]>
git.ipfire.org Git - thirdparty/kernel/linux.git/blob - fs/overlayfs/namei.c
1 // SPDX-License-Identifier: GPL-2.0-only
3 * Copyright (C) 2011 Novell Inc.
4 * Copyright (C) 2016 Red Hat, Inc.
8 #include <linux/cred.h>
9 #include <linux/ctype.h>
10 #include <linux/namei.h>
11 #include <linux/xattr.h>
12 #include <linux/ratelimit.h>
13 #include <linux/mount.h>
14 #include <linux/exportfs.h>
15 #include "overlayfs.h"
17 #include "../internal.h" /* for vfs_path_lookup */
19 struct ovl_lookup_data
{
20 struct super_block
*sb
;
29 /* Referring to last redirect xattr */
30 bool absolute_redirect
;
33 static int ovl_check_redirect(const struct path
*path
, struct ovl_lookup_data
*d
,
34 size_t prelen
, const char *post
)
38 struct ovl_fs
*ofs
= OVL_FS(d
->sb
);
40 d
->absolute_redirect
= false;
41 buf
= ovl_get_redirect_xattr(ofs
, path
, prelen
+ strlen(post
));
42 if (IS_ERR_OR_NULL(buf
))
46 d
->absolute_redirect
= true;
48 * One of the ancestor path elements in an absolute path
49 * lookup in ovl_lookup_layer() could have been opaque and
50 * that will stop further lookup in lower layers (d->stop=true)
51 * But we have found an absolute redirect in descendant path
52 * element and that should force continue lookup in lower
53 * layers (reset d->stop).
57 res
= strlen(buf
) + 1;
58 memmove(buf
+ prelen
, buf
, res
);
59 memcpy(buf
, d
->name
.name
, prelen
);
65 d
->name
.name
= d
->redirect
;
66 d
->name
.len
= strlen(d
->redirect
);
71 static int ovl_acceptable(void *ctx
, struct dentry
*dentry
)
74 * A non-dir origin may be disconnected, which is fine, because
75 * we only need it for its unique inode number.
77 if (!d_is_dir(dentry
))
80 /* Don't decode a deleted empty directory */
81 if (d_unhashed(dentry
))
84 /* Check if directory belongs to the layer we are decoding from */
85 return is_subdir(dentry
, ((struct vfsmount
*)ctx
)->mnt_root
);
89 * Check validity of an overlay file handle buffer.
91 * Return 0 for a valid file handle.
92 * Return -ENODATA for "origin unknown".
93 * Return <0 for an invalid file handle.
95 int ovl_check_fb_len(struct ovl_fb
*fb
, int fb_len
)
97 if (fb_len
< sizeof(struct ovl_fb
) || fb_len
< fb
->len
)
100 if (fb
->magic
!= OVL_FH_MAGIC
)
103 /* Treat larger version and unknown flags as "origin unknown" */
104 if (fb
->version
> OVL_FH_VERSION
|| fb
->flags
& ~OVL_FH_FLAG_ALL
)
107 /* Treat endianness mismatch as "origin unknown" */
108 if (!(fb
->flags
& OVL_FH_FLAG_ANY_ENDIAN
) &&
109 (fb
->flags
& OVL_FH_FLAG_BIG_ENDIAN
) != OVL_FH_FLAG_CPU_ENDIAN
)
115 static struct ovl_fh
*ovl_get_fh(struct ovl_fs
*ofs
, struct dentry
*upperdentry
,
119 struct ovl_fh
*fh
= NULL
;
121 res
= ovl_getxattr_upper(ofs
, upperdentry
, ox
, NULL
, 0);
123 if (res
== -ENODATA
|| res
== -EOPNOTSUPP
)
127 /* Zero size value means "copied up but origin unknown" */
131 fh
= kzalloc(res
+ OVL_FH_WIRE_OFFSET
, GFP_KERNEL
);
133 return ERR_PTR(-ENOMEM
);
135 res
= ovl_getxattr_upper(ofs
, upperdentry
, ox
, fh
->buf
, res
);
139 err
= ovl_check_fb_len(&fh
->fb
, res
);
153 pr_warn_ratelimited("failed to get origin (%i)\n", res
);
156 pr_warn_ratelimited("invalid origin (%*phN)\n", res
, fh
);
160 struct dentry
*ovl_decode_real_fh(struct ovl_fs
*ofs
, struct ovl_fh
*fh
,
161 struct vfsmount
*mnt
, bool connected
)
166 if (!capable(CAP_DAC_READ_SEARCH
))
170 * Make sure that the stored uuid matches the uuid of the lower
171 * layer where file handle will be decoded.
172 * In case of uuid=off option just make sure that stored uuid is null.
174 if (ovl_origin_uuid(ofs
) ?
