1 // SPDX-License-Identifier: GPL-2.0 1 // SPDX-License-Identifier: GPL-2.0
2 #include <linux/syscalls.h> 2 #include <linux/syscalls.h>
3 #include <linux/slab.h> 3 #include <linux/slab.h>
4 #include <linux/fs.h> 4 #include <linux/fs.h>
5 #include <linux/file.h> 5 #include <linux/file.h>
6 #include <linux/mount.h> 6 #include <linux/mount.h>
7 #include <linux/namei.h> 7 #include <linux/namei.h>
8 #include <linux/exportfs.h> 8 #include <linux/exportfs.h>
9 #include <linux/fs_struct.h> 9 #include <linux/fs_struct.h>
10 #include <linux/fsnotify.h> 10 #include <linux/fsnotify.h>
11 #include <linux/personality.h> 11 #include <linux/personality.h>
12 #include <linux/uaccess.h> 12 #include <linux/uaccess.h>
13 #include <linux/compat.h> 13 #include <linux/compat.h>
14 #include "internal.h" 14 #include "internal.h"
15 #include "mount.h" 15 #include "mount.h"
16 16
17 static long do_sys_name_to_handle(const struct !! 17 static long do_sys_name_to_handle(struct path *path,
18 struct file_ 18 struct file_handle __user *ufh,
19 void __user !! 19 int __user *mnt_id)
20 int fh_flags <<
21 { 20 {
22 long retval; 21 long retval;
23 struct file_handle f_handle; 22 struct file_handle f_handle;
24 int handle_dwords, handle_bytes; 23 int handle_dwords, handle_bytes;
25 struct file_handle *handle = NULL; 24 struct file_handle *handle = NULL;
26 25
27 /* 26 /*
28 * We need to make sure whether the fi !! 27 * We need to make sure whether the file system
29 * the file handle if decodeable file !! 28 * support decoding of the file handle
30 */ 29 */
31 if (!exportfs_can_encode_fh(path->dent !! 30 if (!path->dentry->d_sb->s_export_op ||
>> 31 !path->dentry->d_sb->s_export_op->fh_to_dentry)
32 return -EOPNOTSUPP; 32 return -EOPNOTSUPP;
33 33
34 if (copy_from_user(&f_handle, ufh, siz 34 if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle)))
35 return -EFAULT; 35 return -EFAULT;
36 36
37 if (f_handle.handle_bytes > MAX_HANDLE 37 if (f_handle.handle_bytes > MAX_HANDLE_SZ)
38 return -EINVAL; 38 return -EINVAL;
39 39
40 handle = kzalloc(struct_size(handle, f !! 40 handle = kmalloc(sizeof(struct file_handle) + f_handle.handle_bytes,
41 GFP_KERNEL); 41 GFP_KERNEL);
42 if (!handle) 42 if (!handle)
43 return -ENOMEM; 43 return -ENOMEM;
44 44
45 /* convert handle size to multiple of 45 /* convert handle size to multiple of sizeof(u32) */
46 handle_dwords = f_handle.handle_bytes 46 handle_dwords = f_handle.handle_bytes >> 2;
47 47
48 /* we ask for a non connectable maybe !! 48 /* we ask for a non connected handle */
49 retval = exportfs_encode_fh(path->dent 49 retval = exportfs_encode_fh(path->dentry,
50 (struct fi 50 (struct fid *)handle->f_handle,
51 &handle_dw !! 51 &handle_dwords, 0);
52 handle->handle_type = retval; 52 handle->handle_type = retval;
53 /* convert handle size to bytes */ 53 /* convert handle size to bytes */
54 handle_bytes = handle_dwords * sizeof( 54 handle_bytes = handle_dwords * sizeof(u32);
55 handle->handle_bytes = handle_bytes; 55 handle->handle_bytes = handle_bytes;
56 if ((handle->handle_bytes > f_handle.h 56 if ((handle->handle_bytes > f_handle.handle_bytes) ||
57 (retval == FILEID_INVALID) || (ret !! 57 (retval == FILEID_INVALID) || (retval == -ENOSPC)) {
58 /* As per old exportfs_encode_ 58 /* As per old exportfs_encode_fh documentation
59 * we could return ENOSPC to i 59 * we could return ENOSPC to indicate overflow
60 * But file system returned 25 60 * But file system returned 255 always. So handle
61 * both the values 61 * both the values
62 */ 62 */
