1 // SPDX-License-Identifier: GPL-2.0 1 // SPDX-License-Identifier: GPL-2.0
2 #include <linux/syscalls.h> 2 #include <linux/syscalls.h>
3 #include <linux/slab.h> 3 #include <linux/slab.h>
4 #include <linux/fs.h> 4 #include <linux/fs.h>
5 #include <linux/file.h> 5 #include <linux/file.h>
6 #include <linux/mount.h> 6 #include <linux/mount.h>
7 #include <linux/namei.h> 7 #include <linux/namei.h>
8 #include <linux/exportfs.h> 8 #include <linux/exportfs.h>
9 #include <linux/fs_struct.h> 9 #include <linux/fs_struct.h>
10 #include <linux/fsnotify.h> 10 #include <linux/fsnotify.h>
11 #include <linux/personality.h> 11 #include <linux/personality.h>
12 #include <linux/uaccess.h> 12 #include <linux/uaccess.h>
13 #include <linux/compat.h> 13 #include <linux/compat.h>
14 #include "internal.h" 14 #include "internal.h"
15 #include "mount.h" 15 #include "mount.h"
16 16
17 static long do_sys_name_to_handle(const struct !! 17 static long do_sys_name_to_handle(struct path *path,
18 struct file_ 18 struct file_handle __user *ufh,
19 void __user !! 19 int __user *mnt_id)
20 int fh_flags <<
21 { 20 {
22 long retval; 21 long retval;
23 struct file_handle f_handle; 22 struct file_handle f_handle;
24 int handle_dwords, handle_bytes; 23 int handle_dwords, handle_bytes;
25 struct file_handle *handle = NULL; 24 struct file_handle *handle = NULL;
26 25
27 /* 26 /*
28 * We need to make sure whether the fi !! 27 * We need to make sure whether the file system
29 * the file handle if decodeable file !! 28 * support decoding of the file handle
30 */ 29 */
31 if (!exportfs_can_encode_fh(path->dent !! 30 if (!path->dentry->d_sb->s_export_op ||
>> 31 !path->dentry->d_sb->s_export_op->fh_to_dentry)
32 return -EOPNOTSUPP; 32 return -EOPNOTSUPP;
33 33
34 if (copy_from_user(&f_handle, ufh, siz 34 if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle)))
35 return -EFAULT; 35 return -EFAULT;
36 36
37 if (f_handle.handle_bytes > MAX_HANDLE 37 if (f_handle.handle_bytes > MAX_HANDLE_SZ)
38 return -EINVAL; 38 return -EINVAL;
39 39
40 handle = kzalloc(struct_size(handle, f !! 40 handle = kmalloc(sizeof(struct file_handle) + f_handle.handle_bytes,
41 GFP_KERNEL); 41 GFP_KERNEL);
42 if (!handle) 42 if (!handle)
43 return -ENOMEM; 43 return -ENOMEM;
44 44
45 /* convert handle size to multiple of 45 /* convert handle size to multiple of sizeof(u32) */
46 handle_dwords = f_handle.handle_bytes 46 handle_dwords = f_handle.handle_bytes >> 2;
47 47
48 /* we ask for a non connectable maybe !! 48 /* we ask for a non connected handle */
49 retval = exportfs_encode_fh(path->dent 49 retval = exportfs_encode_fh(path->dentry,
50 (struct fi 50 (struct fid *)handle->f_handle,
51 &handle_dw !! 51 &handle_dwords, 0);
52 handle->handle_type = retval; 52 handle->handle_type = retval;
53 /* convert handle size to bytes */ 53 /* convert handle size to bytes */
54 handle_bytes = handle_dwords * sizeof( 54 handle_bytes = handle_dwords * sizeof(u32);
55 handle->handle_bytes = handle_bytes; 55 handle->handle_bytes = handle_bytes;
56 if ((handle->handle_bytes > f_handle.h 56 if ((handle->handle_bytes > f_handle.handle_bytes) ||
57 (retval == FILEID_INVALID) || (ret !! 57 (retval == FILEID_INVALID) || (retval == -ENOSPC)) {
58 /* As per old exportfs_encode_ 58 /* As per old exportfs_encode_fh documentation
59 * we could return ENOSPC to i 59 * we could return ENOSPC to indicate overflow
60 * But file system returned 25 60 * But file system returned 255 always. So handle
61 * both the values 61 * both the values
62 */ 62 */