175 !uuid_equal(&fh
->fb
.uuid
, &mnt
->mnt_sb
->s_uuid
) :
176 !uuid_is_null(&fh
->fb
.uuid
))
179 bytes
= (fh
->fb
.len
- offsetof(struct ovl_fb
, fid
));
180 real
= exportfs_decode_fh(mnt
, (struct fid
*)fh
->fb
.fid
,
181 bytes
>> 2, (int)fh
->fb
.type
,
182 connected
? ovl_acceptable
: NULL
, mnt
);
185 * Treat stale file handle to lower file as "origin unknown".
186 * upper file handle could become stale when upper file is
187 * unlinked and this information is needed to handle stale
188 * index entries correctly.
190 if (real
== ERR_PTR(-ESTALE
) &&
191 !(fh
->fb
.flags
& OVL_FH_FLAG_PATH_UPPER
))
196 if (ovl_dentry_weird(real
)) {
204 static bool ovl_is_opaquedir(struct ovl_fs
*ofs
, const struct path
*path
)
206 return ovl_path_check_dir_xattr(ofs
, path
, OVL_XATTR_OPAQUE
);
209 static struct dentry
*ovl_lookup_positive_unlocked(struct ovl_lookup_data
*d
,
211 struct dentry
*base
, int len
,
214 struct dentry
*ret
= lookup_one_unlocked(mnt_idmap(d
->mnt
), name
, base
, len
);
216 if (!IS_ERR(ret
) && d_flags_negative(smp_load_acquire(&ret
->d_flags
))) {
217 if (drop_negative
&& ret
->d_lockref
.count
== 1) {
218 spin_lock(&ret
->d_lock
);
219 /* Recheck condition under lock */
220 if (d_is_negative(ret
) && ret
->d_lockref
.count
== 1)
222 spin_unlock(&ret
->d_lock
);
225 ret
= ERR_PTR(-ENOENT
);
230 static int ovl_lookup_single(struct dentry
*base
, struct ovl_lookup_data
*d
,
231 const char *name
, unsigned int namelen
,
232 size_t prelen
, const char *post
,
233 struct dentry
**ret
, bool drop_negative
)
238 bool last_element
= !post
[0];
240 this = ovl_lookup_positive_unlocked(d
, name
, base
, namelen
, drop_negative
);
244 if (err
== -ENOENT
|| err
== -ENAMETOOLONG
)
249 if (ovl_dentry_weird(this)) {
250 /* Don't support traversing automounts and other weirdness */
254 if (ovl_is_whiteout(this)) {
255 d
->stop
= d
->opaque
= true;
259 * This dentry should be a regular file if previous layer lookup
260 * found a metacopy dentry.
262 if (last_element
&& d
->metacopy
&& !d_is_reg(this)) {
269 if (!d_can_lookup(this)) {
270 if (d
->is_dir
|| !last_element
) {
274 err
= ovl_check_metacopy_xattr(OVL_FS(d
->sb
), &path
, NULL
);
279 d
->stop
= !d
->metacopy
;
280 if (!d
->metacopy
|| d
->last
)
283 if (ovl_lookup_trap_inode(d
->sb
, this)) {
284 /* Caught in a trap of overlapping layers */
294 if (ovl_is_opaquedir(OVL_FS(d
->sb
), &path
)) {
301 err
= ovl_check_redirect(&path
, d
, prelen
, post
);
318 static int ovl_lookup_layer(struct dentry
*base
, struct ovl_lookup_data
*d
,
319 struct dentry
**ret
, bool drop_negative
)
321 /* Counting down from the end, since the prefix can change */
322 size_t rem
= d
->name
.len
- 1;
323 struct dentry
*dentry
= NULL
;
326 if (d
->name
.name
[0] != '/')
327 return ovl_lookup_single(base
, d
, d
->name
.name
, d
->name
.len
,
328 0, "", ret
, drop_negative
);
330 while (!IS_ERR_OR_NULL(base
) && d_can_lookup(base
)) {
331 const char *s
= d
->name
.name
+ d
->name
.len
- rem
;
332 const char *next
= strchrnul(s
, '/');
333 size_t thislen
= next
- s
;
336 /* Verify we did not go off the rails */
337 if (WARN_ON(s
[-1] != '/'))
340 err
= ovl_lookup_single(base
, d
, s
, thislen
,
341 d
->name
.len
- rem
, next
, &base
,
352 if (WARN_ON(rem
>= d
->name
.len
))
359 static int ovl_lookup_data_layer(struct dentry
