Line data Source code
1 : // SPDX-License-Identifier: GPL-2.0-only
2 : /*
3 : * linux/fs/namespace.c
4 : *
5 : * (C) Copyright Al Viro 2000, 2001
6 : *
7 : * Based on code from fs/super.c, copyright Linus Torvalds and others.
8 : * Heavily rewritten.
9 : */
10 :
11 : #include <linux/syscalls.h>
12 : #include <linux/export.h>
13 : #include <linux/capability.h>
14 : #include <linux/mnt_namespace.h>
15 : #include <linux/user_namespace.h>
16 : #include <linux/namei.h>
17 : #include <linux/security.h>
18 : #include <linux/cred.h>
19 : #include <linux/idr.h>
20 : #include <linux/init.h> /* init_rootfs */
21 : #include <linux/fs_struct.h> /* get_fs_root et.al. */
22 : #include <linux/fsnotify.h> /* fsnotify_vfsmount_delete */
23 : #include <linux/file.h>
24 : #include <linux/uaccess.h>
25 : #include <linux/proc_ns.h>
26 : #include <linux/magic.h>
27 : #include <linux/memblock.h>
28 : #include <linux/proc_fs.h>
29 : #include <linux/task_work.h>
30 : #include <linux/sched/task.h>
31 : #include <uapi/linux/mount.h>
32 : #include <linux/fs_context.h>
33 : #include <linux/shmem_fs.h>
34 : #include <linux/mnt_idmapping.h>
35 :
36 : #include "pnode.h"
37 : #include "internal.h"
38 :
39 : /* Maximum number of mounts in a mount namespace */
40 : static unsigned int sysctl_mount_max __read_mostly = 100000;
41 :
42 : static unsigned int m_hash_mask __read_mostly;
43 : static unsigned int m_hash_shift __read_mostly;
44 : static unsigned int mp_hash_mask __read_mostly;
45 : static unsigned int mp_hash_shift __read_mostly;
46 :
47 : static __initdata unsigned long mhash_entries;
48 0 : static int __init set_mhash_entries(char *str)
49 : {
50 0 : if (!str)
51 : return 0;
52 0 : mhash_entries = simple_strtoul(str, &str, 0);
53 0 : return 1;
54 : }
55 : __setup("mhash_entries=", set_mhash_entries);
56 :
57 : static __initdata unsigned long mphash_entries;
58 0 : static int __init set_mphash_entries(char *str)
59 : {
60 0 : if (!str)
61 : return 0;
62 0 : mphash_entries = simple_strtoul(str, &str, 0);
63 0 : return 1;
64 : }
65 : __setup("mphash_entries=", set_mphash_entries);
66 :
67 : static u64 event;
68 : static DEFINE_IDA(mnt_id_ida);
69 : static DEFINE_IDA(mnt_group_ida);
70 :
71 : static struct hlist_head *mount_hashtable __read_mostly;
72 : static struct hlist_head *mountpoint_hashtable __read_mostly;
73 : static struct kmem_cache *mnt_cache __read_mostly;
74 : static DECLARE_RWSEM(namespace_sem);
75 : static HLIST_HEAD(unmounted); /* protected by namespace_sem */
76 : static LIST_HEAD(ex_mountpoints); /* protected by namespace_sem */
77 :
78 : struct mount_kattr {
79 : unsigned int attr_set;
80 : unsigned int attr_clr;
81 : unsigned int propagation;
82 : unsigned int lookup_flags;
83 : bool recurse;
84 : struct user_namespace *mnt_userns;
85 : struct mnt_idmap *mnt_idmap;
86 : };
87 :
88 : /* /sys/fs */
89 : struct kobject *fs_kobj;
90 : EXPORT_SYMBOL_GPL(fs_kobj);
91 :
92 : /*
93 : * vfsmount lock may be taken for read to prevent changes to the
94 : * vfsmount hash, ie. during mountpoint lookups or walking back
95 : * up the tree.
96 : *
97 : * It should be taken for write in all cases where the vfsmount
98 : * tree or hash is modified or when a vfsmount structure is modified.
99 : */
100 : __cacheline_aligned_in_smp DEFINE_SEQLOCK(mount_lock);
101 :
102 : static inline void lock_mount_hash(void)
103 : {
104 77 : write_seqlock(&mount_lock);
105 : }
106 :
107 : static inline void unlock_mount_hash(void)
108 : {
109 77 : write_sequnlock(&mount_lock);
110 : }
111 :
112 : static inline struct hlist_head *m_hash(struct vfsmount *mnt, struct dentry *dentry)
113 : {
114 0 : unsigned long tmp = ((unsigned long)mnt / L1_CACHE_BYTES);
115 0 : tmp += ((unsigned long)dentry / L1_CACHE_BYTES);
116 0 : tmp = tmp + (tmp >> m_hash_shift);
117 0 : return &mount_hashtable[tmp & m_hash_mask];
118 : }
119 :
120 : static inline struct hlist_head *mp_hash(struct dentry *dentry)
121 : {
122 0 : unsigned long tmp = ((unsigned long)dentry / L1_CACHE_BYTES);
123 0 : tmp = tmp + (tmp >> mp_hash_shift);
124 0 : return &mountpoint_hashtable[tmp & mp_hash_mask];
125 : }
126 :
127 : static int mnt_alloc_id(struct mount *mnt)
128 : {
129 32 : int res = ida_alloc(&mnt_id_ida, GFP_KERNEL);
130 :
131 32 : if (res < 0)
132 : return res;
133 32 : mnt->mnt_id = res;
134 : return 0;
135 : }
136 :
137 : static void mnt_free_id(struct mount *mnt)
138 : {
139 22 : ida_free(&mnt_id_ida, mnt->mnt_id);
140 : }
141 :
142 : /*
143 : * Allocate a new peer group ID
144 : */
145 : static int mnt_alloc_group_id(struct mount *mnt)
146 : {
147 0 : int res = ida_alloc_min(&mnt_group_ida, 1, GFP_KERNEL);
148 :
149 0 : if (res < 0)
150 : return res;
151 0 : mnt->mnt_group_id = res;
152 : return 0;
153 : }
154 :
155 : /*
156 : * Release a peer group ID
157 : */
158 0 : void mnt_release_group_id(struct mount *mnt)
159 : {
160 0 : ida_free(&mnt_group_ida, mnt->mnt_group_id);
161 0 : mnt->mnt_group_id = 0;
162 0 : }
163 :
164 : /*
165 : * vfsmount lock must be held for read
166 : */
167 : static inline void mnt_add_count(struct mount *mnt, int n)
168 : {
169 : #ifdef CONFIG_SMP
170 : this_cpu_add(mnt->mnt_pcp->mnt_count, n);
171 : #else
172 76 : preempt_disable();
173 76 : mnt->mnt_count += n;
174 76 : preempt_enable();
175 : #endif
176 : }
177 :
178 : /*
179 : * vfsmount lock must be held for write
180 : */
181 0 : int mnt_get_count(struct mount *mnt)
182 : {
183 : #ifdef CONFIG_SMP
184 : int count = 0;
185 : int cpu;
186 :
187 : for_each_possible_cpu(cpu) {
188 : count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_count;
189 : }
190 :
191 : return count;
192 : #else
193 45 : return mnt->mnt_count;
194 : #endif
195 : }
196 :
197 32 : static struct mount *alloc_vfsmnt(const char *name)
198 : {
199 64 : struct mount *mnt = kmem_cache_zalloc(mnt_cache, GFP_KERNEL);
200 32 : if (mnt) {
201 : int err;
202 :
203 32 : err = mnt_alloc_id(mnt);
204 32 : if (err)
205 : goto out_free_cache;
206 :
207 32 : if (name) {
208 32 : mnt->mnt_devname = kstrdup_const(name,
209 : GFP_KERNEL_ACCOUNT);
210 32 : if (!mnt->mnt_devname)
211 : goto out_free_id;
212 : }
213 :
214 : #ifdef CONFIG_SMP
215 : mnt->mnt_pcp = alloc_percpu(struct mnt_pcp);
216 : if (!mnt->mnt_pcp)
217 : goto out_free_devname;
218 :
219 : this_cpu_add(mnt->mnt_pcp->mnt_count, 1);
220 : #else
221 32 : mnt->mnt_count = 1;
222 32 : mnt->mnt_writers = 0;
223 : #endif
224 :
225 64 : INIT_HLIST_NODE(&mnt->mnt_hash);
226 64 : INIT_LIST_HEAD(&mnt->mnt_child);
227 64 : INIT_LIST_HEAD(&mnt->mnt_mounts);
228 64 : INIT_LIST_HEAD(&mnt->mnt_list);
229 64 : INIT_LIST_HEAD(&mnt->mnt_expire);
230 64 : INIT_LIST_HEAD(&mnt->mnt_share);
231 64 : INIT_LIST_HEAD(&mnt->mnt_slave_list);
232 64 : INIT_LIST_HEAD(&mnt->mnt_slave);
233 64 : INIT_HLIST_NODE(&mnt->mnt_mp_list);
234 64 : INIT_LIST_HEAD(&mnt->mnt_umounting);
235 32 : INIT_HLIST_HEAD(&mnt->mnt_stuck_children);
236 32 : mnt->mnt.mnt_idmap = &nop_mnt_idmap;
237 : }
238 : return mnt;
239 :
240 : #ifdef CONFIG_SMP
241 : out_free_devname:
242 : kfree_const(mnt->mnt_devname);
243 : #endif
244 : out_free_id:
245 : mnt_free_id(mnt);
246 : out_free_cache:
247 0 : kmem_cache_free(mnt_cache, mnt);
248 0 : return NULL;
249 : }
250 :
251 : /*
252 : * Most r/o checks on a fs are for operations that take
253 : * discrete amounts of time, like a write() or unlink().
254 : * We must keep track of when those operations start
255 : * (for permission checks) and when they end, so that
256 : * we can determine when writes are able to occur to
257 : * a filesystem.
258 : */
259 : /*
260 : * __mnt_is_readonly: check whether a mount is read-only
261 : * @mnt: the mount to check for its write status
262 : *
263 : * This shouldn't be used directly ouside of the VFS.
264 : * It does not guarantee that the filesystem will stay
265 : * r/w, just that it is right *now*. This can not and
266 : * should not be used in place of IS_RDONLY(inode).
267 : * mnt_want/drop_write() will _keep_ the filesystem
268 : * r/w.
269 : */
270 0 : bool __mnt_is_readonly(struct vfsmount *mnt)
271 : {
272 6 : return (mnt->mnt_flags & MNT_READONLY) || sb_rdonly(mnt->mnt_sb);
273 : }
274 : EXPORT_SYMBOL_GPL(__mnt_is_readonly);
275 :
276 : static inline void mnt_inc_writers(struct mount *mnt)
277 : {
278 : #ifdef CONFIG_SMP
279 : this_cpu_inc(mnt->mnt_pcp->mnt_writers);
280 : #else
281 3 : mnt->mnt_writers++;
282 : #endif
283 : }
284 :
285 : static inline void mnt_dec_writers(struct mount *mnt)
286 : {
287 : #ifdef CONFIG_SMP
288 : this_cpu_dec(mnt->mnt_pcp->mnt_writers);
289 : #else
290 3 : mnt->mnt_writers--;
291 : #endif
292 : }
293 :
294 : static unsigned int mnt_get_writers(struct mount *mnt)
295 : {
296 : #ifdef CONFIG_SMP
297 : unsigned int count = 0;
298 : int cpu;
299 :
300 : for_each_possible_cpu(cpu) {
301 : count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_writers;
302 : }
303 :
304 : return count;
305 : #else
306 : return mnt->mnt_writers;
307 : #endif
308 : }
309 :
310 : static int mnt_is_readonly(struct vfsmount *mnt)
311 : {
312 3 : if (mnt->mnt_sb->s_readonly_remount)
313 : return 1;
314 : /* Order wrt setting s_flags/s_readonly_remount in do_remount() */
315 3 : smp_rmb();
316 3 : return __mnt_is_readonly(mnt);
317 : }
318 :
319 : /*
320 : * Most r/o & frozen checks on a fs are for operations that take discrete
321 : * amounts of time, like a write() or unlink(). We must keep track of when
322 : * those operations start (for permission checks) and when they end, so that we
323 : * can determine when writes are able to occur to a filesystem.