63 if (retval == FILEID_INVALID | <<
64 retval = -EOVERFLOW; <<
65 /* 63 /*
66 * set the handle size to zero 64 * set the handle size to zero so we copy only
67 * non variable part of the fi 65 * non variable part of the file_handle
68 */ 66 */
69 handle_bytes = 0; 67 handle_bytes = 0;
>> 68 retval = -EOVERFLOW;
70 } else 69 } else
71 retval = 0; 70 retval = 0;
72 /* copy the mount id */ 71 /* copy the mount id */
73 if (unique_mntid) { !! 72 if (copy_to_user(mnt_id, &real_mount(path->mnt)->mnt_id,
74 if (put_user(real_mount(path-> !! 73 sizeof(*mnt_id)) ||
75 (u64 __user *) mn !! 74 copy_to_user(ufh, handle,
76 retval = -EFAULT; !! 75 sizeof(struct file_handle) + handle_bytes))
77 } else { <<
78 if (put_user(real_mount(path-> <<
79 (int __user *) mn <<
80 retval = -EFAULT; <<
81 } <<
82 /* copy the handle */ <<
83 if (retval != -EFAULT && <<
84 copy_to_user(ufh, handle, <<
85 struct_size(handl <<
86 retval = -EFAULT; 76 retval = -EFAULT;
87 kfree(handle); 77 kfree(handle);
88 return retval; 78 return retval;
89 } 79 }
90 80
91 /** 81 /**
92 * sys_name_to_handle_at: convert name to hand 82 * sys_name_to_handle_at: convert name to handle
93 * @dfd: directory relative to which name is i 83 * @dfd: directory relative to which name is interpreted if not absolute
94 * @name: name that should be converted to han 84 * @name: name that should be converted to handle.
95 * @handle: resulting file handle 85 * @handle: resulting file handle
96 * @mnt_id: mount id of the file system contai 86 * @mnt_id: mount id of the file system containing the file
97 * (u64 if AT_HANDLE_MNT_ID_UNIQUE, o <<
98 * @flag: flag value to indicate whether to fo 87 * @flag: flag value to indicate whether to follow symlink or not
99 * and whether a decodable file handle <<
100 * 88 *
101 * @handle->handle_size indicate the space ava 89 * @handle->handle_size indicate the space available to store the
102 * variable part of the file handle in bytes. 90 * variable part of the file handle in bytes. If there is not
103 * enough space, the field is updated to retur 91 * enough space, the field is updated to return the minimum
104 * value required. 92 * value required.
105 */ 93 */
106 SYSCALL_DEFINE5(name_to_handle_at, int, dfd, c 94 SYSCALL_DEFINE5(name_to_handle_at, int, dfd, const char __user *, name,
107 struct file_handle __user *, h !! 95 struct file_handle __user *, handle, int __user *, mnt_id,
108 int, flag) 96 int, flag)
109 { 97 {
110 struct path path; 98 struct path path;
111 int lookup_flags; 99 int lookup_flags;
112 int fh_flags; <<
113 int err; 100 int err;
114 101
115 if (flag & ~(AT_SYMLINK_FOLLOW | AT_EM !! 102 if ((flag & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
116 AT_HANDLE_MNT_ID_UNIQUE)) <<
117 return -EINVAL; 103 return -EINVAL;
118 104
119 lookup_flags = (flag & AT_SYMLINK_FOLL 105 lookup_flags = (flag & AT_SYMLINK_FOLLOW) ? LOOKUP_FOLLOW : 0;
120 fh_flags = (flag & AT_HANDLE_FID) ? EX <<
121 if (flag & AT_EMPTY_PATH) 106 if (flag & AT_EMPTY_PATH)
122 lookup_flags |= LOOKUP_EMPTY; 107 lookup_flags |= LOOKUP_EMPTY;
123 err = user_path_at(dfd, name, lookup_f 108 err = user_path_at(dfd, name, lookup_flags, &path);
124 if (!err) { 109 if (!err) {
125 err = do_sys_name_to_handle(&p !! 110 err = do_sys_name_to_handle(&path, handle, mnt_id);
126 fl <<
127 fh <<
128 path_put(&path); 111 path_put(&path);
129 } 112 }
130 return err; 113 return err;
131 } 114 }
132 115
133 static int get_path_from_fd(int fd, struct pat !! 116 static struct vfsmount *get_vfsmount_from_fd(int fd)
134 { 117 {
