1// SPDX-License-Identifier: GPL-2.0-only 2/* 3 * 4 * Copyright (C) 2011 Novell Inc. 5 */ 6 7#include <linux/fs.h> 8#include <linux/slab.h> 9#include <linux/cred.h> 10#include <linux/xattr.h> 11#include <linux/posix_acl.h> 12#include <linux/ratelimit.h> 13#include <linux/fiemap.h> 14#include <linux/fileattr.h> 15#include <linux/security.h> 16#include <linux/namei.h> 17#include <linux/posix_acl.h> 18#include <linux/posix_acl_xattr.h> 19#include "overlayfs.h" 20 21 22int ovl_setattr(struct mnt_idmap *idmap, struct dentry *dentry, 23 struct iattr *attr) 24{ 25 int err; 26 struct ovl_fs *ofs = OVL_FS(dentry->d_sb); 27 bool full_copy_up = false; 28 struct dentry *upperdentry; 29 const struct cred *old_cred; 30 31 err = setattr_prepare(&nop_mnt_idmap, dentry, attr); 32 if (err) 33 return err; 34 35 if (attr->ia_valid & ATTR_SIZE) { 36 /* Truncate should trigger data copy up as well */ 37 full_copy_up = true; 38 } 39 40 if (!full_copy_up) 41 err = ovl_copy_up(dentry); 42 else 43 err = ovl_copy_up_with_data(dentry); 44 if (!err) { 45 struct inode *winode = NULL; 46 47 upperdentry = ovl_dentry_upper(dentry); 48 49 if (attr->ia_valid & ATTR_SIZE) { 50 winode = d_inode(upperdentry); 51 err = get_write_access(winode); 52 if (err) 53 goto out; 54 } 55 56 if (attr->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) 57 attr->ia_valid &= ~ATTR_MODE; 58 59 /* 60 * We might have to translate ovl file into real file object 61 * once use cases emerge. For now, simply don't let underlying 62 * filesystem rely on attr->ia_file 63 */ 64 attr->ia_valid &= ~ATTR_FILE; 65 66 /* 67 * If open(O_TRUNC) is done, VFS calls ->setattr with ATTR_OPEN 68 * set. Overlayfs does not pass O_TRUNC flag to underlying 69 * filesystem during open -> do not pass ATTR_OPEN. This 70 * disables optimization in fuse which assumes open(O_TRUNC) 71 * already set file size to 0. But we never passed O_TRUNC to 72 * fuse. So by clearing ATTR_OPEN, fuse will be forced to send 73 * setattr request to server. 74 */ 75 attr->ia_valid &= ~ATTR_OPEN; 76 77 err = ovl_want_write(dentry); 78 if (err) 79 goto out_put_write; 80 81 inode_lock(upperdentry->d_inode); 82 old_cred = ovl_override_creds(dentry->d_sb); 83 err = ovl_do_notify_change(ofs, upperdentry, attr); 84 revert_creds(old_cred); 85 if (!err) 86 ovl_copyattr(dentry->d_inode); 87 inode_unlock(upperdentry->d_inode); 88 ovl_drop_write(dentry); 89 90out_put_write: 91 if (winode) 92 put_write_access(winode); 93 } 94out: 95 return err; 96} 97 98static void ovl_map_dev_ino(struct dentry *dentry, struct kstat *stat, int fsid) 99{ 100 struct ovl_fs *ofs = OVL_FS(dentry->d_sb); 101 bool samefs = ovl_same_fs(ofs); 102 unsigned int xinobits = ovl_xino_bits(ofs); 103 unsigned int xinoshift = 64 - xinobits; 104 105 if (samefs) { 106 /* 107 * When all layers are on the same fs, all real inode 108 * number are unique, so we use the overlay st_dev, 109 * which is friendly to du -x. 110 */ 111 stat->dev = dentry->d_sb->s_dev; 112 return; 113 } else if (xinobits) { 114 /* 115 * All inode numbers of underlying fs should not be using the 116 * high xinobits, so we use high xinobits to partition the 117 * overlay st_ino address space. The high bits holds the fsid 118 * (upper fsid is 0). The lowest xinobit is reserved for mapping 119 * the non-persistent inode numbers range in case of overflow. 120 * This way all overlay inode numbers are unique and use the 121 * overlay st_dev. 122 */ 123 if (likely(!(stat->ino >> xinoshift))) { 124 stat->ino |= ((u64)fsid) << (xinoshift + 1); 125 stat->dev = dentry->d_sb->s_dev; 126 return; 127 } else if (ovl_xino_warn(ofs)) { 128 pr_warn_ratelimited("inode number too big (%pd2, ino=%llu, xinobits=%d)\n", 129 dentry, stat->ino, xinobits); 130 } 131 } 132 133 /* The inode could not be mapped to a unified st_ino address space */ 134 if (S_ISDIR(dentry->d_inode->i_mode)) { 135 /* 136 * Always use the overlay st_dev for directories, so 'find 137 * -xdev' will scan the entire overlay mount and won't cross the 138 * overlay mount boundaries. 139 * 140 * If not all layers are on the same fs the pair {real st_ino; 141 * overlay st_dev} is not unique, so use the non persistent 142 * overlay st_ino for directories. 143 */ 144 stat->dev = dentry->d_sb->s_dev; 145 stat->ino = dentry->d_inode->i_ino; 146 } else { 147 /* 148 * For non-samefs setup, if we cannot map all layers st_ino 149 * to a unified address space, we need to make sure that st_dev 150 * is unique per underlying fs, so we use the unique anonymous 151 * bdev assigned to the underlying fs. 152 */ 153 stat->dev = ofs->fs[fsid].pseudo_dev; 154 } 155} 156 157int ovl_getattr(struct mnt_idmap *idmap, const struct path *path, 158 struct kstat *stat, u32 request_mask, unsigned int flags) 159{ 160 struct dentry *dentry = path->dentry; 161 enum ovl_path_type type; 162 struct path realpath; 163 const struct cred *old_cred; 164 struct inode *inode = d_inode(dentry); 165 bool is_dir = S_ISDIR(inode->i_mode); 166 int fsid = 0; 167 int err; 168 bool metacopy_blocks = false; 169 170 metacopy_blocks = ovl_is_metacopy_dentry(dentry); 171 172 type = ovl_path_real(dentry, &realpath); 173 old_cred = ovl_override_creds(dentry->d_sb); 174 err = ovl_do_getattr(&realpath, stat, request_mask, flags); 175 if (err) 176 goto out; 177 178 /* Report the effective immutable/append-only STATX flags */ 179 generic_fill_statx_attr(inode, stat); 180 181 /* 182 * For non-dir or same fs, we use st_ino of the copy up origin. 