324 : */
325 : /**
326 : * __mnt_want_write - get write access to a mount without freeze protection
327 : * @m: the mount on which to take a write
328 : *
329 : * This tells the low-level filesystem that a write is about to be performed to
330 : * it, and makes sure that writes are allowed (mnt it read-write) before
331 : * returning success. This operation does not protect against filesystem being
332 : * frozen. When the write operation is finished, __mnt_drop_write() must be
333 : * called. This is effectively a refcount.
334 : */
335 3 : int __mnt_want_write(struct vfsmount *m)
336 : {
337 3 : struct mount *mnt = real_mount(m);
338 3 : int ret = 0;
339 :
340 3 : preempt_disable();
341 : mnt_inc_writers(mnt);
342 : /*
343 : * The store to mnt_inc_writers must be visible before we pass
344 : * MNT_WRITE_HOLD loop below, so that the slowpath can see our
345 : * incremented count after it has set MNT_WRITE_HOLD.
346 : */
347 3 : smp_mb();
348 : might_lock(&mount_lock.lock);
349 6 : while (READ_ONCE(mnt->mnt.mnt_flags) & MNT_WRITE_HOLD) {
350 : if (!IS_ENABLED(CONFIG_PREEMPT_RT)) {
351 : cpu_relax();
352 : } else {
353 : /*
354 : * This prevents priority inversion, if the task
355 : * setting MNT_WRITE_HOLD got preempted on a remote
356 : * CPU, and it prevents life lock if the task setting
357 : * MNT_WRITE_HOLD has a lower priority and is bound to
358 : * the same CPU as the task that is spinning here.
359 : */
360 : preempt_enable();
361 : lock_mount_hash();
362 : unlock_mount_hash();
363 : preempt_disable();
364 : }
365 : }
366 : /*
367 : * After the slowpath clears MNT_WRITE_HOLD, mnt_is_readonly will
368 : * be set to match its requirements. So we must not load that until
369 : * MNT_WRITE_HOLD is cleared.
370 : */
371 3 : smp_rmb();
372 6 : if (mnt_is_readonly(m)) {
373 : mnt_dec_writers(mnt);
374 0 : ret = -EROFS;
375 : }
376 3 : preempt_enable();
377 :
378 3 : return ret;
379 : }
380 :
381 : /**
382 : * mnt_want_write - get write access to a mount
383 : * @m: the mount on which to take a write
384 : *
385 : * This tells the low-level filesystem that a write is about to be performed to
386 : * it, and makes sure that writes are allowed (mount is read-write, filesystem
387 : * is not frozen) before returning success. When the write operation is
388 : * finished, mnt_drop_write() must be called. This is effectively a refcount.
389 : */
390 3 : int mnt_want_write(struct vfsmount *m)
391 : {
392 : int ret;
393 :
394 6 : sb_start_write(m->mnt_sb);
395 3 : ret = __mnt_want_write(m);
396 3 : if (ret)
397 0 : sb_end_write(m->mnt_sb);
398 3 : return ret;
399 : }
400 : EXPORT_SYMBOL_GPL(mnt_want_write);
401 :
402 : /**
403 : * __mnt_want_write_file - get write access to a file's mount
404 : * @file: the file who's mount on which to take a write
405 : *
406 : * This is like __mnt_want_write, but if the file is already open for writing it
407 : * skips incrementing mnt_writers (since the open file already has a reference)
408 : * and instead only does the check for emergency r/o remounts. This must be
409 : * paired with __mnt_drop_write_file.
410 : */
411 0 : int __mnt_want_write_file(struct file *file)
412 : {
413 0 : if (file->f_mode & FMODE_WRITER) {
414 : /*
415 : * Superblock may have become readonly while there are still
416 : * writable fd's, e.g. due to a fs error with errors=remount-ro
417 : */
418 0 : if (__mnt_is_readonly(file->f_path.mnt))
419 : return -EROFS;
420 0 : return 0;
421 : }
422 0 : return __mnt_want_write(file->f_path.mnt);
423 : }
424 :
425 : /**
426 : * mnt_want_write_file - get write access to a file's mount
427 : * @file: the file who's mount on which to take a write
428 : *
429 : * This is like mnt_want_write, but if the file is already open for writing it
430 : * skips incrementing mnt_writers (since the open file already has a reference)
431 : * and instead only does the freeze protection and the check for emergency r/o
432 : * remounts. This must be paired with mnt_drop_write_file.
433 : */
434 0 : int mnt_want_write_file(struct file *file)
435 : {
436 : int ret;
437 :
438 0 : sb_start_write(file_inode(file)->i_sb);
439 0 : ret = __mnt_want_write_file(file);
440 0 : if (ret)
441 0 : sb_end_write(file_inode(file)->i_sb);
442 0 : return ret;
443 : }
444 : EXPORT_SYMBOL_GPL(mnt_want_write_file);
445 :
446 : /**
447 : * __mnt_drop_write - give up write access to a mount
448 : * @mnt: the mount on which to give up write access
449 : *
450 : * Tells the low-level filesystem that we are done
451 : * performing writes to it. Must be matched with
452 : * __mnt_want_write() call above.
453 : */
454 0 : void __mnt_drop_write(struct vfsmount *mnt)
455 : {
456 3 : preempt_disable();
457 3 : mnt_dec_writers(real_mount(mnt));
458 3 : preempt_enable();
459 0 : }
460 :
461 : /**
462 : * mnt_drop_write - give up write access to a mount
463 : * @mnt: the mount on which to give up write access
464 : *
465 : * Tells the low-level filesystem that we are done performing writes to it and
466 : * also allows filesystem to be frozen again. Must be matched with
467 : * mnt_want_write() call above.
468 : */
469 3 : void mnt_drop_write(struct vfsmount *mnt)
470 : {
471 3 : __mnt_drop_write(mnt);
472 6 : sb_end_write(mnt->mnt_sb);
473 3 : }
474 : EXPORT_SYMBOL_GPL(mnt_drop_write);
475 :
476 0 : void __mnt_drop_write_file(struct file *file)
477 : {
478 0 : if (!(file->f_mode & FMODE_WRITER))
479 0 : __mnt_drop_write(file->f_path.mnt);
480 0 : }
481 :
482 0 : void mnt_drop_write_file(struct file *file)
483 : {
484 0 : __mnt_drop_write_file(file);
485 0 : sb_end_write(file_inode(file)->i_sb);
486 0 : }
487 : EXPORT_SYMBOL(mnt_drop_write_file);
488 :
489 : /**
490 : * mnt_hold_writers - prevent write access to the given mount
491 : * @mnt: mnt to prevent write access to
492 : *
493 : * Prevents write access to @mnt if there are no active writers for @mnt.
494 : * This function needs to be called and return successfully before changing
495 : * properties of @mnt that need to remain stable for callers with write access
496 : * to @mnt.
497 : *
498 : * After this functions has been called successfully callers must pair it with
499 : * a call to mnt_unhold_writers() in order to stop preventing write access to
500 : * @mnt.
501 : *
502 : * Context: This function expects lock_mount_hash() to be held serializing
503 : * setting MNT_WRITE_HOLD.
504 : * Return: On success 0 is returned.
505 : * On error, -EBUSY is returned.
506 : */
507 : static inline int mnt_hold_writers(struct mount *mnt)
508 : {
509 0 : mnt->mnt.mnt_flags |= MNT_WRITE_HOLD;
510 : /*
511 : * After storing MNT_WRITE_HOLD, we'll read the counters. This store
512 : * should be visible before we do.
513 : */
514 0 : smp_mb();
515 :
516 : /*
517 : * With writers on hold, if this value is zero, then there are
518 : * definitely no active writers (although held writers may subsequently
519 : * increment the count, they'll have to wait, and decrement it after
520 : * seeing MNT_READONLY).
521 : *
522 : * It is OK to have counter incremented on one CPU and decremented on
523 : * another: the sum will add up correctly. The danger would be when we
524 : * sum up each counter, if we read a counter before it is incremented,
525 : * but then read another CPU's count which it has been subsequently
526 : * decremented from -- we would see more decrements than we should.
527 : * MNT_WRITE_HOLD protects against this scenario, because
528 : * mnt_want_write first increments count, then smp_mb, then spins on
529 : * MNT_WRITE_HOLD, so it can't be decremented by another CPU while
530 : * we're counting up here.
531 : */
532 0 : if (mnt_get_writers(mnt) > 0)
533 : return -EBUSY;
534 :
535 : return 0;
536 : }
537 :
538 : /**
539 : * mnt_unhold_writers - stop preventing write access to the given mount
540 : * @mnt: mnt to stop preventing write access to
541 : *
542 : * Stop preventing write access to @mnt allowing callers to gain write access
543 : * to @mnt again.
544 : *
545 : * This function can only be called after a successful call to
546 : * mnt_hold_writers().
547 : *
548 : * Context: This function expects lock_mount_hash() to be held.
549 : */
550 : static inline void mnt_unhold_writers(struct mount *mnt)
551 : {
552 : /*
553 : * MNT_READONLY must become visible before ~MNT_WRITE_HOLD, so writers
554 : * that become unheld will see MNT_READONLY.
555 : */
556 0 : smp_wmb();
557 0 : mnt->mnt.mnt_flags &= ~MNT_WRITE_HOLD;
558 : }
559 :
560 : static int mnt_make_readonly(struct mount *mnt)
561 : {
562 : int ret;
563 :
564 0 : ret = mnt_hold_writers(mnt);
565 0 : if (!ret)
566 0 : mnt->mnt.mnt_flags |= MNT_READONLY;
567 0 : mnt_unhold_writers(mnt);
568 : return ret;
569 : }
570 :
571 0 : int sb_prepare_remount_readonly(struct super_block *sb)
572 : {
573 : struct mount *mnt;
574 0 : int err = 0;
575 :
576 : /* Racy optimization. Recheck the counter under MNT_WRITE_HOLD */
577 0 : if (atomic_long_read(&sb->s_remove_count))
578 : return -EBUSY;
579 :
580 : lock_mount_hash();
581 0 : list_for_each_entry(mnt, &sb->s_mounts, mnt_instance) {
582 0 : if (!(mnt->mnt.mnt_flags & MNT_READONLY)) {
583 0 : err = mnt_hold_writers(mnt);
584 0 : if (err)
585 : break;
586 : }
587 : }
588 0 : if (!err && atomic_long_read(&sb->s_remove_count))
589 0 : err = -EBUSY;
590 :
591 0 : if (!err) {
592 0 : sb->s_readonly_remount = 1;
593 0 : smp_wmb();
594 : }
595 0 : list_for_each_entry(mnt, &sb->s_mounts, mnt_instance) {
596 0 : if (mnt->mnt.mnt_flags & MNT_WRITE_HOLD)
597 0 : mnt->mnt.mnt_flags &= ~MNT_WRITE_HOLD;
598 : }
599 : unlock_mount_hash();
600 :
601 0 : return err;
602 : }
603 :
604 22 : static void free_vfsmnt(struct mount *mnt)
605 : {
606 44 : mnt_idmap_put(mnt_idmap(&mnt->mnt));
607 22 : kfree_const(mnt->mnt_devname);
608 : #ifdef CONFIG_SMP
609 : free_percpu(mnt->mnt_pcp);
610 : #endif
611 22 : kmem_cache_free(mnt_cache, mnt);
612 22 : }
613 :
614 22 : static void delayed_free_vfsmnt(struct rcu_head *head)
615 : {
616 22 : free_vfsmnt(container_of(head, struct mount, mnt_rcu));
617 22 : }
618 :
619 : /* call under rcu_read_lock */
620 3 : int __legitimize_mnt(struct vfsmount *bastard, unsigned seq)
621 : {
622 : struct mount *mnt;
623 3 : if (read_seqretry(&mount_lock, seq))
624 : return 1;
625 3 : if (bastard == NULL)
626 : return 0;
627 3 : mnt = real_mount(bastard);
628 6 : mnt_add_count(mnt, 1);
629 3 : smp_mb(); // see mntput_no_expire()
630 3 : if (likely(!read_seqretry(&mount_lock, seq)))
631 : return 0;
632 0 : if (bastard->mnt_flags & MNT_SYNC_UMOUNT) {
633 0 : mnt_add_count(mnt, -1);
634 0 : return 1;
635 : }
636 : lock_mount_hash();
637 0 : if (unlikely(bastard->mnt_flags & MNT_DOOMED)) {
638 0 : mnt_add_count(mnt, -1);
639 : unlock_mount_hash();
640 0 : return 1;
641 : }
642 : unlock_mount_hash();
643 : /* caller will mntput() */
644 0 : return -1;
645 : }
646 :
647 : /* call under rcu_read_lock */
648 0 : static bool legitimize_mnt(struct vfsmount *bastard, unsigned seq)
649 : {
650 0 : int res = __legitimize_mnt(bastard, seq);
651 0 : if (likely(!res))
652 : return true;
653 0 : if (unlikely(res < 0)) {
654 0 : rcu_read_unlock();
655 0 : mntput(bastard);
656 : rcu_read_lock();
657 : }
658 : return false;
659 : }
660 :
661 : /*
662 : * find the first mount at @dentry on vfsmount @mnt.