>> 118 struct vfsmount *mnt;
>> 119
135 if (fd == AT_FDCWD) { 120 if (fd == AT_FDCWD) {
136 struct fs_struct *fs = current 121 struct fs_struct *fs = current->fs;
137 spin_lock(&fs->lock); 122 spin_lock(&fs->lock);
138 *root = fs->pwd; !! 123 mnt = mntget(fs->pwd.mnt);
139 path_get(root); <<
140 spin_unlock(&fs->lock); 124 spin_unlock(&fs->lock);
141 } else { 125 } else {
142 struct fd f = fdget(fd); 126 struct fd f = fdget(fd);
143 if (!fd_file(f)) !! 127 if (!f.file)
144 return -EBADF; !! 128 return ERR_PTR(-EBADF);
145 *root = fd_file(f)->f_path; !! 129 mnt = mntget(f.file->f_path.mnt);
146 path_get(root); <<
147 fdput(f); 130 fdput(f);
148 } 131 }
149 !! 132 return mnt;
150 return 0; <<
151 } 133 }
152 134
153 enum handle_to_path_flags { <<
154 HANDLE_CHECK_PERMS = (1 << 0), <<
155 HANDLE_CHECK_SUBTREE = (1 << 1), <<
156 }; <<
157 <<
158 struct handle_to_path_ctx { <<
159 struct path root; <<
160 enum handle_to_path_flags flags; <<
161 unsigned int fh_flags; <<
162 }; <<
163 <<
164 static int vfs_dentry_acceptable(void *context 135 static int vfs_dentry_acceptable(void *context, struct dentry *dentry)
165 { 136 {
166 struct handle_to_path_ctx *ctx = conte !! 137 return 1;
167 struct user_namespace *user_ns = curre <<
168 struct dentry *d, *root = ctx->root.de <<
169 struct mnt_idmap *idmap = mnt_idmap(ct <<
170 int retval = 0; <<
171 <<
172 if (!root) <<
173 return 1; <<
174 <<
175 /* Old permission model with global CA <<
176 if (!ctx->flags) <<
177 return 1; <<
178 <<
179 /* <<
180 * It's racy as we're not taking renam <<
181 * permissions and we just need an app <<
182 * to follow a path to the file. <<
183 * <<
184 * It's also potentially expensive on <<
185 * there is a deep path. <<
186 */ <<
187 d = dget(dentry); <<
188 while (d != root && !IS_ROOT(d)) { <<
189 struct dentry *parent = dget_p <<
190 <<
191 /* <<
192 * We know that we have the ab <<
193 * as we've verified this earl <<
194 * we also need to make sure t <<
195 * inodes in the path that wou <<
196 * file. <<
197 */ <<
198 if (!privileged_wrt_inode_uidg <<
199 <<
200 dput(d); <<
201 dput(parent); <<
202 return retval; <<
203 } <<
204 <<
205 dput(d); <<
206 d = parent; <<
207 } <<
208 <<
209 if (!(ctx->flags & HANDLE_CHECK_SUBTRE <<
210 retval = 1; <<
211 WARN_ON_ONCE(d != root && d != root->d <<
212 dput(d); <<
213 return retval; <<
214 } 138 }
215 139
216 static int do_handle_to_path(struct file_handl !! 140 static int do_handle_to_path(int mountdirfd, struct file_handle *handle,
217 struct handle_to_ !! 141 struct path *path)
218 { 142 {
>> 143 int retval = 0;
219 int handle_dwords; 144 int handle_dwords;
220 struct vfsmount *mnt = ctx->root.mnt; <<
221 145
>> 146 path->mnt = get_vfsmount_from_fd(mountdirfd);
>> 147 if (IS_ERR(path->mnt)) {
>> 148 retval = PTR_ERR(path->mnt);
>> 149 goto out_err;
>> 150 }
222 /* change the handle size to multiple 151 /* change the handle size to multiple of sizeof(u32) */
223 handle_dwords = handle->handle_bytes > 152 handle_dwords = handle->handle_bytes >> 2;
224 path->dentry = exportfs_decode_fh_raw( !! 153 path->dentry = exportfs_decode_fh(path->mnt,
225 (str 154 (struct fid *)handle->f_handle,
226 hand 155 handle_dwords, handle->handle_type,
227 ctx- !! 156 vfs_dentry_acceptable, NULL);
228 vfs_ !! 157 if (IS_ERR(path->dentry)) {
229 if (IS_ERR_OR_NULL(path->dentry)) { !! 158 retval = PTR_ERR(path->dentry);
230 if (path->dentry == ERR_PTR(-E !! 159 goto out_mnt;
231 return -ENOMEM; <<
232 return -ESTALE; <<
233 } 160 }
234 path->mnt = mntget(mnt); <<
