1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (C) Neil Brown 2002
4  * Copyright (C) Christoph Hellwig 2007
5  *
6  * This file contains the code mapping from inodes to NFS file handles,
7  * and for mapping back from file handles to dentries.
8  *
9  * For details on why we do all the strange and hairy things in here
10  * take a look at Documentation/filesystems/nfs/exporting.rst.
11  */
12 #include <linux/exportfs.h>
13 #include <linux/fs.h>
14 #include <linux/file.h>
15 #include <linux/module.h>
16 #include <linux/mount.h>
17 #include <linux/namei.h>
18 #include <linux/sched.h>
19 #include <linux/cred.h>
20 
21 #define dprintk(fmt, args...) pr_debug(fmt, ##args)
22 
23 
24 static int get_name(const struct path *path, char *name, struct dentry *child);
25 
26 
exportfs_get_name(struct vfsmount * mnt,struct dentry * dir,char * name,struct dentry * child)27 static int exportfs_get_name(struct vfsmount *mnt, struct dentry *dir,
28 		char *name, struct dentry *child)
29 {
30 	const struct export_operations *nop = dir->d_sb->s_export_op;
31 	struct path path = {.mnt = mnt, .dentry = dir};
32 
33 	if (nop->get_name)
34 		return nop->get_name(dir, name, child);
35 	else
36 		return get_name(&path, name, child);
37 }
38 
39 /*
40  * Check if the dentry or any of it's aliases is acceptable.
41  */
42 static struct dentry *
find_acceptable_alias(struct dentry * result,int (* acceptable)(void * context,struct dentry * dentry),void * context)43 find_acceptable_alias(struct dentry *result,
44 		int (*acceptable)(void *context, struct dentry *dentry),
45 		void *context)
46 {
47 	struct dentry *dentry, *toput = NULL;
48 	struct inode *inode;
49 
50 	if (acceptable(context, result))
51 		return result;
52 
53 	inode = result->d_inode;
54 	spin_lock(&inode->i_lock);
55 	hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
56 		dget(dentry);
57 		spin_unlock(&inode->i_lock);
58 		if (toput)
59 			dput(toput);
60 		if (dentry != result && acceptable(context, dentry)) {
61 			dput(result);
62 			return dentry;
63 		}
64 		spin_lock(&inode->i_lock);
65 		toput = dentry;
66 	}
67 	spin_unlock(&inode->i_lock);
68 
69 	if (toput)
70 		dput(toput);
71 	return NULL;
72 }
73 
dentry_connected(struct dentry * dentry)74 static bool dentry_connected(struct dentry *dentry)
75 {
76 	dget(dentry);
77 	while (dentry->d_flags & DCACHE_DISCONNECTED) {
78 		struct dentry *parent = dget_parent(dentry);
79 
80 		dput(dentry);
81 		if (dentry == parent) {
82 			dput(parent);
83 			return false;
84 		}
85 		dentry = parent;
86 	}
87 	dput(dentry);
88 	return true;
89 }
90 
clear_disconnected(struct dentry * dentry)91 static void clear_disconnected(struct dentry *dentry)
92 {
93 	dget(dentry);
94 	while (dentry->d_flags & DCACHE_DISCONNECTED) {
95 		struct dentry *parent = dget_parent(dentry);
96 
97 		WARN_ON_ONCE(IS_ROOT(dentry));
98 
99 		spin_lock(&dentry->d_lock);
100 		dentry->d_flags &= ~DCACHE_DISCONNECTED;
101 		spin_unlock(&dentry->d_lock);
102 
103 		dput(dentry);
104 		dentry = parent;
105 	}
106 	dput(dentry);
107 }
108 
109 /*
110  * Reconnect a directory dentry with its parent.
111  *
112  * This can return a dentry, or NULL, or an error.
113  *
114  * In the first case the returned dentry is the parent of the given
115  * dentry, and may itself need to be reconnected to its parent.
116  *
117  * In the NULL case, a concurrent VFS operation has either renamed or
118  * removed this directory.  The concurrent operation has reconnected our
119  * dentry, so we no longer need to.
