vfs_lookup.c revision 190759
1/*- 2 * Copyright (c) 1982, 1986, 1989, 1993 3 * The Regents of the University of California. All rights reserved. 4 * (c) UNIX System Laboratories, Inc. 5 * All or some portions of this file are derived from material licensed 6 * to the University of California by American Telephone and Telegraph 7 * Co. or Unix System Laboratories, Inc. and are reproduced herein with 8 * the permission of UNIX System Laboratories, Inc. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 4. Neither the name of the University nor the names of its contributors 19 * may be used to endorse or promote products derived from this software 20 * without specific prior written permission. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32 * SUCH DAMAGE. 33 * 34 * @(#)vfs_lookup.c 8.4 (Berkeley) 2/16/94 35 */ 36 37#include <sys/cdefs.h> 38__FBSDID("$FreeBSD: head/sys/kern/vfs_lookup.c 190759 2009-04-06 10:32:40Z rwatson $"); 39 40#include "opt_kdtrace.h" 41#include "opt_ktrace.h" 42#include "opt_mac.h" 43 44#include <sys/param.h> 45#include <sys/systm.h> 46#include <sys/kernel.h> 47#include <sys/fcntl.h> 48#include <sys/lock.h> 49#include <sys/mutex.h> 50#include <sys/namei.h> 51#include <sys/vnode.h> 52#include <sys/mount.h> 53#include <sys/filedesc.h> 54#include <sys/proc.h> 55#include <sys/sdt.h> 56#include <sys/syscallsubr.h> 57#include <sys/sysctl.h> 58#ifdef KTRACE 59#include <sys/ktrace.h> 60#endif 61 62#include <security/audit/audit.h> 63#include <security/mac/mac_framework.h> 64 65#include <vm/uma.h> 66 67#define NAMEI_DIAGNOSTIC 1 68#undef NAMEI_DIAGNOSTIC 69 70SDT_PROVIDER_DECLARE(vfs); 71SDT_PROBE_DEFINE3(vfs, namei, lookup, entry, "struct vnode *", "char *", 72 "unsigned long"); 73SDT_PROBE_DEFINE2(vfs, namei, lookup, return, "int", "struct vnode *"); 74 75/* 76 * Allocation zone for namei 77 */ 78uma_zone_t namei_zone; 79/* 80 * Placeholder vnode for mp traversal 81 */ 82static struct vnode *vp_crossmp; 83 84static void 85nameiinit(void *dummy __unused) 86{ 87 int error; 88 89 namei_zone = uma_zcreate("NAMEI", MAXPATHLEN, NULL, NULL, NULL, NULL, 90 UMA_ALIGN_PTR, 0); 91 error = getnewvnode("crossmp", NULL, &dead_vnodeops, &vp_crossmp); 92 if (error != 0) 93 panic("nameiinit: getnewvnode"); 94 VN_LOCK_ASHARE(vp_crossmp); 95} 96SYSINIT(vfs, SI_SUB_VFS, SI_ORDER_SECOND, nameiinit, NULL); 97 98static int lookup_shared = 1; 99SYSCTL_INT(_vfs, OID_AUTO, lookup_shared, CTLFLAG_RW, &lookup_shared, 0, 100 "Enables/Disables shared locks for path name translation"); 101TUNABLE_INT("vfs.lookup_shared", &lookup_shared); 102 103/* 104 * Convert a pathname into a pointer to a locked vnode. 105 * 106 * The FOLLOW flag is set when symbolic links are to be followed 107 * when they occur at the end of the name translation process. 108 * Symbolic links are always followed for all other pathname 109 * components other than the last. 110 * 111 * The segflg defines whether the name is to be copied from user 112 * space or kernel space. 113 * 114 * Overall outline of namei: 115 * 116 * copy in name 117 * get starting directory 118 * while (!done && !error) { 119 * call lookup to search path. 120 * if symbolic link, massage name in buffer and continue 121 * } 122 */ 123int 124namei(struct nameidata *ndp) 125{ 126 struct filedesc *fdp; /* pointer to file descriptor state */ 127 char *cp; /* pointer into pathname argument */ 128 struct vnode *dp; /* the directory we are searching */ 129 struct iovec aiov; /* uio for reading symbolic links */ 130 struct uio auio; 131 int error, linklen; 132 struct componentname *cnp = &ndp->ni_cnd; 133 struct thread *td = cnp->cn_thread; 134 struct proc *p = td->td_proc; 135 int vfslocked; 136 137 KASSERT((cnp->cn_flags & MPSAFE) != 0 || mtx_owned(&Giant) != 0, 138 ("NOT MPSAFE and Giant not held")); 139 ndp->ni_cnd.cn_cred = ndp->ni_cnd.cn_thread->td_ucred; 140 KASSERT(cnp->cn_cred && p, ("namei: bad cred/proc")); 141 KASSERT((cnp->cn_nameiop & (~OPMASK)) == 0, 142 ("namei: nameiop contaminated with flags")); 143 KASSERT((cnp->cn_flags & OPMASK) == 0, 144 ("namei: flags contaminated with nameiops")); 145 if (!lookup_shared) 146 cnp->cn_flags &= ~LOCKSHARED; 147 fdp = p->p_fd; 148 149 /* 150 * Get a buffer for the name to be translated, and copy the 151 * name into the buffer. 