663 : * call under rcu_read_lock()
664 : */
665 0 : struct mount *__lookup_mnt(struct vfsmount *mnt, struct dentry *dentry)
666 : {
667 0 : struct hlist_head *head = m_hash(mnt, dentry);
668 : struct mount *p;
669 :
670 0 : hlist_for_each_entry_rcu(p, head, mnt_hash)
671 0 : if (&p->mnt_parent->mnt == mnt && p->mnt_mountpoint == dentry)
672 : return p;
673 : return NULL;
674 : }
675 :
676 : /*
677 : * lookup_mnt - Return the first child mount mounted at path
678 : *
679 : * "First" means first mounted chronologically. If you create the
680 : * following mounts:
681 : *
682 : * mount /dev/sda1 /mnt
683 : * mount /dev/sda2 /mnt
684 : * mount /dev/sda3 /mnt
685 : *
686 : * Then lookup_mnt() on the base /mnt dentry in the root mount will
687 : * return successively the root dentry and vfsmount of /dev/sda1, then
688 : * /dev/sda2, then /dev/sda3, then NULL.
689 : *
690 : * lookup_mnt takes a reference to the found vfsmount.
691 : */
692 0 : struct vfsmount *lookup_mnt(const struct path *path)
693 : {
694 : struct mount *child_mnt;
695 : struct vfsmount *m;
696 : unsigned seq;
697 :
698 : rcu_read_lock();
699 : do {
700 0 : seq = read_seqbegin(&mount_lock);
701 0 : child_mnt = __lookup_mnt(path->mnt, path->dentry);
702 0 : m = child_mnt ? &child_mnt->mnt : NULL;
703 0 : } while (!legitimize_mnt(m, seq));
704 : rcu_read_unlock();
705 0 : return m;
706 : }
707 :
708 : static inline void lock_ns_list(struct mnt_namespace *ns)
709 : {
710 0 : spin_lock(&ns->ns_lock);
711 : }
712 :
713 : static inline void unlock_ns_list(struct mnt_namespace *ns)
714 : {
715 0 : spin_unlock(&ns->ns_lock);
716 : }
717 :
718 : static inline bool mnt_is_cursor(struct mount *mnt)
719 : {
720 0 : return mnt->mnt.mnt_flags & MNT_CURSOR;
721 : }
722 :
723 : /*
724 : * __is_local_mountpoint - Test to see if dentry is a mountpoint in the
725 : * current mount namespace.
726 : *
727 : * The common case is dentries are not mountpoints at all and that
728 : * test is handled inline. For the slow case when we are actually
729 : * dealing with a mountpoint of some kind, walk through all of the
730 : * mounts in the current mount namespace and test to see if the dentry
731 : * is a mountpoint.
732 : *
733 : * The mount_hashtable is not usable in the context because we
734 : * need to identify all mounts that may be in the current mount
735 : * namespace not just a mount that happens to have some specified
736 : * parent mount.
737 : */
738 0 : bool __is_local_mountpoint(struct dentry *dentry)
739 : {
740 0 : struct mnt_namespace *ns = current->nsproxy->mnt_ns;
741 : struct mount *mnt;
742 0 : bool is_covered = false;
743 :
744 0 : down_read(&namespace_sem);
745 0 : lock_ns_list(ns);
746 0 : list_for_each_entry(mnt, &ns->list, mnt_list) {
747 0 : if (mnt_is_cursor(mnt))
748 0 : continue;
749 0 : is_covered = (mnt->mnt_mountpoint == dentry);
750 0 : if (is_covered)
751 : break;
752 : }
753 0 : unlock_ns_list(ns);
754 0 : up_read(&namespace_sem);
755 :
756 0 : return is_covered;
757 : }
758 :
759 0 : static struct mountpoint *lookup_mountpoint(struct dentry *dentry)
760 : {
761 0 : struct hlist_head *chain = mp_hash(dentry);
762 : struct mountpoint *mp;
763 :
764 0 : hlist_for_each_entry(mp, chain, m_hash) {
765 0 : if (mp->m_dentry == dentry) {
766 0 : mp->m_count++;
767 0 : return mp;
768 : }
769 : }
770 : return NULL;
771 : }
772 :
773 0 : static struct mountpoint *get_mountpoint(struct dentry *dentry)
774 : {
775 0 : struct mountpoint *mp, *new = NULL;
776 : int ret;
777 :
778 0 : if (d_mountpoint(dentry)) {
779 : /* might be worth a WARN_ON() */
780 0 : if (d_unlinked(dentry))
781 : return ERR_PTR(-ENOENT);
782 : mountpoint:
783 0 : read_seqlock_excl(&mount_lock);
784 0 : mp = lookup_mountpoint(dentry);
785 0 : read_sequnlock_excl(&mount_lock);
786 0 : if (mp)
787 : goto done;
788 : }
789 :
790 0 : if (!new)
791 0 : new = kmalloc(sizeof(struct mountpoint), GFP_KERNEL);
792 0 : if (!new)
793 : return ERR_PTR(-ENOMEM);
794 :
795 :
796 : /* Exactly one processes may set d_mounted */
797 0 : ret = d_set_mounted(dentry);
798 :
799 : /* Someone else set d_mounted? */
800 0 : if (ret == -EBUSY)
801 : goto mountpoint;
802 :
803 : /* The dentry is not available as a mountpoint? */
804 0 : mp = ERR_PTR(ret);
805 0 : if (ret)
806 : goto done;
807 :
808 : /* Add the new mountpoint to the hash table */
809 0 : read_seqlock_excl(&mount_lock);
810 0 : new->m_dentry = dget(dentry);
811 0 : new->m_count = 1;
812 0 : hlist_add_head(&new->m_hash, mp_hash(dentry));
813 0 : INIT_HLIST_HEAD(&new->m_list);
814 0 : read_sequnlock_excl(&mount_lock);
815 :
816 0 : mp = new;
817 0 : new = NULL;
818 : done:
819 0 : kfree(new);
820 0 : return mp;
821 : }
822 :
823 : /*
824 : * vfsmount lock must be held. Additionally, the caller is responsible
825 : * for serializing calls for given disposal list.
826 : */
827 0 : static void __put_mountpoint(struct mountpoint *mp, struct list_head *list)
828 : {
829 0 : if (!--mp->m_count) {
830 0 : struct dentry *dentry = mp->m_dentry;
831 0 : BUG_ON(!hlist_empty(&mp->m_list));
832 0 : spin_lock(&dentry->d_lock);
833 0 : dentry->d_flags &= ~DCACHE_MOUNTED;
834 0 : spin_unlock(&dentry->d_lock);
835 0 : dput_to_list(dentry, list);
836 0 : hlist_del(&mp->m_hash);
837 0 : kfree(mp);
838 : }
839 0 : }
840 :
841 : /* called with namespace_lock and vfsmount lock */
842 : static void put_mountpoint(struct mountpoint *mp)
843 : {
844 0 : __put_mountpoint(mp, &ex_mountpoints);
845 : }
846 :
847 : static inline int check_mnt(struct mount *mnt)
848 : {
849 0 : return mnt->mnt_ns == current->nsproxy->mnt_ns;
850 : }
851 :
852 : /*
853 : * vfsmount lock must be held for write
854 : */
855 0 : static void touch_mnt_namespace(struct mnt_namespace *ns)
856 : {
857 0 : if (ns) {
858 0 : ns->event = ++event;
859 0 : wake_up_interruptible(&ns->poll);
860 : }
861 0 : }
862 :
863 : /*
864 : * vfsmount lock must be held for write
865 : */
866 0 : static void __touch_mnt_namespace(struct mnt_namespace *ns)
867 : {
868 0 : if (ns && ns->event != event) {
869 0 : ns->event = event;
870 0 : wake_up_interruptible(&ns->poll);
871 : }
872 0 : }
873 :
874 : /*
875 : * vfsmount lock must be held for write
876 : */
877 0 : static struct mountpoint *unhash_mnt(struct mount *mnt)
878 : {
879 : struct mountpoint *mp;
880 0 : mnt->mnt_parent = mnt;
881 0 : mnt->mnt_mountpoint = mnt->mnt.mnt_root;
882 0 : list_del_init(&mnt->mnt_child);
883 0 : hlist_del_init_rcu(&mnt->mnt_hash);
884 0 : hlist_del_init(&mnt->mnt_mp_list);
885 0 : mp = mnt->mnt_mp;
886 0 : mnt->mnt_mp = NULL;
887 0 : return mp;
888 : }
889 :
890 : /*
891 : * vfsmount lock must be held for write
892 : */
893 : static void umount_mnt(struct mount *mnt)
894 : {
895 0 : put_mountpoint(unhash_mnt(mnt));
896 : }
897 :
898 : /*
899 : * vfsmount lock must be held for write
900 : */
901 0 : void mnt_set_mountpoint(struct mount *mnt,
902 : struct mountpoint *mp,
903 : struct mount *child_mnt)
904 : {
905 0 : mp->m_count++;
906 0 : mnt_add_count(mnt, 1); /* essentially, that's mntget */
907 0 : child_mnt->mnt_mountpoint = mp->m_dentry;
908 0 : child_mnt->mnt_parent = mnt;
909 0 : child_mnt->mnt_mp = mp;
910 0 : hlist_add_head(&child_mnt->mnt_mp_list, &mp->m_list);
911 0 : }
912 :
913 0 : static void __attach_mnt(struct mount *mnt, struct mount *parent)
914 : {
915 0 : hlist_add_head_rcu(&mnt->mnt_hash,
916 : m_hash(&parent->mnt, mnt->mnt_mountpoint));
917 0 : list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
918 0 : }
919 :
920 : /*
921 : * vfsmount lock must be held for write
922 : */
923 0 : static void attach_mnt(struct mount *mnt,
924 : struct mount *parent,
925 : struct mountpoint *mp)
926 : {
927 0 : mnt_set_mountpoint(parent, mp, mnt);
928 0 : __attach_mnt(mnt, parent);
929 0 : }
930 :
931 0 : void mnt_change_mountpoint(struct mount *parent, struct mountpoint *mp, struct mount *mnt)
932 : {
933 0 : struct mountpoint *old_mp = mnt->mnt_mp;
934 0 : struct mount *old_parent = mnt->mnt_parent;
935 :
936 0 : list_del_init(&mnt->mnt_child);
937 0 : hlist_del_init(&mnt->mnt_mp_list);
938 0 : hlist_del_init_rcu(&mnt->mnt_hash);
939 :
940 0 : attach_mnt(mnt, parent, mp);
941 :
942 0 : put_mountpoint(old_mp);
943 0 : mnt_add_count(old_parent, -1);
944 0 : }
945 :
946 : /*
947 : * vfsmount lock must be held for write
948 : */
949 0 : static void commit_tree(struct mount *mnt)
950 : {
951 0 : struct mount *parent = mnt->mnt_parent;
952 : struct mount *m;
953 0 : LIST_HEAD(head);
954 0 : struct mnt_namespace *n = parent->mnt_ns;
955 :
956 0 : BUG_ON(parent == mnt);
957 :
958 0 : list_add_tail(&head, &mnt->mnt_list);
959 0 : list_for_each_entry(m, &head, mnt_list)
960 0 : m->mnt_ns = n;
961 :
962 0 : list_splice(&head, n->list.prev);
963 :
964 0 : n->mounts += n->pending_mounts;
965 0 : n->pending_mounts = 0;
966 :
967 0 : __attach_mnt(mnt, parent);
968 0 : touch_mnt_namespace(n);
969 0 : }
970 :
971 : static struct mount *next_mnt(struct mount *p, struct mount *root)
972 : {
973 0 : struct list_head *next = p->mnt_mounts.next;
974 0 : if (next == &p->mnt_mounts) {
975 : while (1) {
976 0 : if (p == root)
977 : return NULL;
978 0 : next = p->mnt_child.next;
979 0 : if (next != &p->mnt_parent->mnt_mounts)
980 : break;
981 : p = p->mnt_parent;
982 : }
983 : }
984 0 : return list_entry(next, struct mount, mnt_child);
985 : }
986 :
987 : static struct mount *skip_mnt_tree(struct mount *p)
988 : {
989 0 : struct list_head *prev = p->mnt_mounts.prev;
990 0 : while (prev != &p->mnt_mounts) {
991 0 : p = list_entry(prev, struct mount, mnt_child);
992 0 : prev = p->mnt_mounts.prev;
993 : }
994 : return p;
995 : }
996 :
997 : /**
998 : * vfs_create_mount - Create a mount for a configured superblock
999 : * @fc: The configuration context with the superblock attached
1000 : *
1001 : * Create a mount to an already configured superblock. If necessary, the
1002 : * caller should invoke vfs_get_tree() before calling this.