*dentry
, const char *redirect
,
360 const struct ovl_layer
*layer
,
361 struct path
*datapath
)
365 err
= vfs_path_lookup(layer
->mnt
->mnt_root
, layer
->mnt
, redirect
,
366 LOOKUP_BENEATH
| LOOKUP_NO_SYMLINKS
| LOOKUP_NO_XDEV
,
368 pr_debug("lookup lowerdata (%pd2, redirect=\"%s\", layer=%d, err=%i)\n",
369 dentry
, redirect
, layer
->idx
, err
);
375 if (ovl_dentry_weird(datapath
->dentry
))
379 /* Only regular file is acceptable as lower data */
380 if (!d_is_reg(datapath
->dentry
))
391 /* Lookup in data-only layers by absolute redirect to layer root */
392 static int ovl_lookup_data_layers(struct dentry
*dentry
, const char *redirect
,
393 struct ovl_path
*lowerdata
)
395 struct ovl_fs
*ofs
= OVL_FS(dentry
->d_sb
);
396 const struct ovl_layer
*layer
;
397 struct path datapath
;
401 layer
= &ofs
->layers
[ofs
->numlayer
- ofs
->numdatalayer
];
402 for (i
= 0; i
< ofs
->numdatalayer
; i
++, layer
++) {
403 err
= ovl_lookup_data_layer(dentry
, redirect
, layer
, &datapath
);
405 mntput(datapath
.mnt
);
406 lowerdata
->dentry
= datapath
.dentry
;
407 lowerdata
->layer
= layer
;
415 int ovl_check_origin_fh(struct ovl_fs
*ofs
, struct ovl_fh
*fh
, bool connected
,
416 struct dentry
*upperdentry
, struct ovl_path
**stackp
)
418 struct dentry
*origin
= NULL
;
421 for (i
= 1; i
<= ovl_numlowerlayer(ofs
); i
++) {
423 * If lower fs uuid is not unique among lower fs we cannot match
426 if (ofs
->layers
[i
].fsid
&&
427 ofs
->layers
[i
].fs
->bad_uuid
)
430 origin
= ovl_decode_real_fh(ofs
, fh
, ofs
->layers
[i
].mnt
,
438 else if (IS_ERR(origin
))
439 return PTR_ERR(origin
);
441 if (upperdentry
&& !ovl_is_whiteout(upperdentry
) &&
442 inode_wrong_type(d_inode(upperdentry
), d_inode(origin
)->i_mode
))
446 *stackp
= kmalloc(sizeof(struct ovl_path
), GFP_KERNEL
);
451 **stackp
= (struct ovl_path
){
453 .layer
= &ofs
->layers
[i
]
459 pr_warn_ratelimited("invalid origin (%pd2, ftype=%x, origin ftype=%x).\n",
460 upperdentry
, d_inode(upperdentry
)->i_mode
& S_IFMT
,
461 d_inode(origin
)->i_mode
& S_IFMT
);
466 static int ovl_check_origin(struct ovl_fs
*ofs
, struct dentry
*upperdentry
,
467 struct ovl_path
**stackp
)
469 struct ovl_fh
*fh
= ovl_get_fh(ofs
, upperdentry
, OVL_XATTR_ORIGIN
);
472 if (IS_ERR_OR_NULL(fh
))
475 err
= ovl_check_origin_fh(ofs
, fh
, false, upperdentry
, stackp
);
488 * Verify that @fh matches the file handle stored in xattr @name.
489 * Return 0 on match, -ESTALE on mismatch, < 0 on error.
491 static int ovl_verify_fh(struct ovl_fs
*ofs
, struct dentry
*dentry
,
492 enum ovl_xattr ox
, const struct ovl_fh
*fh
)
494 struct ovl_fh
*ofh
= ovl_get_fh(ofs
, dentry
, ox
);
503 if (fh
->fb
.len
!= ofh
->fb
.len
|| memcmp(&fh
->fb
, &ofh
->fb
, fh
->fb
.len
))
510 int ovl_verify_set_fh(struct ovl_fs
*ofs
, struct dentry
*dentry
,
511 enum ovl_xattr ox
, const struct ovl_fh
*fh
,
512 bool is_upper
, bool set
)
516 err
= ovl_verify_fh(ofs
, dentry
, ox
, fh
);
517 if (set
&& err
== -ENODATA
)
518 err
= ovl_setxattr(ofs
, dentry
, ox
, fh
->buf
, fh
->fb
.len
);
524 * Verify that @real dentry matches the file handle stored in xattr @name.
526 * If @set is true and there is no stored file handle, encode @real and store
527 * file handle in xattr @name.
529 * Return 0 on match, -ESTALE on mismatch, -ENODATA on no xattr, < 0 on error.
