1 // SPDX-License-Identifier: GPL-2.0 <<
2 #include <linux/syscalls.h> 1 #include <linux/syscalls.h>
3 #include <linux/slab.h> 2 #include <linux/slab.h>
4 #include <linux/fs.h> 3 #include <linux/fs.h>
5 #include <linux/file.h> 4 #include <linux/file.h>
6 #include <linux/mount.h> 5 #include <linux/mount.h>
7 #include <linux/namei.h> 6 #include <linux/namei.h>
8 #include <linux/exportfs.h> 7 #include <linux/exportfs.h>
9 #include <linux/fs_struct.h> 8 #include <linux/fs_struct.h>
10 #include <linux/fsnotify.h> 9 #include <linux/fsnotify.h>
11 #include <linux/personality.h> 10 #include <linux/personality.h>
12 #include <linux/uaccess.h> !! 11 #include <asm/uaccess.h>
13 #include <linux/compat.h> <<
14 #include "internal.h" 12 #include "internal.h"
15 #include "mount.h" 13 #include "mount.h"
16 14
17 static long do_sys_name_to_handle(const struct !! 15 static long do_sys_name_to_handle(struct path *path,
18 struct file_ 16 struct file_handle __user *ufh,
19 void __user !! 17 int __user *mnt_id)
20 int fh_flags <<
21 { 18 {
22 long retval; 19 long retval;
23 struct file_handle f_handle; 20 struct file_handle f_handle;
24 int handle_dwords, handle_bytes; 21 int handle_dwords, handle_bytes;
25 struct file_handle *handle = NULL; 22 struct file_handle *handle = NULL;
26 23
27 /* 24 /*
28 * We need to make sure whether the fi !! 25 * We need to make sure whether the file system
29 * the file handle if decodeable file !! 26 * support decoding of the file handle
30 */ 27 */
31 if (!exportfs_can_encode_fh(path->dent !! 28 if (!path->dentry->d_sb->s_export_op ||
>> 29 !path->dentry->d_sb->s_export_op->fh_to_dentry)
32 return -EOPNOTSUPP; 30 return -EOPNOTSUPP;
33 31
34 if (copy_from_user(&f_handle, ufh, siz 32 if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle)))
35 return -EFAULT; 33 return -EFAULT;
36 34
37 if (f_handle.handle_bytes > MAX_HANDLE 35 if (f_handle.handle_bytes > MAX_HANDLE_SZ)
38 return -EINVAL; 36 return -EINVAL;
39 37
40 handle = kzalloc(struct_size(handle, f !! 38 handle = kmalloc(sizeof(struct file_handle) + f_handle.handle_bytes,
41 GFP_KERNEL); 39 GFP_KERNEL);
42 if (!handle) 40 if (!handle)
43 return -ENOMEM; 41 return -ENOMEM;
44 42
45 /* convert handle size to multiple of 43 /* convert handle size to multiple of sizeof(u32) */
46 handle_dwords = f_handle.handle_bytes 44 handle_dwords = f_handle.handle_bytes >> 2;
47 45
48 /* we ask for a non connectable maybe !! 46 /* we ask for a non connected handle */
49 retval = exportfs_encode_fh(path->dent 47 retval = exportfs_encode_fh(path->dentry,
50 (struct fi 48 (struct fid *)handle->f_handle,
51 &handle_dw !! 49 &handle_dwords, 0);
52 handle->handle_type = retval; 50 handle->handle_type = retval;
53 /* convert handle size to bytes */ 51 /* convert handle size to bytes */
54 handle_bytes = handle_dwords * sizeof( 52 handle_bytes = handle_dwords * sizeof(u32);
55 handle->handle_bytes = handle_bytes; 53 handle->handle_bytes = handle_bytes;
56 if ((handle->handle_bytes > f_handle.h 54 if ((handle->handle_bytes > f_handle.handle_bytes) ||
57 (retval == FILEID_INVALID) || (ret !! 55 (retval == FILEID_INVALID) || (retval == -ENOSPC)) {