1003 : *
1004 : * Note that this does not attach the mount to anything.
1005 : */
1006 32 : struct vfsmount *vfs_create_mount(struct fs_context *fc)
1007 : {
1008 : struct mount *mnt;
1009 :
1010 32 : if (!fc->root)
1011 : return ERR_PTR(-EINVAL);
1012 :
1013 32 : mnt = alloc_vfsmnt(fc->source ?: "none");
1014 32 : if (!mnt)
1015 : return ERR_PTR(-ENOMEM);
1016 :
1017 32 : if (fc->sb_flags & SB_KERNMOUNT)
1018 31 : mnt->mnt.mnt_flags = MNT_INTERNAL;
1019 :
1020 64 : atomic_inc(&fc->root->d_sb->s_active);
1021 32 : mnt->mnt.mnt_sb = fc->root->d_sb;
1022 64 : mnt->mnt.mnt_root = dget(fc->root);
1023 32 : mnt->mnt_mountpoint = mnt->mnt.mnt_root;
1024 32 : mnt->mnt_parent = mnt;
1025 :
1026 : lock_mount_hash();
1027 64 : list_add_tail(&mnt->mnt_instance, &mnt->mnt.mnt_sb->s_mounts);
1028 : unlock_mount_hash();
1029 32 : return &mnt->mnt;
1030 : }
1031 : EXPORT_SYMBOL(vfs_create_mount);
1032 :
1033 32 : struct vfsmount *fc_mount(struct fs_context *fc)
1034 : {
1035 32 : int err = vfs_get_tree(fc);
1036 32 : if (!err) {
1037 32 : up_write(&fc->root->d_sb->s_umount);
1038 32 : return vfs_create_mount(fc);
1039 : }
1040 0 : return ERR_PTR(err);
1041 : }
1042 : EXPORT_SYMBOL(fc_mount);
1043 :
1044 32 : struct vfsmount *vfs_kern_mount(struct file_system_type *type,
1045 : int flags, const char *name,
1046 : void *data)
1047 : {
1048 : struct fs_context *fc;
1049 : struct vfsmount *mnt;
1050 32 : int ret = 0;
1051 :
1052 32 : if (!type)
1053 : return ERR_PTR(-EINVAL);
1054 :
1055 32 : fc = fs_context_for_mount(type, flags);
1056 32 : if (IS_ERR(fc))
1057 : return ERR_CAST(fc);
1058 :
1059 32 : if (name)
1060 32 : ret = vfs_parse_fs_string(fc, "source",
1061 : name, strlen(name));
1062 32 : if (!ret)
1063 32 : ret = parse_monolithic_mount_data(fc, data);
1064 32 : if (!ret)
1065 32 : mnt = fc_mount(fc);
1066 : else
1067 0 : mnt = ERR_PTR(ret);
1068 :
1069 32 : put_fs_context(fc);
1070 32 : return mnt;
1071 : }
1072 : EXPORT_SYMBOL_GPL(vfs_kern_mount);
1073 :
1074 : struct vfsmount *
1075 0 : vfs_submount(const struct dentry *mountpoint, struct file_system_type *type,
1076 : const char *name, void *data)
1077 : {
1078 : /* Until it is worked out how to pass the user namespace
1079 : * through from the parent mount to the submount don't support
1080 : * unprivileged mounts with submounts.
1081 : */
1082 0 : if (mountpoint->d_sb->s_user_ns != &init_user_ns)
1083 : return ERR_PTR(-EPERM);
1084 :
1085 0 : return vfs_kern_mount(type, SB_SUBMOUNT, name, data);
1086 : }
1087 : EXPORT_SYMBOL_GPL(vfs_submount);
1088 :
1089 0 : static struct mount *clone_mnt(struct mount *old, struct dentry *root,
1090 : int flag)
1091 : {
1092 0 : struct super_block *sb = old->mnt.mnt_sb;
1093 : struct mount *mnt;
1094 : int err;
1095 :
1096 0 : mnt = alloc_vfsmnt(old->mnt_devname);
1097 0 : if (!mnt)
1098 : return ERR_PTR(-ENOMEM);
1099 :
1100 0 : if (flag & (CL_SLAVE | CL_PRIVATE | CL_SHARED_TO_SLAVE))
1101 0 : mnt->mnt_group_id = 0; /* not a peer of original */
1102 : else
1103 0 : mnt->mnt_group_id = old->mnt_group_id;
1104 :
1105 0 : if ((flag & CL_MAKE_SHARED) && !mnt->mnt_group_id) {
1106 0 : err = mnt_alloc_group_id(mnt);
1107 0 : if (err)
1108 : goto out_free;
1109 : }
1110 :
1111 0 : mnt->mnt.mnt_flags = old->mnt.mnt_flags;
1112 0 : mnt->mnt.mnt_flags &= ~(MNT_WRITE_HOLD|MNT_MARKED|MNT_INTERNAL);
1113 :
1114 0 : atomic_inc(&sb->s_active);
1115 0 : mnt->mnt.mnt_idmap = mnt_idmap_get(mnt_idmap(&old->mnt));
1116 :
1117 0 : mnt->mnt.mnt_sb = sb;
1118 0 : mnt->mnt.mnt_root = dget(root);
1119 0 : mnt->mnt_mountpoint = mnt->mnt.mnt_root;
1120 0 : mnt->mnt_parent = mnt;
1121 : lock_mount_hash();
1122 0 : list_add_tail(&mnt->mnt_instance, &sb->s_mounts);
1123 : unlock_mount_hash();
1124 :
1125 0 : if ((flag & CL_SLAVE) ||
1126 0 : ((flag & CL_SHARED_TO_SLAVE) && IS_MNT_SHARED(old))) {
1127 0 : list_add(&mnt->mnt_slave, &old->mnt_slave_list);
1128 0 : mnt->mnt_master = old;
1129 0 : CLEAR_MNT_SHARED(mnt);
1130 0 : } else if (!(flag & CL_PRIVATE)) {
1131 0 : if ((flag & CL_MAKE_SHARED) || IS_MNT_SHARED(old))
1132 0 : list_add(&mnt->mnt_share, &old->mnt_share);
1133 0 : if (IS_MNT_SLAVE(old))
1134 0 : list_add(&mnt->mnt_slave, &old->mnt_slave);
1135 0 : mnt->mnt_master = old->mnt_master;
1136 : } else {
1137 0 : CLEAR_MNT_SHARED(mnt);
1138 : }
1139 0 : if (flag & CL_MAKE_SHARED)
1140 0 : set_mnt_shared(mnt);
1141 :
1142 : /* stick the duplicate mount on the same expiry list
1143 : * as the original if that was on one */
1144 0 : if (flag & CL_EXPIRE) {
1145 0 : if (!list_empty(&old->mnt_expire))
1146 0 : list_add(&mnt->mnt_expire, &old->mnt_expire);
1147 : }
1148 :
1149 : return mnt;
1150 :
1151 : out_free:
1152 0 : mnt_free_id(mnt);
1153 0 : free_vfsmnt(mnt);
1154 0 : return ERR_PTR(err);
1155 : }
1156 :
1157 22 : static void cleanup_mnt(struct mount *mnt)
1158 : {
1159 : struct hlist_node *p;
1160 : struct mount *m;
1161 : /*
1162 : * The warning here probably indicates that somebody messed
1163 : * up a mnt_want/drop_write() pair. If this happens, the
1164 : * filesystem was probably unable to make r/w->r/o transitions.
1165 : * The locking used to deal with mnt_count decrement provides barriers,
1166 : * so mnt_get_writers() below is safe.
1167 : */
1168 22 : WARN_ON(mnt_get_writers(mnt));
1169 22 : if (unlikely(mnt->mnt_pins.first))
1170 0 : mnt_pin_kill(mnt);
1171 22 : hlist_for_each_entry_safe(m, p, &mnt->mnt_stuck_children, mnt_umount) {
1172 0 : hlist_del(&m->mnt_umount);
1173 0 : mntput(&m->mnt);
1174 : }
1175 44 : fsnotify_vfsmount_delete(&mnt->mnt);
1176 22 : dput(mnt->mnt.mnt_root);
1177 22 : deactivate_super(mnt->mnt.mnt_sb);
1178 22 : mnt_free_id(mnt);
1179 22 : call_rcu(&mnt->mnt_rcu, delayed_free_vfsmnt);
1180 22 : }
1181 :
1182 0 : static void __cleanup_mnt(struct rcu_head *head)
1183 : {
1184 0 : cleanup_mnt(container_of(head, struct mount, mnt_rcu));
1185 0 : }
1186 :
1187 : static LLIST_HEAD(delayed_mntput_list);
1188 0 : static void delayed_mntput(struct work_struct *unused)
1189 : {
1190 0 : struct llist_node *node = llist_del_all(&delayed_mntput_list);
1191 : struct mount *m, *t;
1192 :
1193 0 : llist_for_each_entry_safe(m, t, node, mnt_llist)
1194 0 : cleanup_mnt(m);
1195 0 : }
1196 : static DECLARE_DELAYED_WORK(delayed_mntput_work, delayed_mntput);
1197 :
1198 48 : static void mntput_no_expire(struct mount *mnt)
1199 : {
1200 48 : LIST_HEAD(list);
1201 : int count;
1202 :
1203 : rcu_read_lock();
1204 48 : if (likely(READ_ONCE(mnt->mnt_ns))) {
1205 : /*
1206 : * Since we don't do lock_mount_hash() here,
1207 : * ->mnt_ns can change under us. However, if it's
1208 : * non-NULL, then there's a reference that won't
1209 : * be dropped until after an RCU delay done after
1210 : * turning ->mnt_ns NULL. So if we observe it
1211 : * non-NULL under rcu_read_lock(), the reference
1212 : * we are dropping is not the final one.
1213 : */
1214 6 : mnt_add_count(mnt, -1);
1215 : rcu_read_unlock();
1216 26 : return;
1217 : }
1218 : lock_mount_hash();
1219 : /*
1220 : * make sure that if __legitimize_mnt() has not seen us grab
1221 : * mount_lock, we'll see their refcount increment here.