531 int ovl_verify_origin_xattr(struct ovl_fs
*ofs
, struct dentry
*dentry
,
532 enum ovl_xattr ox
, struct dentry
*real
,
533 bool is_upper
, bool set
)
539 fh
= ovl_encode_real_fh(ofs
, real
, is_upper
);
546 err
= ovl_verify_set_fh(ofs
, dentry
, ox
, fh
, is_upper
, set
);
555 inode
= d_inode(real
);
556 pr_warn_ratelimited("failed to verify %s (%pd2, ino=%lu, err=%i)\n",
557 is_upper
? "upper" : "origin", real
,
558 inode
? inode
->i_ino
: 0, err
);
563 /* Get upper dentry from index */
564 struct dentry
*ovl_index_upper(struct ovl_fs
*ofs
, struct dentry
*index
,
568 struct dentry
*upper
;
570 if (!d_is_dir(index
))
573 fh
= ovl_get_fh(ofs
, index
, OVL_XATTR_UPPER
);
574 if (IS_ERR_OR_NULL(fh
))
577 upper
= ovl_decode_real_fh(ofs
, fh
, ovl_upper_mnt(ofs
), connected
);
580 if (IS_ERR_OR_NULL(upper
))
581 return upper
?: ERR_PTR(-ESTALE
);
583 if (!d_is_dir(upper
)) {
584 pr_warn_ratelimited("invalid index upper (%pd2, upper=%pd2).\n",
587 return ERR_PTR(-EIO
);
594 * Verify that an index entry name matches the origin file handle stored in
595 * OVL_XATTR_ORIGIN and that origin file handle can be decoded to lower path.
596 * Return 0 on match, -ESTALE on mismatch or stale origin, < 0 on error.
598 int ovl_verify_index(struct ovl_fs
*ofs
, struct dentry
*index
)
600 struct ovl_fh
*fh
= NULL
;
602 struct ovl_path origin
= { };
603 struct ovl_path
*stack
= &origin
;
604 struct dentry
*upper
= NULL
;
611 if (index
->d_name
.len
< sizeof(struct ovl_fb
)*2)
615 len
= index
->d_name
.len
/ 2;
616 fh
= kzalloc(len
+ OVL_FH_WIRE_OFFSET
, GFP_KERNEL
);
621 if (hex2bin(fh
->buf
, index
->d_name
.name
, len
))
624 err
= ovl_check_fb_len(&fh
->fb
, len
);
629 * Whiteout index entries are used as an indication that an exported
630 * overlay file handle should be treated as stale (i.e. after unlink
631 * of the overlay inode). These entries contain no origin xattr.
633 if (ovl_is_whiteout(index
))
637 * Verifying directory index entries are not stale is expensive, so
638 * only verify stale dir index if NFS export is enabled.
640 if (d_is_dir(index
) && !ofs
->config
.nfs_export
)
644 * Directory index entries should have 'upper' xattr pointing to the
645 * real upper dir. Non-dir index entries are hardlinks to the upper
646 * real inode. For non-dir index, we can read the copy up origin xattr
647 * directly from the index dentry, but for dir index we first need to
648 * decode the upper directory.
650 upper
= ovl_index_upper(ofs
, index
, false);
651 if (IS_ERR_OR_NULL(upper
)) {
652 err
= PTR_ERR(upper
);
654 * Directory index entries with no 'upper' xattr need to be
655 * removed. When dir index entry has a stale 'upper' xattr,
656 * we assume that upper dir was removed and we treat the dir
657 * index as orphan entry that needs to be whited out.
666 err
= ovl_verify_fh(ofs
, upper
, OVL_XATTR_ORIGIN
, fh
);
671 /* Check if non-dir index is orphan and don't warn before cleaning it */
672 if (!d_is_dir(index
) && d_inode(index
)->i_nlink
== 1) {
673 err
= ovl_check_origin_fh(ofs
, fh
, false, index
, &stack
);
677 if (ovl_get_nlink(ofs
, origin
.dentry
, index
, 0) == 0)
687 pr_warn_ratelimited("failed to verify index (%pd2, ftype=%x, err=%i)\n",
688 index
, d_inode(index
)->i_mode
& S_IFMT
, err
);
692 pr_warn_ratelimited("orphan index entry (%pd2, ftype=%x, nlink=%u)\n",
693 index
, d_inode(index
)->i_mode
& S_IFMT
,
694 d_inode(index
)->i_nlink
);
699 int ovl_get_index_name_fh(const struct ovl_fh
*fh
, struct qstr