58 /* As per old exportfs_encode_ 56 /* As per old exportfs_encode_fh documentation
59 * we could return ENOSPC to i 57 * we could return ENOSPC to indicate overflow
60 * But file system returned 25 58 * But file system returned 255 always. So handle
61 * both the values 59 * both the values
62 */ 60 */
63 if (retval == FILEID_INVALID | <<
64 retval = -EOVERFLOW; <<
65 /* 61 /*
66 * set the handle size to zero 62 * set the handle size to zero so we copy only
67 * non variable part of the fi 63 * non variable part of the file_handle
68 */ 64 */
69 handle_bytes = 0; 65 handle_bytes = 0;
>> 66 retval = -EOVERFLOW;
70 } else 67 } else
71 retval = 0; 68 retval = 0;
72 /* copy the mount id */ 69 /* copy the mount id */
73 if (unique_mntid) { !! 70 if (copy_to_user(mnt_id, &real_mount(path->mnt)->mnt_id,
74 if (put_user(real_mount(path-> !! 71 sizeof(*mnt_id)) ||
75 (u64 __user *) mn !! 72 copy_to_user(ufh, handle,
76 retval = -EFAULT; !! 73 sizeof(struct file_handle) + handle_bytes))
77 } else { <<
78 if (put_user(real_mount(path-> <<
79 (int __user *) mn <<
80 retval = -EFAULT; <<
81 } <<
82 /* copy the handle */ <<
83 if (retval != -EFAULT && <<
84 copy_to_user(ufh, handle, <<
85 struct_size(handl <<
86 retval = -EFAULT; 74 retval = -EFAULT;
87 kfree(handle); 75 kfree(handle);
88 return retval; 76 return retval;
89 } 77 }
90 78
91 /** 79 /**
92 * sys_name_to_handle_at: convert name to hand 80 * sys_name_to_handle_at: convert name to handle
93 * @dfd: directory relative to which name is i 81 * @dfd: directory relative to which name is interpreted if not absolute
94 * @name: name that should be converted to han 82 * @name: name that should be converted to handle.
95 * @handle: resulting file handle 83 * @handle: resulting file handle
96 * @mnt_id: mount id of the file system contai 84 * @mnt_id: mount id of the file system containing the file
97 * (u64 if AT_HANDLE_MNT_ID_UNIQUE, o <<
98 * @flag: flag value to indicate whether to fo 85 * @flag: flag value to indicate whether to follow symlink or not
99 * and whether a decodable file handle <<
100 * 86 *
101 * @handle->handle_size indicate the space ava 87 * @handle->handle_size indicate the space available to store the
102 * variable part of the file handle in bytes. 88 * variable part of the file handle in bytes. If there is not
103 * enough space, the field is updated to retur 89 * enough space, the field is updated to return the minimum
104 * value required. 90 * value required.
105 */ 91 */
106 SYSCALL_DEFINE5(name_to_handle_at, int, dfd, c 92 SYSCALL_DEFINE5(name_to_handle_at, int, dfd, const char __user *, name,
107 struct file_handle __user *, h !! 93 struct file_handle __user *, handle, int __user *, mnt_id,
108 int, flag) 94 int, flag)
109 { 95 {
110 struct path path; 96 struct path path;
111 int lookup_flags; 97 int lookup_flags;
112 int fh_flags; <<
113 int err; 98 int err;
114 99
115 if (flag & ~(AT_SYMLINK_FOLLOW | AT_EM !! 100 if ((flag & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
116 AT_HANDLE_MNT_ID_UNIQUE)) <<
117 return -EINVAL; 101 return -EINVAL;
118 102
119 lookup_flags = (flag & AT_SYMLINK_FOLL 103 lookup_flags = (flag & AT_SYMLINK_FOLLOW) ? LOOKUP_FOLLOW : 0;