152 */ 153 if ((cnp->cn_flags & HASBUF) == 0) 154 cnp->cn_pnbuf = uma_zalloc(namei_zone, M_WAITOK); 155 if (ndp->ni_segflg == UIO_SYSSPACE) 156 error = copystr(ndp->ni_dirp, cnp->cn_pnbuf, 157 MAXPATHLEN, (size_t *)&ndp->ni_pathlen); 158 else 159 error = copyinstr(ndp->ni_dirp, cnp->cn_pnbuf, 160 MAXPATHLEN, (size_t *)&ndp->ni_pathlen); 161 162 /* If we are auditing the kernel pathname, save the user pathname. */ 163 if (cnp->cn_flags & AUDITVNODE1) 164 AUDIT_ARG(upath, td, cnp->cn_pnbuf, ARG_UPATH1); 165 if (cnp->cn_flags & AUDITVNODE2) 166 AUDIT_ARG(upath, td, cnp->cn_pnbuf, ARG_UPATH2); 167 168 /* 169 * Don't allow empty pathnames. 170 */ 171 if (!error && *cnp->cn_pnbuf == '\0') 172 error = ENOENT; 173 174 if (error) { 175 uma_zfree(namei_zone, cnp->cn_pnbuf); 176#ifdef DIAGNOSTIC 177 cnp->cn_pnbuf = NULL; 178 cnp->cn_nameptr = NULL; 179#endif 180 ndp->ni_vp = NULL; 181 return (error); 182 } 183 ndp->ni_loopcnt = 0; 184#ifdef KTRACE 185 if (KTRPOINT(td, KTR_NAMEI)) { 186 KASSERT(cnp->cn_thread == curthread, 187 ("namei not using curthread")); 188 ktrnamei(cnp->cn_pnbuf); 189 } 190#endif 191 /* 192 * Get starting point for the translation. 193 */ 194 FILEDESC_SLOCK(fdp); 195 ndp->ni_rootdir = fdp->fd_rdir; 196 ndp->ni_topdir = fdp->fd_jdir; 197 198 dp = NULL; 199 if (cnp->cn_pnbuf[0] != '/') { 200 if (ndp->ni_startdir != NULL) { 201 dp = ndp->ni_startdir; 202 error = 0; 203 } else if (ndp->ni_dirfd != AT_FDCWD) 204 error = fgetvp(td, ndp->ni_dirfd, &dp); 205 if (error != 0 || dp != NULL) { 206 FILEDESC_SUNLOCK(fdp); 207 if (error == 0 && dp->v_type != VDIR) { 208 vfslocked = VFS_LOCK_GIANT(dp->v_mount); 209 vrele(dp); 210 VFS_UNLOCK_GIANT(vfslocked); 211 error = ENOTDIR; 212 } 213 } 214 if (error) { 215 uma_zfree(namei_zone, cnp->cn_pnbuf); 216#ifdef DIAGNOSTIC 217 cnp->cn_pnbuf = NULL; 218 cnp->cn_nameptr = NULL; 219#endif 220 return (error); 221 } 222 } 223 if (dp == NULL) { 224 dp = fdp->fd_cdir; 225 VREF(dp); 226 FILEDESC_SUNLOCK(fdp); 227 if (ndp->ni_startdir != NULL) { 228 vfslocked = VFS_LOCK_GIANT(ndp->ni_startdir->v_mount); 229 vrele(ndp->ni_startdir); 230 VFS_UNLOCK_GIANT(vfslocked); 231 } 232 } 233 SDT_PROBE(vfs, namei, lookup, entry, dp, cnp->cn_pnbuf, 234 cnp->cn_flags, 0, 0); 235 vfslocked = VFS_LOCK_GIANT(dp->v_mount); 236 for (;;) { 237 /* 238 * Check if root directory should replace current directory. 239 * Done at start of translation and after symbolic link. 240 */ 241 cnp->cn_nameptr = cnp->cn_pnbuf; 242 if (*(cnp->cn_nameptr) == '/') { 243 vrele(dp); 244 VFS_UNLOCK_GIANT(vfslocked); 245 while (*(cnp->cn_nameptr) == '/') { 246 cnp->cn_nameptr++; 247 ndp->ni_pathlen--; 248 } 249 dp = ndp->ni_rootdir; 250 vfslocked = VFS_LOCK_GIANT(dp->v_mount); 251 VREF(dp); 252 } 253 if (vfslocked) 254 ndp->ni_cnd.cn_flags |= GIANTHELD; 255 ndp->ni_startdir = dp; 256 error = lookup(ndp); 257 if (error) { 258 uma_zfree(namei_zone, cnp->cn_pnbuf); 259#ifdef DIAGNOSTIC 260 cnp->cn_pnbuf = NULL; 261 cnp->cn_nameptr = NULL; 262#endif 263 SDT_PROBE(vfs, namei, lookup, return, error, NULL, 0, 264 0, 0); 265 return (error); 266 } 267 vfslocked = (ndp->ni_cnd.cn_flags & GIANTHELD) != 0; 268 ndp->ni_cnd.cn_flags &= ~GIANTHELD; 269 /* 270 * Check for symbolic link 271 */ 272 if ((cnp->cn_flags & ISSYMLINK) == 0) { 273 if ((cnp->cn_flags & (SAVENAME | SAVESTART)) == 0) { 274 uma_zfree(namei_zone, cnp->cn_pnbuf); 275#ifdef DIAGNOSTIC 276 cnp->cn_pnbuf = NULL; 277 cnp->cn_nameptr = NULL; 278#endif 279 } else 280 cnp->cn_flags |= HASBUF; 281 282 if ((cnp->cn_flags & MPSAFE) == 0) { 283 VFS_UNLOCK_GIANT(vfslocked); 284 } else if (vfslocked) 285 ndp->ni_cnd.cn_flags |= GIANTHELD; 286 SDT_PROBE(vfs, namei, lookup, return, 0, ndp->ni_vp, 287 0, 0, 0); 288 return (0); 289 } 290 if (ndp->ni_loopcnt++ >= MAXSYMLINKS) { 291 error = ELOOP; 292 break; 293 } 294#ifdef MAC 295 if ((cnp->cn_flags & NOMACCHECK) == 0) { 296 error = mac_vnode_check_readlink(td->td_ucred, 297 ndp->ni_vp); 298 if (error) 299 break; 300 } 301#endif 302 if (ndp->ni_pathlen > 1) 303 cp = uma_zalloc(namei_zone, M_WAITOK); 304 else 305 cp = cnp->cn_pnbuf; 306 aiov.iov_base = cp; 307 aiov.iov_len = MAXPATHLEN; 308 auio.uio_iov = &aiov; 309 auio.uio_iovcnt = 1; 310 auio.uio_offset = 0; 311 auio.uio_rw = UIO_READ; 312 auio.uio_segflg = UIO_SYSSPACE; 313 auio.uio_td = (struct thread *)0; 314 