1 // SPDX-License-Identifier: GPL-2.0-only
4 * Copyright (C) 2011 Novell Inc.
8 #include <linux/slab.h>
9 #include <linux/cred.h>
10 #include <linux/xattr.h>
11 #include <linux/posix_acl.h>
12 #include <linux/ratelimit.h>
13 #include <linux/fiemap.h>
14 #include <linux/fileattr.h>
15 #include <linux/security.h>
16 #include <linux/namei.h>
17 #include <linux/posix_acl.h>
18 #include <linux/posix_acl_xattr.h>
19 #include "overlayfs.h"
22 int ovl_setattr(struct mnt_idmap
*idmap
, struct dentry
*dentry
,
26 struct ovl_fs
*ofs
= OVL_FS(dentry
->d_sb
);
27 bool full_copy_up
= false;
28 struct dentry
*upperdentry
;
29 const struct cred
*old_cred
;
31 err
= setattr_prepare(&nop_mnt_idmap
, dentry
, attr
);
35 if (attr
->ia_valid
& ATTR_SIZE
) {
36 /* Truncate should trigger data copy up as well */
41 err
= ovl_copy_up(dentry
);
43 err
= ovl_copy_up_with_data(dentry
);
45 struct inode
*winode
= NULL
;
47 upperdentry
= ovl_dentry_upper(dentry
);
49 if (attr
->ia_valid
& ATTR_SIZE
) {
50 winode
= d_inode(upperdentry
);
51 err
= get_write_access(winode
);
56 if (attr
->ia_valid
& (ATTR_KILL_SUID
|ATTR_KILL_SGID
))
57 attr
->ia_valid
&= ~ATTR_MODE
;
60 * We might have to translate ovl file into real file object
61 * once use cases emerge. For now, simply don't let underlying
62 * filesystem rely on attr->ia_file
64 attr
->ia_valid
&= ~ATTR_FILE
;
67 * If open(O_TRUNC) is done, VFS calls ->setattr with ATTR_OPEN
68 * set. Overlayfs does not pass O_TRUNC flag to underlying
69 * filesystem during open -> do not pass ATTR_OPEN. This
70 * disables optimization in fuse which assumes open(O_TRUNC)
71 * already set file size to 0. But we never passed O_TRUNC to
72 * fuse. So by clearing ATTR_OPEN, fuse will be forced to send
73 * setattr request to server.
75 attr
->ia_valid
&= ~ATTR_OPEN
;
77 err
= ovl_want_write(dentry
);
81 inode_lock(upperdentry
->d_inode
);
82 old_cred
= ovl_override_creds(dentry
->d_sb
);
83 err
= ovl_do_notify_change(ofs
, upperdentry
, attr
);
84 revert_creds(old_cred
);
86 ovl_copyattr(dentry
->d_inode
);
87 inode_unlock(upperdentry
->d_inode
);
88 ovl_drop_write(dentry
);
92 put_write_access(winode
);
98 static void ovl_map_dev_ino(struct dentry
*dentry
, struct kstat
*stat
, int fsid
)
100 struct ovl_fs
*ofs
= OVL_FS(dentry
->d_sb
);
101 bool samefs
= ovl_same_fs(ofs
);
102 unsigned int xinobits
= ovl_xino_bits(ofs
);
103 unsigned int xinoshift
= 64 - xinobits
;
107 * When all layers are on the same fs, all real inode
108 * number are unique, so we use the overlay st_dev,
109 * which is friendly to du -x.
111 stat
->dev
= dentry
->d_sb
->s_dev
;
113 } else if (xinobits
) {
115 * All inode numbers of underlying fs should not be using the
116 * high xinobits, so we use high xinobits to partition the
117 * overlay st_ino address space. The high bits holds the fsid
118 * (upper fsid is 0). The lowest xinobit is reserved for mapping
119 * the non-persistent inode numbers range in case of overflow.
120 * This way all overlay inode numbers are unique and use the
123 if (likely(!(stat
->ino
>> xinoshift
))) {
124 stat
->ino
|= ((u64
)fsid
) << (xinoshift
+ 1);
125 stat
->dev
= dentry
->d_sb
->s_dev
;
127 } else if (ovl_xino_warn(ofs
)) {
128 pr_warn_ratelimited("inode number too big (%pd2, ino=%llu, xinobits=%d)\n",
129 dentry
, stat
->ino
, xinobits
);
133 /* The inode could not be mapped to a unified st_ino address space */
134 if (S_ISDIR(dentry
->d_inode
->i_mode
)) {
136 * Always use the overlay st_dev for directories, so 'find
137 * -xdev' will scan the entire overlay mount and won't cross the
138 * overlay mount boundaries.
140 * If not all layers are on the same fs the pair {real st_ino;
141 * overlay st_dev} is not unique, so use the non persistent
142 * overlay st_ino for directories.
144 stat
->dev
= dentry
->d_sb
->s_dev
;
145 stat
->ino
= dentry
->d_inode
->i_ino
;
148 * For non-samefs setup, if we cannot map all layers st_ino
149 * to a unified address space, we need to make sure that st_dev
150 * is unique per underlying fs, so we use the unique anonymous
151 * bdev assigned to the underlying fs.