120 fh_flags = (flag & AT_HANDLE_FID) ? EX <<
121 if (flag & AT_EMPTY_PATH) 104 if (flag & AT_EMPTY_PATH)
122 lookup_flags |= LOOKUP_EMPTY; 105 lookup_flags |= LOOKUP_EMPTY;
123 err = user_path_at(dfd, name, lookup_f 106 err = user_path_at(dfd, name, lookup_flags, &path);
124 if (!err) { 107 if (!err) {
125 err = do_sys_name_to_handle(&p !! 108 err = do_sys_name_to_handle(&path, handle, mnt_id);
126 fl <<
127 fh <<
128 path_put(&path); 109 path_put(&path);
129 } 110 }
130 return err; 111 return err;
131 } 112 }
132 113
133 static int get_path_from_fd(int fd, struct pat !! 114 static struct vfsmount *get_vfsmount_from_fd(int fd)
134 { 115 {
>> 116 struct vfsmount *mnt;
>> 117
135 if (fd == AT_FDCWD) { 118 if (fd == AT_FDCWD) {
136 struct fs_struct *fs = current 119 struct fs_struct *fs = current->fs;
137 spin_lock(&fs->lock); 120 spin_lock(&fs->lock);
138 *root = fs->pwd; !! 121 mnt = mntget(fs->pwd.mnt);
139 path_get(root); <<
140 spin_unlock(&fs->lock); 122 spin_unlock(&fs->lock);
141 } else { 123 } else {
142 struct fd f = fdget(fd); 124 struct fd f = fdget(fd);
143 if (!fd_file(f)) !! 125 if (!f.file)
144 return -EBADF; !! 126 return ERR_PTR(-EBADF);
145 *root = fd_file(f)->f_path; !! 127 mnt = mntget(f.file->f_path.mnt);
146 path_get(root); <<
147 fdput(f); 128 fdput(f);
148 } 129 }
149 !! 130 return mnt;
150 return 0; <<
151 } 131 }
152 132
153 enum handle_to_path_flags { <<
154 HANDLE_CHECK_PERMS = (1 << 0), <<
155 HANDLE_CHECK_SUBTREE = (1 << 1), <<
156 }; <<
157 <<
158 struct handle_to_path_ctx { <<
159 struct path root; <<
160 enum handle_to_path_flags flags; <<
161 unsigned int fh_flags; <<
162 }; <<
163 <<
164 static int vfs_dentry_acceptable(void *context 133 static int vfs_dentry_acceptable(void *context, struct dentry *dentry)
165 { 134 {
166 struct handle_to_path_ctx *ctx = conte !! 135 return 1;
167 struct user_namespace *user_ns = curre <<
168 struct dentry *d, *root = ctx->root.de <<
169 struct mnt_idmap *idmap = mnt_idmap(ct <<
170 int retval = 0; <<
171 <<
172 if (!root) <<
173 return 1; <<
174 <<
175 /* Old permission model with global CA <<
176 if (!ctx->flags) <<
177 return 1; <<
178 <<
179 /* <<
180 * It's racy as we're not taking renam <<
181 * permissions and we just need an app <<
182 * to follow a path to the file. <<
183 * <<
184 * It's also potentially expensive on <<
185 * there is a deep path. <<
186 */ <<
187 d = dget(dentry); <<
188 while (d != root && !IS_ROOT(d)) { <<
189 struct dentry *parent = dget_p <<
190 <<
191 /* <<
192 * We know that we have the ab <<
193 * as we've verified this earl <<
194 * we also need to make sure t <<
195 * inodes in the path that wou <<
196 * file. <<
197 */ <<
198 if (!privileged_wrt_inode_uidg <<
199 <<
200 dput(d); <<
201 dput(parent); <<
202 return retval; <<
203 } <<
204 <<
205 dput(d); <<
206 d = parent; <<
207 } <<
208 <<
209 if (!(ctx->flags & HANDLE_CHECK_SUBTRE <<
210 retval = 1; <<
211 WARN_ON_ONCE(d != root && d != root->d <<
212 dput(d); <<
213 return retval; <<
214 } 136 }
215 137
216 static int do_handle_to_path(struct file_handl !! 138 static int do_handle_to_path(int mountdirfd, struct file_handle *handle,
217 struct handle_to_ !! 139 struct path *path)