auio.uio_resid = MAXPATHLEN; 315 error = VOP_READLINK(ndp->ni_vp, &auio, cnp->cn_cred); 316 if (error) { 317 if (ndp->ni_pathlen > 1) 318 uma_zfree(namei_zone, cp); 319 break; 320 } 321 linklen = MAXPATHLEN - auio.uio_resid; 322 if (linklen == 0) { 323 if (ndp->ni_pathlen > 1) 324 uma_zfree(namei_zone, cp); 325 error = ENOENT; 326 break; 327 } 328 if (linklen + ndp->ni_pathlen >= MAXPATHLEN) { 329 if (ndp->ni_pathlen > 1) 330 uma_zfree(namei_zone, cp); 331 error = ENAMETOOLONG; 332 break; 333 } 334 if (ndp->ni_pathlen > 1) { 335 bcopy(ndp->ni_next, cp + linklen, ndp->ni_pathlen); 336 uma_zfree(namei_zone, cnp->cn_pnbuf); 337 cnp->cn_pnbuf = cp; 338 } else 339 cnp->cn_pnbuf[linklen] = '\0'; 340 ndp->ni_pathlen += linklen; 341 vput(ndp->ni_vp); 342 dp = ndp->ni_dvp; 343 } 344 uma_zfree(namei_zone, cnp->cn_pnbuf); 345#ifdef DIAGNOSTIC 346 cnp->cn_pnbuf = NULL; 347 cnp->cn_nameptr = NULL; 348#endif 349 vput(ndp->ni_vp); 350 ndp->ni_vp = NULL; 351 vrele(ndp->ni_dvp); 352 VFS_UNLOCK_GIANT(vfslocked); 353 SDT_PROBE(vfs, namei, lookup, return, error, NULL, 0, 0, 0); 354 return (error); 355} 356 357static int 358compute_cn_lkflags(struct mount *mp, int lkflags) 359{ 360 361 if (mp == NULL || 362 ((lkflags & LK_SHARED) && !(mp->mnt_kern_flag & MNTK_LOOKUP_SHARED))) { 363 lkflags &= ~LK_SHARED; 364 lkflags |= LK_EXCLUSIVE; 365 } 366 return (lkflags); 367} 368 369static __inline int 370needs_exclusive_leaf(struct mount *mp, int flags) 371{ 372 373 /* 374 * Intermediate nodes can use shared locks, we only need to 375 * force an exclusive lock for leaf nodes. 376 */ 377 if ((flags & (ISLASTCN | LOCKLEAF)) != (ISLASTCN | LOCKLEAF)) 378 return (0); 379 380 /* Always use exclusive locks if LOCKSHARED isn't set. */ 381 if (!(flags & LOCKSHARED)) 382 return (1); 383 384 /* 385 * For lookups during open(), if the mount point supports 386 * extended shared operations, then use a shared lock for the 387 * leaf node, otherwise use an exclusive lock. 388 */ 389 if (flags & ISOPEN) { 390 if (mp != NULL && 391 (mp->mnt_kern_flag & MNTK_EXTENDED_SHARED)) 392 return (0); 393 else 394 return (1); 395 } 396 397 /* 398 * Lookup requests outside of open() that specify LOCKSHARED 399 * only need a shared lock on the leaf vnode. 400 */ 401 return (0); 402} 403 404/* 405 * Search a pathname. 406 * This is a very central and rather complicated routine. 407 * 408 * The pathname is pointed to by ni_ptr and is of length ni_pathlen. 409 * The starting directory is taken from ni_startdir. The pathname is 410 * descended until done, or a symbolic link is encountered. The variable 411 * ni_more is clear if the path is completed; it is set to one if a 412 * symbolic link needing interpretation is encountered. 413 * 414 * The flag argument is LOOKUP, CREATE, RENAME, or DELETE depending on 415 * whether the name is to be looked up, created, renamed, or deleted. 416 * When CREATE, RENAME, or DELETE is specified, information usable in 417 * creating, renaming, or deleting a directory entry may be calculated. 418 * If flag has LOCKPARENT or'ed into it, the parent directory is returned 419 * locked. If flag has WANTPARENT or'ed into it, the parent directory is 420 * returned unlocked. Otherwise the parent directory is not returned. If 421 * the target of the pathname exists and LOCKLEAF is or'ed into the flag 422 * the target is returned locked, otherwise it is returned unlocked. 423 * When creating or renaming and LOCKPARENT is specified, the target may not 424 * be ".". When deleting and LOCKPARENT is specified, the target may be ".". 425 * 426 * Overall outline of lookup: 427 * 428 * dirloop: 429 * identify next component of name at ndp->ni_ptr 430 * handle degenerate case where name is null string 431 * if .. and crossing mount points and on mounted filesys, find parent 432 * call VOP_LOOKUP routine for next component name 433 * directory vnode returned in ni_dvp, unlocked unless LOCKPARENT set 434 * component vnode returned in ni_vp (if it exists), locked. 