63 if (retval == FILEID_INVALID | <<
64 retval = -EOVERFLOW; <<
65 /* 63 /*
66 * set the handle size to zero 64 * set the handle size to zero so we copy only
67 * non variable part of the fi 65 * non variable part of the file_handle
68 */ 66 */
69 handle_bytes = 0; 67 handle_bytes = 0;
>> 68 retval = -EOVERFLOW;
70 } else 69 } else
71 retval = 0; 70 retval = 0;
72 /* copy the mount id */ 71 /* copy the mount id */
73 if (unique_mntid) { !! 72 if (put_user(real_mount(path->mnt)->mnt_id, mnt_id) ||
74 if (put_user(real_mount(path-> !! 73 copy_to_user(ufh, handle,
75 (u64 __user *) mn !! 74 sizeof(struct file_handle) + handle_bytes))
76 retval = -EFAULT; <<
77 } else { <<
78 if (put_user(real_mount(path-> <<
79 (int __user *) mn <<
80 retval = -EFAULT; <<
81 } <<
82 /* copy the handle */ <<
83 if (retval != -EFAULT && <<
84 copy_to_user(ufh, handle, <<
85 struct_size(handl <<
86 retval = -EFAULT; 75 retval = -EFAULT;
87 kfree(handle); 76 kfree(handle);
88 return retval; 77 return retval;
89 } 78 }
90 79
91 /** 80 /**
92 * sys_name_to_handle_at: convert name to hand 81 * sys_name_to_handle_at: convert name to handle
93 * @dfd: directory relative to which name is i 82 * @dfd: directory relative to which name is interpreted if not absolute
94 * @name: name that should be converted to han 83 * @name: name that should be converted to handle.
95 * @handle: resulting file handle 84 * @handle: resulting file handle
96 * @mnt_id: mount id of the file system contai 85 * @mnt_id: mount id of the file system containing the file
97 * (u64 if AT_HANDLE_MNT_ID_UNIQUE, o <<
98 * @flag: flag value to indicate whether to fo 86 * @flag: flag value to indicate whether to follow symlink or not
99 * and whether a decodable file handle <<
100 * 87 *
101 * @handle->handle_size indicate the space ava 88 * @handle->handle_size indicate the space available to store the
102 * variable part of the file handle in bytes. 89 * variable part of the file handle in bytes. If there is not
103 * enough space, the field is updated to retur 90 * enough space, the field is updated to return the minimum
104 * value required. 91 * value required.
105 */ 92 */
106 SYSCALL_DEFINE5(name_to_handle_at, int, dfd, c 93 SYSCALL_DEFINE5(name_to_handle_at, int, dfd, const char __user *, name,
107 struct file_handle __user *, h !! 94 struct file_handle __user *, handle, int __user *, mnt_id,
108 int, flag) 95 int, flag)
109 { 96 {
110 struct path path; 97 struct path path;
111 int lookup_flags; 98 int lookup_flags;
112 int fh_flags; <<
113 int err; 99 int err;
114 100
115 if (flag & ~(AT_SYMLINK_FOLLOW | AT_EM !! 101 if ((flag & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
116 AT_HANDLE_MNT_ID_UNIQUE)) <<
117 return -EINVAL; 102 return -EINVAL;
118 103
119 lookup_flags = (flag & AT_SYMLINK_FOLL 104 lookup_flags = (flag & AT_SYMLINK_FOLLOW) ? LOOKUP_FOLLOW : 0;
120 fh_flags = (flag & AT_HANDLE_FID) ? EX <<
121 if (flag & AT_EMPTY_PATH) 105 if (flag & AT_EMPTY_PATH)
122 lookup_flags |= LOOKUP_EMPTY; 106 lookup_flags |= LOOKUP_EMPTY;
123 err = user_path_at(dfd, name, lookup_f 107 err = user_path_at(dfd, name, lookup_flags, &path);
124 if (!err) { 108 if (!err) {
125 err = do_sys_name_to_handle(&p !! 109 err = do_sys_name_to_handle(&path, handle, mnt_id);
126 fl <<
127 fh <<
128 path_put(&path); 110 path_put(&path);
129 } 111 }
130 return err; 112 return err;
131 } 113 }
132 114
133 static int get_path_from_fd(int fd, struct pat !! 115 static struct vfsmount *get_vfsmount_from_fd(int fd)
134 { 116 {
>> 117 struct vfsmount *mnt;