120  */
reconnect_one(struct vfsmount * mnt,struct dentry * dentry,char * nbuf)121 static struct dentry *reconnect_one(struct vfsmount *mnt,
122 		struct dentry *dentry, char *nbuf)
123 {
124 	struct dentry *parent;
125 	struct dentry *tmp;
126 	int err;
127 
128 	parent = ERR_PTR(-EACCES);
129 	if (mnt->mnt_sb->s_export_op->get_parent)
130 		parent = mnt->mnt_sb->s_export_op->get_parent(dentry);
131 
132 	if (IS_ERR(parent)) {
133 		dprintk("get_parent of %lu failed, err %ld\n",
134 			dentry->d_inode->i_ino, PTR_ERR(parent));
135 		return parent;
136 	}
137 
138 	dprintk("%s: find name of %lu in %lu\n", __func__,
139 		dentry->d_inode->i_ino, parent->d_inode->i_ino);
140 	err = exportfs_get_name(mnt, parent, nbuf, dentry);
141 	if (err == -ENOENT)
142 		goto out_reconnected;
143 	if (err)
144 		goto out_err;
145 	dprintk("%s: found name: %s\n", __func__, nbuf);
146 	tmp = lookup_one_unlocked(mnt_idmap(mnt), nbuf, parent, strlen(nbuf));
147 	if (IS_ERR(tmp)) {
148 		dprintk("lookup failed: %ld\n", PTR_ERR(tmp));
149 		err = PTR_ERR(tmp);
150 		goto out_err;
151 	}
152 	if (tmp != dentry) {
153 		/*
154 		 * Somebody has renamed it since exportfs_get_name();
155 		 * great, since it could've only been renamed if it
156 		 * got looked up and thus connected, and it would
157 		 * remain connected afterwards.  We are done.
158 		 */
159 		dput(tmp);
160 		goto out_reconnected;
161 	}
162 	dput(tmp);
163 	if (IS_ROOT(dentry)) {
164 		err = -ESTALE;
165 		goto out_err;
166 	}
167 	return parent;
168 
169 out_err:
170 	dput(parent);
171 	return ERR_PTR(err);
172 out_reconnected:
173 	dput(parent);
174 	/*
175 	 * Someone must have renamed our entry into another parent, in
176 	 * which case it has been reconnected by the rename.
177 	 *
178 	 * Or someone removed it entirely, in which case filehandle
179 	 * lookup will succeed but the directory is now IS_DEAD and
180 	 * subsequent operations on it will fail.
181 	 *
182 	 * Alternatively, maybe there was no race at all, and the
183 	 * filesystem is just corrupt and gave us a parent that doesn't
184 	 * actually contain any entry pointing to this inode.  So,
185 	 * double check that this worked and return -ESTALE if not:
186 	 */
187 	if (!dentry_connected(dentry))
188 		return ERR_PTR(-ESTALE);
189 	return NULL;
190 }
191 
192 /*
193  * Make sure target_dir is fully connected to the dentry tree.
194  *
195  * On successful return, DCACHE_DISCONNECTED will be cleared on
196  * target_dir, and target_dir->d_parent->...->d_parent will reach the
197  * root of the filesystem.
198  *
199  * Whenever DCACHE_DISCONNECTED is unset, target_dir is fully connected.
200  * But the converse is not true: target_dir may have DCACHE_DISCONNECTED
201  * set but already be connected.  In that case we'll verify the
202  * connection to root and then clear the flag.
203  *
204  * Note that target_dir could be removed by a concurrent operation.  In
205  * that case reconnect_path may still succeed with target_dir fully
206  * connected, but further operations using the filehandle will fail when
207  * necessary (due to S_DEAD being set on the directory).
208  */
209 static int
reconnect_path(struct vfsmount * mnt,struct dentry * target_dir,char * nbuf)210 reconnect_path(struct vfsmount *mnt, struct dentry *target_dir, char *nbuf)
211 {
212 	struct dentry *dentry, *parent;
213 
214 	dentry = dget(target_dir);
215 
216 	while (dentry->d_flags & DCACHE_DISCONNECTED) {
217 		BUG_ON(dentry == mnt->mnt_sb->s_root);
218 
219 		if (IS_ROOT(dentry))
220 			parent = reconnect_one(mnt, dentry, nbuf);
221 		else
222 			parent = dget_parent(dentry);
223 
224 		if (!parent)
225 			break;
226 		dput(dentry);
227 		if (IS_ERR(parent))
228 			return PTR_ERR(parent);
229 		dentry = parent;
230 	}
231 	dput(dentry);
232 	clear_disconnected(target_dir);
233 	return 0;
234 }
235 
236 struct getdents_callback {
237 	struct dir_context ctx;
238 	char *name;		/* name that was found. It already points to a
239 				   buffer NAME_MAX+1 is size */
240 	u64 ino;		/* the inum we are looking for */
241 	int found;		/* inode matched? */
242 	int sequence;		/* sequence counter */
243 };
244 
245 /*
246  * A rather strange filldir function to capture
247  * the name matching the specified inode number.