218 { 140 {
>> 141 int retval = 0;
219 int handle_dwords; 142 int handle_dwords;
220 struct vfsmount *mnt = ctx->root.mnt; <<
221 143
>> 144 path->mnt = get_vfsmount_from_fd(mountdirfd);
>> 145 if (IS_ERR(path->mnt)) {
>> 146 retval = PTR_ERR(path->mnt);
>> 147 goto out_err;
>> 148 }
222 /* change the handle size to multiple 149 /* change the handle size to multiple of sizeof(u32) */
223 handle_dwords = handle->handle_bytes > 150 handle_dwords = handle->handle_bytes >> 2;
224 path->dentry = exportfs_decode_fh_raw( !! 151 path->dentry = exportfs_decode_fh(path->mnt,
225 (str 152 (struct fid *)handle->f_handle,
226 hand 153 handle_dwords, handle->handle_type,
227 ctx- !! 154 vfs_dentry_acceptable, NULL);
228 vfs_ !! 155 if (IS_ERR(path->dentry)) {
229 if (IS_ERR_OR_NULL(path->dentry)) { !! 156 retval = PTR_ERR(path->dentry);
230 if (path->dentry == ERR_PTR(-E !! 157 goto out_mnt;
231 return -ENOMEM; <<
232 return -ESTALE; <<
233 } 158 }
234 path->mnt = mntget(mnt); <<
235 return 0; 159 return 0;
236 } !! 160 out_mnt:
237 !! 161 mntput(path->mnt);
238 /* !! 162 out_err:
239 * Allow relaxed permissions of file handles i !! 163 return retval;
240 * ability to mount the filesystem or create a <<
241 * provided @mountdirfd. <<
242 * <<
243 * In both cases the caller may be able to get <<
244 * the encoded file handle. If the caller is o <<
245 * bind-mount we need to verify that there are <<
246 * of it that could prevent us from getting to <<
247 * <<
248 * In principle, locked mounts can prevent the <<
249 * filesystem but that only applies to procfs <<
250 * support decoding file handles. <<
251 */ <<
252 static inline bool may_decode_fh(struct handle <<
253 unsigned int <<
254 { <<
255 struct path *root = &ctx->root; <<
256 <<
257 /* <<
258 * Restrict to O_DIRECTORY to provide <<
259 * confusing api in the face of discon <<
260 * <<
261 * There's only one dentry for each di <<
262 */ <<
263 if (!(o_flags & O_DIRECTORY)) <<
264 return false; <<
265 <<
266 if (ns_capable(root->mnt->mnt_sb->s_us <<
267 ctx->flags = HANDLE_CHECK_PERM <<
268 else if (is_mounted(root->mnt) && <<
269 ns_capable(real_mount(root->m <<
270 CAP_SYS_ADMIN) && <<
271 !has_locked_children(real_mou <<
272 ctx->flags = HANDLE_CHECK_PERM <<
273 else <<
274 return false; <<
275 <<
276 /* Are we able to override DAC permiss <<
277 if (!ns_capable(current_user_ns(), CAP <<
278 return false; <<
279 <<
280 ctx->fh_flags = EXPORT_FH_DIR_ONLY; <<
281 return true; <<
282 } 164 }
283 165
284 static int handle_to_path(int mountdirfd, stru 166 static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
285 struct path *path, unsigned !! 167 struct path *path)
286 { 168 {
287 int retval = 0; 169 int retval = 0;
288 struct file_handle f_handle; 170 struct file_handle f_handle;
289 struct file_handle *handle = NULL; 171 struct file_handle *handle = NULL;
290 struct handle_to_path_ctx ctx = {}; <<
291 <<
292 retval = get_path_from_fd(mountdirfd, <<
293 if (retval) <<
294 goto out_err; <<
295 172
296 if (!capable(CAP_DAC_READ_SEARCH) && ! !! 173 /*
>> 174 * With handle we don't look at the execute bit on the
>> 175 * the directory. Ideally we would like CAP_DAC_SEARCH.