153 stat
->dev
= ofs
->fs
[fsid
].pseudo_dev
;
157 int ovl_getattr(struct mnt_idmap
*idmap
, const struct path
*path
,
158 struct kstat
*stat
, u32 request_mask
, unsigned int flags
)
160 struct dentry
*dentry
= path
->dentry
;
161 enum ovl_path_type type
;
162 struct path realpath
;
163 const struct cred
*old_cred
;
164 struct inode
*inode
= d_inode(dentry
);
165 bool is_dir
= S_ISDIR(inode
->i_mode
);
168 bool metacopy_blocks
= false;
170 metacopy_blocks
= ovl_is_metacopy_dentry(dentry
);
172 type
= ovl_path_real(dentry
, &realpath
);
173 old_cred
= ovl_override_creds(dentry
->d_sb
);
174 err
= ovl_do_getattr(&realpath
, stat
, request_mask
, flags
);
178 /* Report the effective immutable/append-only STATX flags */
179 generic_fill_statx_attr(inode
, stat
);
182 * For non-dir or same fs, we use st_ino of the copy up origin.
183 * This guaranties constant st_dev/st_ino across copy up.
184 * With xino feature and non-samefs, we use st_ino of the copy up
185 * origin masked with high bits that represent the layer id.
187 * If lower filesystem supports NFS file handles, this also guaranties
188 * persistent st_ino across mount cycle.
190 if (!is_dir
|| ovl_same_dev(OVL_FS(dentry
->d_sb
))) {
191 if (!OVL_TYPE_UPPER(type
)) {
192 fsid
= ovl_layer_lower(dentry
)->fsid
;
193 } else if (OVL_TYPE_ORIGIN(type
)) {
194 struct kstat lowerstat
;
195 u32 lowermask
= STATX_INO
| STATX_BLOCKS
|
196 (!is_dir
? STATX_NLINK
: 0);
198 ovl_path_lower(dentry
, &realpath
);
199 err
= ovl_do_getattr(&realpath
, &lowerstat
, lowermask
,
205 * Lower hardlinks may be broken on copy up to different
206 * upper files, so we cannot use the lower origin st_ino
207 * for those different files, even for the same fs case.
209 * Similarly, several redirected dirs can point to the
210 * same dir on a lower layer. With the "verify_lower"
211 * feature, we do not use the lower origin st_ino, if
212 * we haven't verified that this redirect is unique.
214 * With inodes index enabled, it is safe to use st_ino
215 * of an indexed origin. The index validates that the
216 * upper hardlink is not broken and that a redirected
217 * dir is the only redirect to that origin.
219 if (ovl_test_flag(OVL_INDEX
, d_inode(dentry
)) ||
220 (!ovl_verify_lower(dentry
->d_sb
) &&
221 (is_dir
|| lowerstat
.nlink
== 1))) {
222 fsid
= ovl_layer_lower(dentry
)->fsid
;
223 stat
->ino
= lowerstat
.ino
;
227 * If we are querying a metacopy dentry and lower
228 * dentry is data dentry, then use the blocks we
229 * queried just now. We don't have to do additional
230 * vfs_getattr(). If lower itself is metacopy, then
231 * additional vfs_getattr() is unavoidable.
233 if (metacopy_blocks
&&
234 realpath
.dentry
== ovl_dentry_lowerdata(dentry
)) {
235 stat
->blocks
= lowerstat
.blocks
;
236 metacopy_blocks
= false;
240 if (metacopy_blocks
) {
242 * If lower is not same as lowerdata or if there was
243 * no origin on upper, we can end up here.
244 * With lazy lowerdata lookup, guess lowerdata blocks
245 * from size to avoid lowerdata lookup on stat(2).
247 struct kstat lowerdatastat
;
248 u32 lowermask
= STATX_BLOCKS
;
250 ovl_path_lowerdata(dentry
, &realpath
);
251 if (realpath
.dentry
) {
252 err
= ovl_do_getattr(&realpath
, &lowerdatastat
,
257 lowerdatastat
.blocks
=
258 round_up(stat
->size
, stat
->blksize
) >> 9;
260 stat
->blocks
= lowerdatastat
.blocks
;
264 ovl_map_dev_ino(dentry
, stat
, fsid
);
267 * It's probably not worth it to count subdirs to get the
268 * correct link count. nlink=1 seems to pacify 'find' and
271 if (is_dir
&& OVL_TYPE_MERGE(type
))
275 * Return the overlay inode nlinks for indexed upper inodes.
276 * Overlay inode nlink counts the union of the upper hardlinks
277 * and non-covered lower hardlinks. It does not include the upper
280 if (!is_dir
&& ovl_test_flag(OVL_INDEX
, d_inode(dentry
)))
281 stat
->nlink
= dentry
->d_inode
->i_nlink
;
284 revert_creds(old_cred
);
289 int ovl_permission(struct mnt_idmap
*idmap
,
290 struct inode
*inode
, int mask
)
292 struct inode
*upperinode
= ovl_inode_upper(inode
);
293 struct inode
*realinode
;
294 struct path realpath
;
295 const struct cred
*old_cred
;
298 /* Careful in RCU walk mode */
299 realinode
= ovl_i_path_real(inode
, &realpath
);
301 WARN_ON(!(mask
& MAY_NOT_BLOCK
));
306 * Check overlay inode with the creds of task and underlying inode
307 * with creds of mounter
309 err
= generic_permission(&nop_mnt_idmap
, inode
, mask
);
313 old_cred
= ovl_override_creds(inode
->i_sb
);
315 !special_file(realinode
->i_mode
) && mask
& MAY_WRITE
) {
316 mask
&= ~(MAY_WRITE
| MAY_APPEND
);
317 /* Make sure mounter can read file for copy up later */
320 err
= inode_permission(mnt_idmap(realpath
.mnt
), realinode
, mask
);
321 revert_creds(old_cred
);
326 static const char *ovl_get_link(struct dentry
*dentry
,
328 struct delayed_call
*done
)
330 const struct cred
*old_cred
;
334 return ERR_PTR(-ECHILD
);
336 old_cred
= ovl_override_creds(dentry
->d_sb
);
337 p
= vfs_get_link(ovl_dentry_real(dentry
), done
);
338 revert_creds(old_cred
);
342 #ifdef CONFIG_FS_POSIX_ACL
344 * Apply the idmapping of the layer to POSIX ACLs. The caller must pass a clone
345 * of the POSIX ACLs retrieved from the lower layer to this function to not
346 * alter the POSIX ACLs for the underlying filesystem.