*name
)
703 n
= kcalloc(fh
->fb
.len
, 2, GFP_KERNEL
);
707 s
= bin2hex(n
, fh
->buf
, fh
->fb
.len
);
708 *name
= (struct qstr
) QSTR_INIT(n
, s
- n
);
715 * Lookup in indexdir for the index entry of a lower real inode or a copy up
716 * origin inode. The index entry name is the hex representation of the lower
719 * If the index dentry in negative, then either no lower aliases have been
720 * copied up yet, or aliases have been copied up in older kernels and are
723 * If the index dentry for a copy up origin inode is positive, but points
724 * to an inode different than the upper inode, then either the upper inode
725 * has been copied up and not indexed or it was indexed, but since then
726 * index dir was cleared. Either way, that index cannot be used to identify
729 int ovl_get_index_name(struct ovl_fs
*ofs
, struct dentry
*origin
,
735 fh
= ovl_encode_real_fh(ofs
, origin
, false);
739 err
= ovl_get_index_name_fh(fh
, name
);
745 /* Lookup index by file handle for NFS export */
746 struct dentry
*ovl_get_index_fh(struct ovl_fs
*ofs
, struct ovl_fh
*fh
)
748 struct dentry
*index
;
752 err
= ovl_get_index_name_fh(fh
, &name
);
756 index
= lookup_positive_unlocked(name
.name
, ofs
->indexdir
, name
.len
);
759 if (PTR_ERR(index
) == -ENOENT
)
764 if (ovl_is_whiteout(index
))
766 else if (ovl_dentry_weird(index
))
775 struct dentry
*ovl_lookup_index(struct ovl_fs
*ofs
, struct dentry
*upper
,
776 struct dentry
*origin
, bool verify
)
778 struct dentry
*index
;
781 bool is_dir
= d_is_dir(origin
);
784 err
= ovl_get_index_name(ofs
, origin
, &name
);
788 index
= lookup_one_positive_unlocked(ovl_upper_mnt_idmap(ofs
), name
.name
,
789 ofs
->indexdir
, name
.len
);
791 err
= PTR_ERR(index
);
792 if (err
== -ENOENT
) {
796 pr_warn_ratelimited("failed inode index lookup (ino=%lu, key=%.*s, err=%i);\n"
797 "overlayfs: mount with '-o index=off' to disable inodes index.\n",
798 d_inode(origin
)->i_ino
, name
.len
, name
.name
,
803 inode
= d_inode(index
);
804 if (ovl_is_whiteout(index
) && !verify
) {
806 * When index lookup is called with !verify for decoding an
807 * overlay file handle, a whiteout index implies that decode
808 * should treat file handle as stale and no need to print a
812 index
= ERR_PTR(-ESTALE
);
814 } else if (ovl_dentry_weird(index
) || ovl_is_whiteout(index
) ||
815 inode_wrong_type(inode
, d_inode(origin
)->i_mode
)) {
817 * Index should always be of the same file type as origin
818 * except for the case of a whiteout index. A whiteout
819 * index should only exist if all lower aliases have been
820 * unlinked, which means that finding a lower origin on lookup
821 * whose index is a whiteout should be treated as an error.
823 pr_warn_ratelimited("bad index found (index=%pd2, ftype=%x, origin ftype=%x).\n",
824 index
, d_inode(index
)->i_mode
& S_IFMT
,
825 d_inode(origin
)->i_mode
& S_IFMT
);
827 } else if (is_dir
&& verify
) {
829 pr_warn_ratelimited("suspected uncovered redirected dir found (origin=%pd2, index=%pd2).\n",
834 /* Verify that dir index 'upper' xattr points to upper dir */
835 err
= ovl_verify_upper(ofs
, index
, upper
, false);
837 if (err
== -ESTALE
) {
838 pr_warn_ratelimited("suspected multiply redirected dir found (upper=%pd2, origin=%pd2, index=%pd2).\n",
839 upper
, origin
, index
);
843 } else if (upper
&& d_inode(upper
) != inode
) {
857 index
= ERR_PTR(-EIO
);
862 * Returns next layer in stack starting from top.
863 * Returns -1 if this is the last layer.