435 * if result vnode is mounted on and crossing mount points, 436 * find mounted on vnode 437 * if more components of name, do next level at dirloop 438 * return the answer in ni_vp, locked if LOCKLEAF set 439 * if LOCKPARENT set, return locked parent in ni_dvp 440 * if WANTPARENT set, return unlocked parent in ni_dvp 441 */ 442int 443lookup(struct nameidata *ndp) 444{ 445 char *cp; /* pointer into pathname argument */ 446 struct vnode *dp = 0; /* the directory we are searching */ 447 struct vnode *tdp; /* saved dp */ 448 struct mount *mp; /* mount table entry */ 449 int docache; /* == 0 do not cache last component */ 450 int wantparent; /* 1 => wantparent or lockparent flag */ 451 int rdonly; /* lookup read-only flag bit */ 452 int trailing_slash; 453 int error = 0; 454 int dpunlocked = 0; /* dp has already been unlocked */ 455 struct componentname *cnp = &ndp->ni_cnd; 456 struct thread *td = cnp->cn_thread; 457 int vfslocked; /* VFS Giant state for child */ 458 int dvfslocked; /* VFS Giant state for parent */ 459 int tvfslocked; 460 int lkflags_save; 461 462 /* 463 * Setup: break out flag bits into variables. 464 */ 465 dvfslocked = (ndp->ni_cnd.cn_flags & GIANTHELD) != 0; 466 vfslocked = 0; 467 ndp->ni_cnd.cn_flags &= ~GIANTHELD; 468 wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT); 469 KASSERT(cnp->cn_nameiop == LOOKUP || wantparent, 470 ("CREATE, DELETE, RENAME require LOCKPARENT or WANTPARENT.")); 471 docache = (cnp->cn_flags & NOCACHE) ^ NOCACHE; 472 if (cnp->cn_nameiop == DELETE || 473 (wantparent && cnp->cn_nameiop != CREATE && 474 cnp->cn_nameiop != LOOKUP)) 475 docache = 0; 476 rdonly = cnp->cn_flags & RDONLY; 477 cnp->cn_flags &= ~ISSYMLINK; 478 ndp->ni_dvp = NULL; 479 /* 480 * We use shared locks until we hit the parent of the last cn then 481 * we adjust based on the requesting flags. 482 */ 483 if (lookup_shared) 484 cnp->cn_lkflags = LK_SHARED; 485 else 486 cnp->cn_lkflags = LK_EXCLUSIVE; 487 dp = ndp->ni_startdir; 488 ndp->ni_startdir = NULLVP; 489 vn_lock(dp, 490 compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | LK_RETRY)); 491 492dirloop: 493 /* 494 * Search a new directory. 495 * 496 * The last component of the filename is left accessible via 497 * cnp->cn_nameptr for callers that need the name. Callers needing 498 * the name set the SAVENAME flag. When done, they assume 499 * responsibility for freeing the pathname buffer. 500 */ 501 cnp->cn_consume = 0; 502 for (cp = cnp->cn_nameptr; *cp != 0 && *cp != '/'; cp++) 503 continue; 504 cnp->cn_namelen = cp - cnp->cn_nameptr; 505 if (cnp->cn_namelen > NAME_MAX) { 506 error = ENAMETOOLONG; 507 goto bad; 508 } 509#ifdef NAMEI_DIAGNOSTIC 510 { char c = *cp; 511 *cp = '\0'; 512 printf("{%s}: ", cnp->cn_nameptr); 513 *cp = c; } 514#endif 515 ndp->ni_pathlen -= cnp->cn_namelen; 516 ndp->ni_next = cp; 517 518 /* 519 * Replace multiple slashes by a single slash and trailing slashes 520 * by a null. This must be done before VOP_LOOKUP() because some 521 * fs's don't know about trailing slashes. Remember if there were 522 * trailing slashes to handle symlinks, existing non-directories 523 * and non-existing files that won't be directories specially later. 524 */ 525 trailing_slash = 0; 526 while (*cp == '/' && (cp[1] == '/' || cp[1] == '\0')) { 527 cp++; 528 ndp->ni_pathlen--; 529 if (*cp == '\0') { 530 trailing_slash = 1; 531 *ndp->ni_next = '\0'; /* XXX for direnter() ... */ 532 } 533 } 534 ndp->ni_next = cp; 535 536 cnp->cn_flags |= MAKEENTRY; 537 if (*cp == '\0' && docache == 0) 538 cnp->cn_flags &= ~MAKEENTRY; 539 if (cnp->cn_namelen == 2 && 540 cnp->cn_nameptr[1] == '.' && cnp->cn_nameptr[0] == '.') 541 cnp->cn_flags |= ISDOTDOT; 542 else 543 cnp->cn_flags &= ~ISDOTDOT; 544 if (*ndp->ni_next == 0) 545 cnp->cn_flags |= ISLASTCN; 546 else 547 cnp->cn_flags &= ~ISLASTCN; 548 549 550 /* 551 * Check for degenerate name (e.g. / or "") 552 * which is a way of talking about a directory, 553 * e.g. like "/." or ".". 554 */ 555 if (cnp->cn_nameptr[0] == '\0') { 556 if (dp->v_type != VDIR) { 557 error = ENOTDIR; 558 goto bad; 559 } 560 if (cnp->cn_nameiop != LOOKUP) { 561 error = EISDIR; 562 goto bad; 563 } 564 if (wantparent) { 565 ndp->ni_dvp = dp; 566 VREF(dp); 567 } 568 ndp->ni_vp = dp; 569 570 if (cnp->cn_flags & AUDITVNODE1) 571 AUDIT_ARG(vnode, dp, ARG_VNODE1); 572 else if (cnp->cn_flags & AUDITVNODE2) 573 AUDIT_ARG(vnode, dp, ARG_VNODE2); 574 575 if (!(cnp->cn_flags & (LOCKPARENT | LOCKLEAF))) 576 VOP_UNLOCK(dp, 0); 577 /* XXX This should probably move to the top of function. */ 578 if (cnp->cn_flags & SAVESTART) 579 panic("lookup: SAVESTART"); 580 goto success; 581 } 582 583 /* 584 * Handle "..": four special cases. 