183 * This guaranties constant st_dev/st_ino across copy up. 184 * With xino feature and non-samefs, we use st_ino of the copy up 185 * origin masked with high bits that represent the layer id. 186 * 187 * If lower filesystem supports NFS file handles, this also guaranties 188 * persistent st_ino across mount cycle. 189 */ 190 if (!is_dir || ovl_same_dev(OVL_FS(dentry->d_sb))) { 191 if (!OVL_TYPE_UPPER(type)) { 192 fsid = ovl_layer_lower(dentry)->fsid; 193 } else if (OVL_TYPE_ORIGIN(type)) { 194 struct kstat lowerstat; 195 u32 lowermask = STATX_INO | STATX_BLOCKS | 196 (!is_dir ? STATX_NLINK : 0); 197 198 ovl_path_lower(dentry, &realpath); 199 err = ovl_do_getattr(&realpath, &lowerstat, lowermask, 200 flags); 201 if (err) 202 goto out; 203 204 /* 205 * Lower hardlinks may be broken on copy up to different 206 * upper files, so we cannot use the lower origin st_ino 207 * for those different files, even for the same fs case. 208 * 209 * Similarly, several redirected dirs can point to the 210 * same dir on a lower layer. With the "verify_lower" 211 * feature, we do not use the lower origin st_ino, if 212 * we haven't verified that this redirect is unique. 213 * 214 * With inodes index enabled, it is safe to use st_ino 215 * of an indexed origin. The index validates that the 216 * upper hardlink is not broken and that a redirected 217 * dir is the only redirect to that origin. 218 */ 219 if (ovl_test_flag(OVL_INDEX, d_inode(dentry)) || 220 (!ovl_verify_lower(dentry->d_sb) && 221 (is_dir || lowerstat.nlink == 1))) { 222 fsid = ovl_layer_lower(dentry)->fsid; 223 stat->ino = lowerstat.ino; 224 } 225 226 /* 227 * If we are querying a metacopy dentry and lower 228 * dentry is data dentry, then use the blocks we 229 * queried just now. We don't have to do additional 230 * vfs_getattr(). If lower itself is metacopy, then 231 * additional vfs_getattr() is unavoidable. 232 */ 233 if (metacopy_blocks && 234 realpath.dentry == ovl_dentry_lowerdata(dentry)) { 235 stat->blocks = lowerstat.blocks; 236 metacopy_blocks = false; 237 } 238 } 239 240 if (metacopy_blocks) { 241 /* 242 * If lower is not same as lowerdata or if there was 243 * no origin on upper, we can end up here. 244 * With lazy lowerdata lookup, guess lowerdata blocks 245 * from size to avoid lowerdata lookup on stat(2). 246 */ 247 struct kstat lowerdatastat; 248 u32 lowermask = STATX_BLOCKS; 249 250 ovl_path_lowerdata(dentry, &realpath); 251 if (realpath.dentry) { 252 err = ovl_do_getattr(&realpath, &lowerdatastat, 253 lowermask, flags); 254 if (err) 255 goto out; 256 } else { 257 lowerdatastat.blocks = 258 round_up(stat->size, stat->blksize) >> 9; 259 } 260 stat->blocks = lowerdatastat.blocks; 261 } 262 } 263 264 ovl_map_dev_ino(dentry, stat, fsid); 265 266 /* 267 * It's probably not worth it to count subdirs to get the 268 * correct link count. nlink=1 seems to pacify 'find' and 269 * other utilities. 270 */ 271 if (is_dir && OVL_TYPE_MERGE(type)) 272 stat->nlink = 1; 273 274 /* 275 * Return the overlay inode nlinks for indexed upper inodes. 276 * Overlay inode nlink counts the union of the upper hardlinks 277 * and non-covered lower hardlinks. It does not include the upper 278 * index hardlink. 279 */ 280 if (!is_dir && ovl_test_flag(OVL_INDEX, d_inode(dentry))) 281 stat->nlink = dentry->d_inode->i_nlink; 282 283out: 284 revert_creds(old_cred); 285 286 return err; 287} 288 289int ovl_permission(struct mnt_idmap *idmap, 290 struct inode *inode, int mask) 291{ 292 struct inode *upperinode = ovl_inode_upper(inode); 293 struct inode *realinode; 294 struct path realpath; 295 const struct cred *old_cred; 296 int err; 297 298 /* Careful in RCU walk mode */ 299 realinode = ovl_i_path_real(inode, &realpath); 300 if (!realinode) { 301 WARN_ON(!(mask & MAY_NOT_BLOCK)); 302 return -ECHILD; 303 } 304 305 /* 306 * Check overlay inode with the creds of task and underlying inode 307 * with creds of mounter 308 */ 309 err = generic_permission(&nop_mnt_idmap, inode, mask); 310 if (err) 311 return err; 312 313 old_cred = ovl_override_creds(inode->i_sb); 314 if (!upperinode && 315 !special_file(realinode->i_mode) && mask & MAY_WRITE) { 316 mask &= ~(MAY_WRITE | MAY_APPEND); 317 /* Make sure mounter can read file for copy up later */ 318 mask |= MAY_READ; 319 } 320 err = inode_permission(mnt_idmap(realpath.mnt), realinode, mask); 321 revert_creds(old_cred); 322 323 return err; 324} 325 326static const char *ovl_get_link(struct dentry *dentry, 327 struct inode *inode, 328 struct delayed_call *done) 329{ 330 const struct cred *old_cred; 331 const char *p; 332 333 if (!dentry) 334 return ERR_PTR(-ECHILD); 335 336 old_cred = ovl_override_creds(dentry->d_sb); 337 p = vfs_get_link(ovl_dentry_real(dentry), done); 338 revert_creds(old_cred); 339 return p; 340} 341 342#ifdef CONFIG_FS_POSIX_ACL 343/* 344 * Apply the idmapping of the layer to POSIX ACLs. The caller must pass a clone 345 * of the POSIX ACLs retrieved from the lower layer to this function to not 346 * alter the POSIX ACLs for the underlying filesystem. 