248  */
filldir_one(struct dir_context * ctx,const char * name,int len,loff_t pos,u64 ino,unsigned int d_type)249 static bool filldir_one(struct dir_context *ctx, const char *name, int len,
250 			loff_t pos, u64 ino, unsigned int d_type)
251 {
252 	struct getdents_callback *buf =
253 		container_of(ctx, struct getdents_callback, ctx);
254 
255 	buf->sequence++;
256 	if (buf->ino == ino && len <= NAME_MAX && !is_dot_dotdot(name, len)) {
257 		memcpy(buf->name, name, len);
258 		buf->name[len] = '\0';
259 		buf->found = 1;
260 		return false;	// no more
261 	}
262 	return true;
263 }
264 
265 /**
266  * get_name - default export_operations->get_name function
267  * @path:   the directory in which to find a name
268  * @name:   a pointer to a %NAME_MAX+1 char buffer to store the name
269  * @child:  the dentry for the child directory.
270  *
271  * calls readdir on the parent until it finds an entry with
272  * the same inode number as the child, and returns that.
273  */
get_name(const struct path * path,char * name,struct dentry * child)274 static int get_name(const struct path *path, char *name, struct dentry *child)
275 {
276 	const struct cred *cred = current_cred();
277 	struct inode *dir = path->dentry->d_inode;
278 	int error;
279 	struct file *file;
280 	struct kstat stat;
281 	struct path child_path = {
282 		.mnt = path->mnt,
283 		.dentry = child,
284 	};
285 	struct getdents_callback buffer = {
286 		.ctx.actor = filldir_one,
287 		.name = name,
288 	};
289 
290 	error = -ENOTDIR;
291 	if (!dir || !S_ISDIR(dir->i_mode))
292 		goto out;
293 	error = -EINVAL;
294 	if (!dir->i_fop)
295 		goto out;
296 	/*
297 	 * inode->i_ino is unsigned long, kstat->ino is u64, so the
298 	 * former would be insufficient on 32-bit hosts when the
299 	 * filesystem supports 64-bit inode numbers.  So we need to
300 	 * actually call ->getattr, not just read i_ino:
301 	 */
302 	error = vfs_getattr_nosec(&child_path, &stat,
303 				  STATX_INO, AT_STATX_SYNC_AS_STAT);
304 	if (error)
305 		return error;
306 	buffer.ino = stat.ino;
307 	/*
308 	 * Open the directory ...
309 	 */
310 	file = dentry_open(path, O_RDONLY, cred);
311 	error = PTR_ERR(file);
312 	if (IS_ERR(file))
313 		goto out;
314 
315 	error = -EINVAL;
316 	if (!file->f_op->iterate_shared)
317 		goto out_close;
318 
319 	buffer.sequence = 0;
320 	while (1) {
321 		int old_seq = buffer.sequence;
322 
323 		error = iterate_dir(file, &buffer.ctx);
324 		if (buffer.found) {
325 			error = 0;
326 			break;
327 		}
328 
329 		if (error < 0)
330 			break;
331 
332 		error = -ENOENT;
333 		if (old_seq == buffer.sequence)
334 			break;
335 	}
336 
337 out_close:
338 	fput(file);
339 out:
340 	return error;
341 }
342 
343 #define FILEID_INO64_GEN_LEN 3
344 
345 /**
346  * exportfs_encode_ino64_fid - encode non-decodeable 64bit ino file id
347  * @inode:   the object to encode
348  * @fid:     where to store the file handle fragment
349  * @max_len: maximum length to store there (in 4 byte units)
350  *
351  * This generic function is used to encode a non-decodeable file id for
352  * fanotify for filesystems that do not support NFS export.
353  */
exportfs_encode_ino64_fid(struct inode * inode,struct fid * fid,int * max_len)354 static int exportfs_encode_ino64_fid(struct inode *inode, struct fid *fid,
355 				     int *max_len)
356 {
357 	if (*max_len < FILEID_INO64_GEN_LEN) {
358 		*max_len = FILEID_INO64_GEN_LEN;
359 		return FILEID_INVALID;
360 	}
361 
362 	fid->i64.ino = inode->i_ino;
363 	fid->i64.gen = inode->i_generation;
364 	*max_len = FILEID_INO64_GEN_LEN;
365 
366 	return FILEID_INO64_GEN;
367 }
368 
369 /**
370  * exportfs_encode_inode_fh - encode a file handle from inode
371  * @inode:   the object to encode
372  * @fid:     where to store the file handle fragment
373  * @max_len: maximum length to store there
374  * @parent:  parent directory inode, if wanted
375  * @flags:   properties of the requested file handle
376  *
377  * Returns an enum fid_type or a negative errno.