585 * 1. Return an error if this is the last component of 586 * the name and the operation is DELETE or RENAME. 587 * 2. If at root directory (e.g. after chroot) 588 * or at absolute root directory 589 * then ignore it so can't get out. 590 * 3. If this vnode is the root of a mounted 591 * filesystem, then replace it with the 592 * vnode which was mounted on so we take the 593 * .. in the other filesystem. 594 * 4. If the vnode is the top directory of 595 * the jail or chroot, don't let them out. 596 */ 597 if (cnp->cn_flags & ISDOTDOT) { 598 if ((cnp->cn_flags & ISLASTCN) != 0 && 599 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 600 error = EINVAL; 601 goto bad; 602 } 603 for (;;) { 604 if (dp == ndp->ni_rootdir || 605 dp == ndp->ni_topdir || 606 dp == rootvnode || 607 ((dp->v_vflag & VV_ROOT) != 0 && 608 (cnp->cn_flags & NOCROSSMOUNT) != 0)) { 609 ndp->ni_dvp = dp; 610 ndp->ni_vp = dp; 611 vfslocked = VFS_LOCK_GIANT(dp->v_mount); 612 VREF(dp); 613 goto nextname; 614 } 615 if ((dp->v_vflag & VV_ROOT) == 0) 616 break; 617 if (dp->v_iflag & VI_DOOMED) { /* forced unmount */ 618 error = ENOENT; 619 goto bad; 620 } 621 tdp = dp; 622 dp = dp->v_mount->mnt_vnodecovered; 623 tvfslocked = dvfslocked; 624 dvfslocked = VFS_LOCK_GIANT(dp->v_mount); 625 VREF(dp); 626 vput(tdp); 627 VFS_UNLOCK_GIANT(tvfslocked); 628 vn_lock(dp, 629 compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | 630 LK_RETRY)); 631 } 632 } 633 634 /* 635 * We now have a segment name to search for, and a directory to search. 636 */ 637unionlookup: 638#ifdef MAC 639 if ((cnp->cn_flags & NOMACCHECK) == 0) { 640 error = mac_vnode_check_lookup(td->td_ucred, dp, cnp); 641 if (error) 642 goto bad; 643 } 644#endif 645 ndp->ni_dvp = dp; 646 ndp->ni_vp = NULL; 647 ASSERT_VOP_LOCKED(dp, "lookup"); 648 VNASSERT(vfslocked == 0, dp, ("lookup: vfslocked %d", vfslocked)); 649 /* 650 * If we have a shared lock we may need to upgrade the lock for the 651 * last operation. 652 */ 653 if (dp != vp_crossmp && 654 VOP_ISLOCKED(dp) == LK_SHARED && 655 (cnp->cn_flags & ISLASTCN) && (cnp->cn_flags & LOCKPARENT)) 656 vn_lock(dp, LK_UPGRADE|LK_RETRY); 657 /* 658 * If we're looking up the last component and we need an exclusive 659 * lock, adjust our lkflags. 660 */ 661 if (needs_exclusive_leaf(dp->v_mount, cnp->cn_flags)) 662 cnp->cn_lkflags = LK_EXCLUSIVE; 663#ifdef NAMEI_DIAGNOSTIC 664 vprint("lookup in", dp); 665#endif 666 lkflags_save = cnp->cn_lkflags; 667 cnp->cn_lkflags = compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags); 668 if ((error = VOP_LOOKUP(dp, &ndp->ni_vp, cnp)) != 0) { 669 cnp->cn_lkflags = lkflags_save; 670 KASSERT(ndp->ni_vp == NULL, ("leaf should be empty")); 671#ifdef NAMEI_DIAGNOSTIC 672 printf("not found\n"); 673#endif 674 if ((error == ENOENT) && 675 (dp->v_vflag & VV_ROOT) && (dp->v_mount != NULL) && 676 (dp->v_mount->mnt_flag & MNT_UNION)) { 677 tdp = dp; 678 dp = dp->v_mount->mnt_vnodecovered; 679 tvfslocked = dvfslocked; 680 dvfslocked = VFS_LOCK_GIANT(dp->v_mount); 681 VREF(dp); 682 vput(tdp); 683 VFS_UNLOCK_GIANT(tvfslocked); 684 vn_lock(dp, 685 compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | 686 LK_RETRY)); 687 goto unionlookup; 688 } 689 690 if (error != EJUSTRETURN) 691 goto bad; 692 /* 693 * If creating and at end of pathname, then can consider 694 * allowing file to be created. 695 */ 696 if (rdonly) { 697 error = EROFS; 698 goto bad; 699 } 700 if (*cp == '\0' && trailing_slash && 701 !(cnp->cn_flags & WILLBEDIR)) { 702 error = ENOENT; 703 goto bad; 704 } 705 if ((cnp->cn_flags & LOCKPARENT) == 0) 706 VOP_UNLOCK(dp, 0); 707 /* 708 * This is a temporary assert to make sure I know what the 709 * behavior here was. 710 */ 711 KASSERT((cnp->cn_flags & (WANTPARENT|LOCKPARENT)) != 0, 712 ("lookup: Unhandled case.")); 713 /* 714 * We return with ni_vp NULL to indicate that the entry 715 * doesn't currently exist, leaving a pointer to the 716 * (possibly locked) directory vnode in ndp->ni_dvp. 717 */ 718 if (cnp->cn_flags & SAVESTART) { 719 ndp->ni_startdir = ndp->ni_dvp; 720 VREF(ndp->ni_startdir); 721 } 722 goto success; 723 } else 724 cnp->cn_lkflags = lkflags_save; 725#ifdef NAMEI_DIAGNOSTIC 726 printf("found\n"); 727#endif 728 /* 729 * Take into account any additional components consumed by 730 * the underlying filesystem. 