1222 : */
1223 45 : smp_mb();
1224 90 : mnt_add_count(mnt, -1);
1225 45 : count = mnt_get_count(mnt);
1226 45 : if (count != 0) {
1227 23 : WARN_ON(count < 0);
1228 : rcu_read_unlock();
1229 : unlock_mount_hash();
1230 : return;
1231 : }
1232 22 : if (unlikely(mnt->mnt.mnt_flags & MNT_DOOMED)) {
1233 : rcu_read_unlock();
1234 : unlock_mount_hash();
1235 : return;
1236 : }
1237 22 : mnt->mnt.mnt_flags |= MNT_DOOMED;
1238 : rcu_read_unlock();
1239 :
1240 44 : list_del(&mnt->mnt_instance);
1241 :
1242 44 : if (unlikely(!list_empty(&mnt->mnt_mounts))) {
1243 : struct mount *p, *tmp;
1244 0 : list_for_each_entry_safe(p, tmp, &mnt->mnt_mounts, mnt_child) {
1245 0 : __put_mountpoint(unhash_mnt(p), &list);
1246 0 : hlist_add_head(&p->mnt_umount, &mnt->mnt_stuck_children);
1247 : }
1248 : }
1249 : unlock_mount_hash();
1250 22 : shrink_dentry_list(&list);
1251 :
1252 22 : if (likely(!(mnt->mnt.mnt_flags & MNT_INTERNAL))) {
1253 0 : struct task_struct *task = current;
1254 0 : if (likely(!(task->flags & PF_KTHREAD))) {
1255 0 : init_task_work(&mnt->mnt_rcu, __cleanup_mnt);
1256 0 : if (!task_work_add(task, &mnt->mnt_rcu, TWA_RESUME))
1257 : return;
1258 : }
1259 0 : if (llist_add(&mnt->mnt_llist, &delayed_mntput_list))
1260 : schedule_delayed_work(&delayed_mntput_work, 1);
1261 : return;
1262 : }
1263 22 : cleanup_mnt(mnt);
1264 : }
1265 :
1266 51 : void mntput(struct vfsmount *mnt)
1267 : {
1268 51 : if (mnt) {
1269 48 : struct mount *m = real_mount(mnt);
1270 : /* avoid cacheline pingpong, hope gcc doesn't get "smart" */
1271 48 : if (unlikely(m->mnt_expiry_mark))
1272 0 : m->mnt_expiry_mark = 0;
1273 48 : mntput_no_expire(m);
1274 : }
1275 51 : }
1276 : EXPORT_SYMBOL(mntput);
1277 :
1278 25 : struct vfsmount *mntget(struct vfsmount *mnt)
1279 : {
1280 25 : if (mnt)
1281 25 : mnt_add_count(real_mount(mnt), 1);
1282 25 : return mnt;
1283 : }
1284 : EXPORT_SYMBOL(mntget);
1285 :
1286 : /*
1287 : * Make a mount point inaccessible to new lookups.
1288 : * Because there may still be current users, the caller MUST WAIT
1289 : * for an RCU grace period before destroying the mount point.
1290 : */
1291 0 : void mnt_make_shortterm(struct vfsmount *mnt)
1292 : {
1293 0 : if (mnt)
1294 0 : real_mount(mnt)->mnt_ns = NULL;
1295 0 : }
1296 :
1297 : /**
1298 : * path_is_mountpoint() - Check if path is a mount in the current namespace.
1299 : * @path: path to check
1300 : *
1301 : * d_mountpoint() can only be used reliably to establish if a dentry is
1302 : * not mounted in any namespace and that common case is handled inline.
1303 : * d_mountpoint() isn't aware of the possibility there may be multiple
1304 : * mounts using a given dentry in a different namespace. This function
1305 : * checks if the passed in path is a mountpoint rather than the dentry
1306 : * alone.
1307 : */
1308 0 : bool path_is_mountpoint(const struct path *path)
1309 : {
1310 : unsigned seq;
1311 : bool res;
1312 :
1313 0 : if (!d_mountpoint(path->dentry))
1314 : return false;
1315 :
1316 : rcu_read_lock();
1317 : do {
1318 0 : seq = read_seqbegin(&mount_lock);
1319 0 : res = __path_is_mountpoint(path);
1320 0 : } while (read_seqretry(&mount_lock, seq));
1321 : rcu_read_unlock();
1322 :
1323 0 : return res;
1324 : }
1325 : EXPORT_SYMBOL(path_is_mountpoint);
1326 :
1327 0 : struct vfsmount *mnt_clone_internal(const struct path *path)
1328 : {
1329 : struct mount *p;
1330 0 : p = clone_mnt(real_mount(path->mnt), path->dentry, CL_PRIVATE);
1331 0 : if (IS_ERR(p))
1332 : return ERR_CAST(p);
1333 0 : p->mnt.mnt_flags |= MNT_INTERNAL;
1334 0 : return &p->mnt;
1335 : }
1336 :
1337 : #ifdef CONFIG_PROC_FS
1338 : static struct mount *mnt_list_next(struct mnt_namespace *ns,
1339 : struct list_head *p)
1340 : {
1341 0 : struct mount *mnt, *ret = NULL;
1342 :
1343 0 : lock_ns_list(ns);
1344 0 : list_for_each_continue(p, &ns->list) {
1345 0 : mnt = list_entry(p, typeof(*mnt), mnt_list);
1346 0 : if (!mnt_is_cursor(mnt)) {
1347 : ret = mnt;
1348 : break;
1349 : }
1350 : }
1351 0 : unlock_ns_list(ns);
1352 :
1353 : return ret;
1354 : }
1355 :
1356 : /* iterator; we want it to have access to namespace_sem, thus here... */
1357 0 : static void *m_start(struct seq_file *m, loff_t *pos)
1358 : {
1359 0 : struct proc_mounts *p = m->private;
1360 : struct list_head *prev;
1361 :
1362 0 : down_read(&namespace_sem);
1363 0 : if (!*pos) {
1364 0 : prev = &p->ns->list;
1365 : } else {
1366 0 : prev = &p->cursor.mnt_list;
1367 :
1368 : /* Read after we'd reached the end? */
1369 0 : if (list_empty(prev))
1370 : return NULL;
1371 : }
1372 :
1373 0 : return mnt_list_next(p->ns, prev);
1374 : }
1375 :
1376 0 : static void *m_next(struct seq_file *m, void *v, loff_t *pos)
1377 : {
1378 0 : struct proc_mounts *p = m->private;
1379 0 : struct mount *mnt = v;
1380 :
1381 0 : ++*pos;
1382 0 : return mnt_list_next(p->ns, &mnt->mnt_list);
1383 : }
1384 :
1385 0 : static void m_stop(struct seq_file *m, void *v)
1386 : {
1387 0 : struct proc_mounts *p = m->private;
1388 0 : struct mount *mnt = v;
1389 :
1390 0 : lock_ns_list(p->ns);
1391 0 : if (mnt)
1392 0 : list_move_tail(&p->cursor.mnt_list, &mnt->mnt_list);
1393 : else
1394 0 : list_del_init(&p->cursor.mnt_list);
1395 0 : unlock_ns_list(p->ns);
1396 0 : up_read(&namespace_sem);
1397 0 : }
1398 :
1399 0 : static int m_show(struct seq_file *m, void *v)
1400 : {
1401 0 : struct proc_mounts *p = m->private;
1402 0 : struct mount *r = v;
1403 0 : return p->show(m, &r->mnt);
1404 : }
1405 :
1406 : const struct seq_operations mounts_op = {
1407 : .start = m_start,
1408 : .next = m_next,
1409 : .stop = m_stop,
1410 : .show = m_show,
1411 : };
1412 :
1413 0 : void mnt_cursor_del(struct mnt_namespace *ns, struct mount *cursor)
1414 : {
1415 0 : down_read(&namespace_sem);
1416 0 : lock_ns_list(ns);
1417 0 : list_del(&cursor->mnt_list);
1418 0 : unlock_ns_list(ns);
1419 0 : up_read(&namespace_sem);
1420 0 : }
1421 : #endif /* CONFIG_PROC_FS */
1422 :
1423 : /**
1424 : * may_umount_tree - check if a mount tree is busy
1425 : * @m: root of mount tree
1426 : *
1427 : * This is called to check if a tree of mounts has any
1428 : * open files, pwds, chroots or sub mounts that are
1429 : * busy.
1430 : */
1431 0 : int may_umount_tree(struct vfsmount *m)
1432 : {
1433 0 : struct mount *mnt = real_mount(m);
1434 0 : int actual_refs = 0;
1435 0 : int minimum_refs = 0;
1436 : struct mount *p;
1437 0 : BUG_ON(!m);
1438 :
1439 : /* write lock needed for mnt_get_count */
1440 : lock_mount_hash();
1441 0 : for (p = mnt; p; p = next_mnt(p, mnt)) {
1442 0 : actual_refs += mnt_get_count(p);
1443 0 : minimum_refs += 2;
1444 : }
1445 : unlock_mount_hash();
1446 :
1447 0 : if (actual_refs > minimum_refs)
1448 : return 0;
1449 :
1450 0 : return 1;
1451 : }
1452 :
1453 : EXPORT_SYMBOL(may_umount_tree);
1454 :
1455 : /**
1456 : * may_umount - check if a mount point is busy
1457 : * @mnt: root of mount
1458 : *
1459 : * This is called to check if a mount point has any
1460 : * open files, pwds, chroots or sub mounts. If the
1461 : * mount has sub mounts this will return busy
1462 : * regardless of whether the sub mounts are busy.
1463 : *
1464 : * Doesn't take quota and stuff into account. IOW, in some cases it will
1465 : * give false negatives. The main reason why it's here is that we need
1466 : * a non-destructive way to look for easily umountable filesystems.
1467 : */
1468 0 : int may_umount(struct vfsmount *mnt)
1469 : {
1470 0 : int ret = 1;
1471 0 : down_read(&namespace_sem);
1472 0 : lock_mount_hash();
1473 0 : if (propagate_mount_busy(real_mount(mnt), 2))
1474 0 : ret = 0;
1475 : unlock_mount_hash();
1476 0 : up_read(&namespace_sem);
1477 0 : return ret;
1478 : }
1479 :
1480 : EXPORT_SYMBOL(may_umount);
1481 :
1482 0 : static void namespace_unlock(void)
1483 : {
1484 : struct hlist_head head;
1485 : struct hlist_node *p;
1486 : struct mount *m;
1487 0 : LIST_HEAD(list);
1488 :
1489 0 : hlist_move_list(&unmounted, &head);
1490 0 : list_splice_init(&ex_mountpoints, &list);
1491 :
1492 0 : up_write(&namespace_sem);
1493 :
1494 0 : shrink_dentry_list(&list);
1495 :
1496 0 : if (likely(hlist_empty(&head)))
1497 0 : return;
1498 :
1499 : synchronize_rcu_expedited();
1500 :
1501 0 : hlist_for_each_entry_safe(m, p, &head, mnt_umount) {
1502 0 : hlist_del(&m->mnt_umount);
1503 0 : mntput(&m->mnt);
1504 : }
1505 : }
1506 :
1507 : static inline void namespace_lock(void)
1508 : {
1509 0 : down_write(&namespace_sem);
1510 : }
1511 :
1512 : enum umount_tree_flags {
1513 : UMOUNT_SYNC = 1,
1514 : UMOUNT_PROPAGATE = 2,
1515 : UMOUNT_CONNECTED = 4,
1516 : };
1517 :
1518 : static bool disconnect_mount(struct mount *mnt, enum umount_tree_flags how)
1519 : {
1520 : /* Leaving mounts connected is only valid for lazy umounts */
1521 0 : if (how & UMOUNT_SYNC)
1522 : return true;
1523 :
1524 : /* A mount without a parent has nothing to be connected to */
1525 0 : if (!mnt_has_parent(mnt))
1526 : return true;
1527 :
1528 : /* Because the reference counting rules change when mounts are
1529 : * unmounted and connected, umounted mounts may not be
1530 : * connected to mounted mounts.