235 return 0; 161 return 0;
236 } !! 162 out_mnt:
237 !! 163 mntput(path->mnt);
238 /* !! 164 out_err:
239 * Allow relaxed permissions of file handles i !! 165 return retval;
240 * ability to mount the filesystem or create a <<
241 * provided @mountdirfd. <<
242 * <<
243 * In both cases the caller may be able to get <<
244 * the encoded file handle. If the caller is o <<
245 * bind-mount we need to verify that there are <<
246 * of it that could prevent us from getting to <<
247 * <<
248 * In principle, locked mounts can prevent the <<
249 * filesystem but that only applies to procfs <<
250 * support decoding file handles. <<
251 */ <<
252 static inline bool may_decode_fh(struct handle <<
253 unsigned int <<
254 { <<
255 struct path *root = &ctx->root; <<
256 <<
257 /* <<
258 * Restrict to O_DIRECTORY to provide <<
259 * confusing api in the face of discon <<
260 * <<
261 * There's only one dentry for each di <<
262 */ <<
263 if (!(o_flags & O_DIRECTORY)) <<
264 return false; <<
265 <<
266 if (ns_capable(root->mnt->mnt_sb->s_us <<
267 ctx->flags = HANDLE_CHECK_PERM <<
268 else if (is_mounted(root->mnt) && <<
269 ns_capable(real_mount(root->m <<
270 CAP_SYS_ADMIN) && <<
271 !has_locked_children(real_mou <<
272 ctx->flags = HANDLE_CHECK_PERM <<
273 else <<
274 return false; <<
275 <<
276 /* Are we able to override DAC permiss <<
277 if (!ns_capable(current_user_ns(), CAP <<
278 return false; <<
279 <<
280 ctx->fh_flags = EXPORT_FH_DIR_ONLY; <<
281 return true; <<
282 } 166 }
283 167
284 static int handle_to_path(int mountdirfd, stru 168 static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
285 struct path *path, unsigned !! 169 struct path *path)
286 { 170 {
287 int retval = 0; 171 int retval = 0;
288 struct file_handle f_handle; 172 struct file_handle f_handle;
289 struct file_handle *handle = NULL; 173 struct file_handle *handle = NULL;
290 struct handle_to_path_ctx ctx = {}; <<
291 174
292 retval = get_path_from_fd(mountdirfd, !! 175 /*
293 if (retval) !! 176 * With handle we don't look at the execute bit on the
294 goto out_err; !! 177 * the directory. Ideally we would like CAP_DAC_SEARCH.
295 !! 178 * But we don't have that
296 if (!capable(CAP_DAC_READ_SEARCH) && ! !! 179 */
>> 180 if (!capable(CAP_DAC_READ_SEARCH)) {
297 retval = -EPERM; 181 retval = -EPERM;
298 goto out_path; !! 182 goto out_err;
299 } 183 }
300 <<
301 if (copy_from_user(&f_handle, ufh, siz 184 if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle))) {
302 retval = -EFAULT; 185 retval = -EFAULT;
303 goto out_path; !! 186 goto out_err;
304 } 187 }
305 if ((f_handle.handle_bytes > MAX_HANDL 188 if ((f_handle.handle_bytes > MAX_HANDLE_SZ) ||
306 (f_handle.handle_bytes == 0)) { 189 (f_handle.handle_bytes == 0)) {
307 retval = -EINVAL; 190 retval = -EINVAL;
308 goto out_path; !! 191 goto out_err;
309 } 192 }
310 handle = kmalloc(struct_size(handle, f !! 193 handle = kmalloc(sizeof(struct file_handle) + f_handle.handle_bytes,
311 GFP_KERNEL); 194 GFP_KERNEL);
312 if (!handle) { 195 if (!handle) {
313 retval = -ENOMEM; 196 retval = -ENOMEM;
314 goto out_path; !! 197 goto out_err;
315 } 198 }
316 /* copy the full handle */ 199 /* copy the full handle */
317 *handle = f_handle; 200 *handle = f_handle;
318 if (copy_from_user(&handle->f_handle, 201 if (copy_from_user(&handle->f_handle,
319 &ufh->f_handle, 202 &ufh->f_handle,
320 f_handle.handle_byt 203 f_handle.handle_bytes)) {
321 retval = -EFAULT; 204 retval = -EFAULT;
322 goto out_handle; 205 goto out_handle;
323 } 206 }
324 207