347 */ 348static void ovl_idmap_posix_acl(const struct inode *realinode, 349 struct mnt_idmap *idmap, 350 struct posix_acl *acl) 351{ 352 struct user_namespace *fs_userns = i_user_ns(realinode); 353 354 for (unsigned int i = 0; i < acl->a_count; i++) { 355 vfsuid_t vfsuid; 356 vfsgid_t vfsgid; 357 358 struct posix_acl_entry *e = &acl->a_entries[i]; 359 switch (e->e_tag) { 360 case ACL_USER: 361 vfsuid = make_vfsuid(idmap, fs_userns, e->e_uid); 362 e->e_uid = vfsuid_into_kuid(vfsuid); 363 break; 364 case ACL_GROUP: 365 vfsgid = make_vfsgid(idmap, fs_userns, e->e_gid); 366 e->e_gid = vfsgid_into_kgid(vfsgid); 367 break; 368 } 369 } 370} 371 372/* 373 * The @noperm argument is used to skip permission checking and is a temporary 374 * measure. Quoting Miklos from an earlier discussion: 375 * 376 * > So there are two paths to getting an acl: 377 * > 1) permission checking and 2) retrieving the value via getxattr(2). 378 * > This is a similar situation as reading a symlink vs. following it. 379 * > When following a symlink overlayfs always reads the link on the 380 * > underlying fs just as if it was a readlink(2) call, calling 381 * > security_inode_readlink() instead of security_inode_follow_link(). 382 * > This is logical: we are reading the link from the underlying storage, 383 * > and following it on overlayfs. 384 * > 385 * > Applying the same logic to acl: we do need to call the 386 * > security_inode_getxattr() on the underlying fs, even if just want to 387 * > check permissions on overlay. This is currently not done, which is an 388 * > inconsistency. 389 * > 390 * > Maybe adding the check to ovl_get_acl() is the right way to go, but 391 * > I'm a little afraid of a performance regression. Will look into that. 392 * 393 * Until we have made a decision allow this helper to take the @noperm 394 * argument. We should hopefully be able to remove it soon. 395 */ 396struct posix_acl *ovl_get_acl_path(const struct path *path, 397 const char *acl_name, bool noperm) 398{ 399 struct posix_acl *real_acl, *clone; 400 struct mnt_idmap *idmap; 401 struct inode *realinode = d_inode(path->dentry); 402 403 idmap = mnt_idmap(path->mnt); 404 405 if (noperm) 406 real_acl = get_inode_acl(realinode, posix_acl_type(acl_name)); 407 else 408 real_acl = vfs_get_acl(idmap, path->dentry, acl_name); 409 if (IS_ERR_OR_NULL(real_acl)) 410 return real_acl; 411 412 if (!is_idmapped_mnt(path->mnt)) 413 return real_acl; 414 415 /* 416 * We cannot alter the ACLs returned from the relevant layer as that 417 * would alter the cached values filesystem wide for the lower 418 * filesystem. Instead we can clone the ACLs and then apply the 419 * relevant idmapping of the layer. 420 */ 421 clone = posix_acl_clone(real_acl, GFP_KERNEL); 422 posix_acl_release(real_acl); /* release original acl */ 423 if (!clone) 424 return ERR_PTR(-ENOMEM); 425 426 ovl_idmap_posix_acl(realinode, idmap, clone); 427 return clone; 428} 429 430/* 431 * When the relevant layer is an idmapped mount we need to take the idmapping 432 * of the layer into account and translate any ACL_{GROUP,USER} values 433 * according to the idmapped mount. 434 * 435 * We cannot alter the ACLs returned from the relevant layer as that would 436 * alter the cached values filesystem wide for the lower filesystem. Instead we 437 * can clone the ACLs and then apply the relevant idmapping of the layer. 438 * 439 * This is obviously only relevant when idmapped layers are used. 440 */ 441struct posix_acl *do_ovl_get_acl(struct mnt_idmap *idmap, 442 struct inode *inode, int type, 443 bool rcu, bool noperm) 444{ 445 struct inode *realinode; 446 struct posix_acl *acl; 447 struct path realpath; 448 449 /* Careful in RCU walk mode */ 450 realinode = ovl_i_path_real(inode, &realpath); 451 if (!realinode) { 452 WARN_ON(!rcu); 453 return ERR_PTR(-ECHILD); 454 } 455 456 if (!IS_POSIXACL(realinode)) 457 return NULL; 458 459 if (rcu) { 460 /* 461 * If the layer is idmapped drop out of RCU path walk 462 * so we can clone the ACLs. 463 */ 464 if (is_idmapped_mnt(realpath.mnt)) 465 return ERR_PTR(-ECHILD); 466 467 acl = get_cached_acl_rcu(realinode, type); 468 } else { 469 const struct cred *old_cred; 470 471 old_cred = ovl_override_creds(inode->i_sb); 472 acl = ovl_get_acl_path(&realpath, posix_acl_xattr_name(type), noperm); 473 revert_creds(old_cred); 474 } 475 476 return acl; 477} 478 