>> 176 * But we don't have that
>> 177 */
>> 178 if (!capable(CAP_DAC_READ_SEARCH)) {
297 retval = -EPERM; 179 retval = -EPERM;
298 goto out_path; !! 180 goto out_err;
299 } 181 }
300 <<
301 if (copy_from_user(&f_handle, ufh, siz 182 if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle))) {
302 retval = -EFAULT; 183 retval = -EFAULT;
303 goto out_path; !! 184 goto out_err;
304 } 185 }
305 if ((f_handle.handle_bytes > MAX_HANDL 186 if ((f_handle.handle_bytes > MAX_HANDLE_SZ) ||
306 (f_handle.handle_bytes == 0)) { 187 (f_handle.handle_bytes == 0)) {
307 retval = -EINVAL; 188 retval = -EINVAL;
308 goto out_path; !! 189 goto out_err;
309 } 190 }
310 handle = kmalloc(struct_size(handle, f !! 191 handle = kmalloc(sizeof(struct file_handle) + f_handle.handle_bytes,
311 GFP_KERNEL); 192 GFP_KERNEL);
312 if (!handle) { 193 if (!handle) {
313 retval = -ENOMEM; 194 retval = -ENOMEM;
314 goto out_path; !! 195 goto out_err;
315 } 196 }
316 /* copy the full handle */ 197 /* copy the full handle */
317 *handle = f_handle; 198 *handle = f_handle;
318 if (copy_from_user(&handle->f_handle, 199 if (copy_from_user(&handle->f_handle,
319 &ufh->f_handle, 200 &ufh->f_handle,
320 f_handle.handle_byt 201 f_handle.handle_bytes)) {
321 retval = -EFAULT; 202 retval = -EFAULT;
322 goto out_handle; 203 goto out_handle;
323 } 204 }
324 205
325 retval = do_handle_to_path(handle, pat !! 206 retval = do_handle_to_path(mountdirfd, handle, path);
326 207
327 out_handle: 208 out_handle:
328 kfree(handle); 209 kfree(handle);
329 out_path: <<
330 path_put(&ctx.root); <<
331 out_err: 210 out_err:
332 return retval; 211 return retval;
333 } 212 }
334 213
335 static long do_handle_open(int mountdirfd, str !! 214 long do_handle_open(int mountdirfd,
336 int open_flag) !! 215 struct file_handle __user *ufh, int open_flag)
337 { 216 {
338 long retval = 0; 217 long retval = 0;
339 struct path path; 218 struct path path;
340 struct file *file; 219 struct file *file;
341 int fd; 220 int fd;
342 221
343 retval = handle_to_path(mountdirfd, uf !! 222 retval = handle_to_path(mountdirfd, ufh, &path);
344 if (retval) 223 if (retval)
345 return retval; 224 return retval;
346 225
347 fd = get_unused_fd_flags(open_flag); 226 fd = get_unused_fd_flags(open_flag);
348 if (fd < 0) { 227 if (fd < 0) {
349 path_put(&path); 228 path_put(&path);
350 return fd; 229 return fd;
351 } 230 }
352 file = file_open_root(&path, "", open_ !! 231 file = file_open_root(path.dentry, path.mnt, "", open_flag);
353 if (IS_ERR(file)) { 232 if (IS_ERR(file)) {
354 put_unused_fd(fd); 233 put_unused_fd(fd);
355 retval = PTR_ERR(file); 234 retval = PTR_ERR(file);
356 } else { 235 } else {
357 retval = fd; 236 retval = fd;
>> 237 fsnotify_open(file);
358 fd_install(fd, file); 238 fd_install(fd, file);
359 } 239 }
360 path_put(&path); 240 path_put(&path);
361 return retval; 241 return retval;
362 } 242 }
363 243
364 /** 244 /**
365 * sys_open_by_handle_at: Open the file handle 245 * sys_open_by_handle_at: Open the file handle
366 * @mountdirfd: directory file descriptor 246 * @mountdirfd: directory file descriptor
367 * @handle: file handle to be opened 247 * @handle: file handle to be opened
368 * @flags: open flags. !! 248 * @flag: open flags.
369 * 249 *
370 * @mountdirfd indicate the directory file des 250 * @mountdirfd indicate the directory file descriptor
371 * of the mount point. file handle is decoded 251 * of the mount point. file handle is decoded relative
372 * to the vfsmount pointed by the @mountdirfd. 252 * to the vfsmount pointed by the @mountdirfd. @flags
373 * value is same as the open(2) flags. 253 * value is same as the open(2) flags.
374 */ 254 */
375 SYSCALL_DEFINE3(open_by_handle_at, int, mountd 255 SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd,
376 struct file_handle __user *, h 256 struct file_handle __user *, handle,
377 int, flags) 257 int, flags)
378 { 258 {
379 long ret; 259 long ret;
380 260
381 if (force_o_largefile()) 261 if (force_o_largefile())
382 flags |= O_LARGEFILE; 262 flags |= O_LARGEFILE;
383 263
384 ret = do_handle_open(mountdirfd, handl 264 ret = do_handle_open(mountdirfd, handle, flags);
385 return ret; 265 return ret;
386 } 266 }
387 <<
388 #ifdef CONFIG_COMPAT <<
389 /* <<
390 * Exactly like fs/open.c:sys_open_by_handle_a <<
391 * doesn't set the O_LARGEFILE flag. <<
392 */ <<
393 COMPAT_SYSCALL_DEFINE3(open_by_handle_at, int, <<
394 struct file_handl <<
395 { <<
396 return do_handle_open(mountdirfd, hand <<
397 } <<
398 #endif <<
399 267
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.