325 retval = do_handle_to_path(handle, pat !! 208 retval = do_handle_to_path(mountdirfd, handle, path);
326 209
327 out_handle: 210 out_handle:
328 kfree(handle); 211 kfree(handle);
329 out_path: <<
330 path_put(&ctx.root); <<
331 out_err: 212 out_err:
332 return retval; 213 return retval;
333 } 214 }
334 215
335 static long do_handle_open(int mountdirfd, str 216 static long do_handle_open(int mountdirfd, struct file_handle __user *ufh,
336 int open_flag) 217 int open_flag)
337 { 218 {
338 long retval = 0; 219 long retval = 0;
339 struct path path; 220 struct path path;
340 struct file *file; 221 struct file *file;
341 int fd; 222 int fd;
342 223
343 retval = handle_to_path(mountdirfd, uf !! 224 retval = handle_to_path(mountdirfd, ufh, &path);
344 if (retval) 225 if (retval)
345 return retval; 226 return retval;
346 227
347 fd = get_unused_fd_flags(open_flag); 228 fd = get_unused_fd_flags(open_flag);
348 if (fd < 0) { 229 if (fd < 0) {
349 path_put(&path); 230 path_put(&path);
350 return fd; 231 return fd;
351 } 232 }
352 file = file_open_root(&path, "", open_ !! 233 file = file_open_root(path.dentry, path.mnt, "", open_flag, 0);
353 if (IS_ERR(file)) { 234 if (IS_ERR(file)) {
354 put_unused_fd(fd); 235 put_unused_fd(fd);
355 retval = PTR_ERR(file); 236 retval = PTR_ERR(file);
356 } else { 237 } else {
357 retval = fd; 238 retval = fd;
>> 239 fsnotify_open(file);
358 fd_install(fd, file); 240 fd_install(fd, file);
359 } 241 }
360 path_put(&path); 242 path_put(&path);
361 return retval; 243 return retval;
362 } 244 }
363 245
364 /** 246 /**
365 * sys_open_by_handle_at: Open the file handle 247 * sys_open_by_handle_at: Open the file handle
366 * @mountdirfd: directory file descriptor 248 * @mountdirfd: directory file descriptor
367 * @handle: file handle to be opened 249 * @handle: file handle to be opened
368 * @flags: open flags. !! 250 * @flag: open flags.
369 * 251 *
370 * @mountdirfd indicate the directory file des 252 * @mountdirfd indicate the directory file descriptor
371 * of the mount point. file handle is decoded 253 * of the mount point. file handle is decoded relative
372 * to the vfsmount pointed by the @mountdirfd. 254 * to the vfsmount pointed by the @mountdirfd. @flags
373 * value is same as the open(2) flags. 255 * value is same as the open(2) flags.
374 */ 256 */
375 SYSCALL_DEFINE3(open_by_handle_at, int, mountd 257 SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd,
376 struct file_handle __user *, h 258 struct file_handle __user *, handle,
377 int, flags) 259 int, flags)
378 { 260 {
379 long ret; 261 long ret;
380 262
381 if (force_o_largefile()) 263 if (force_o_largefile())
382 flags |= O_LARGEFILE; 264 flags |= O_LARGEFILE;
383 265
384 ret = do_handle_open(mountdirfd, handl 266 ret = do_handle_open(mountdirfd, handle, flags);
385 return ret; 267 return ret;
386 } 268 }
387 269
388 #ifdef CONFIG_COMPAT 270 #ifdef CONFIG_COMPAT
389 /* 271 /*
390 * Exactly like fs/open.c:sys_open_by_handle_a 272 * Exactly like fs/open.c:sys_open_by_handle_at(), except that it
391 * doesn't set the O_LARGEFILE flag. 273 * doesn't set the O_LARGEFILE flag.
392 */ 274 */
393 COMPAT_SYSCALL_DEFINE3(open_by_handle_at, int, 275 COMPAT_SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd,
394 struct file_handl 276 struct file_handle __user *, handle, int, flags)
395 { 277 {
396 return do_handle_open(mountdirfd, hand 278 return do_handle_open(mountdirfd, handle, flags);
397 } 279 }
398 #endif 280 #endif
399 281
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.