479static int ovl_set_or_remove_acl(struct dentry *dentry, struct inode *inode, 480 struct posix_acl *acl, int type) 481{ 482 int err; 483 struct path realpath; 484 const char *acl_name; 485 const struct cred *old_cred; 486 struct ovl_fs *ofs = OVL_FS(dentry->d_sb); 487 struct dentry *upperdentry = ovl_dentry_upper(dentry); 488 struct dentry *realdentry = upperdentry ?: ovl_dentry_lower(dentry); 489 490 /* 491 * If ACL is to be removed from a lower file, check if it exists in 492 * the first place before copying it up. 493 */ 494 acl_name = posix_acl_xattr_name(type); 495 if (!acl && !upperdentry) { 496 struct posix_acl *real_acl; 497 498 ovl_path_lower(dentry, &realpath); 499 old_cred = ovl_override_creds(dentry->d_sb); 500 real_acl = vfs_get_acl(mnt_idmap(realpath.mnt), realdentry, 501 acl_name); 502 revert_creds(old_cred); 503 if (IS_ERR(real_acl)) { 504 err = PTR_ERR(real_acl); 505 goto out; 506 } 507 posix_acl_release(real_acl); 508 } 509 510 if (!upperdentry) { 511 err = ovl_copy_up(dentry); 512 if (err) 513 goto out; 514 515 realdentry = ovl_dentry_upper(dentry); 516 } 517 518 err = ovl_want_write(dentry); 519 if (err) 520 goto out; 521 522 old_cred = ovl_override_creds(dentry->d_sb); 523 if (acl) 524 err = ovl_do_set_acl(ofs, realdentry, acl_name, acl); 525 else 526 err = ovl_do_remove_acl(ofs, realdentry, acl_name); 527 revert_creds(old_cred); 528 ovl_drop_write(dentry); 529 530 /* copy c/mtime */ 531 ovl_copyattr(inode); 532out: 533 return err; 534} 535 536int ovl_set_acl(struct mnt_idmap *idmap, struct dentry *dentry, 537 struct posix_acl *acl, int type) 538{ 539 int err; 540 struct inode *inode = d_inode(dentry); 541 struct dentry *workdir = ovl_workdir(dentry); 542 struct inode *realinode = ovl_inode_real(inode); 543 544 if (!IS_POSIXACL(d_inode(workdir))) 545 return -EOPNOTSUPP; 546 if (!realinode->i_op->set_acl) 547 return -EOPNOTSUPP; 548 if (type == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode)) 549 return acl ? -EACCES : 0; 550 if (!inode_owner_or_capable(&nop_mnt_idmap, inode)) 551 return -EPERM; 552 553 /* 554 * Check if sgid bit needs to be cleared (actual setacl operation will 555 * be done with mounter's capabilities and so that won't do it for us). 556 */ 557 if (unlikely(inode->i_mode & S_ISGID) && type == ACL_TYPE_ACCESS && 558 !in_group_p(inode->i_gid) && 559 !capable_wrt_inode_uidgid(&nop_mnt_idmap, inode, CAP_FSETID)) { 560 struct iattr iattr = { .ia_valid = ATTR_KILL_SGID }; 561 562 err = ovl_setattr(&nop_mnt_idmap, dentry, &iattr); 563 if (err) 564 return err; 565 } 566 567 return ovl_set_or_remove_acl(dentry, inode, acl, type); 568} 569#endif 570 571int ovl_update_time(struct inode *inode, int flags) 572{ 573 if (flags & S_ATIME) { 574 struct ovl_fs *ofs = OVL_FS(inode->i_sb); 575 struct path upperpath = { 576 .mnt = ovl_upper_mnt(ofs), 577 .dentry = ovl_upperdentry_dereference(OVL_I(inode)), 578 }; 579 580 if (upperpath.dentry) { 581 touch_atime(&upperpath); 582 inode_set_atime_to_ts(inode, 583 inode_get_atime(d_inode(upperpath.dentry))); 584 } 585 } 586 return 0; 587} 588 589static int ovl_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, 590 u64 start, u64 len) 591{ 592 int err; 593 struct inode *realinode = ovl_inode_realdata(inode); 594 const struct cred *old_cred; 595 596 if (!realinode) 597 return -EIO; 598 599 if (!realinode->i_op->fiemap) 600 return -EOPNOTSUPP; 601 602 old_cred = ovl_override_creds(inode->i_sb); 603 err = realinode->i_op->fiemap(realinode, fieinfo, start, len); 604 revert_creds(old_cred); 605 606 return err; 607} 608 609/* 610 * Work around the fact that security_file_ioctl() takes a file argument. 611 * Introducing security_inode_fileattr_get/set() hooks would solve this issue 612 * properly. 613 */ 614static int ovl_security_fileattr(const struct path *realpath, struct fileattr *fa, 615 bool set) 616{ 617 struct file *file; 618 unsigned int cmd; 619 int err; 620 621 file = dentry_open(realpath, O_RDONLY, current_cred()); 622 if (IS_ERR(file)) 623 return PTR_ERR(file); 624 625 if (set) 626 cmd = fa->fsx_valid ? FS_IOC_FSSETXATTR : FS_IOC_SETFLAGS; 627 else 628 cmd = fa->fsx_valid ? FS_IOC_FSGETXATTR : FS_IOC_GETFLAGS; 629 630 err = security_file_ioctl(file, cmd, 0); 631 fput(file); 632 633 return err; 634} 635 636int ovl_real_fileattr_set(const struct path *realpath, struct fileattr *fa) 637{ 638 int err; 639 640 err = ovl_security_fileattr(realpath, fa, true); 641 if (err) 642 return err; 643 644 return vfs_fileattr_set(mnt_idmap(realpath->mnt), realpath->dentry, fa); 645} 646 647int ovl_fileattr_set(struct mnt_idmap *idmap, 648 struct dentry *dentry, struct fileattr *fa) 649{ 650 struct inode *inode = d_inode(dentry); 651 struct path upperpath; 652 const struct cred *old_cred; 653 unsigned int flags; 654 int err; 655 656 err = ovl_copy_up(dentry); 657 if (!err) { 658 ovl_path_real(dentry, &upperpath); 659 660 err = ovl_want_write(dentry); 661 if (err) 662 goto out; 663 664 old_cred = ovl_override_creds(inode->i_sb); 665 /* 666 * Store immutable/append-only flags in xattr and clear them 667 * in upper fileattr (in case they were set by older kernel) 668 * so children of "ovl-immutable" directories lower aliases of 669 * "ovl-immutable" hardlinks could be copied up. 670 * Clear xattr when flags are cleared. 