>> 118
135 if (fd == AT_FDCWD) { 119 if (fd == AT_FDCWD) {
136 struct fs_struct *fs = current 120 struct fs_struct *fs = current->fs;
137 spin_lock(&fs->lock); 121 spin_lock(&fs->lock);
138 *root = fs->pwd; !! 122 mnt = mntget(fs->pwd.mnt);
139 path_get(root); <<
140 spin_unlock(&fs->lock); 123 spin_unlock(&fs->lock);
141 } else { 124 } else {
142 struct fd f = fdget(fd); 125 struct fd f = fdget(fd);
143 if (!fd_file(f)) !! 126 if (!f.file)
144 return -EBADF; !! 127 return ERR_PTR(-EBADF);
145 *root = fd_file(f)->f_path; !! 128 mnt = mntget(f.file->f_path.mnt);
146 path_get(root); <<
147 fdput(f); 129 fdput(f);
148 } 130 }
149 !! 131 return mnt;
150 return 0; <<
151 } 132 }
152 133
153 enum handle_to_path_flags { <<
154 HANDLE_CHECK_PERMS = (1 << 0), <<
155 HANDLE_CHECK_SUBTREE = (1 << 1), <<
156 }; <<
157 <<
158 struct handle_to_path_ctx { <<
159 struct path root; <<
160 enum handle_to_path_flags flags; <<
161 unsigned int fh_flags; <<
162 }; <<
163 <<
164 static int vfs_dentry_acceptable(void *context 134 static int vfs_dentry_acceptable(void *context, struct dentry *dentry)
165 { 135 {
166 struct handle_to_path_ctx *ctx = conte !! 136 return 1;
167 struct user_namespace *user_ns = curre <<
168 struct dentry *d, *root = ctx->root.de <<
169 struct mnt_idmap *idmap = mnt_idmap(ct <<
170 int retval = 0; <<
171 <<
172 if (!root) <<
173 return 1; <<
174 <<
175 /* Old permission model with global CA <<
176 if (!ctx->flags) <<
177 return 1; <<
178 <<
179 /* <<
180 * It's racy as we're not taking renam <<
181 * permissions and we just need an app <<
182 * to follow a path to the file. <<
183 * <<
184 * It's also potentially expensive on <<
185 * there is a deep path. <<
186 */ <<
187 d = dget(dentry); <<
188 while (d != root && !IS_ROOT(d)) { <<
189 struct dentry *parent = dget_p <<
190 <<
191 /* <<
192 * We know that we have the ab <<
193 * as we've verified this earl <<
194 * we also need to make sure t <<
195 * inodes in the path that wou <<
196 * file. <<
197 */ <<
198 if (!privileged_wrt_inode_uidg <<
199 <<
200 dput(d); <<
201 dput(parent); <<
202 return retval; <<
203 } <<
204 <<
205 dput(d); <<
206 d = parent; <<
207 } <<
208 <<
209 if (!(ctx->flags & HANDLE_CHECK_SUBTRE <<
210 retval = 1; <<
211 WARN_ON_ONCE(d != root && d != root->d <<
212 dput(d); <<
213 return retval; <<
214 } 137 }
215 138
216 static int do_handle_to_path(struct file_handl !! 139 static int do_handle_to_path(int mountdirfd, struct file_handle *handle,
217 struct handle_to_ !! 140 struct path *path)
218 { 141 {
>> 142 int retval = 0;
219 int handle_dwords; 143 int handle_dwords;
220 struct vfsmount *mnt = ctx->root.mnt; <<
221 144
>> 145 path->mnt = get_vfsmount_from_fd(mountdirfd);
>> 146 if (IS_ERR(path->mnt)) {
>> 147 retval = PTR_ERR(path->mnt);
>> 148 goto out_err;
>> 149 }
222 /* change the handle size to multiple 150 /* change the handle size to multiple of sizeof(u32) */
223 handle_dwords = handle->handle_bytes > 151 handle_dwords = handle->handle_bytes >> 2;
224 path->dentry = exportfs_decode_fh_raw( !! 152 path->dentry = exportfs_decode_fh(path->mnt,
225 (str 153 (struct fid *)handle->f_handle,
226 hand 154 handle_dwords, handle->handle_type,
227 ctx- !! 155 vfs_dentry_acceptable, NULL);
228 vfs_ !! 156 if (IS_ERR(path->dentry)) {
229 if (IS_ERR_OR_NULL(path->dentry)) { !! 157 retval = PTR_ERR(path->dentry);
230 if (path->dentry == ERR_PTR(-E !! 158 goto out_mnt;
231 return -ENOMEM; <<
232 return -ESTALE; <<
233 } 159 }
234 path->mnt = mntget(mnt); <<