348 static void ovl_idmap_posix_acl(const struct inode
*realinode
,
349 struct mnt_idmap
*idmap
,
350 struct posix_acl
*acl
)
352 struct user_namespace
*fs_userns
= i_user_ns(realinode
);
354 for (unsigned int i
= 0; i
< acl
->a_count
; i
++) {
358 struct posix_acl_entry
*e
= &acl
->a_entries
[i
];
361 vfsuid
= make_vfsuid(idmap
, fs_userns
, e
->e_uid
);
362 e
->e_uid
= vfsuid_into_kuid(vfsuid
);
365 vfsgid
= make_vfsgid(idmap
, fs_userns
, e
->e_gid
);
366 e
->e_gid
= vfsgid_into_kgid(vfsgid
);
373 * The @noperm argument is used to skip permission checking and is a temporary
374 * measure. Quoting Miklos from an earlier discussion:
376 * > So there are two paths to getting an acl:
377 * > 1) permission checking and 2) retrieving the value via getxattr(2).
378 * > This is a similar situation as reading a symlink vs. following it.
379 * > When following a symlink overlayfs always reads the link on the
380 * > underlying fs just as if it was a readlink(2) call, calling
381 * > security_inode_readlink() instead of security_inode_follow_link().
382 * > This is logical: we are reading the link from the underlying storage,
383 * > and following it on overlayfs.
385 * > Applying the same logic to acl: we do need to call the
386 * > security_inode_getxattr() on the underlying fs, even if just want to
387 * > check permissions on overlay. This is currently not done, which is an
390 * > Maybe adding the check to ovl_get_acl() is the right way to go, but
391 * > I'm a little afraid of a performance regression. Will look into that.
393 * Until we have made a decision allow this helper to take the @noperm
394 * argument. We should hopefully be able to remove it soon.
396 struct posix_acl
*ovl_get_acl_path(const struct path
*path
,
397 const char *acl_name
, bool noperm
)
399 struct posix_acl
*real_acl
, *clone
;
400 struct mnt_idmap
*idmap
;
401 struct inode
*realinode
= d_inode(path
->dentry
);
403 idmap
= mnt_idmap(path
->mnt
);
406 real_acl
= get_inode_acl(realinode
, posix_acl_type(acl_name
));
408 real_acl
= vfs_get_acl(idmap
, path
->dentry
, acl_name
);
409 if (IS_ERR_OR_NULL(real_acl
))
412 if (!is_idmapped_mnt(path
->mnt
))
416 * We cannot alter the ACLs returned from the relevant layer as that
417 * would alter the cached values filesystem wide for the lower
418 * filesystem. Instead we can clone the ACLs and then apply the
419 * relevant idmapping of the layer.
421 clone
= posix_acl_clone(real_acl
, GFP_KERNEL
);
422 posix_acl_release(real_acl
); /* release original acl */
424 return ERR_PTR(-ENOMEM
);
426 ovl_idmap_posix_acl(realinode
, idmap
, clone
);
431 * When the relevant layer is an idmapped mount we need to take the idmapping
432 * of the layer into account and translate any ACL_{GROUP,USER} values
433 * according to the idmapped mount.
435 * We cannot alter the ACLs returned from the relevant layer as that would
436 * alter the cached values filesystem wide for the lower filesystem. Instead we
437 * can clone the ACLs and then apply the relevant idmapping of the layer.
439 * This is obviously only relevant when idmapped layers are used.
441 struct posix_acl
*do_ovl_get_acl(struct mnt_idmap
*idmap
,
442 struct inode
*inode
, int type
,
443 bool rcu
, bool noperm
)
445 struct inode
*realinode
;
446 struct posix_acl
*acl
;
447 struct path realpath
;
449 /* Careful in RCU walk mode */
450 realinode
= ovl_i_path_real(inode
, &realpath
);
453 return ERR_PTR(-ECHILD
);
456 if (!IS_POSIXACL(realinode
))
461 * If the layer is idmapped drop out of RCU path walk
462 * so we can clone the ACLs.
464 if (is_idmapped_mnt(realpath
.mnt
))
465 return ERR_PTR(-ECHILD
);
467 acl
= get_cached_acl_rcu(realinode
, type
);
469 const struct cred
*old_cred
;
471 old_cred
= ovl_override_creds(inode
->i_sb
);
472 acl
= ovl_get_acl_path(&realpath
, posix_acl_xattr_name(type
), noperm
);
473 revert_creds(old_cred
);
479 static int ovl_set_or_remove_acl(struct dentry
*dentry
, struct inode
*inode
,
480 struct posix_acl
*acl
, int type
)
483 struct path realpath
;
484 const char *acl_name
;
485 const struct cred
*old_cred
;
486 struct ovl_fs
*ofs
= OVL_FS(dentry
->d_sb
);
487 struct dentry
*upperdentry
= ovl_dentry_upper(dentry
);
488 struct dentry
*realdentry
= upperdentry
?: ovl_dentry_lower(dentry
);
491 * If ACL is to be removed from a lower file, check if it exists in
492 * the first place before copying it up.