671 */ 672 err = ovl_set_protattr(inode, upperpath.dentry, fa); 673 if (!err) 674 err = ovl_real_fileattr_set(&upperpath, fa); 675 revert_creds(old_cred); 676 ovl_drop_write(dentry); 677 678 /* 679 * Merge real inode flags with inode flags read from 680 * overlay.protattr xattr 681 */ 682 flags = ovl_inode_real(inode)->i_flags & OVL_COPY_I_FLAGS_MASK; 683 684 BUILD_BUG_ON(OVL_PROT_I_FLAGS_MASK & ~OVL_COPY_I_FLAGS_MASK); 685 flags |= inode->i_flags & OVL_PROT_I_FLAGS_MASK; 686 inode_set_flags(inode, flags, OVL_COPY_I_FLAGS_MASK); 687 688 /* Update ctime */ 689 ovl_copyattr(inode); 690 } 691out: 692 return err; 693} 694 695/* Convert inode protection flags to fileattr flags */ 696static void ovl_fileattr_prot_flags(struct inode *inode, struct fileattr *fa) 697{ 698 BUILD_BUG_ON(OVL_PROT_FS_FLAGS_MASK & ~FS_COMMON_FL); 699 BUILD_BUG_ON(OVL_PROT_FSX_FLAGS_MASK & ~FS_XFLAG_COMMON); 700 701 if (inode->i_flags & S_APPEND) { 702 fa->flags |= FS_APPEND_FL; 703 fa->fsx_xflags |= FS_XFLAG_APPEND; 704 } 705 if (inode->i_flags & S_IMMUTABLE) { 706 fa->flags |= FS_IMMUTABLE_FL; 707 fa->fsx_xflags |= FS_XFLAG_IMMUTABLE; 708 } 709} 710 711int ovl_real_fileattr_get(const struct path *realpath, struct fileattr *fa) 712{ 713 int err; 714 715 err = ovl_security_fileattr(realpath, fa, false); 716 if (err) 717 return err; 718 719 err = vfs_fileattr_get(realpath->dentry, fa); 720 if (err == -ENOIOCTLCMD) 721 err = -ENOTTY; 722 return err; 723} 724 725int ovl_fileattr_get(struct dentry *dentry, struct fileattr *fa) 726{ 727 struct inode *inode = d_inode(dentry); 728 struct path realpath; 729 const struct cred *old_cred; 730 int err; 731 732 ovl_path_real(dentry, &realpath); 733 734 old_cred = ovl_override_creds(inode->i_sb); 735 err = ovl_real_fileattr_get(&realpath, fa); 736 ovl_fileattr_prot_flags(inode, fa); 737 revert_creds(old_cred); 738 739 return err; 740} 741 742static const struct inode_operations ovl_file_inode_operations = { 743 .setattr = ovl_setattr, 744 .permission = ovl_permission, 745 .getattr = ovl_getattr, 746 .listxattr = ovl_listxattr, 747 .get_inode_acl = ovl_get_inode_acl, 748 .get_acl = ovl_get_acl, 749 .set_acl = ovl_set_acl, 750 .update_time = ovl_update_time, 751 .fiemap = ovl_fiemap, 752 .fileattr_get = ovl_fileattr_get, 753 .fileattr_set = ovl_fileattr_set, 754}; 755 756static const struct inode_operations ovl_symlink_inode_operations = { 757 .setattr = ovl_setattr, 758 .get_link = ovl_get_link, 759 .getattr = ovl_getattr, 760 .listxattr = ovl_listxattr, 761 .update_time = ovl_update_time, 762}; 763 764static const struct inode_operations ovl_special_inode_operations = { 765 .setattr = ovl_setattr, 766 .permission = ovl_permission, 767 .getattr = ovl_getattr, 768 .listxattr = ovl_listxattr, 769 .get_inode_acl = ovl_get_inode_acl, 770 .get_acl = ovl_get_acl, 771 .set_acl = ovl_set_acl, 772 .update_time = ovl_update_time, 773}; 774 775static const struct address_space_operations ovl_aops = { 776 /* For O_DIRECT dentry_open() checks f_mapping->a_ops->direct_IO */ 777 .direct_IO = noop_direct_IO, 778}; 779 780/* 781 * It is possible to stack overlayfs instance on top of another 782 * overlayfs instance as lower layer. We need to annotate the 783 * stackable i_mutex locks according to stack level of the super 784 * block instance. An overlayfs instance can never be in stack 785 * depth 0 (there is always a real fs below it). An overlayfs 786 * inode lock will use the lockdep annotation ovl_i_mutex_key[depth]. 787 * 788 * For example, here is a snip from /proc/lockdep_chains after 789 * dir_iterate of nested overlayfs: 790 * 791 * [...] &ovl_i_mutex_dir_key[depth] (stack_depth=2) 792 * [...] &ovl_i_mutex_dir_key[depth]#2 (stack_depth=1) 793 * [...] &type->i_mutex_dir_key (stack_depth=0) 794 * 795 * Locking order w.r.t ovl_want_write() is important for nested overlayfs. 796 * 797 * This chain is valid: 798 * - inode->i_rwsem (inode_lock[2]) 799 * - upper_mnt->mnt_sb->s_writers (ovl_want_write[0]) 800 * - OVL_I(inode)->lock (ovl_inode_lock[2]) 801 * - OVL_I(lowerinode)->lock (ovl_inode_lock[1]) 802 * 803 * And this chain is valid: 804 * - inode->i_rwsem (inode_lock[2]) 805 * - OVL_I(inode)->lock (ovl_inode_lock[2]) 806 * - lowerinode->i_rwsem (inode_lock[1]) 807 * - OVL_I(lowerinode)->lock (ovl_inode_lock[1]) 808 * 809 * But lowerinode->i_rwsem SHOULD NOT be acquired while ovl_want_write() is 810 * held, because it is in reverse order of the non-nested case using the same 811 * upper fs: 812 * - inode->i_rwsem (inode_lock[1]) 813 * - upper_mnt->mnt_sb->s_writers (ovl_want_write[0]) 814 * - OVL_I(inode)->lock (ovl_inode_lock[1]) 815 */ 816#define