1531 : */
1532 0 : if (!(mnt->mnt_parent->mnt.mnt_flags & MNT_UMOUNT))
1533 : return true;
1534 :
1535 : /* Has it been requested that the mount remain connected? */
1536 0 : if (how & UMOUNT_CONNECTED)
1537 : return false;
1538 :
1539 : /* Is the mount locked such that it needs to remain connected? */
1540 0 : if (IS_MNT_LOCKED(mnt))
1541 : return false;
1542 :
1543 : /* By default disconnect the mount */
1544 : return true;
1545 : }
1546 :
1547 : /*
1548 : * mount_lock must be held
1549 : * namespace_sem must be held for write
1550 : */
1551 0 : static void umount_tree(struct mount *mnt, enum umount_tree_flags how)
1552 : {
1553 0 : LIST_HEAD(tmp_list);
1554 : struct mount *p;
1555 :
1556 0 : if (how & UMOUNT_PROPAGATE)
1557 0 : propagate_mount_unlock(mnt);
1558 :
1559 : /* Gather the mounts to umount */
1560 0 : for (p = mnt; p; p = next_mnt(p, mnt)) {
1561 0 : p->mnt.mnt_flags |= MNT_UMOUNT;
1562 0 : list_move(&p->mnt_list, &tmp_list);
1563 : }
1564 :
1565 : /* Hide the mounts from mnt_mounts */
1566 0 : list_for_each_entry(p, &tmp_list, mnt_list) {
1567 0 : list_del_init(&p->mnt_child);
1568 : }
1569 :
1570 : /* Add propogated mounts to the tmp_list */
1571 0 : if (how & UMOUNT_PROPAGATE)
1572 0 : propagate_umount(&tmp_list);
1573 :
1574 0 : while (!list_empty(&tmp_list)) {
1575 : struct mnt_namespace *ns;
1576 : bool disconnect;
1577 0 : p = list_first_entry(&tmp_list, struct mount, mnt_list);
1578 0 : list_del_init(&p->mnt_expire);
1579 0 : list_del_init(&p->mnt_list);
1580 0 : ns = p->mnt_ns;
1581 0 : if (ns) {
1582 0 : ns->mounts--;
1583 0 : __touch_mnt_namespace(ns);
1584 : }
1585 0 : p->mnt_ns = NULL;
1586 0 : if (how & UMOUNT_SYNC)
1587 0 : p->mnt.mnt_flags |= MNT_SYNC_UMOUNT;
1588 :
1589 0 : disconnect = disconnect_mount(p, how);
1590 0 : if (mnt_has_parent(p)) {
1591 0 : mnt_add_count(p->mnt_parent, -1);
1592 0 : if (!disconnect) {
1593 : /* Don't forget about p */
1594 0 : list_add_tail(&p->mnt_child, &p->mnt_parent->mnt_mounts);
1595 : } else {
1596 : umount_mnt(p);
1597 : }
1598 : }
1599 0 : change_mnt_propagation(p, MS_PRIVATE);
1600 0 : if (disconnect)
1601 0 : hlist_add_head(&p->mnt_umount, &unmounted);
1602 : }
1603 0 : }
1604 :
1605 : static void shrink_submounts(struct mount *mnt);
1606 :
1607 0 : static int do_umount_root(struct super_block *sb)
1608 : {
1609 0 : int ret = 0;
1610 :
1611 0 : down_write(&sb->s_umount);
1612 0 : if (!sb_rdonly(sb)) {
1613 : struct fs_context *fc;
1614 :
1615 0 : fc = fs_context_for_reconfigure(sb->s_root, SB_RDONLY,
1616 : SB_RDONLY);
1617 0 : if (IS_ERR(fc)) {
1618 0 : ret = PTR_ERR(fc);
1619 : } else {
1620 0 : ret = parse_monolithic_mount_data(fc, NULL);
1621 0 : if (!ret)
1622 0 : ret = reconfigure_super(fc);
1623 0 : put_fs_context(fc);
1624 : }
1625 : }
1626 0 : up_write(&sb->s_umount);
1627 0 : return ret;
1628 : }
1629 :
1630 0 : static int do_umount(struct mount *mnt, int flags)
1631 : {
1632 0 : struct super_block *sb = mnt->mnt.mnt_sb;
1633 : int retval;
1634 :
1635 0 : retval = security_sb_umount(&mnt->mnt, flags);
1636 : if (retval)
1637 : return retval;
1638 :
1639 : /*
1640 : * Allow userspace to request a mountpoint be expired rather than
1641 : * unmounting unconditionally. Unmount only happens if:
1642 : * (1) the mark is already set (the mark is cleared by mntput())
1643 : * (2) the usage count == 1 [parent vfsmount] + 1 [sys_umount]
1644 : */
1645 0 : if (flags & MNT_EXPIRE) {
1646 0 : if (&mnt->mnt == current->fs->root.mnt ||
1647 0 : flags & (MNT_FORCE | MNT_DETACH))
1648 : return -EINVAL;
1649 :
1650 : /*
1651 : * probably don't strictly need the lock here if we examined
1652 : * all race cases, but it's a slowpath.
1653 : */
1654 0 : lock_mount_hash();
1655 0 : if (mnt_get_count(mnt) != 2) {
1656 : unlock_mount_hash();
1657 0 : return -EBUSY;
1658 : }
1659 : unlock_mount_hash();
1660 :
1661 0 : if (!xchg(&mnt->mnt_expiry_mark, 1))
1662 : return -EAGAIN;
1663 : }
1664 :
1665 : /*
1666 : * If we may have to abort operations to get out of this
1667 : * mount, and they will themselves hold resources we must
1668 : * allow the fs to do things. In the Unix tradition of
1669 : * 'Gee thats tricky lets do it in userspace' the umount_begin
1670 : * might fail to complete on the first run through as other tasks
1671 : * must return, and the like. Thats for the mount program to worry
1672 : * about for the moment.
1673 : */
1674 :
1675 0 : if (flags & MNT_FORCE && sb->s_op->umount_begin) {
1676 0 : sb->s_op->umount_begin(sb);
1677 : }
1678 :
1679 : /*
1680 : * No sense to grab the lock for this test, but test itself looks
1681 : * somewhat bogus. Suggestions for better replacement?
1682 : * Ho-hum... In principle, we might treat that as umount + switch
1683 : * to rootfs. GC would eventually take care of the old vfsmount.
1684 : * Actually it makes sense, especially if rootfs would contain a
1685 : * /reboot - static binary that would close all descriptors and
1686 : * call reboot(9). Then init(8) could umount root and exec /reboot.
1687 : */
1688 0 : if (&mnt->mnt == current->fs->root.mnt && !(flags & MNT_DETACH)) {
1689 : /*
1690 : * Special case for "unmounting" root ...
1691 : * we just try to remount it readonly.
1692 : */
1693 0 : if (!ns_capable(sb->s_user_ns, CAP_SYS_ADMIN))
1694 : return -EPERM;
1695 0 : return do_umount_root(sb);
1696 : }
1697 :
1698 : namespace_lock();
1699 : lock_mount_hash();
1700 :
1701 : /* Recheck MNT_LOCKED with the locks held */
1702 0 : retval = -EINVAL;
1703 0 : if (mnt->mnt.mnt_flags & MNT_LOCKED)
1704 : goto out;
1705 :
1706 0 : event++;
1707 0 : if (flags & MNT_DETACH) {
1708 0 : if (!list_empty(&mnt->mnt_list))
1709 0 : umount_tree(mnt, UMOUNT_PROPAGATE);
1710 : retval = 0;
1711 : } else {
1712 0 : shrink_submounts(mnt);
1713 0 : retval = -EBUSY;
1714 0 : if (!propagate_mount_busy(mnt, 2)) {
1715 0 : if (!list_empty(&mnt->mnt_list))
1716 0 : umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC);
1717 : retval = 0;
1718 : }
1719 : }
1720 : out:
1721 : unlock_mount_hash();
1722 0 : namespace_unlock();
1723 0 : return retval;
1724 : }
1725 :
1726 : /*
1727 : * __detach_mounts - lazily unmount all mounts on the specified dentry
1728 : *
1729 : * During unlink, rmdir, and d_drop it is possible to loose the path
1730 : * to an existing mountpoint, and wind up leaking the mount.
1731 : * detach_mounts allows lazily unmounting those mounts instead of
1732 : * leaking them.
1733 : *
1734 : * The caller may hold dentry->d_inode->i_mutex.
1735 : */
1736 0 : void __detach_mounts(struct dentry *dentry)
1737 : {
1738 : struct mountpoint *mp;
1739 : struct mount *mnt;
1740 :
1741 : namespace_lock();
1742 : lock_mount_hash();
1743 0 : mp = lookup_mountpoint(dentry);
1744 0 : if (!mp)
1745 : goto out_unlock;
1746 :
1747 0 : event++;
1748 0 : while (!hlist_empty(&mp->m_list)) {
1749 0 : mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list);
1750 0 : if (mnt->mnt.mnt_flags & MNT_UMOUNT) {
1751 0 : umount_mnt(mnt);
1752 0 : hlist_add_head(&mnt->mnt_umount, &unmounted);
1753 : }
1754 0 : else umount_tree(mnt, UMOUNT_CONNECTED);
1755 : }
1756 : put_mountpoint(mp);
1757 : out_unlock:
1758 : unlock_mount_hash();
1759 0 : namespace_unlock();
1760 0 : }
1761 :
1762 : /*
1763 : * Is the caller allowed to modify his namespace?
1764 : */
1765 0 : bool may_mount(void)
1766 : {
1767 0 : return ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN);
1768 : }
1769 :
1770 0 : static void warn_mandlock(void)
1771 : {
1772 0 : pr_warn_once("=======================================================\n"
1773 : "WARNING: The mand mount option has been deprecated and\n"
1774 : " and is ignored by this kernel. Remove the mand\n"
1775 : " option from the mount to silence this warning.\n"
1776 : "=======================================================\n");
1777 0 : }
1778 :
1779 0 : static int can_umount(const struct path *path, int flags)
1780 : {
1781 0 : struct mount *mnt = real_mount(path->mnt);
1782 :
1783 0 : if (!may_mount())
1784 : return -EPERM;
1785 0 : if (path->dentry != path->mnt->mnt_root)
1786 : return -EINVAL;
1787 0 : if (!check_mnt(mnt))
1788 : return -EINVAL;
1789 0 : if (mnt->mnt.mnt_flags & MNT_LOCKED) /* Check optimistically */
1790 : return -EINVAL;
1791 0 : if (flags & MNT_FORCE && !capable(CAP_SYS_ADMIN))
1792 : return -EPERM;
1793 : return 0;
1794 : }
1795 :
1796 : // caller is responsible for flags being sane
1797 0 : int path_umount(struct path *path, int flags)
1798 : {
1799 0 : struct mount *mnt = real_mount(path->mnt);
1800 : int ret;
1801 :
1802 0 : ret = can_umount(path, flags);
1803 0 : if (!ret)
1804 0 : ret = do_umount(mnt, flags);
1805 :
1806 : /* we mustn't call path_put() as that would clear mnt_expiry_mark */
1807 0 : dput(path->dentry);
1808 0 : mntput_no_expire(mnt);
1809 0 : return ret;
1810 : }
1811 :
1812 0 : static int ksys_umount(char __user *name, int flags)
1813 : {
1814 0 : int lookup_flags = LOOKUP_MOUNTPOINT;
1815 : struct path path;
1816 : int ret;
1817 :
1818 : // basic validity checks done first
1819 0 : if (flags & ~(MNT_FORCE | MNT_DETACH | MNT_EXPIRE | UMOUNT_NOFOLLOW))
1820 : return -EINVAL;
1821 :
1822 0 : if (!(flags & UMOUNT_NOFOLLOW))
1823 0 : lookup_flags |= LOOKUP_FOLLOW;
1824 0 : ret = user_path_at(AT_FDCWD, name, lookup_flags, &path);
1825 0 : if (ret)
1826 : return ret;
1827 0 : return path_umount(&path, flags);
1828 : }
1829 :
1830 0 : SYSCALL_DEFINE2(umount, char __user *, name, int, flags)
1831 : {
1832 0 : return ksys_umount(name, flags);
1833 : }
1834 :
1835 : #ifdef __ARCH_WANT_SYS_OLDUMOUNT
1836 :
1837 : /*
1838 : * The 2.0 compatible umount. No flags.