494 acl_name
= posix_acl_xattr_name(type
);
495 if (!acl
&& !upperdentry
) {
496 struct posix_acl
*real_acl
;
498 ovl_path_lower(dentry
, &realpath
);
499 old_cred
= ovl_override_creds(dentry
->d_sb
);
500 real_acl
= vfs_get_acl(mnt_idmap(realpath
.mnt
), realdentry
,
502 revert_creds(old_cred
);
503 if (IS_ERR(real_acl
)) {
504 err
= PTR_ERR(real_acl
);
507 posix_acl_release(real_acl
);
511 err
= ovl_copy_up(dentry
);
515 realdentry
= ovl_dentry_upper(dentry
);
518 err
= ovl_want_write(dentry
);
522 old_cred
= ovl_override_creds(dentry
->d_sb
);
524 err
= ovl_do_set_acl(ofs
, realdentry
, acl_name
, acl
);
526 err
= ovl_do_remove_acl(ofs
, realdentry
, acl_name
);
527 revert_creds(old_cred
);
528 ovl_drop_write(dentry
);
536 int ovl_set_acl(struct mnt_idmap
*idmap
, struct dentry
*dentry
,
537 struct posix_acl
*acl
, int type
)
540 struct inode
*inode
= d_inode(dentry
);
541 struct dentry
*workdir
= ovl_workdir(dentry
);
542 struct inode
*realinode
= ovl_inode_real(inode
);
544 if (!IS_POSIXACL(d_inode(workdir
)))
546 if (!realinode
->i_op
->set_acl
)
548 if (type
== ACL_TYPE_DEFAULT
&& !S_ISDIR(inode
->i_mode
))
549 return acl
? -EACCES
: 0;
550 if (!inode_owner_or_capable(&nop_mnt_idmap
, inode
))
554 * Check if sgid bit needs to be cleared (actual setacl operation will
555 * be done with mounter's capabilities and so that won't do it for us).
557 if (unlikely(inode
->i_mode
& S_ISGID
) && type
== ACL_TYPE_ACCESS
&&
558 !in_group_p(inode
->i_gid
) &&
559 !capable_wrt_inode_uidgid(&nop_mnt_idmap
, inode
, CAP_FSETID
)) {
560 struct iattr iattr
= { .ia_valid
= ATTR_KILL_SGID
};
562 err
= ovl_setattr(&nop_mnt_idmap
, dentry
, &iattr
);
567 return ovl_set_or_remove_acl(dentry
, inode
, acl
, type
);
571 int ovl_update_time(struct inode
*inode
, int flags
)
573 if (flags
& S_ATIME
) {
574 struct ovl_fs
*ofs
= OVL_FS(inode
->i_sb
);
575 struct path upperpath
= {
576 .mnt
= ovl_upper_mnt(ofs
),
577 .dentry
= ovl_upperdentry_dereference(OVL_I(inode
)),
580 if (upperpath
.dentry
) {
581 touch_atime(&upperpath
);
582 inode_set_atime_to_ts(inode
,
583 inode_get_atime(d_inode(upperpath
.dentry
)));
589 static int ovl_fiemap(struct inode
*inode
, struct fiemap_extent_info
*fieinfo
,
593 struct inode
*realinode
= ovl_inode_realdata(inode
);
594 const struct cred
*old_cred
;
599 if (!realinode
->i_op
->fiemap
)
602 old_cred
= ovl_override_creds(inode
->i_sb
);
603 err
= realinode
->i_op
->fiemap(realinode
, fieinfo
, start
, len
);
604 revert_creds(old_cred
);
610 * Work around the fact that security_file_ioctl() takes a file argument.
611 * Introducing security_inode_fileattr_get/set() hooks would solve this issue
614 static int ovl_security_fileattr(const struct path
*realpath
, struct fileattr
*fa
,
621 file
= dentry_open(realpath
, O_RDONLY
, current_cred());
623 return PTR_ERR(file
);
626 cmd
= fa
->fsx_valid
? FS_IOC_FSSETXATTR
: FS_IOC_SETFLAGS
;
628 cmd
= fa
->fsx_valid
? FS_IOC_FSGETXATTR
: FS_IOC_GETFLAGS
;
630 err
= security_file_ioctl(file
, cmd
, 0);
636 int ovl_real_fileattr_set(const struct path
*realpath
, struct fileattr
*fa
)
640 err
= ovl_security_fileattr(realpath
, fa
, true);
644 return vfs_fileattr_set(mnt_idmap(realpath
->mnt
), realpath
->dentry
, fa
);
647 int ovl_fileattr_set(struct mnt_idmap
*idmap
,
648 struct dentry
*dentry
, struct fileattr
*fa
)
650 struct inode
*inode
= d_inode(dentry
);
651 struct path upperpath
;
652 const struct cred
*old_cred
;
656 err
= ovl_copy_up(dentry
);
658 ovl_path_real(dentry
, &upperpath
);
660 err
= ovl_want_write(dentry
);
664 old_cred
= ovl_override_creds(inode
->i_sb
);
666 * Store immutable/append-only flags in xattr and clear them
667 * in upper fileattr (in case they were set by older kernel)
668 * so children of "ovl-immutable" directories lower aliases of
669 * "ovl-immutable" hardlinks could be copied up.
670 * Clear xattr when flags are cleared.
