL lower inode in ovl_inode even if lowerdentry is NULL. |
1081 | * This happens when finding a copied up overlay inode for a renamed |
1082 | * or hardlinked overlay dentry and lower dentry cannot be followed |
1083 | * by origin because lower fs does not support file handles. |
1084 | */ |
1085 | if (lowerdentry && ovl_inode_lower(inode) != d_inode(dentry: lowerdentry)) |
1086 | return false; |
1087 | |
1088 | /* |
1089 | * Allow non-NULL __upperdentry in inode even if upperdentry is NULL. |
1090 | * This happens when finding a lower alias for a copied up hard link. |
1091 | */ |
1092 | if (upperdentry && ovl_inode_upper(inode) != d_inode(dentry: upperdentry)) |
1093 | return false; |
1094 | |
1095 | return true; |
1096 | } |
1097 | |
1098 | struct inode *ovl_lookup_inode(struct super_block *sb, struct dentry *real, |
1099 | bool is_upper) |
1100 | { |
1101 | struct inode *inode, *key = d_inode(dentry: real); |
1102 | |
1103 | inode = ilookup5(sb, hashval: (unsigned long) key, test: ovl_inode_test, data: key); |
1104 | if (!inode) |
1105 | return NULL; |
1106 | |
1107 | if (!ovl_verify_inode(inode, lowerdentry: is_upper ? NULL : real, |
1108 | upperdentry: is_upper ? real : NULL, strict: false)) { |
1109 | iput(inode); |
1110 | return ERR_PTR(error: -ESTALE); |
1111 | } |
1112 | |
1113 | return inode; |
1114 | } |
1115 | |
1116 | bool ovl_lookup_trap_inode(struct super_block *sb, struct dentry *dir) |
1117 | { |
1118 | struct inode *key = d_inode(dentry: dir); |
1119 | struct inode *trap; |
1120 | bool res; |
1121 | |
1122 | trap = ilookup5(sb, hashval: (unsigned long) key, test: ovl_inode_test, data: key); |
1123 | if (!trap) |
1124 | return false; |
1125 | |
1126 | res = IS_DEADDIR(trap) && !ovl_inode_upper(inode: trap) && |
1127 | !ovl_inode_lower(inode: trap); |
1128 | |
1129 | iput(trap); |
1130 | return res; |
1131 | } |
1132 | |
1133 | /* |
1134 | * Create an inode cache entry for layer root dir, that will intentionally |
1135 | * fail ovl_verify_inode(), so any lookup that will find some layer root |
1136 | * will fail. |
1137 | */ |
1138 | struct inode *ovl_get_trap_inode(struct super_block *sb, struct dentry *dir) |
1139 | { |
1140 | struct inode *key = d_inode(dentry: dir); |
1141 | struct inode *trap; |
1142 | |
1143 | if (!d_is_dir(dentry: dir)) |
1144 | return ERR_PTR(error: -ENOTDIR); |
1145 | |
1146 | trap = iget5_locked(sb, (unsigned long) key, test: ovl_inode_test, |
1147 | set: ovl_inode_set, key); |
1148 | if (!trap) |
1149 | return ERR_PTR(error: -ENOMEM); |
1150 | |
1151 | if (!(trap->i_state & I_NEW)) { |
1152 | /* Conflicting layer roots? */ |
1153 | iput(trap); |
1154 | return ERR_PTR(error: -ELOOP); |
1155 | } |
1156 | |
1157 | trap->i_mode = S_IFDIR; |
1158 | trap->i_flags = S_DEAD; |
1159 | unlock_new_inode(trap); |
1160 | |
1161 | return trap; |
1162 | } |
1163 | |
1164 | /* |
1165 | * Does overlay inode need to be hashed by lower inode? |
1166 | */ |
1167 | static bool ovl_hash_bylower(struct super_block *sb, struct dentry *upper, |
1168 | struct dentry *lower, bool index) |
1169 | { |
1170 | struct ovl_fs *ofs = OVL_FS(sb); |
1171 | |
1172 | /* No, if pure upper */ |
1173 | if (!lower) |
1174 | return false; |
1175 | |
1176 | /* Yes, if already indexed */ |
1177 | if (index) |
1178 | return true; |
1179 | |
1180 | /* Yes, if won't be copied up */ |
1181 | if (!ovl_upper_mnt(ofs)) |
1182 | return true; |
1183 | |
1184 | /* No, if lower hardlink is or will be broken on copy up */ |
1185 | if ((upper || !ovl_indexdir(sb)) && |
1186 | !d_is_dir(dentry: lower) && d_inode(dentry: lower)->i_nlink > 1) |
1187 | return false; |
1188 | |
1189 | /* No, if non-indexed upper with NFS export */ |
1190 | if (ofs->config.nfs_export && upper) |
1191 | return false; |
1192 | |
1193 | /* Otherwise, hash by lower inode for fsnotify */ |
1194 | return true; |
1195 | } |
1196 | |
1197 | static struct inode *ovl_iget5(struct super_block *sb, struct inode *newinode, |
1198 | struct inode *key) |
1199 | { |