865 int ovl_path_next(int idx
, struct dentry
*dentry
, struct path
*path
)
867 struct ovl_entry
*oe
= OVL_E(dentry
);
868 struct ovl_path
*lowerstack
= ovl_lowerstack(oe
);
872 ovl_path_upper(dentry
, path
);
874 return ovl_numlower(oe
) ? 1 : -1;
877 BUG_ON(idx
> ovl_numlower(oe
));
878 path
->dentry
= lowerstack
[idx
- 1].dentry
;
879 path
->mnt
= lowerstack
[idx
- 1].layer
->mnt
;
881 return (idx
< ovl_numlower(oe
)) ? idx
+ 1 : -1;
884 /* Fix missing 'origin' xattr */
885 static int ovl_fix_origin(struct ovl_fs
*ofs
, struct dentry
*dentry
,
886 struct dentry
*lower
, struct dentry
*upper
)
888 const struct ovl_fh
*fh
;
891 if (ovl_check_origin_xattr(ofs
, upper
))
894 fh
= ovl_get_origin_fh(ofs
, lower
);
898 err
= ovl_want_write(dentry
);
902 err
= ovl_set_origin_fh(ofs
, fh
, upper
);
904 err
= ovl_set_impure(dentry
->d_parent
, upper
->d_parent
);
906 ovl_drop_write(dentry
);
912 static int ovl_maybe_validate_verity(struct dentry
*dentry
)
914 struct ovl_fs
*ofs
= OVL_FS(dentry
->d_sb
);
915 struct inode
*inode
= d_inode(dentry
);
916 struct path datapath
, metapath
;
919 if (!ofs
->config
.verity_mode
||
920 !ovl_is_metacopy_dentry(dentry
) ||
921 ovl_test_flag(OVL_VERIFIED_DIGEST
, inode
))
924 if (!ovl_test_flag(OVL_HAS_DIGEST
, inode
)) {
925 if (ofs
->config
.verity_mode
== OVL_VERITY_REQUIRE
) {
926 pr_warn_ratelimited("metacopy file '%pd' has no digest specified\n",
933 ovl_path_lowerdata(dentry
, &datapath
);
934 if (!datapath
.dentry
)
937 ovl_path_real(dentry
, &metapath
);
938 if (!metapath
.dentry
)
941 err
= ovl_inode_lock_interruptible(inode
);
945 if (!ovl_test_flag(OVL_VERIFIED_DIGEST
, inode
)) {
946 const struct cred
*old_cred
;
948 old_cred
= ovl_override_creds(dentry
->d_sb
);
950 err
= ovl_validate_verity(ofs
, &metapath
, &datapath
);
952 ovl_set_flag(OVL_VERIFIED_DIGEST
, inode
);
954 revert_creds(old_cred
);
957 ovl_inode_unlock(inode
);
962 /* Lazy lookup of lowerdata */
963 static int ovl_maybe_lookup_lowerdata(struct dentry
*dentry
)
965 struct inode
*inode
= d_inode(dentry
);
966 const char *redirect
= ovl_lowerdata_redirect(inode
);
967 struct ovl_path datapath
= {};
968 const struct cred
*old_cred
;
971 if (!redirect
|| ovl_dentry_lowerdata(dentry
))
974 if (redirect
[0] != '/')
977 err
= ovl_inode_lock_interruptible(inode
);
982 /* Someone got here before us? */
983 if (ovl_dentry_lowerdata(dentry
))
986 old_cred
= ovl_override_creds(dentry
->d_sb
);
987 err
= ovl_lookup_data_layers(dentry
, redirect
, &datapath
);
988 revert_creds(old_cred
);
992 err
= ovl_dentry_set_lowerdata(dentry
, &datapath
);
997 ovl_inode_unlock(inode
);
998 dput(datapath
.dentry
);
1003 pr_warn_ratelimited("lazy lowerdata lookup failed (%pd2, err=%i)\n",
1008 int ovl_verify_lowerdata(struct dentry
*dentry
)
1012 err
= ovl_maybe_lookup_lowerdata(dentry
);
1016 return ovl_maybe_validate_verity(dentry
);
1019 struct dentry
*ovl_lookup(struct inode
*dir
, struct dentry
*dentry
,
1022 struct ovl_entry
*oe
= NULL
;
1023 const struct cred
*old_cred
;
1024 struct ovl_fs
*ofs
= OVL_FS(dentry
->d_sb
);
1025 struct ovl_entry
*poe
= OVL_E(dentry
->d_parent
);
1026 struct ovl_entry
*roe
= OVL_E(dentry
->d_sb
->s_root
);
1027 struct ovl_path
*stack
= NULL
, *origin_path
= NULL
;
1028 struct dentry
*upperdir
, *upperdentry
= NULL
;
1029 struct dentry
*origin
= NULL
;
1030 struct dentry
*index
= NULL
;
1031 unsigned int ctr
= 0;
1032 struct inode
*inode
= NULL
;
1033 bool upperopaque
= false;
1034 char *upperredirect
= NULL
;
1035 struct dentry
*this;
1038 bool uppermetacopy
= false;
1039 int metacopy_size
= 0;
1040 struct ovl_lookup_data d
= {
1042 .name
= dentry
->d_name
,
1046 .last
= ovl_redirect_follow(ofs
) ? false : !ovl_numlower(poe
),
1051 if (dentry
->d_name
.len
> ofs
->namelen
)
1052 return ERR_PTR(-ENAMETOOLONG
);
1054 old_cred
= ovl_override_creds(dentry
->d_sb
);
1055 upperdir
= ovl_dentry_upper(dentry
->d_parent
);
1057 d
.mnt
= ovl_upper_mnt(ofs
);
1058 err
= ovl_lookup_layer(upperdir
, &d
, &upperdentry
, true);
1062 if (upperdentry
&& upperdentry
->d_flags
& DCACHE_OP_REAL
) {
1067 if (upperdentry
&& !d
.is_dir
) {
1069 * Lookup copy up origin by decoding origin file handle.