378  */
exportfs_encode_inode_fh(struct inode * inode,struct fid * fid,int * max_len,struct inode * parent,int flags)379 int exportfs_encode_inode_fh(struct inode *inode, struct fid *fid,
380 			     int *max_len, struct inode *parent, int flags)
381 {
382 	const struct export_operations *nop = inode->i_sb->s_export_op;
383 	enum fid_type type;
384 
385 	if (!exportfs_can_encode_fh(nop, flags))
386 		return -EOPNOTSUPP;
387 
388 	if (!nop && (flags & EXPORT_FH_FID))
389 		type = exportfs_encode_ino64_fid(inode, fid, max_len);
390 	else
391 		type = nop->encode_fh(inode, fid->raw, max_len, parent);
392 
393 	if (type > 0 && FILEID_USER_FLAGS(type)) {
394 		pr_warn_once("%s: unexpected fh type value 0x%x from fstype %s.\n",
395 			     __func__, type, inode->i_sb->s_type->name);
396 		return -EINVAL;
397 	}
398 
399 	return type;
400 
401 }
402 EXPORT_SYMBOL_GPL(exportfs_encode_inode_fh);
403 
404 /**
405  * exportfs_encode_fh - encode a file handle from dentry
406  * @dentry:  the object to encode
407  * @fid:     where to store the file handle fragment
408  * @max_len: maximum length to store there
409  * @flags:   properties of the requested file handle
410  *
411  * Returns an enum fid_type or a negative errno.
412  */
exportfs_encode_fh(struct dentry * dentry,struct fid * fid,int * max_len,int flags)413 int exportfs_encode_fh(struct dentry *dentry, struct fid *fid, int *max_len,
414 		       int flags)
415 {
416 	int error;
417 	struct dentry *p = NULL;
418 	struct inode *inode = dentry->d_inode, *parent = NULL;
419 
420 	if ((flags & EXPORT_FH_CONNECTABLE) && !S_ISDIR(inode->i_mode)) {
421 		p = dget_parent(dentry);
422 		/*
423 		 * note that while p might've ceased to be our parent already,
424 		 * it's still pinned by and still positive.
425 		 */
426 		parent = p->d_inode;
427 	}
428 
429 	error = exportfs_encode_inode_fh(inode, fid, max_len, parent, flags);
430 	dput(p);
431 
432 	return error;
433 }
434 EXPORT_SYMBOL_GPL(exportfs_encode_fh);
435 
436 struct dentry *
exportfs_decode_fh_raw(struct vfsmount * mnt,struct fid * fid,int fh_len,int fileid_type,unsigned int flags,int (* acceptable)(void *,struct dentry *),void * context)437 exportfs_decode_fh_raw(struct vfsmount *mnt, struct fid *fid, int fh_len,
438 		       int fileid_type, unsigned int flags,
439 		       int (*acceptable)(void *, struct dentry *),
440 		       void *context)
441 {
442 	const struct export_operations *nop = mnt->mnt_sb->s_export_op;
443 	struct dentry *result, *alias;
444 	char nbuf[NAME_MAX+1];
445 	int err;
446 
447 	if (fileid_type < 0 || FILEID_USER_FLAGS(fileid_type))
448 		return ERR_PTR(-EINVAL);
449 
450 	/*
451 	 * Try to get any dentry for the given file handle from the filesystem.
452 	 */
453 	if (!exportfs_can_decode_fh(nop))
454 		return ERR_PTR(-ESTALE);
455 	result = nop->fh_to_dentry(mnt->mnt_sb, fid, fh_len, fileid_type);
456 	if (IS_ERR_OR_NULL(result))
457 		return result;
458 
459 	if ((flags & EXPORT_FH_DIR_ONLY) && !d_is_dir(result)) {
460 		err = -ENOTDIR;
461 		goto err_result;
462 	}
463 
464 	/*
465 	 * If no acceptance criteria was specified by caller, a disconnected
466 	 * dentry is also accepatable. Callers may use this mode to query if
467 	 * file handle is stale or to get a reference to an inode without
468 	 * risking the high overhead caused by directory reconnect.
469 	 */
470 	if (!acceptable)
471 		return result;
472 
473 	if (d_is_dir(result)) {
474 		/*
475 		 * This request is for a directory.
476 		 *
477 		 * On the positive side there is only one dentry for each
478 		 * directory inode.  On the negative side this implies that we
479 		 * to ensure our dentry is connected all the way up to the
480 		 * filesystem root.