OVL_MAX_NESTING FILESYSTEM_MAX_STACK_DEPTH 817 818static inline void ovl_lockdep_annotate_inode_mutex_key(struct inode *inode) 819{ 820#ifdef CONFIG_LOCKDEP 821 static struct lock_class_key ovl_i_mutex_key[OVL_MAX_NESTING]; 822 static struct lock_class_key ovl_i_mutex_dir_key[OVL_MAX_NESTING]; 823 static struct lock_class_key ovl_i_lock_key[OVL_MAX_NESTING]; 824 825 int depth = inode->i_sb->s_stack_depth - 1; 826 827 if (WARN_ON_ONCE(depth < 0 || depth >= OVL_MAX_NESTING)) 828 depth = 0; 829 830 if (S_ISDIR(inode->i_mode)) 831 lockdep_set_class(&inode->i_rwsem, &ovl_i_mutex_dir_key[depth]); 832 else 833 lockdep_set_class(&inode->i_rwsem, &ovl_i_mutex_key[depth]); 834 835 lockdep_set_class(&OVL_I(inode)->lock, &ovl_i_lock_key[depth]); 836#endif 837} 838 839static void ovl_next_ino(struct inode *inode) 840{ 841 struct ovl_fs *ofs = OVL_FS(inode->i_sb); 842 843 inode->i_ino = atomic_long_inc_return(&ofs->last_ino); 844 if (unlikely(!inode->i_ino)) 845 inode->i_ino = atomic_long_inc_return(&ofs->last_ino); 846} 847 848static void ovl_map_ino(struct inode *inode, unsigned long ino, int fsid) 849{ 850 struct ovl_fs *ofs = OVL_FS(inode->i_sb); 851 int xinobits = ovl_xino_bits(ofs); 852 unsigned int xinoshift = 64 - xinobits; 853 854 /* 855 * When d_ino is consistent with st_ino (samefs or i_ino has enough 856 * bits to encode layer), set the same value used for st_ino to i_ino, 857 * so inode number exposed via /proc/locks and a like will be 858 * consistent with d_ino and st_ino values. An i_ino value inconsistent 859 * with d_ino also causes nfsd readdirplus to fail. 860 */ 861 inode->i_ino = ino; 862 if (ovl_same_fs(ofs)) { 863 return; 864 } else if (xinobits && likely(!(ino >> xinoshift))) { 865 inode->i_ino |= (unsigned long)fsid << (xinoshift + 1); 866 return; 867 } 868 869 /* 870 * For directory inodes on non-samefs with xino disabled or xino 871 * overflow, we allocate a non-persistent inode number, to be used for 872 * resolving st_ino collisions in ovl_map_dev_ino(). 873 * 874 * To avoid ino collision with legitimate xino values from upper 875 * layer (fsid 0), use the lowest xinobit to map the non 876 * persistent inode numbers to the unified st_ino address space. 877 */ 878 if (S_ISDIR(inode->i_mode)) { 879 ovl_next_ino(inode); 880 if (xinobits) { 881 inode->i_ino &= ~0UL >> xinobits; 882 inode->i_ino |= 1UL << xinoshift; 883 } 884 } 885} 886 887void ovl_inode_init(struct inode *inode, struct ovl_inode_params *oip, 888 unsigned long ino, int fsid) 889{ 890 struct inode *realinode; 891 struct ovl_inode *oi = OVL_I(inode); 892 893 oi->__upperdentry = oip->upperdentry; 894 oi->oe = oip->oe; 895 oi->redirect = oip->redirect; 896 oi->lowerdata_redirect = oip->lowerdata_redirect; 897 898 realinode = ovl_inode_real(inode); 899 ovl_copyattr(inode); 900 ovl_copyflags(realinode, inode); 901 ovl_map_ino(inode, ino, fsid); 902} 903 904static void ovl_fill_inode(struct inode *inode, umode_t mode, dev_t rdev) 905{ 906 inode->i_mode = mode; 907 inode->i_flags |= S_NOCMTIME; 908#ifdef CONFIG_FS_POSIX_ACL 909 inode->i_acl = inode->i_default_acl = ACL_DONT_CACHE; 910#endif 911 912 ovl_lockdep_annotate_inode_mutex_key(inode); 913 914 switch (mode & S_IFMT) { 915 case S_IFREG: 916 inode->i_op = &ovl_file_inode_operations; 917 inode->i_fop = &ovl_file_operations; 918 inode->i_mapping->a_ops = &ovl_aops; 919 break; 920 921 case S_IFDIR: 922 inode->i_op = &ovl_dir_inode_operations; 923 inode->i_fop = &ovl_dir_operations; 924 break; 925 926 case S_IFLNK: 927 inode->i_op = &ovl_symlink_inode_operations; 928 break; 929 930 default: 931 inode->i_op = &ovl_special_inode_operations; 932 init_special_inode(inode, mode, rdev); 933 break; 934 } 935} 936 937/* 938 * With inodes index enabled, an overlay inode nlink counts the union of upper 939 * hardlinks and non-covered lower hardlinks. During the lifetime of a non-pure 940 * upper inode, the following nlink modifying operations can happen: 941 * 942 * 1. Lower hardlink copy up 943 * 2. Upper hardlink created, unlinked or renamed over 944 * 3. Lower hardlink whiteout or renamed over 945 * 946 * For the first, copy up case, the union nlink does not change, whether the 947 * operation succeeds or fails, but the upper inode nlink may change. 948 * Therefore, before copy up, we store the union nlink value relative to the 949 * lower inode nlink in the index inode xattr .overlay.nlink. 950 * 951 * For the second, upper hardlink case, the union nlink should be incremented 952 * or decremented IFF the operation succeeds, aligned with nlink change of the 953 * upper inode. Therefore, before link/unlink/rename, we store the union nlink 954 * value relative to the upper inode nlink in the index inode. 955 * 956 * For the last, lower cover up case, we simplify things by preceding the 957 * whiteout or cover up with copy up. This makes sure that there is an index 958 * upper inode where the nlink xattr can be stored before the copied up upper 959 * entry is unlink. 