672 err
= ovl_set_protattr(inode
, upperpath
.dentry
, fa
);
674 err
= ovl_real_fileattr_set(&upperpath
, fa
);
675 revert_creds(old_cred
);
676 ovl_drop_write(dentry
);
679 * Merge real inode flags with inode flags read from
680 * overlay.protattr xattr
682 flags
= ovl_inode_real(inode
)->i_flags
& OVL_COPY_I_FLAGS_MASK
;
684 BUILD_BUG_ON(OVL_PROT_I_FLAGS_MASK
& ~OVL_COPY_I_FLAGS_MASK
);
685 flags
|= inode
->i_flags
& OVL_PROT_I_FLAGS_MASK
;
686 inode_set_flags(inode
, flags
, OVL_COPY_I_FLAGS_MASK
);
695 /* Convert inode protection flags to fileattr flags */
696 static void ovl_fileattr_prot_flags(struct inode
*inode
, struct fileattr
*fa
)
698 BUILD_BUG_ON(OVL_PROT_FS_FLAGS_MASK
& ~FS_COMMON_FL
);
699 BUILD_BUG_ON(OVL_PROT_FSX_FLAGS_MASK
& ~FS_XFLAG_COMMON
);
701 if (inode
->i_flags
& S_APPEND
) {
702 fa
->flags
|= FS_APPEND_FL
;
703 fa
->fsx_xflags
|= FS_XFLAG_APPEND
;
705 if (inode
->i_flags
& S_IMMUTABLE
) {
706 fa
->flags
|= FS_IMMUTABLE_FL
;
707 fa
->fsx_xflags
|= FS_XFLAG_IMMUTABLE
;
711 int ovl_real_fileattr_get(const struct path
*realpath
, struct fileattr
*fa
)
715 err
= ovl_security_fileattr(realpath
, fa
, false);
719 err
= vfs_fileattr_get(realpath
->dentry
, fa
);
720 if (err
== -ENOIOCTLCMD
)
725 int ovl_fileattr_get(struct dentry
*dentry
, struct fileattr
*fa
)
727 struct inode
*inode
= d_inode(dentry
);
728 struct path realpath
;
729 const struct cred
*old_cred
;
732 ovl_path_real(dentry
, &realpath
);
734 old_cred
= ovl_override_creds(inode
->i_sb
);
735 err
= ovl_real_fileattr_get(&realpath
, fa
);
736 ovl_fileattr_prot_flags(inode
, fa
);
737 revert_creds(old_cred
);
742 static const struct inode_operations ovl_file_inode_operations
= {
743 .setattr
= ovl_setattr
,
744 .permission
= ovl_permission
,
745 .getattr
= ovl_getattr
,
746 .listxattr
= ovl_listxattr
,
747 .get_inode_acl
= ovl_get_inode_acl
,
748 .get_acl
= ovl_get_acl
,
749 .set_acl
= ovl_set_acl
,
750 .update_time
= ovl_update_time
,
751 .fiemap
= ovl_fiemap
,
752 .fileattr_get
= ovl_fileattr_get
,
753 .fileattr_set
= ovl_fileattr_set
,
756 static const struct inode_operations ovl_symlink_inode_operations
= {
757 .setattr
= ovl_setattr
,
758 .get_link
= ovl_get_link
,
759 .getattr
= ovl_getattr
,
760 .listxattr
= ovl_listxattr
,
761 .update_time
= ovl_update_time
,
764 static const struct inode_operations ovl_special_inode_operations
= {
765 .setattr
= ovl_setattr
,
766 .permission
= ovl_permission
,
767 .getattr
= ovl_getattr
,
768 .listxattr
= ovl_listxattr
,
769 .get_inode_acl
= ovl_get_inode_acl
,
770 .get_acl
= ovl_get_acl
,
771 .set_acl
= ovl_set_acl
,
772 .update_time
= ovl_update_time
,
775 static const struct address_space_operations ovl_aops
= {
776 /* For O_DIRECT dentry_open() checks f_mapping->a_ops->direct_IO */
777 .direct_IO
= noop_direct_IO
,
781 * It is possible to stack overlayfs instance on top of another
782 * overlayfs instance as lower layer. We need to annotate the
783 * stackable i_mutex locks according to stack level of the super
784 * block instance. An overlayfs instance can never be in stack
785 * depth 0 (there is always a real fs below it). An overlayfs
786 * inode lock will use the lockdep annotation ovl_i_mutex_key[depth].
788 * For example, here is a snip from /proc/lockdep_chains after
789 * dir_iterate of nested overlayfs:
791 * [...] &ovl_i_mutex_dir_key[depth] (stack_depth=2)
792 * [...] &ovl_i_mutex_dir_key[depth]#2 (stack_depth=1)
793 * [...] &type->i_mutex_dir_key (stack_depth=0)
795 * Locking order w.r.t ovl_want_write() is important for nested overlayfs.