731 */ 732 if (cnp->cn_consume > 0) { 733 cnp->cn_nameptr += cnp->cn_consume; 734 ndp->ni_next += cnp->cn_consume; 735 ndp->ni_pathlen -= cnp->cn_consume; 736 cnp->cn_consume = 0; 737 } 738 739 dp = ndp->ni_vp; 740 vfslocked = VFS_LOCK_GIANT(dp->v_mount); 741 742 /* 743 * Check to see if the vnode has been mounted on; 744 * if so find the root of the mounted filesystem. 745 */ 746 while (dp->v_type == VDIR && (mp = dp->v_mountedhere) && 747 (cnp->cn_flags & NOCROSSMOUNT) == 0) { 748 if (vfs_busy(mp, 0)) 749 continue; 750 vput(dp); 751 VFS_UNLOCK_GIANT(vfslocked); 752 vfslocked = VFS_LOCK_GIANT(mp); 753 if (dp != ndp->ni_dvp) 754 vput(ndp->ni_dvp); 755 else 756 vrele(ndp->ni_dvp); 757 VFS_UNLOCK_GIANT(dvfslocked); 758 dvfslocked = 0; 759 vref(vp_crossmp); 760 ndp->ni_dvp = vp_crossmp; 761 error = VFS_ROOT(mp, compute_cn_lkflags(mp, cnp->cn_lkflags), &tdp, td); 762 vfs_unbusy(mp); 763 if (vn_lock(vp_crossmp, LK_SHARED | LK_NOWAIT)) 764 panic("vp_crossmp exclusively locked or reclaimed"); 765 if (error) { 766 dpunlocked = 1; 767 goto bad2; 768 } 769 ndp->ni_vp = dp = tdp; 770 } 771 772 /* 773 * Check for symbolic link 774 */ 775 if ((dp->v_type == VLNK) && 776 ((cnp->cn_flags & FOLLOW) || trailing_slash || 777 *ndp->ni_next == '/')) { 778 cnp->cn_flags |= ISSYMLINK; 779 if (dp->v_iflag & VI_DOOMED) { 780 /* 781 * We can't know whether the directory was mounted with 782 * NOSYMFOLLOW, so we can't follow safely. 783 */ 784 error = ENOENT; 785 goto bad2; 786 } 787 if (dp->v_mount->mnt_flag & MNT_NOSYMFOLLOW) { 788 error = EACCES; 789 goto bad2; 790 } 791 /* 792 * Symlink code always expects an unlocked dvp. 793 */ 794 if (ndp->ni_dvp != ndp->ni_vp) 795 VOP_UNLOCK(ndp->ni_dvp, 0); 796 goto success; 797 } 798 799 /* 800 * Check for bogus trailing slashes. 801 */ 802 if (trailing_slash && dp->v_type != VDIR) { 803 error = ENOTDIR; 804 goto bad2; 805 } 806 807nextname: 808 /* 809 * Not a symbolic link. If more pathname, 810 * continue at next component, else return. 811 */ 812 KASSERT((cnp->cn_flags & ISLASTCN) || *ndp->ni_next == '/', 813 ("lookup: invalid path state.")); 814 if (*ndp->ni_next == '/') { 815 cnp->cn_nameptr = ndp->ni_next; 816 while (*cnp->cn_nameptr == '/') { 817 cnp->cn_nameptr++; 818 ndp->ni_pathlen--; 819 } 820 if (ndp->ni_dvp != dp) 821 vput(ndp->ni_dvp); 822 else 823 vrele(ndp->ni_dvp); 824 VFS_UNLOCK_GIANT(dvfslocked); 825 dvfslocked = vfslocked; /* dp becomes dvp in dirloop */ 826 vfslocked = 0; 827 goto dirloop; 828 } 829 /* 830 * Disallow directory write attempts on read-only filesystems. 831 */ 832 if (rdonly && 833 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 834 error = EROFS; 835 goto bad2; 836 } 837 if (cnp->cn_flags & SAVESTART) { 838 ndp->ni_startdir = ndp->ni_dvp; 839 VREF(ndp->ni_startdir); 840 } 841 if (!wantparent) { 842 if (ndp->ni_dvp != dp) 843 vput(ndp->ni_dvp); 844 else 845 vrele(ndp->ni_dvp); 846 VFS_UNLOCK_GIANT(dvfslocked); 847 dvfslocked = 0; 848 } else if ((cnp->cn_flags & LOCKPARENT) == 0 && ndp->ni_dvp != dp) 849 VOP_UNLOCK(ndp->ni_dvp, 0); 850 851 if (cnp->cn_flags & AUDITVNODE1) 852 AUDIT_ARG(vnode, dp, ARG_VNODE1); 853 else if (cnp->cn_flags & AUDITVNODE2) 854 AUDIT_ARG(vnode, dp, ARG_VNODE2); 855 856 if ((cnp->cn_flags & LOCKLEAF) == 0) 857 VOP_UNLOCK(dp, 0); 858success: 859 /* 860 * Because of lookup_shared we may have the vnode shared locked, but 861 * the caller may want it to be exclusively locked. 862 */ 863 if (needs_exclusive_leaf(dp->v_mount, cnp->cn_flags) && 864 VOP_ISLOCKED(dp) != LK_EXCLUSIVE) { 865 vn_lock(dp, LK_UPGRADE | LK_RETRY); 866 if (dp->v_iflag & VI_DOOMED) { 867 error = ENOENT; 868 goto bad2; 869 } 870 } 871 if (vfslocked && dvfslocked) 872 VFS_UNLOCK_GIANT(dvfslocked); /* Only need one */ 873 if (vfslocked || dvfslocked) 874 ndp->ni_cnd.cn_flags |= GIANTHELD; 875 return (0); 876 877bad2: 878 if (dp != ndp->ni_dvp) 879 vput(ndp->ni_dvp); 880 else 881 vrele(ndp->ni_dvp); 882bad: 883 if (!dpunlocked) 884 vput(dp); 885 VFS_UNLOCK_GIANT(vfslocked); 886 VFS_UNLOCK_GIANT(dvfslocked); 887 ndp->ni_cnd.cn_flags &= ~GIANTHELD; 888 ndp->ni_vp = NULL; 889 return (error); 890} 891 892/* 893 * relookup - lookup a path name component 894 * Used by lookup to re-acquire things. 