960 */ 961#define OVL_NLINK_ADD_UPPER (1 << 0) 962 963/* 964 * On-disk format for indexed nlink: 965 * 966 * nlink relative to the upper inode - "U[+-]NUM" 967 * nlink relative to the lower inode - "L[+-]NUM" 968 */ 969 970static int ovl_set_nlink_common(struct dentry *dentry, 971 struct dentry *realdentry, const char *format) 972{ 973 struct inode *inode = d_inode(dentry); 974 struct inode *realinode = d_inode(realdentry); 975 char buf[13]; 976 int len; 977 978 len = snprintf(buf, sizeof(buf), format, 979 (int) (inode->i_nlink - realinode->i_nlink)); 980 981 if (WARN_ON(len >= sizeof(buf))) 982 return -EIO; 983 984 return ovl_setxattr(OVL_FS(inode->i_sb), ovl_dentry_upper(dentry), 985 OVL_XATTR_NLINK, buf, len); 986} 987 988int ovl_set_nlink_upper(struct dentry *dentry) 989{ 990 return ovl_set_nlink_common(dentry, ovl_dentry_upper(dentry), "U%+i"); 991} 992 993int ovl_set_nlink_lower(struct dentry *dentry) 994{ 995 return ovl_set_nlink_common(dentry, ovl_dentry_lower(dentry), "L%+i"); 996} 997 998unsigned int ovl_get_nlink(struct ovl_fs *ofs, struct dentry *lowerdentry, 999 struct dentry *upperdentry, 1000 unsigned int fallback) 1001{ 1002 int nlink_diff; 1003 int nlink; 1004 char buf[13]; 1005 int err; 1006 1007 if (!lowerdentry || !upperdentry || d_inode(lowerdentry)->i_nlink == 1) 1008 return fallback; 1009 1010 err = ovl_getxattr_upper(ofs, upperdentry, OVL_XATTR_NLINK, 1011 &buf, sizeof(buf) - 1); 1012 if (err < 0) 1013 goto fail; 1014 1015 buf[err] = '\0'; 1016 if ((buf[0] != 'L' && buf[0] != 'U') || 1017 (buf[1] != '+' && buf[1] != '-')) 1018 goto fail; 1019 1020 err = kstrtoint(buf + 1, 10, &nlink_diff); 1021 if (err < 0) 1022 goto fail; 1023 1024 nlink = d_inode(buf[0] == 'L' ? lowerdentry : upperdentry)->i_nlink; 1025 nlink += nlink_diff; 1026 1027 if (nlink <= 0) 1028 goto fail; 1029 1030 return nlink; 1031 1032fail: 1033 pr_warn_ratelimited("failed to get index nlink (%pd2, err=%i)\n", 1034 upperdentry, err); 1035 return fallback; 1036} 1037 1038struct inode *ovl_new_inode(struct super_block *sb, umode_t mode, dev_t rdev) 1039{ 1040 struct inode *inode; 1041 1042 inode = new_inode(sb); 1043 if (inode) 1044 ovl_fill_inode(inode, mode, rdev); 1045 1046 return inode; 1047} 1048 1049static int ovl_inode_test(struct inode *inode, void *data) 1050{ 1051 return inode->i_private == data; 1052} 1053 1054static int ovl_inode_set(struct inode *inode, void *data) 1055{ 1056 inode->i_private = data; 1057 return 0; 1058} 1059 1060static bool ovl_verify_inode(struct inode *inode, struct dentry *lowerdentry, 1061 struct dentry *upperdentry, bool strict) 1062{ 1063 /* 1064 * For directories, @strict verify from lookup path performs consistency 1065 * checks, so NULL lower/upper in dentry must match NULL lower/upper in 1066 * inode. Non @strict verify from NFS handle decode path passes NULL for 1067 * 'unknown' lower/upper. 1068 */ 1069 if (S_ISDIR(inode->i_mode) && strict) { 1070 /* Real lower dir moved to upper layer under us? */ 1071 if (!lowerdentry && ovl_inode_lower(inode)) 1072 return false; 1073 1074 /* Lookup of an uncovered redirect origin? */ 1075 if (!upperdentry && ovl_inode_upper(inode)) 1076 return false; 1077 } 1078 1079 /* 1080 * Allow non-NULL lower inode in ovl_inode even if lowerdentry is NULL. 1081 * This happens when finding a copied up overlay inode for a renamed 1082 * or hardlinked overlay dentry and lower dentry cannot be followed 1083 * by origin because lower fs does not support file handles. 1084 */ 1085 if (lowerdentry && ovl_inode_lower(inode) != d_inode(lowerdentry)) 1086 return false; 1087 1088 /* 1089 * Allow non-NULL __upperdentry in inode even if upperdentry is NULL. 1090 * This happens when finding a lower alias for a copied up hard link. 1091 */ 1092 if (upperdentry && ovl_inode_upper(inode) != d_inode(upperdentry)) 1093 return false; 1094 1095 return true; 1096} 1097 1098struct inode *ovl_lookup_inode(struct super_block *sb, struct dentry *real, 1099 bool is_upper) 1100{ 1101 struct inode *inode, *key = d_inode(real); 1102 1103 inode = ilookup5(sb, (unsigned long) key, ovl_inode_test, key); 1104 if (!inode) 1105 return NULL; 1106 1107 if (!ovl_verify_inode(inode, is_upper ? NULL : real, 1108 is_upper ? real : NULL, false)) { 1109 iput(inode); 1110 return ERR_PTR(-ESTALE); 1111 } 1112 1113 return inode; 1114} 1115 1116bool ovl_lookup_trap_inode(struct super_block *sb, struct dentry *dir) 1117{ 1118 struct inode *key = d_inode(dir); 1119 struct inode *trap; 1120 bool res; 1121 1122 trap = ilookup5(sb, (unsigned long) key, ovl_inode_test, key); 1123 if (!trap) 1124 return false; 1125 1126 res = IS_DEADDIR(trap) && !ovl_inode_upper(trap) && 1127 !ovl_inode_lower(trap); 1128 1129 iput(trap); 1130 return res; 1131} 1132 1133/* 1134 * Create an inode cache entry for layer root dir, that will intentionally 1135 * fail ovl_verify_inode(), so any lookup that will find some layer root 1136 * will fail. 1137 */ 1138struct inode *ovl_get_trap_inode(struct super_block *sb, struct dentry *dir) 1139{ 1140 struct inode *key = d_inode(dir); 1141 struct inode *trap; 1142 1143 if (!d_is_dir(dir)) 1144 return ERR_PTR(-ENOTDIR); 1145 1146 trap = iget5_locked(sb, (unsigned long) key, ovl_inode_test, 1147 ovl_inode_set, key); 1148 if (!trap) 1149 return ERR_PTR(-ENOMEM); 1150 1151 if (!