797 * This chain is valid:
798 * - inode->i_rwsem (inode_lock[2])
799 * - upper_mnt->mnt_sb->s_writers (ovl_want_write[0])
800 * - OVL_I(inode)->lock (ovl_inode_lock[2])
801 * - OVL_I(lowerinode)->lock (ovl_inode_lock[1])
803 * And this chain is valid:
804 * - inode->i_rwsem (inode_lock[2])
805 * - OVL_I(inode)->lock (ovl_inode_lock[2])
806 * - lowerinode->i_rwsem (inode_lock[1])
807 * - OVL_I(lowerinode)->lock (ovl_inode_lock[1])
809 * But lowerinode->i_rwsem SHOULD NOT be acquired while ovl_want_write() is
810 * held, because it is in reverse order of the non-nested case using the same
812 * - inode->i_rwsem (inode_lock[1])
813 * - upper_mnt->mnt_sb->s_writers (ovl_want_write[0])
814 * - OVL_I(inode)->lock (ovl_inode_lock[1])
816 #define OVL_MAX_NESTING FILESYSTEM_MAX_STACK_DEPTH
818 static inline void ovl_lockdep_annotate_inode_mutex_key(struct inode
*inode
)
820 #ifdef CONFIG_LOCKDEP
821 static struct lock_class_key ovl_i_mutex_key
[OVL_MAX_NESTING
];
822 static struct lock_class_key ovl_i_mutex_dir_key
[OVL_MAX_NESTING
];
823 static struct lock_class_key ovl_i_lock_key
[OVL_MAX_NESTING
];
825 int depth
= inode
->i_sb
->s_stack_depth
- 1;
827 if (WARN_ON_ONCE(depth
< 0 || depth
>= OVL_MAX_NESTING
))
830 if (S_ISDIR(inode
->i_mode
))
831 lockdep_set_class(&inode
->i_rwsem
, &ovl_i_mutex_dir_key
[depth
]);
833 lockdep_set_class(&inode
->i_rwsem
, &ovl_i_mutex_key
[depth
]);
835 lockdep_set_class(&OVL_I(inode
)->lock
, &ovl_i_lock_key
[depth
]);
839 static void ovl_next_ino(struct inode
*inode
)
841 struct ovl_fs
*ofs
= OVL_FS(inode
->i_sb
);
843 inode
->i_ino
= atomic_long_inc_return(&ofs
->last_ino
);
844 if (unlikely(!inode
->i_ino
))
845 inode
->i_ino
= atomic_long_inc_return(&ofs
->last_ino
);
848 static void ovl_map_ino(struct inode
*inode
, unsigned long ino
, int fsid
)
850 struct ovl_fs
*ofs
= OVL_FS(inode
->i_sb
);
851 int xinobits
= ovl_xino_bits(ofs
);
852 unsigned int xinoshift
= 64 - xinobits
;
855 * When d_ino is consistent with st_ino (samefs or i_ino has enough
856 * bits to encode layer), set the same value used for st_ino to i_ino,
857 * so inode number exposed via /proc/locks and a like will be
858 * consistent with d_ino and st_ino values. An i_ino value inconsistent
859 * with d_ino also causes nfsd readdirplus to fail.
862 if (ovl_same_fs(ofs
)) {
864 } else if (xinobits
&& likely(!(ino
>> xinoshift
))) {
865 inode
->i_ino
|= (unsigned long)fsid
<< (xinoshift
+ 1);
870 * For directory inodes on non-samefs with xino disabled or xino
871 * overflow, we allocate a non-persistent inode number, to be used for
872 * resolving st_ino collisions in ovl_map_dev_ino().
874 * To avoid ino collision with legitimate xino values from upper
875 * layer (fsid 0), use the lowest xinobit to map the non
876 * persistent inode numbers to the unified st_ino address space.
878 if (S_ISDIR(inode
->i_mode
)) {
881 inode
->i_ino
&= ~0UL >> xinobits
;
882 inode
->i_ino
|= 1UL << xinoshift
;
887 void ovl_inode_init(struct inode
*inode
, struct ovl_inode_params
*oip
,
888 unsigned long ino
, int fsid
)
890 struct inode
*realinode
;
891 struct ovl_inode
*oi
= OVL_I(inode
);
893 oi
->__upperdentry
= oip
->upperdentry
;
895 oi
->redirect
= oip
->redirect
;
896 oi
->lowerdata_redirect
= oip
->lowerdata_redirect
;
898 realinode
= ovl_inode_real(inode
);
900 ovl_copyflags(realinode
, inode
);
901 ovl_map_ino(inode
, ino
, fsid
);
904 static void ovl_fill_inode(struct inode
*inode
, umode_t mode
, dev_t rdev
)
906 inode
->i_mode
= mode
;
907 inode
->i_flags
|= S_NOCMTIME
;
908 #ifdef CONFIG_FS_POSIX_ACL
909 inode
->i_acl
= inode
->i_default_acl
= ACL_DONT_CACHE
;
912 ovl_lockdep_annotate_inode_mutex_key(inode
);
914 switch (mode
& S_IFMT
) {
916 inode
->i_op
= &ovl_file_inode_operations
;
917 inode
->i_fop
= &ovl_file_operations
;
918 inode
->i_mapping
->a_ops
= &ovl_aops
;
922 inode
->i_op
= &ovl_dir_inode_operations
;
923 inode
->i_fop
= &ovl_dir_operations
;
927 inode
->i_op
= &ovl_symlink_inode_operations
;
931 inode
->i_op
= &ovl_special_inode_operations
;
932 init_special_inode(inode
, mode
, rdev
);
938 * With inodes index enabled, an overlay inode nlink counts the union of upper
939 * hardlinks and non-covered lower hardlinks. During the lifetime of a non-pure
940 * upper inode, the following nlink modifying operations can happen:
942 * 1. Lower hardlink copy up
943 * 2. Upper hardlink created, unlinked or renamed over
944 * 3. Lower hardlink whiteout or renamed over
946 * For the first, copy up case, the union nlink does not change, whether the
947 * operation succeeds or fails, but the upper inode nlink may change.
948 * Therefore, before copy up, we store the union nlink value relative to the
949 * lower inode nlink in the index inode xattr .overlay.nlink.
951 * For the second, upper hardlink case, the union nlink should be incremented
952 * or decremented IFF the operation succeeds, aligned with nlink change of the
953 * upper inode. Therefore, before link/unlink/rename, we store the union nlink
954 * value relative to the upper inode nlink in the index inode.