1070 * We may get a disconnected dentry, which is fine,
1071 * because we only need to hold the origin inode in
1072 * cache and use its inode number. We may even get a
1073 * connected dentry, that is not under any of the lower
1074 * layers root. That is also fine for using it's inode
1075 * number - it's the same as if we held a reference
1076 * to a dentry in lower layer that was moved under us.
1078 err
= ovl_check_origin(ofs
, upperdentry
, &origin_path
);
1083 uppermetacopy
= true;
1084 metacopy_size
= d
.metacopy
;
1089 upperredirect
= kstrdup(d
.redirect
, GFP_KERNEL
);
1092 if (d
.redirect
[0] == '/')
1095 upperopaque
= d
.opaque
;
1098 if (!d
.stop
&& ovl_numlower(poe
)) {
1100 stack
= ovl_stack_alloc(ofs
->numlayer
- 1);
1105 for (i
= 0; !d
.stop
&& i
< ovl_numlower(poe
); i
++) {
1106 struct ovl_path lower
= ovl_lowerstack(poe
)[i
];
1108 if (!ovl_redirect_follow(ofs
))
1109 d
.last
= i
== ovl_numlower(poe
) - 1;
1110 else if (d
.is_dir
|| !ofs
->numdatalayer
)
1111 d
.last
= lower
.layer
->idx
== ovl_numlower(roe
);
1113 d
.mnt
= lower
.layer
->mnt
;
1114 err
= ovl_lookup_layer(lower
.dentry
, &d
, &this, false);
1121 if ((uppermetacopy
|| d
.metacopy
) && !ofs
->config
.metacopy
) {
1124 pr_warn_ratelimited("refusing to follow metacopy origin for (%pd2)\n", dentry
);
1129 * If no origin fh is stored in upper of a merge dir, store fh
1130 * of lower dir and set upper parent "impure".
1132 if (upperdentry
&& !ctr
&& !ofs
->noxattr
&& d
.is_dir
) {
1133 err
= ovl_fix_origin(ofs
, dentry
, this, upperdentry
);
1141 * When "verify_lower" feature is enabled, do not merge with a
1142 * lower dir that does not match a stored origin xattr. In any
1143 * case, only verified origin is used for index lookup.
1145 * For non-dir dentry, if index=on, then ensure origin
1146 * matches the dentry found using path based lookup,
1147 * otherwise error out.
1149 if (upperdentry
&& !ctr
&&
1150 ((d
.is_dir
&& ovl_verify_lower(dentry
->d_sb
)) ||
1151 (!d
.is_dir
&& ofs
->config
.index
&& origin_path
))) {
1152 err
= ovl_verify_origin(ofs
, upperdentry
, this, false);
1162 if (!upperdentry
&& !d
.is_dir
&& !ctr
&& d
.metacopy
)
1163 metacopy_size
= d
.metacopy
;
1165 if (d
.metacopy
&& ctr
) {
1167 * Do not store intermediate metacopy dentries in
1168 * lower chain, except top most lower metacopy dentry.
1169 * Continue the loop so that if there is an absolute
1170 * redirect on this dentry, poe can be reset to roe.
1175 stack
[ctr
].dentry
= this;
1176 stack
[ctr
].layer
= lower
.layer
;
1181 * Following redirects can have security consequences: it's like
1182 * a symlink into the lower layer without the permission checks.
1183 * This is only a problem if the upper layer is untrusted (e.g
1184 * comes from an USB drive). This can allow a non-readable file
1185 * or directory to become readable.
1187 * Only following redirects when redirects are enabled disables
1188 * this attack vector when not necessary.
1191 if (d
.redirect
&& !ovl_redirect_follow(ofs
)) {
1192 pr_warn_ratelimited("refusing to follow redirect for (%pd2)\n",
1200 if (d
.redirect
&& d
.redirect
[0] == '/' && poe
!= roe
) {
1202 /* Find the current layer on the root dentry */
1203 i
= lower
.layer
->idx
- 1;
1207 /* Defer lookup of lowerdata in data-only layers to first access */
1208 if (d
.metacopy
&& ctr
&& ofs
->numdatalayer
&& d
.absolute_redirect
) {
1214 * For regular non-metacopy upper dentries, there is no lower
1215 * path based lookup, hence ctr will be zero. If a dentry is found
1216 * using ORIGIN xattr on upper, install it in stack.
1218 * For metacopy dentry, path based lookup will find lower dentries.
1219 * Just make sure a corresponding data dentry has been found.
1221 if (d
.metacopy
|| (uppermetacopy
&& !ctr
)) {
1222 pr_warn_ratelimited("metacopy with no lower data found - abort lookup (%pd2)\n",
1226 } else if (!d
.is_dir
&& upperdentry
&& !ctr
&& origin_path
) {
1227 if (WARN_ON(stack
!= NULL
)) {
1231 stack
= origin_path
;
1233 origin
= origin_path
->dentry
;
1238 * Always lookup index if there is no-upperdentry.