1200 | return newinode ? inode_insert5(inode: newinode, hashval: (unsigned long) key, |
1201 | test: ovl_inode_test, set: ovl_inode_set, data: key) : |
1202 | iget5_locked(sb, (unsigned long) key, |
1203 | test: ovl_inode_test, set: ovl_inode_set, key); |
1204 | } |
1205 | |
1206 | struct inode *ovl_get_inode(struct super_block *sb, |
1207 | struct ovl_inode_params *oip) |
1208 | { |
1209 | struct ovl_fs *ofs = OVL_FS(sb); |
1210 | struct dentry *upperdentry = oip->upperdentry; |
1211 | struct ovl_path *lowerpath = ovl_lowerpath(oe: oip->oe); |
1212 | struct inode *realinode = upperdentry ? d_inode(dentry: upperdentry) : NULL; |
1213 | struct inode *inode; |
1214 | struct dentry *lowerdentry = lowerpath ? lowerpath->dentry : NULL; |
1215 | struct path realpath = { |
1216 | .dentry = upperdentry ?: lowerdentry, |
1217 | .mnt = upperdentry ? ovl_upper_mnt(ofs) : lowerpath->layer->mnt, |
1218 | }; |
1219 | bool bylower = ovl_hash_bylower(sb, upper: upperdentry, lower: lowerdentry, |
1220 | index: oip->index); |
1221 | int fsid = bylower ? lowerpath->layer->fsid : 0; |
1222 | bool is_dir; |
1223 | unsigned long ino = 0; |
1224 | int err = oip->newinode ? -EEXIST : -ENOMEM; |
1225 | |
1226 | if (!realinode) |
1227 | realinode = d_inode(dentry: lowerdentry); |
1228 | |
1229 | /* |
1230 | * Copy up origin (lower) may exist for non-indexed upper, but we must |
1231 | * not use lower as hash key if this is a broken hardlink. |
1232 | */ |
1233 | is_dir = S_ISDIR(realinode->i_mode); |
1234 | if (upperdentry || bylower) { |
1235 | struct inode *key = d_inode(dentry: bylower ? lowerdentry : |
1236 | upperdentry); |
1237 | unsigned int nlink = is_dir ? 1 : realinode->i_nlink; |
1238 | |
1239 | inode = ovl_iget5(sb, newinode: oip->newinode, key); |
1240 | if (!inode) |
1241 | goto out_err; |
1242 | if (!(inode->i_state & I_NEW)) { |
1243 | /* |
1244 | * Verify that the underlying files stored in the inode |
1245 | * match those in the dentry. |
1246 | */ |
1247 | if (!ovl_verify_inode(inode, lowerdentry, upperdentry, |
1248 | strict: true)) { |
1249 | iput(inode); |
1250 | err = -ESTALE; |
1251 | goto out_err; |
1252 | } |
1253 | |
1254 | dput(upperdentry); |
1255 | ovl_free_entry(oe: oip->oe); |
1256 | kfree(objp: oip->redirect); |
1257 | kfree(objp: oip->lowerdata_redirect); |
1258 | goto out; |
1259 | } |
1260 | |
1261 | /* Recalculate nlink for non-dir due to indexing */ |
1262 | if (!is_dir) |
1263 | nlink = ovl_get_nlink(ofs, lowerdentry, upperdentry, |
1264 | fallback: nlink); |
1265 | set_nlink(inode, nlink); |
1266 | ino = key->i_ino; |
1267 | } else { |
1268 | /* Lower hardlink that will be broken on copy up */ |
1269 | inode = new_inode(sb); |
1270 | if (!inode) { |
1271 | err = -ENOMEM; |
1272 | goto out_err; |
1273 | } |
1274 | ino = realinode->i_ino; |
1275 | fsid = lowerpath->layer->fsid; |
1276 | } |
1277 | ovl_fill_inode(inode, mode: realinode->i_mode, rdev: realinode->i_rdev); |
1278 | ovl_inode_init(inode, oip, ino, fsid); |
1279 | |
1280 | if (upperdentry && ovl_is_impuredir(sb, upperdentry)) |
1281 | ovl_set_flag(flag: OVL_IMPURE, inode); |
1282 | |
1283 | if (oip->index) |
1284 | ovl_set_flag(flag: OVL_INDEX, inode); |
1285 | |
1286 | if (bylower) |
1287 | ovl_set_flag(flag: OVL_CONST_INO, inode); |
1288 | |
1289 | /* Check for non-merge dir that may have whiteouts */ |
1290 | if (is_dir) { |
1291 | if (((upperdentry && lowerdentry) || ovl_numlower(oe: oip->oe) > 1) || |
1292 | ovl_path_check_origin_xattr(ofs, path: &realpath)) { |
1293 | ovl_set_flag(flag: OVL_WHITEOUTS, inode); |
1294 | } |
1295 | } |
1296 | |
1297 | /* Check for immutable/append-only inode flags in xattr */ |
1298 | if (upperdentry) |
1299 | ovl_check_protattr(inode, upper: upperdentry); |
1300 | |
1301 | if (inode->i_state & I_NEW) |
1302 | unlock_new_inode(inode); |
1303 | out: |
1304 | return inode; |
1305 | |
1306 | out_err: |
1307 | pr_warn_ratelimited("failed to get inode (%i)\n" , err); |
1308 | inode = ERR_PTR(error: err); |
1309 | goto out; |
1310 | } |
1311 | |