956 * For the last, lower cover up case, we simplify things by preceding the
957 * whiteout or cover up with copy up. This makes sure that there is an index
958 * upper inode where the nlink xattr can be stored before the copied up upper
961 #define OVL_NLINK_ADD_UPPER (1 << 0)
964 * On-disk format for indexed nlink:
966 * nlink relative to the upper inode - "U[+-]NUM"
967 * nlink relative to the lower inode - "L[+-]NUM"
970 static int ovl_set_nlink_common(struct dentry
*dentry
,
971 struct dentry
*realdentry
, const char *format
)
973 struct inode
*inode
= d_inode(dentry
);
974 struct inode
*realinode
= d_inode(realdentry
);
978 len
= snprintf(buf
, sizeof(buf
), format
,
979 (int) (inode
->i_nlink
- realinode
->i_nlink
));
981 if (WARN_ON(len
>= sizeof(buf
)))
984 return ovl_setxattr(OVL_FS(inode
->i_sb
), ovl_dentry_upper(dentry
),
985 OVL_XATTR_NLINK
, buf
, len
);
988 int ovl_set_nlink_upper(struct dentry
*dentry
)
990 return ovl_set_nlink_common(dentry
, ovl_dentry_upper(dentry
), "U%+i");
993 int ovl_set_nlink_lower(struct dentry
*dentry
)
995 return ovl_set_nlink_common(dentry
, ovl_dentry_lower(dentry
), "L%+i");
998 unsigned int ovl_get_nlink(struct ovl_fs
*ofs
, struct dentry
*lowerdentry
,
999 struct dentry
*upperdentry
,
1000 unsigned int fallback
)
1007 if (!lowerdentry
|| !upperdentry
|| d_inode(lowerdentry
)->i_nlink
== 1)
1010 err
= ovl_getxattr_upper(ofs
, upperdentry
, OVL_XATTR_NLINK
,
1011 &buf
, sizeof(buf
) - 1);
1016 if ((buf
[0] != 'L' && buf
[0] != 'U') ||
1017 (buf
[1] != '+' && buf
[1] != '-'))
1020 err
= kstrtoint(buf
+ 1, 10, &nlink_diff
);
1024 nlink
= d_inode(buf
[0] == 'L' ? lowerdentry
: upperdentry
)->i_nlink
;
1025 nlink
+= nlink_diff
;
1033 pr_warn_ratelimited("failed to get index nlink (%pd2, err=%i)\n",
1038 struct inode
*ovl_new_inode(struct super_block
*sb
, umode_t mode
, dev_t rdev
)
1040 struct inode
*inode
;
1042 inode
= new_inode(sb
);
1044 ovl_fill_inode(inode
, mode
, rdev
);
1049 static int ovl_inode_test(struct inode
*inode
, void *data
)
1051 return inode
->i_private
== data
;
1054 static int ovl_inode_set(struct inode
*inode
, void *data
)
1056 inode
->i_private
= data
;
1060 static bool ovl_verify_inode(struct inode
*inode
, struct dentry
*lowerdentry
,
1061 struct dentry
*upperdentry
, bool strict
)
1064 * For directories, @strict verify from lookup path performs consistency
1065 * checks, so NULL lower/upper in dentry must match NULL lower/upper in
1066 * inode. Non @strict verify from NFS handle decode path passes NULL for
1067 * 'unknown' lower/upper.
1069 if (S_ISDIR(inode
->i_mode
) && strict
) {
1070 /* Real lower dir moved to upper layer under us? */
1071 if (!lowerdentry
&& ovl_inode_lower(inode
))
1074 /* Lookup of an uncovered redirect origin? */
1075 if (!upperdentry
&& ovl_inode_upper(inode
))
1080 * Allow non-NULL lower inode in ovl_inode even if lowerdentry is NULL.
1081 * This happens when finding a copied up overlay inode for a renamed
1082 * or hardlinked overlay dentry and lower dentry cannot be followed
1083 * by origin because lower fs does not support file handles.
1085 if (lowerdentry
&& ovl_inode_lower(inode
) != d_inode(lowerdentry
))
1089 * Allow non-NULL __upperdentry in inode even if upperdentry is NULL.
1090 * This happens when finding a lower alias for a copied up hard link.
1092 if (upperdentry
&& ovl_inode_upper(inode
) != d_inode(upperdentry
))
1098 struct inode
*ovl_lookup_inode(struct super_block
*sb
, struct dentry
*real
,
1101 struct inode
*inode
, *key
= d_inode(real
);
1103 inode
= ilookup5(sb
, (unsigned long) key
, ovl_inode_test
, key
);
1107 if (!ovl_verify_inode(inode
, is_upper
? NULL
: real
,
1108 is_upper
? real
: NULL
, false)) {
1110 return ERR_PTR(-ESTALE
);
1116 bool ovl_lookup_trap_inode(struct super_block
*sb
, struct dentry
*dir
)
1118 struct inode
*key
= d_inode(dir
);
1122 trap
= ilookup5(sb
, (unsigned long) key
, ovl_inode_test
, key
);
1126 res
= IS_DEADDIR(trap
) && !ovl_inode_upper(trap
) &&
1127 !ovl_inode_lower(trap
);
1134 * Create an inode cache entry for layer root dir, that will intentionally
1135 * fail ovl_verify_inode(), so any lookup that will find some layer root
1138 struct inode
*ovl_get_trap_inode(struct super_block
*sb
, struct dentry
*dir
)
1140 struct inode
*key
= d_inode(dir
);
1144 return ERR_PTR(-ENOTDIR
);
1146 trap
= iget5_locked(sb
, (unsigned long) key
, ovl_inode_test
,
1147 ovl_inode_set
, key
);
1149 return ERR_PTR(-ENOMEM
);
1151 if (!(trap
->i_state
& I_NEW
)) {
1152 /* Conflicting layer roots? */
1154 return ERR_PTR(-ELOOP
);
1157 trap
->i_mode
= S_IFDIR
;
1158 trap
->i_flags
= S_DEAD
;
1159 unlock_new_inode(trap
);
1165 * Does overlay inode need to be hashed by lower inode?