235 return 0; 160 return 0;
236 } !! 161 out_mnt:
237 !! 162 mntput(path->mnt);
238 /* !! 163 out_err:
239 * Allow relaxed permissions of file handles i !! 164 return retval;
240 * ability to mount the filesystem or create a <<
241 * provided @mountdirfd. <<
242 * <<
243 * In both cases the caller may be able to get <<
244 * the encoded file handle. If the caller is o <<
245 * bind-mount we need to verify that there are <<
246 * of it that could prevent us from getting to <<
247 * <<
248 * In principle, locked mounts can prevent the <<
249 * filesystem but that only applies to procfs <<
250 * support decoding file handles. <<
251 */ <<
252 static inline bool may_decode_fh(struct handle <<
253 unsigned int <<
254 { <<
255 struct path *root = &ctx->root; <<
256 <<
257 /* <<
258 * Restrict to O_DIRECTORY to provide <<
259 * confusing api in the face of discon <<
260 * <<
261 * There's only one dentry for each di <<
262 */ <<
263 if (!(o_flags & O_DIRECTORY)) <<
264 return false; <<
265 <<
266 if (ns_capable(root->mnt->mnt_sb->s_us <<
267 ctx->flags = HANDLE_CHECK_PERM <<
268 else if (is_mounted(root->mnt) && <<
269 ns_capable(real_mount(root->m <<
270 CAP_SYS_ADMIN) && <<
271 !has_locked_children(real_mou <<
272 ctx->flags = HANDLE_CHECK_PERM <<
273 else <<
274 return false; <<
275 <<
276 /* Are we able to override DAC permiss <<
277 if (!ns_capable(current_user_ns(), CAP <<
278 return false; <<
279 <<
280 ctx->fh_flags = EXPORT_FH_DIR_ONLY; <<
281 return true; <<
282 } 165 }
283 166
284 static int handle_to_path(int mountdirfd, stru 167 static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
285 struct path *path, unsigned !! 168 struct path *path)
286 { 169 {
287 int retval = 0; 170 int retval = 0;
288 struct file_handle f_handle; 171 struct file_handle f_handle;
289 struct file_handle *handle = NULL; 172 struct file_handle *handle = NULL;
290 struct handle_to_path_ctx ctx = {}; <<
291 <<
292 retval = get_path_from_fd(mountdirfd, <<
293 if (retval) <<
294 goto out_err; <<
295 173
296 if (!capable(CAP_DAC_READ_SEARCH) && ! !! 174 /*
>> 175 * With handle we don't look at the execute bit on the
>> 176 * the directory. Ideally we would like CAP_DAC_SEARCH.
>> 177 * But we don't have that
>> 178 */
>> 179 if (!capable(CAP_DAC_READ_SEARCH)) {
297 retval = -EPERM; 180 retval = -EPERM;
298 goto out_path; !! 181 goto out_err;
299 } 182 }
300 <<
301 if (copy_from_user(&f_handle, ufh, siz 183 if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle))) {
302 retval = -EFAULT; 184 retval = -EFAULT;
303 goto out_path; !! 185 goto out_err;
304 } 186 }
305 if ((f_handle.handle_bytes > MAX_HANDL 187 if ((f_handle.handle_bytes > MAX_HANDLE_SZ) ||
306 (f_handle.handle_bytes == 0)) { 188 (f_handle.handle_bytes == 0)) {
307 retval = -EINVAL; 189 retval = -EINVAL;
308 goto out_path; !! 190 goto out_err;
309 } 191 }
310 handle = kmalloc(struct_size(handle, f !! 192 handle = kmalloc(sizeof(struct file_handle) + f_handle.handle_bytes,
311 GFP_KERNEL); 193 GFP_KERNEL);
312 if (!handle) { 194 if (!handle) {
313 retval = -ENOMEM; 195 retval = -ENOMEM;
314 goto out_path; !! 196 goto out_err;
315 } 197 }
316 /* copy the full handle */ 198 /* copy the full handle */
317 *handle = f_handle; 199 *handle = f_handle;
318 if (copy_from_user(&handle->f_handle, 200 if (copy_from_user(&handle->f_handle,
319 &ufh->f_handle, 201 &ufh->f_handle,
320 f_handle.handle_byt 202 f_handle.handle_bytes)) {
321 retval = -EFAULT; 203 retval = -EFAULT;
322 goto out_handle; 204 goto out_handle;
323 } 205 }
324 206