1240 * For the case of upperdentry, we have set origin by now if it
1241 * needed to be set. There are basically three cases.
1243 * For directories, lookup index by lower inode and verify it matches
1244 * upper inode. We only trust dir index if we verified that lower dir
1245 * matches origin, otherwise dir index entries may be inconsistent
1246 * and we ignore them.
1248 * For regular upper, we already set origin if upper had ORIGIN
1249 * xattr. There is no verification though as there is no path
1250 * based dentry lookup in lower in this case.
1252 * For metacopy upper, we set a verified origin already if index
1253 * is enabled and if upper had an ORIGIN xattr.
1256 if (!upperdentry
&& ctr
)
1257 origin
= stack
[0].dentry
;
1259 if (origin
&& ovl_indexdir(dentry
->d_sb
) &&
1260 (!d
.is_dir
|| ovl_index_all(dentry
->d_sb
))) {
1261 index
= ovl_lookup_index(ofs
, upperdentry
, origin
, true);
1262 if (IS_ERR(index
)) {
1263 err
= PTR_ERR(index
);
1270 oe
= ovl_alloc_entry(ctr
);
1275 ovl_stack_cpy(ovl_lowerstack(oe
), stack
, ctr
);
1279 ovl_dentry_set_opaque(dentry
);
1282 ovl_dentry_set_upper_alias(dentry
);
1284 struct path upperpath
= {
1285 .dentry
= upperdentry
= dget(index
),
1286 .mnt
= ovl_upper_mnt(ofs
),
1290 * It's safe to assign upperredirect here: the previous
1291 * assignment of happens only if upperdentry is non-NULL, and
1292 * this one only if upperdentry is NULL.
1294 upperredirect
= ovl_get_redirect_xattr(ofs
, &upperpath
, 0);
1295 if (IS_ERR(upperredirect
)) {
1296 err
= PTR_ERR(upperredirect
);
1297 upperredirect
= NULL
;
1300 err
= ovl_check_metacopy_xattr(ofs
, &upperpath
, NULL
);
1303 uppermetacopy
= err
;
1304 metacopy_size
= err
;
1307 if (upperdentry
|| ctr
) {
1308 struct ovl_inode_params oip
= {
1309 .upperdentry
= upperdentry
,
1312 .redirect
= upperredirect
,
1315 /* Store lowerdata redirect for lazy lookup */
1316 if (ctr
> 1 && !d
.is_dir
&& !stack
[ctr
- 1].dentry
) {
1317 oip
.lowerdata_redirect
= d
.redirect
;
1320 inode
= ovl_get_inode(dentry
->d_sb
, &oip
);
1321 err
= PTR_ERR(inode
);
1324 if (upperdentry
&& !uppermetacopy
)
1325 ovl_set_flag(OVL_UPPERDATA
, inode
);
1327 if (metacopy_size
> OVL_METACOPY_MIN_SIZE
)
1328 ovl_set_flag(OVL_HAS_DIGEST
, inode
);
1331 ovl_dentry_init_reval(dentry
, upperdentry
, OVL_I_E(inode
));
1333 revert_creds(old_cred
);
1335 dput(origin_path
->dentry
);
1339 ovl_stack_free(stack
, ctr
);
1341 return d_splice_alias(inode
, dentry
);
1347 ovl_stack_free(stack
, ctr
);
1350 dput(origin_path
->dentry
);
1354 kfree(upperredirect
);
1357 revert_creds(old_cred
);
1358 return ERR_PTR(err
);
1361 bool ovl_lower_positive(struct dentry
*dentry
)
1363 struct ovl_entry
*poe
= OVL_E(dentry
->d_parent
);
1364 const struct qstr
*name
= &dentry
->d_name
;
1365 const struct cred
*old_cred
;
1367 bool positive
= false;
1371 * If dentry is negative, then lower is positive iff this is a
1374 if (!dentry
->d_inode
)
1375 return ovl_dentry_is_opaque(dentry
);
1377 /* Negative upper -> positive lower */
1378 if (!ovl_dentry_upper(dentry
))
1381 old_cred
= ovl_override_creds(dentry
->d_sb
);
1382 /* Positive upper -> have to look up lower to see whether it exists */
1383 for (i
= 0; !done
&& !positive
&& i
< ovl_numlower(poe
); i
++) {
1384 struct dentry
*this;
1385 struct ovl_path
*parentpath
= &ovl_lowerstack(poe
)[i
];
1387 this = lookup_one_positive_unlocked(
1388 mnt_idmap(parentpath
->layer
->mnt
),
1389 name
->name
, parentpath
->dentry
, name
->len
);
1391 switch (PTR_ERR(this)) {
1398 * Assume something is there, we just couldn't
1405 positive
= !ovl_is_whiteout(this);
1410 revert_creds(old_cred
);