1167 static bool ovl_hash_bylower(struct super_block
*sb
, struct dentry
*upper
,
1168 struct dentry
*lower
, bool index
)
1170 struct ovl_fs
*ofs
= OVL_FS(sb
);
1172 /* No, if pure upper */
1176 /* Yes, if already indexed */
1180 /* Yes, if won't be copied up */
1181 if (!ovl_upper_mnt(ofs
))
1184 /* No, if lower hardlink is or will be broken on copy up */
1185 if ((upper
|| !ovl_indexdir(sb
)) &&
1186 !d_is_dir(lower
) && d_inode(lower
)->i_nlink
> 1)
1189 /* No, if non-indexed upper with NFS export */
1190 if (ofs
->config
.nfs_export
&& upper
)
1193 /* Otherwise, hash by lower inode for fsnotify */
1197 static struct inode
*ovl_iget5(struct super_block
*sb
, struct inode
*newinode
,
1200 return newinode
? inode_insert5(newinode
, (unsigned long) key
,
1201 ovl_inode_test
, ovl_inode_set
, key
) :
1202 iget5_locked(sb
, (unsigned long) key
,
1203 ovl_inode_test
, ovl_inode_set
, key
);
1206 struct inode
*ovl_get_inode(struct super_block
*sb
,
1207 struct ovl_inode_params
*oip
)
1209 struct ovl_fs
*ofs
= OVL_FS(sb
);
1210 struct dentry
*upperdentry
= oip
->upperdentry
;
1211 struct ovl_path
*lowerpath
= ovl_lowerpath(oip
->oe
);
1212 struct inode
*realinode
= upperdentry
? d_inode(upperdentry
) : NULL
;
1213 struct inode
*inode
;
1214 struct dentry
*lowerdentry
= lowerpath
? lowerpath
->dentry
: NULL
;
1215 struct path realpath
= {
1216 .dentry
= upperdentry
?: lowerdentry
,
1217 .mnt
= upperdentry
? ovl_upper_mnt(ofs
) : lowerpath
->layer
->mnt
,
1219 bool bylower
= ovl_hash_bylower(sb
, upperdentry
, lowerdentry
,
1221 int fsid
= bylower
? lowerpath
->layer
->fsid
: 0;
1223 unsigned long ino
= 0;
1224 int err
= oip
->newinode
? -EEXIST
: -ENOMEM
;
1227 realinode
= d_inode(lowerdentry
);
1230 * Copy up origin (lower) may exist for non-indexed upper, but we must
1231 * not use lower as hash key if this is a broken hardlink.
1233 is_dir
= S_ISDIR(realinode
->i_mode
);
1234 if (upperdentry
|| bylower
) {
1235 struct inode
*key
= d_inode(bylower
? lowerdentry
:
1237 unsigned int nlink
= is_dir
? 1 : realinode
->i_nlink
;
1239 inode
= ovl_iget5(sb
, oip
->newinode
, key
);
1242 if (!(inode
->i_state
& I_NEW
)) {
1244 * Verify that the underlying files stored in the inode
1245 * match those in the dentry.
1247 if (!ovl_verify_inode(inode
, lowerdentry
, upperdentry
,
1255 ovl_free_entry(oip
->oe
);
1256 kfree(oip
->redirect
);
1257 kfree(oip
->lowerdata_redirect
);
1261 /* Recalculate nlink for non-dir due to indexing */
1263 nlink
= ovl_get_nlink(ofs
, lowerdentry
, upperdentry
,
1265 set_nlink(inode
, nlink
);
1268 /* Lower hardlink that will be broken on copy up */
1269 inode
= new_inode(sb
);
1274 ino
= realinode
->i_ino
;
1275 fsid
= lowerpath
->layer
->fsid
;
1277 ovl_fill_inode(inode
, realinode
->i_mode
, realinode
->i_rdev
);
1278 ovl_inode_init(inode
, oip
, ino
, fsid
);
1280 if (upperdentry
&& ovl_is_impuredir(sb
, upperdentry
))
1281 ovl_set_flag(OVL_IMPURE
, inode
);
1284 ovl_set_flag(OVL_INDEX
, inode
);
1287 ovl_set_flag(OVL_CONST_INO
, inode
);
1289 /* Check for non-merge dir that may have whiteouts */
1291 if (((upperdentry
&& lowerdentry
) || ovl_numlower(oip
->oe
) > 1) ||
1292 ovl_path_check_origin_xattr(ofs
, &realpath
)) {
1293 ovl_set_flag(OVL_WHITEOUTS
, inode
);
1297 /* Check for immutable/append-only inode flags in xattr */
1299 ovl_check_protattr(inode
, upperdentry
);
1301 if (inode
->i_state
& I_NEW
)
1302 unlock_new_inode(inode
);
1307 pr_warn_ratelimited("failed to get inode (%i)\n", err
);
1308 inode
= ERR_PTR(err
);