895 */ 896int 897relookup(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp) 898{ 899 struct vnode *dp = 0; /* the directory we are searching */ 900 int wantparent; /* 1 => wantparent or lockparent flag */ 901 int rdonly; /* lookup read-only flag bit */ 902 int error = 0; 903 904 KASSERT(cnp->cn_flags & ISLASTCN, 905 ("relookup: Not given last component.")); 906 /* 907 * Setup: break out flag bits into variables. 908 */ 909 wantparent = cnp->cn_flags & (LOCKPARENT|WANTPARENT); 910 KASSERT(wantparent, ("relookup: parent not wanted.")); 911 rdonly = cnp->cn_flags & RDONLY; 912 cnp->cn_flags &= ~ISSYMLINK; 913 dp = dvp; 914 cnp->cn_lkflags = LK_EXCLUSIVE; 915 vn_lock(dp, LK_EXCLUSIVE | LK_RETRY); 916 917 /* 918 * Search a new directory. 919 * 920 * The last component of the filename is left accessible via 921 * cnp->cn_nameptr for callers that need the name. Callers needing 922 * the name set the SAVENAME flag. When done, they assume 923 * responsibility for freeing the pathname buffer. 924 */ 925#ifdef NAMEI_DIAGNOSTIC 926 printf("{%s}: ", cnp->cn_nameptr); 927#endif 928 929 /* 930 * Check for degenerate name (e.g. / or "") 931 * which is a way of talking about a directory, 932 * e.g. like "/." or ".". 933 */ 934 if (cnp->cn_nameptr[0] == '\0') { 935 if (cnp->cn_nameiop != LOOKUP || wantparent) { 936 error = EISDIR; 937 goto bad; 938 } 939 if (dp->v_type != VDIR) { 940 error = ENOTDIR; 941 goto bad; 942 } 943 if (!(cnp->cn_flags & LOCKLEAF)) 944 VOP_UNLOCK(dp, 0); 945 *vpp = dp; 946 /* XXX This should probably move to the top of function. */ 947 if (cnp->cn_flags & SAVESTART) 948 panic("lookup: SAVESTART"); 949 return (0); 950 } 951 952 if (cnp->cn_flags & ISDOTDOT) 953 panic ("relookup: lookup on dot-dot"); 954 955 /* 956 * We now have a segment name to search for, and a directory to search. 957 */ 958#ifdef NAMEI_DIAGNOSTIC 959 vprint("search in:", dp); 960#endif 961 if ((error = VOP_LOOKUP(dp, vpp, cnp)) != 0) { 962 KASSERT(*vpp == NULL, ("leaf should be empty")); 963 if (error != EJUSTRETURN) 964 goto bad; 965 /* 966 * If creating and at end of pathname, then can consider 967 * allowing file to be created. 968 */ 969 if (rdonly) { 970 error = EROFS; 971 goto bad; 972 } 973 /* ASSERT(dvp == ndp->ni_startdir) */ 974 if (cnp->cn_flags & SAVESTART) 975 VREF(dvp); 976 if ((cnp->cn_flags & LOCKPARENT) == 0) 977 VOP_UNLOCK(dp, 0); 978 /* 979 * This is a temporary assert to make sure I know what the 980 * behavior here was. 981 */ 982 KASSERT((cnp->cn_flags & (WANTPARENT|LOCKPARENT)) != 0, 983 ("relookup: Unhandled case.")); 984 /* 985 * We return with ni_vp NULL to indicate that the entry 986 * doesn't currently exist, leaving a pointer to the 987 * (possibly locked) directory vnode in ndp->ni_dvp. 988 */ 989 return (0); 990 } 991 992 dp = *vpp; 993 994 /* 995 * Disallow directory write attempts on read-only filesystems. 996 */ 997 if (rdonly && 998 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 999 if (dvp == dp) 1000 vrele(dvp); 1001 else 1002 vput(dvp); 1003 error = EROFS; 1004 goto bad; 1005 } 1006 /* 1007 * Set the parent lock/ref state to the requested state. 1008 */ 1009 if ((cnp->cn_flags & LOCKPARENT) == 0 && dvp != dp) { 1010 if (wantparent) 1011 VOP_UNLOCK(dvp, 0); 1012 else 1013 vput(dvp); 1014 } else if (!wantparent) 1015 vrele(dvp); 1016 /* 1017 * Check for symbolic link 1018 */ 1019 KASSERT(dp->v_type != VLNK || !(cnp->cn_flags & FOLLOW), 1020 ("relookup: symlink found.\n")); 1021 1022 /* ASSERT(dvp == ndp->ni_startdir) */ 1023 if (cnp->cn_flags & SAVESTART) 1024 VREF(dvp); 1025 1026 if ((cnp->cn_flags & LOCKLEAF) == 0) 1027 VOP_UNLOCK(dp, 0); 1028 return (0); 1029bad: 1030 vput(dp); 1031 *vpp = NULL; 1032 return (error); 1033} 1034 1035/* 1036 * Free data allocated by namei(); see namei(9) for details. 1037 */ 1038void 1039NDFREE(struct nameidata *ndp, const u_int flags) 1040{ 1041 int unlock_dvp; 1042 int unlock_vp; 1043 1044 unlock_dvp = 0; 1045 unlock_vp = 0; 1046 1047 if (!(flags & NDF_NO_FREE_PNBUF) && 1048 (ndp->ni_cnd.cn_flags & HASBUF)) { 1049 uma_zfree(namei_zone, ndp->ni_cnd.cn_pnbuf); 1050 ndp->ni_cnd.cn_flags &= ~HASBUF; 1051 } 1052 if (!(flags & NDF_NO_VP_UNLOCK) && 1053 (ndp->ni_cnd.cn_flags & LOCKLEAF) && ndp->ni_vp) 1054 unlock_vp = 1; 1055 if (!