(trap->i_state & I_NEW)) { 1152 /* Conflicting layer roots? */ 1153 iput(trap); 1154 return ERR_PTR(-ELOOP); 1155 } 1156 1157 trap->i_mode = S_IFDIR; 1158 trap->i_flags = S_DEAD; 1159 unlock_new_inode(trap); 1160 1161 return trap; 1162} 1163 1164/* 1165 * Does overlay inode need to be hashed by lower inode? 1166 */ 1167static bool ovl_hash_bylower(struct super_block *sb, struct dentry *upper, 1168 struct dentry *lower, bool index) 1169{ 1170 struct ovl_fs *ofs = OVL_FS(sb); 1171 1172 /* No, if pure upper */ 1173 if (!lower) 1174 return false; 1175 1176 /* Yes, if already indexed */ 1177 if (index) 1178 return true; 1179 1180 /* Yes, if won't be copied up */ 1181 if (!ovl_upper_mnt(ofs)) 1182 return true; 1183 1184 /* No, if lower hardlink is or will be broken on copy up */ 1185 if ((upper || !ovl_indexdir(sb)) && 1186 !d_is_dir(lower) && d_inode(lower)->i_nlink > 1) 1187 return false; 1188 1189 /* No, if non-indexed upper with NFS export */ 1190 if (ofs->config.nfs_export && upper) 1191 return false; 1192 1193 /* Otherwise, hash by lower inode for fsnotify */ 1194 return true; 1195} 1196 1197static struct inode *ovl_iget5(struct super_block *sb, struct inode *newinode, 1198 struct inode *key) 1199{ 1200 return newinode ? inode_insert5(newinode, (unsigned long) key, 1201 ovl_inode_test, ovl_inode_set, key) : 1202 iget5_locked(sb, (unsigned long) key, 1203 ovl_inode_test, ovl_inode_set, key); 1204} 1205 1206struct inode *ovl_get_inode(struct super_block *sb, 1207 struct ovl_inode_params *oip) 1208{ 1209 struct ovl_fs *ofs = OVL_FS(sb); 1210 struct dentry *upperdentry = oip->upperdentry; 1211 struct ovl_path *lowerpath = ovl_lowerpath(oip->oe); 1212 struct inode *realinode = upperdentry ? d_inode(upperdentry) : NULL; 1213 struct inode *inode; 1214 struct dentry *lowerdentry = lowerpath ? lowerpath->dentry : NULL; 1215 struct path realpath = { 1216 .dentry = upperdentry ?: lowerdentry, 1217 .mnt = upperdentry ? ovl_upper_mnt(ofs) : lowerpath->layer->mnt, 1218 }; 1219 bool bylower = ovl_hash_bylower(sb, upperdentry, lowerdentry, 1220 oip->index); 1221 int fsid = bylower ? lowerpath->layer->fsid : 0; 1222 bool is_dir; 1223 unsigned long ino = 0; 1224 int err = oip->newinode ? -EEXIST : -ENOMEM; 1225 1226 if (!realinode) 1227 realinode = d_inode(lowerdentry); 1228 1229 /* 1230 * Copy up origin (lower) may exist for non-indexed upper, but we must 1231 * not use lower as hash key if this is a broken hardlink. 1232 */ 1233 is_dir = S_ISDIR(realinode->i_mode); 1234 if (upperdentry || bylower) { 1235 struct inode *key = d_inode(bylower ? lowerdentry : 1236 upperdentry); 1237 unsigned int nlink = is_dir ? 1 : realinode->i_nlink; 1238 1239 inode = ovl_iget5(sb, oip->newinode, key); 1240 if (!inode) 1241 goto out_err; 1242 if (!(inode->i_state & I_NEW)) { 1243 /* 1244 * Verify that the underlying files stored in the inode 1245 * match those in the dentry. 1246 */ 1247 if (!ovl_verify_inode(inode, lowerdentry, upperdentry, 1248 true)) { 1249 iput(inode); 1250 err = -ESTALE; 1251 goto out_err; 1252 } 1253 1254 dput(upperdentry); 1255 ovl_free_entry(oip->oe); 1256 kfree(oip->redirect); 1257 kfree(oip->lowerdata_redirect); 1258 goto out; 1259 } 1260 1261 /* Recalculate nlink for non-dir due to indexing */ 1262 if (!is_dir) 1263 nlink = ovl_get_nlink(ofs, lowerdentry, upperdentry, 1264 nlink); 1265 set_nlink(inode, nlink); 1266 ino = key->i_ino; 1267 } else { 1268 /* Lower hardlink that will be broken on copy up */ 1269 inode = new_inode(sb); 1270 if (!inode) { 1271 err = -ENOMEM; 1272 goto out_err; 1273 } 1274 ino = realinode->i_ino; 1275 fsid = lowerpath->layer->fsid; 1276 } 1277 ovl_fill_inode(inode, realinode->i_mode, realinode->i_rdev); 1278 ovl_inode_init(inode, oip, ino, fsid); 1279 1280 if (upperdentry && ovl_is_impuredir(sb, upperdentry)) 1281 ovl_set_flag(OVL_IMPURE, inode); 1282 1283 if (oip->index) 1284 ovl_set_flag(OVL_INDEX, inode); 1285 1286 if (bylower) 1287 ovl_set_flag(OVL_CONST_INO, inode); 1288 1289 /* Check for non-merge dir that may have whiteouts */ 1290 if (is_dir) { 1291 if (((upperdentry && lowerdentry) || ovl_numlower(oip->oe) > 1) || 1292 ovl_path_check_origin_xattr(ofs, &realpath)) { 1293 ovl_set_flag(OVL_WHITEOUTS, inode); 1294 } 1295 } 1296 1297 /* Check for immutable/append-only inode flags in xattr */ 1298 if (upperdentry) 1299 ovl_check_protattr(inode, upperdentry); 1300 1301 if (inode->i_state & I_NEW) 1302 unlock_new_inode(inode); 1303out: 1304 return inode; 1305 1306out_err: 1307 pr_warn_ratelimited("failed to get inode (%i)\n", err); 1308 inode = ERR_PTR(err); 1309 goto out; 1310} 1311