1839 : */
1840 0 : SYSCALL_DEFINE1(oldumount, char __user *, name)
1841 : {
1842 0 : return ksys_umount(name, 0);
1843 : }
1844 :
1845 : #endif
1846 :
1847 : static bool is_mnt_ns_file(struct dentry *dentry)
1848 : {
1849 : /* Is this a proxy for a mount namespace? */
1850 0 : return dentry->d_op == &ns_dentry_operations &&
1851 0 : dentry->d_fsdata == &mntns_operations;
1852 : }
1853 :
1854 : static struct mnt_namespace *to_mnt_ns(struct ns_common *ns)
1855 : {
1856 0 : return container_of(ns, struct mnt_namespace, ns);
1857 : }
1858 :
1859 0 : struct ns_common *from_mnt_ns(struct mnt_namespace *mnt)
1860 : {
1861 0 : return &mnt->ns;
1862 : }
1863 :
1864 : static bool mnt_ns_loop(struct dentry *dentry)
1865 : {
1866 : /* Could bind mounting the mount namespace inode cause a
1867 : * mount namespace loop?
1868 : */
1869 : struct mnt_namespace *mnt_ns;
1870 0 : if (!is_mnt_ns_file(dentry))
1871 : return false;
1872 :
1873 0 : mnt_ns = to_mnt_ns(get_proc_ns(dentry->d_inode));
1874 0 : return current->nsproxy->mnt_ns->seq >= mnt_ns->seq;
1875 : }
1876 :
1877 0 : struct mount *copy_tree(struct mount *mnt, struct dentry *dentry,
1878 : int flag)
1879 : {
1880 : struct mount *res, *p, *q, *r, *parent;
1881 :
1882 0 : if (!(flag & CL_COPY_UNBINDABLE) && IS_MNT_UNBINDABLE(mnt))
1883 : return ERR_PTR(-EINVAL);
1884 :
1885 0 : if (!(flag & CL_COPY_MNT_NS_FILE) && is_mnt_ns_file(dentry))
1886 : return ERR_PTR(-EINVAL);
1887 :
1888 0 : res = q = clone_mnt(mnt, dentry, flag);
1889 0 : if (IS_ERR(q))
1890 : return q;
1891 :
1892 0 : q->mnt_mountpoint = mnt->mnt_mountpoint;
1893 :
1894 0 : p = mnt;
1895 0 : list_for_each_entry(r, &mnt->mnt_mounts, mnt_child) {
1896 : struct mount *s;
1897 0 : if (!is_subdir(r->mnt_mountpoint, dentry))
1898 0 : continue;
1899 :
1900 0 : for (s = r; s; s = next_mnt(s, r)) {
1901 0 : if (!(flag & CL_COPY_UNBINDABLE) &&
1902 0 : IS_MNT_UNBINDABLE(s)) {
1903 0 : if (s->mnt.mnt_flags & MNT_LOCKED) {
1904 : /* Both unbindable and locked. */
1905 : q = ERR_PTR(-EPERM);
1906 : goto out;
1907 : } else {
1908 0 : s = skip_mnt_tree(s);
1909 0 : continue;
1910 : }
1911 : }
1912 0 : if (!(flag & CL_COPY_MNT_NS_FILE) &&
1913 0 : is_mnt_ns_file(s->mnt.mnt_root)) {
1914 0 : s = skip_mnt_tree(s);
1915 0 : continue;
1916 : }
1917 0 : while (p != s->mnt_parent) {
1918 0 : p = p->mnt_parent;
1919 0 : q = q->mnt_parent;
1920 : }
1921 0 : p = s;
1922 0 : parent = q;
1923 0 : q = clone_mnt(p, p->mnt.mnt_root, flag);
1924 0 : if (IS_ERR(q))
1925 : goto out;
1926 : lock_mount_hash();
1927 0 : list_add_tail(&q->mnt_list, &res->mnt_list);
1928 0 : attach_mnt(q, parent, p->mnt_mp);
1929 : unlock_mount_hash();
1930 : }
1931 : }
1932 : return res;
1933 : out:
1934 0 : if (res) {
1935 : lock_mount_hash();
1936 0 : umount_tree(res, UMOUNT_SYNC);
1937 : unlock_mount_hash();
1938 : }
1939 : return q;
1940 : }
1941 :
1942 : /* Caller should check returned pointer for errors */
1943 :
1944 0 : struct vfsmount *collect_mounts(const struct path *path)
1945 : {
1946 : struct mount *tree;
1947 : namespace_lock();
1948 0 : if (!check_mnt(real_mount(path->mnt)))
1949 : tree = ERR_PTR(-EINVAL);
1950 : else
1951 0 : tree = copy_tree(real_mount(path->mnt), path->dentry,
1952 : CL_COPY_ALL | CL_PRIVATE);
1953 0 : namespace_unlock();
1954 0 : if (IS_ERR(tree))
1955 : return ERR_CAST(tree);
1956 0 : return &tree->mnt;
1957 : }
1958 :
1959 : static void free_mnt_ns(struct mnt_namespace *);
1960 : static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *, bool);
1961 :
1962 0 : void dissolve_on_fput(struct vfsmount *mnt)
1963 : {
1964 : struct mnt_namespace *ns;
1965 : namespace_lock();
1966 0 : lock_mount_hash();
1967 0 : ns = real_mount(mnt)->mnt_ns;
1968 0 : if (ns) {
1969 0 : if (is_anon_ns(ns))
1970 0 : umount_tree(real_mount(mnt), UMOUNT_CONNECTED);
1971 : else
1972 : ns = NULL;
1973 : }
1974 : unlock_mount_hash();
1975 0 : namespace_unlock();
1976 0 : if (ns)
1977 0 : free_mnt_ns(ns);
1978 0 : }
1979 :
1980 0 : void drop_collected_mounts(struct vfsmount *mnt)
1981 : {
1982 : namespace_lock();
1983 0 : lock_mount_hash();
1984 0 : umount_tree(real_mount(mnt), 0);
1985 : unlock_mount_hash();
1986 0 : namespace_unlock();
1987 0 : }
1988 :
1989 0 : static bool has_locked_children(struct mount *mnt, struct dentry *dentry)
1990 : {
1991 : struct mount *child;
1992 :
1993 0 : list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
1994 0 : if (!is_subdir(child->mnt_mountpoint, dentry))
1995 0 : continue;
1996 :
1997 0 : if (child->mnt.mnt_flags & MNT_LOCKED)
1998 : return true;
1999 : }
2000 : return false;
2001 : }
2002 :
2003 : /**
2004 : * clone_private_mount - create a private clone of a path
2005 : * @path: path to clone
2006 : *
2007 : * This creates a new vfsmount, which will be the clone of @path. The new mount
2008 : * will not be attached anywhere in the namespace and will be private (i.e.
2009 : * changes to the originating mount won't be propagated into this).
2010 : *
2011 : * Release with mntput().
2012 : */
2013 0 : struct vfsmount *clone_private_mount(const struct path *path)
2014 : {
2015 0 : struct mount *old_mnt = real_mount(path->mnt);
2016 : struct mount *new_mnt;
2017 :
2018 0 : down_read(&namespace_sem);
2019 0 : if (IS_MNT_UNBINDABLE(old_mnt))
2020 : goto invalid;
2021 :
2022 0 : if (!check_mnt(old_mnt))
2023 : goto invalid;
2024 :
2025 0 : if (has_locked_children(old_mnt, path->dentry))
2026 : goto invalid;
2027 :
2028 0 : new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE);
2029 0 : up_read(&namespace_sem);
2030 :
2031 0 : if (IS_ERR(new_mnt))
2032 : return ERR_CAST(new_mnt);
2033 :
2034 : /* Longterm mount to be removed by kern_unmount*() */
2035 0 : new_mnt->mnt_ns = MNT_NS_INTERNAL;
2036 :
2037 0 : return &new_mnt->mnt;
2038 :
2039 : invalid:
2040 0 : up_read(&namespace_sem);
2041 0 : return ERR_PTR(-EINVAL);
2042 : }
2043 : EXPORT_SYMBOL_GPL(clone_private_mount);
2044 :
2045 0 : int iterate_mounts(int (*f)(struct vfsmount *, void *), void *arg,
2046 : struct vfsmount *root)
2047 : {
2048 : struct mount *mnt;
2049 0 : int res = f(root, arg);
2050 0 : if (res)
2051 : return res;
2052 0 : list_for_each_entry(mnt, &real_mount(root)->mnt_list, mnt_list) {
2053 0 : res = f(&mnt->mnt, arg);
2054 0 : if (res)
2055 : return res;
2056 : }
2057 : return 0;
2058 : }
2059 :
2060 0 : static void lock_mnt_tree(struct mount *mnt)
2061 : {
2062 : struct mount *p;
2063 :
2064 0 : for (p = mnt; p; p = next_mnt(p, mnt)) {
2065 0 : int flags = p->mnt.mnt_flags;
2066 : /* Don't allow unprivileged users to change mount flags */
2067 0 : flags |= MNT_LOCK_ATIME;
2068 :
2069 0 : if (flags & MNT_READONLY)
2070 0 : flags |= MNT_LOCK_READONLY;
2071 :
2072 0 : if (flags & MNT_NODEV)
2073 0 : flags |= MNT_LOCK_NODEV;
2074 :
2075 0 : if (flags & MNT_NOSUID)
2076 0 : flags |= MNT_LOCK_NOSUID;
2077 :
2078 0 : if (flags & MNT_NOEXEC)
2079 0 : flags |= MNT_LOCK_NOEXEC;
2080 : /* Don't allow unprivileged users to reveal what is under a mount */
2081 0 : if (list_empty(&p->mnt_expire))
2082 0 : flags |= MNT_LOCKED;
2083 0 : p->mnt.mnt_flags = flags;
2084 : }
2085 0 : }
2086 :
2087 0 : static void cleanup_group_ids(struct mount *mnt, struct mount *end)
2088 : {
2089 : struct mount *p;
2090 :
2091 0 : for (p = mnt; p != end; p = next_mnt(p, mnt)) {
2092 0 : if (p->mnt_group_id && !IS_MNT_SHARED(p))
2093 : mnt_release_group_id(p);
2094 : }
2095 0 : }
2096 :
2097 0 : static int invent_group_ids(struct mount *mnt, bool recurse)
2098 : {
2099 : struct mount *p;
2100 :
2101 0 : for (p = mnt; p; p = recurse ? next_mnt(p, mnt) : NULL) {
2102 0 : if (!p->mnt_group_id && !IS_MNT_SHARED(p)) {
2103 0 : int err = mnt_alloc_group_id(p);
2104 0 : if (err) {
2105 0 : cleanup_group_ids(mnt, p);
2106 0 : return err;
2107 : }
2108 : }
2109 : }
2110 :
2111 : return 0;
2112 : }
2113 :
2114 0 : int count_mounts(struct mnt_namespace *ns, struct mount *mnt)
2115 : {
2116 0 : unsigned int max = READ_ONCE(sysctl_mount_max);
2117 0 : unsigned int mounts = 0;
2118 : struct mount *p;
2119 :
2120 0 : if (ns->mounts >= max)
2121 : return -ENOSPC;
2122 0 : max -= ns->mounts;
2123 0 : if (ns->pending_mounts >= max)
2124 : return -ENOSPC;
2125 0 : max -= ns->pending_mounts;
2126 :
2127 0 : for (p = mnt; p; p = next_mnt(p, mnt))
2128 0 : mounts++;
2129 :
2130 0 : if (mounts > max)
2131 : return -ENOSPC;
2132 :
2133 0 : ns->pending_mounts += mounts;
2134 0 : return 0;
2135 : }
2136 :
2137 : /*
2138 : * @source_mnt : mount tree to be attached
2139 : * @nd : place the mount tree @source_mnt is attached
2140 : * @parent_nd : if non-null, detach the source_mnt from its parent and
2141 : * store the parent mount and mountpoint dentry.