481 		 */
482 		if (result->d_flags & DCACHE_DISCONNECTED) {
483 			err = reconnect_path(mnt, result, nbuf);
484 			if (err)
485 				goto err_result;
486 		}
487 
488 		if (!acceptable(context, result)) {
489 			err = -EACCES;
490 			goto err_result;
491 		}
492 
493 		return result;
494 	} else {
495 		/*
496 		 * It's not a directory.  Life is a little more complicated.
497 		 */
498 		struct dentry *target_dir, *nresult;
499 
500 		/*
501 		 * See if either the dentry we just got from the filesystem
502 		 * or any alias for it is acceptable.  This is always true
503 		 * if this filesystem is exported without the subtreecheck
504 		 * option.  If the filesystem is exported with the subtree
505 		 * check option there's a fair chance we need to look at
506 		 * the parent directory in the file handle and make sure
507 		 * it's connected to the filesystem root.
508 		 */
509 		alias = find_acceptable_alias(result, acceptable, context);
510 		if (alias)
511 			return alias;
512 
513 		/*
514 		 * Try to extract a dentry for the parent directory from the
515 		 * file handle.  If this fails we'll have to give up.
516 		 */
517 		err = -ESTALE;
518 		if (!nop->fh_to_parent)
519 			goto err_result;
520 
521 		target_dir = nop->fh_to_parent(mnt->mnt_sb, fid,
522 				fh_len, fileid_type);
523 		if (!target_dir)
524 			goto err_result;
525 		err = PTR_ERR(target_dir);
526 		if (IS_ERR(target_dir))
527 			goto err_result;
528 
529 		/*
530 		 * And as usual we need to make sure the parent directory is
531 		 * connected to the filesystem root.  The VFS really doesn't
532 		 * like disconnected directories..
533 		 */
534 		err = reconnect_path(mnt, target_dir, nbuf);
535 		if (err) {
536 			dput(target_dir);
537 			goto err_result;
538 		}
539 
540 		/*
541 		 * Now that we've got both a well-connected parent and a
542 		 * dentry for the inode we're after, make sure that our
543 		 * inode is actually connected to the parent.
544 		 */
545 		err = exportfs_get_name(mnt, target_dir, nbuf, result);
546 		if (err) {
547 			dput(target_dir);
548 			goto err_result;
549 		}
550 
551 		inode_lock(target_dir->d_inode);
552 		nresult = lookup_one(mnt_idmap(mnt), nbuf,
553 				     target_dir, strlen(nbuf));
554 		if (!IS_ERR(nresult)) {
555 			if (unlikely(nresult->d_inode != result->d_inode)) {
556 				dput(nresult);
557 				nresult = ERR_PTR(-ESTALE);
558 			}
559 		}
560 		inode_unlock(target_dir->d_inode);
561 		/*
562 		 * At this point we are done with the parent, but it's pinned
563 		 * by the child dentry anyway.
564 		 */
565 		dput(target_dir);
566 
567 		if (IS_ERR(nresult)) {
568 			err = PTR_ERR(nresult);
569 			goto err_result;
570 		}
571 		dput(result);
572 		result = nresult;
573 
574 		/*
575 		 * And finally make sure the dentry is actually acceptable
576 		 * to NFSD.
577 		 */
578 		alias = find_acceptable_alias(result, acceptable, context);
579 		if (!alias) {
580 			err = -EACCES;
581 			goto err_result;
582 		}
583 
584 		return alias;
585 	}
586 
587  err_result:
588 	dput(result);
589 	return ERR_PTR(err);
590 }
591 EXPORT_SYMBOL_GPL(exportfs_decode_fh_raw);
592 
exportfs_decode_fh(struct vfsmount * mnt,struct fid * fid,int fh_len,int fileid_type,int (* acceptable)(void *,struct dentry *),void * context)593 struct dentry *exportfs_decode_fh(struct vfsmount *mnt, struct fid *fid,
594 				  int fh_len, int fileid_type,
595 				  int (*acceptable)(void *, struct dentry *),
596 				  void *context)
597 {
598 	struct dentry *ret;
599 
600 	ret = exportfs_decode_fh_raw(mnt, fid, fh_len, fileid_type, 0,
601 				     acceptable, context);
602 	if (IS_ERR_OR_NULL(ret)) {
603 		if (ret == ERR_PTR(-ENOMEM))
604 			return ret;
605 		return ERR_PTR(-ESTALE);
606 	}
607 	return ret;
608 }
609 EXPORT_SYMBOL_GPL(exportfs_decode_fh);
610 
611 MODULE_DESCRIPTION("Code mapping from inodes to file handles");
612 MODULE_LICENSE("GPL");
613