325 retval = do_handle_to_path(handle, pat !! 207 retval = do_handle_to_path(mountdirfd, handle, path);
326 208
327 out_handle: 209 out_handle:
328 kfree(handle); 210 kfree(handle);
329 out_path: <<
330 path_put(&ctx.root); <<
331 out_err: 211 out_err:
332 return retval; 212 return retval;
333 } 213 }
334 214
335 static long do_handle_open(int mountdirfd, str 215 static long do_handle_open(int mountdirfd, struct file_handle __user *ufh,
336 int open_flag) 216 int open_flag)
337 { 217 {
338 long retval = 0; 218 long retval = 0;
339 struct path path; 219 struct path path;
340 struct file *file; 220 struct file *file;
341 int fd; 221 int fd;
342 222
343 retval = handle_to_path(mountdirfd, uf !! 223 retval = handle_to_path(mountdirfd, ufh, &path);
344 if (retval) 224 if (retval)
345 return retval; 225 return retval;
346 226
347 fd = get_unused_fd_flags(open_flag); 227 fd = get_unused_fd_flags(open_flag);
348 if (fd < 0) { 228 if (fd < 0) {
349 path_put(&path); 229 path_put(&path);
350 return fd; 230 return fd;
351 } 231 }
352 file = file_open_root(&path, "", open_ !! 232 file = file_open_root(path.dentry, path.mnt, "", open_flag, 0);
353 if (IS_ERR(file)) { 233 if (IS_ERR(file)) {
354 put_unused_fd(fd); 234 put_unused_fd(fd);
355 retval = PTR_ERR(file); 235 retval = PTR_ERR(file);
356 } else { 236 } else {
357 retval = fd; 237 retval = fd;
>> 238 fsnotify_open(file);
358 fd_install(fd, file); 239 fd_install(fd, file);
359 } 240 }
360 path_put(&path); 241 path_put(&path);
361 return retval; 242 return retval;
362 } 243 }
363 244
364 /** 245 /**
365 * sys_open_by_handle_at: Open the file handle 246 * sys_open_by_handle_at: Open the file handle
366 * @mountdirfd: directory file descriptor 247 * @mountdirfd: directory file descriptor
367 * @handle: file handle to be opened 248 * @handle: file handle to be opened
368 * @flags: open flags. 249 * @flags: open flags.
369 * 250 *
370 * @mountdirfd indicate the directory file des 251 * @mountdirfd indicate the directory file descriptor
371 * of the mount point. file handle is decoded 252 * of the mount point. file handle is decoded relative
372 * to the vfsmount pointed by the @mountdirfd. 253 * to the vfsmount pointed by the @mountdirfd. @flags
373 * value is same as the open(2) flags. 254 * value is same as the open(2) flags.
374 */ 255 */
375 SYSCALL_DEFINE3(open_by_handle_at, int, mountd 256 SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd,
376 struct file_handle __user *, h 257 struct file_handle __user *, handle,
377 int, flags) 258 int, flags)
378 { 259 {
379 long ret; 260 long ret;
380 261
381 if (force_o_largefile()) 262 if (force_o_largefile())
382 flags |= O_LARGEFILE; 263 flags |= O_LARGEFILE;
383 264
384 ret = do_handle_open(mountdirfd, handl 265 ret = do_handle_open(mountdirfd, handle, flags);
385 return ret; 266 return ret;
386 } 267 }
387 268
388 #ifdef CONFIG_COMPAT 269 #ifdef CONFIG_COMPAT
389 /* 270 /*
390 * Exactly like fs/open.c:sys_open_by_handle_a 271 * Exactly like fs/open.c:sys_open_by_handle_at(), except that it
391 * doesn't set the O_LARGEFILE flag. 272 * doesn't set the O_LARGEFILE flag.
392 */ 273 */
393 COMPAT_SYSCALL_DEFINE3(open_by_handle_at, int, 274 COMPAT_SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd,
394 struct file_handl 275 struct file_handle __user *, handle, int, flags)
395 { 276 {
396 return do_handle_open(mountdirfd, hand 277 return do_handle_open(mountdirfd, handle, flags);
397 } 278 }
398 #endif 279 #endif
399 280
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.