(flags & NDF_NO_VP_RELE) && ndp->ni_vp) { 1056 if (unlock_vp) { 1057 vput(ndp->ni_vp); 1058 unlock_vp = 0; 1059 } else 1060 vrele(ndp->ni_vp); 1061 ndp->ni_vp = NULL; 1062 } 1063 if (unlock_vp) 1064 VOP_UNLOCK(ndp->ni_vp, 0); 1065 if (!(flags & NDF_NO_DVP_UNLOCK) && 1066 (ndp->ni_cnd.cn_flags & LOCKPARENT) && 1067 ndp->ni_dvp != ndp->ni_vp) 1068 unlock_dvp = 1; 1069 if (!(flags & NDF_NO_DVP_RELE) && 1070 (ndp->ni_cnd.cn_flags & (LOCKPARENT|WANTPARENT))) { 1071 if (unlock_dvp) { 1072 vput(ndp->ni_dvp); 1073 unlock_dvp = 0; 1074 } else 1075 vrele(ndp->ni_dvp); 1076 ndp->ni_dvp = NULL; 1077 } 1078 if (unlock_dvp) 1079 VOP_UNLOCK(ndp->ni_dvp, 0); 1080 if (!(flags & NDF_NO_STARTDIR_RELE) && 1081 (ndp->ni_cnd.cn_flags & SAVESTART)) { 1082 vrele(ndp->ni_startdir); 1083 ndp->ni_startdir = NULL; 1084 } 1085} 1086 1087/* 1088 * Determine if there is a suitable alternate filename under the specified 1089 * prefix for the specified path. If the create flag is set, then the 1090 * alternate prefix will be used so long as the parent directory exists. 1091 * This is used by the various compatiblity ABIs so that Linux binaries prefer 1092 * files under /compat/linux for example. The chosen path (whether under 1093 * the prefix or under /) is returned in a kernel malloc'd buffer pointed 1094 * to by pathbuf. The caller is responsible for free'ing the buffer from 1095 * the M_TEMP bucket if one is returned. 1096 */ 1097int 1098kern_alternate_path(struct thread *td, const char *prefix, const char *path, 1099 enum uio_seg pathseg, char **pathbuf, int create, int dirfd) 1100{ 1101 struct nameidata nd, ndroot; 1102 char *ptr, *buf, *cp; 1103 size_t len, sz; 1104 int error; 1105 1106 buf = (char *) malloc(MAXPATHLEN, M_TEMP, M_WAITOK); 1107 *pathbuf = buf; 1108 1109 /* Copy the prefix into the new pathname as a starting point. */ 1110 len = strlcpy(buf, prefix, MAXPATHLEN); 1111 if (len >= MAXPATHLEN) { 1112 *pathbuf = NULL; 1113 free(buf, M_TEMP); 1114 return (EINVAL); 1115 } 1116 sz = MAXPATHLEN - len; 1117 ptr = buf + len; 1118 1119 /* Append the filename to the prefix. */ 1120 if (pathseg == UIO_SYSSPACE) 1121 error = copystr(path, ptr, sz, &len); 1122 else 1123 error = copyinstr(path, ptr, sz, &len); 1124 1125 if (error) { 1126 *pathbuf = NULL; 1127 free(buf, M_TEMP); 1128 return (error); 1129 } 1130 1131 /* Only use a prefix with absolute pathnames. */ 1132 if (*ptr != '/') { 1133 error = EINVAL; 1134 goto keeporig; 1135 } 1136 1137 if (dirfd != AT_FDCWD) { 1138 /* 1139 * We want the original because the "prefix" is 1140 * included in the already opened dirfd. 1141 */ 1142 bcopy(ptr, buf, len); 1143 return (0); 1144 } 1145 1146 /* 1147 * We know that there is a / somewhere in this pathname. 1148 * Search backwards for it, to find the file's parent dir 1149 * to see if it exists in the alternate tree. If it does, 1150 * and we want to create a file (cflag is set). We don't 1151 * need to worry about the root comparison in this case. 1152 */ 1153 1154 if (create) { 1155 for (cp = &ptr[len] - 1; *cp != '/'; cp--); 1156 *cp = '\0'; 1157 1158 NDINIT(&nd, LOOKUP, FOLLOW | MPSAFE, UIO_SYSSPACE, buf, td); 1159 error = namei(&nd); 1160 *cp = '/'; 1161 if (error != 0) 1162 goto keeporig; 1163 } else { 1164 NDINIT(&nd, LOOKUP, FOLLOW | MPSAFE, UIO_SYSSPACE, buf, td); 1165 1166 error = namei(&nd); 1167 if (error != 0) 1168 goto keeporig; 1169 1170 /* 1171 * We now compare the vnode of the prefix to the one 1172 * vnode asked. If they resolve to be the same, then we 1173 * ignore the match so that the real root gets used. 1174 * This avoids the problem of traversing "../.." to find the 1175 * root directory and never finding it, because "/" resolves 1176 * to the emulation root directory. This is expensive :-( 1177 */ 1178 NDINIT(&ndroot, LOOKUP, FOLLOW | MPSAFE, UIO_SYSSPACE, prefix, 1179 td); 1180 1181 /* We shouldn't ever get an error from this namei(). */ 1182 error = namei(&ndroot); 1183 if (error == 0) { 1184 if (nd.ni_vp == ndroot.ni_vp) 1185 error = ENOENT; 1186 1187 NDFREE(&ndroot, NDF_ONLY_PNBUF); 1188 vrele(ndroot.ni_vp); 1189 VFS_UNLOCK_GIANT(NDHASGIANT(&ndroot)); 1190 } 1191 } 1192 1193 NDFREE(&nd, NDF_ONLY_PNBUF); 1194 vrele(nd.ni_vp); 1195 VFS_UNLOCK_GIANT(NDHASGIANT(&nd)); 1196 1197keeporig: 1198 /* If there was an error, use the original path name. */ 1199 if (error) 1200 bcopy(ptr, buf, len); 1201 return (error); 1202} 1203