2142 : * (done when source_mnt is moved)
2143 : *
2144 : * NOTE: in the table below explains the semantics when a source mount
2145 : * of a given type is attached to a destination mount of a given type.
2146 : * ---------------------------------------------------------------------------
2147 : * | BIND MOUNT OPERATION |
2148 : * |**************************************************************************
2149 : * | source-->| shared | private | slave | unbindable |
2150 : * | dest | | | | |
2151 : * | | | | | | |
2152 : * | v | | | | |
2153 : * |**************************************************************************
2154 : * | shared | shared (++) | shared (+) | shared(+++)| invalid |
2155 : * | | | | | |
2156 : * |non-shared| shared (+) | private | slave (*) | invalid |
2157 : * ***************************************************************************
2158 : * A bind operation clones the source mount and mounts the clone on the
2159 : * destination mount.
2160 : *
2161 : * (++) the cloned mount is propagated to all the mounts in the propagation
2162 : * tree of the destination mount and the cloned mount is added to
2163 : * the peer group of the source mount.
2164 : * (+) the cloned mount is created under the destination mount and is marked
2165 : * as shared. The cloned mount is added to the peer group of the source
2166 : * mount.
2167 : * (+++) the mount is propagated to all the mounts in the propagation tree
2168 : * of the destination mount and the cloned mount is made slave
2169 : * of the same master as that of the source mount. The cloned mount
2170 : * is marked as 'shared and slave'.
2171 : * (*) the cloned mount is made a slave of the same master as that of the
2172 : * source mount.
2173 : *
2174 : * ---------------------------------------------------------------------------
2175 : * | MOVE MOUNT OPERATION |
2176 : * |**************************************************************************
2177 : * | source-->| shared | private | slave | unbindable |
2178 : * | dest | | | | |
2179 : * | | | | | | |
2180 : * | v | | | | |
2181 : * |**************************************************************************
2182 : * | shared | shared (+) | shared (+) | shared(+++) | invalid |
2183 : * | | | | | |
2184 : * |non-shared| shared (+*) | private | slave (*) | unbindable |
2185 : * ***************************************************************************
2186 : *
2187 : * (+) the mount is moved to the destination. And is then propagated to
2188 : * all the mounts in the propagation tree of the destination mount.
2189 : * (+*) the mount is moved to the destination.
2190 : * (+++) the mount is moved to the destination and is then propagated to
2191 : * all the mounts belonging to the destination mount's propagation tree.
2192 : * the mount is marked as 'shared and slave'.
2193 : * (*) the mount continues to be a slave at the new location.
2194 : *
2195 : * if the source mount is a tree, the operations explained above is
2196 : * applied to each mount in the tree.
2197 : * Must be called without spinlocks held, since this function can sleep
2198 : * in allocations.
2199 : */
2200 0 : static int attach_recursive_mnt(struct mount *source_mnt,
2201 : struct mount *dest_mnt,
2202 : struct mountpoint *dest_mp,
2203 : bool moving)
2204 : {
2205 0 : struct user_namespace *user_ns = current->nsproxy->mnt_ns->user_ns;
2206 0 : HLIST_HEAD(tree_list);
2207 0 : struct mnt_namespace *ns = dest_mnt->mnt_ns;
2208 : struct mountpoint *smp;
2209 : struct mount *child, *p;
2210 : struct hlist_node *n;
2211 : int err;
2212 :
2213 : /* Preallocate a mountpoint in case the new mounts need
2214 : * to be tucked under other mounts.
2215 : */
2216 0 : smp = get_mountpoint(source_mnt->mnt.mnt_root);
2217 0 : if (IS_ERR(smp))
2218 0 : return PTR_ERR(smp);
2219 :
2220 : /* Is there space to add these mounts to the mount namespace? */
2221 0 : if (!moving) {
2222 0 : err = count_mounts(ns, source_mnt);
2223 0 : if (err)
2224 : goto out;
2225 : }
2226 :
2227 0 : if (IS_MNT_SHARED(dest_mnt)) {
2228 0 : err = invent_group_ids(source_mnt, true);
2229 0 : if (err)
2230 : goto out;
2231 0 : err = propagate_mnt(dest_mnt, dest_mp, source_mnt, &tree_list);
2232 : lock_mount_hash();
2233 0 : if (err)
2234 : goto out_cleanup_ids;
2235 0 : for (p = source_mnt; p; p = next_mnt(p, source_mnt))
2236 0 : set_mnt_shared(p);
2237 : } else {
2238 : lock_mount_hash();
2239 : }
2240 0 : if (moving) {
2241 0 : unhash_mnt(source_mnt);
2242 0 : attach_mnt(source_mnt, dest_mnt, dest_mp);
2243 0 : touch_mnt_namespace(source_mnt->mnt_ns);
2244 : } else {
2245 0 : if (source_mnt->mnt_ns) {
2246 : /* move from anon - the caller will destroy */
2247 0 : list_del_init(&source_mnt->mnt_ns->list);
2248 : }
2249 0 : mnt_set_mountpoint(dest_mnt, dest_mp, source_mnt);
2250 0 : commit_tree(source_mnt);
2251 : }
2252 :
2253 0 : hlist_for_each_entry_safe(child, n, &tree_list, mnt_hash) {
2254 : struct mount *q;
2255 0 : hlist_del_init(&child->mnt_hash);
2256 0 : q = __lookup_mnt(&child->mnt_parent->mnt,
2257 : child->mnt_mountpoint);
2258 0 : if (q)
2259 0 : mnt_change_mountpoint(child, smp, q);
2260 : /* Notice when we are propagating across user namespaces */
2261 0 : if (child->mnt_parent->mnt_ns->user_ns != user_ns)
2262 0 : lock_mnt_tree(child);
2263 0 : child->mnt.mnt_flags &= ~MNT_LOCKED;
2264 0 : commit_tree(child);
2265 : }
2266 0 : put_mountpoint(smp);
2267 : unlock_mount_hash();
2268 :
2269 0 : return 0;
2270 :
2271 : out_cleanup_ids:
2272 0 : while (!hlist_empty(&tree_list)) {
2273 0 : child = hlist_entry(tree_list.first, struct mount, mnt_hash);
2274 0 : child->mnt_parent->mnt_ns->pending_mounts = 0;
2275 0 : umount_tree(child, UMOUNT_SYNC);
2276 : }
2277 : unlock_mount_hash();
2278 0 : cleanup_group_ids(source_mnt, NULL);
2279 : out:
2280 0 : ns->pending_mounts = 0;
2281 :
2282 0 : read_seqlock_excl(&mount_lock);
2283 0 : put_mountpoint(smp);
2284 0 : read_sequnlock_excl(&mount_lock);
2285 :
2286 0 : return err;
2287 : }
2288 :
2289 0 : static struct mountpoint *lock_mount(struct path *path)
2290 : {
2291 : struct vfsmount *mnt;
2292 0 : struct dentry *dentry = path->dentry;
2293 : retry:
2294 0 : inode_lock(dentry->d_inode);
2295 0 : if (unlikely(cant_mount(dentry))) {
2296 0 : inode_unlock(dentry->d_inode);
2297 0 : return ERR_PTR(-ENOENT);
2298 : }
2299 : namespace_lock();
2300 0 : mnt = lookup_mnt(path);
2301 0 : if (likely(!mnt)) {
2302 0 : struct mountpoint *mp = get_mountpoint(dentry);
2303 0 : if (IS_ERR(mp)) {
2304 0 : namespace_unlock();
2305 0 : inode_unlock(dentry->d_inode);
2306 0 : return mp;
2307 : }
2308 : return mp;
2309 : }
2310 0 : namespace_unlock();
2311 0 : inode_unlock(path->dentry->d_inode);
2312 0 : path_put(path);
2313 0 : path->mnt = mnt;
2314 0 : dentry = path->dentry = dget(mnt->mnt_root);
2315 0 : goto retry;
2316 : }
2317 :
2318 0 : static void unlock_mount(struct mountpoint *where)
2319 : {
2320 0 : struct dentry *dentry = where->m_dentry;
2321 :
2322 0 : read_seqlock_excl(&mount_lock);
2323 0 : put_mountpoint(where);
2324 0 : read_sequnlock_excl(&mount_lock);
2325 :
2326 0 : namespace_unlock();
2327 0 : inode_unlock(dentry->d_inode);
2328 0 : }
2329 :
2330 0 : static int graft_tree(struct mount *mnt, struct mount *p, struct mountpoint *mp)
2331 : {
2332 0 : if (mnt->mnt.mnt_sb->s_flags & SB_NOUSER)
2333 : return -EINVAL;
2334 :
2335 0 : if (d_is_dir(mp->m_dentry) !=
2336 0 : d_is_dir(mnt->mnt.mnt_root))
2337 : return -ENOTDIR;
2338 :
2339 0 : return attach_recursive_mnt(mnt, p, mp, false);
2340 : }
2341 :
2342 : /*
2343 : * Sanity check the flags to change_mnt_propagation.
2344 : */
2345 :
2346 : static int flags_to_propagation_type(int ms_flags)
2347 : {
2348 0 : int type = ms_flags & ~(MS_REC | MS_SILENT);
2349 :
2350 : /* Fail if any non-propagation flags are set */
2351 0 : if (type & ~(MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
2352 : return 0;
2353 : /* Only one propagation flag should be set */
2354 0 : if (!is_power_of_2(type))
2355 : return 0;
2356 : return type;
2357 : }
2358 :
2359 : /*
2360 : * recursively change the type of the mountpoint.
2361 : */
2362 0 : static int do_change_type(struct path *path, int ms_flags)
2363 : {
2364 : struct mount *m;
2365 0 : struct mount *mnt = real_mount(path->mnt);
2366 0 : int recurse = ms_flags & MS_REC;
2367 : int type;
2368 0 : int err = 0;
2369 :
2370 0 : if (path->dentry != path->mnt->mnt_root)
2371 : return -EINVAL;
2372 :
2373 0 : type = flags_to_propagation_type(ms_flags);
2374 0 : if (!type)
2375 : return -EINVAL;
2376 :
2377 : namespace_lock();
2378 0 : if (type == MS_SHARED) {
2379 0 : err = invent_group_ids(mnt, recurse);
2380 0 : if (err)
2381 : goto out_unlock;
2382 : }
2383 :
2384 : lock_mount_hash();
2385 0 : for (m = mnt; m; m = (recurse ? next_mnt(m, mnt) : NULL))
2386 0 : change_mnt_propagation(m, type);
2387 : unlock_mount_hash();
2388 :
2389 : out_unlock:
2390 0 : namespace_unlock();
2391 0 : return err;
2392 : }
2393 :
2394 0 : static struct mount *__do_loopback(struct path *old_path, int recurse)
2395 : {
2396 0 : struct mount *mnt = ERR_PTR(-EINVAL), *old = real_mount(old_path->mnt);
2397 :
2398 0 : if (IS_MNT_UNBINDABLE(old))
2399 : return mnt;
2400 :
2401 0 : if (!check_mnt(old) && old_path->dentry->d_op != &ns_dentry_operations)
2402 : return mnt;
2403 :
2404 0 : if (!recurse && has_locked_children(old, old_path->dentry))
2405 : return mnt;
2406 :
2407 0 : if (recurse)
2408 0 : mnt = copy_tree(old, old_path->dentry, CL_COPY_MNT_NS_FILE);
2409 : else
2410 0 : mnt = clone_mnt(old, old_path->dentry, 0);
2411 :
2412 0 : if (!IS_ERR(mnt))
2413 0 : mnt->mnt.mnt_flags &= ~MNT_LOCKED;
2414 :
2415 : return mnt;
2416 : }
2417 :
2418 : /*
2419 : * do loopback mount.
2420 : */
2421 0 : static int do_loopback(struct path *path, const char *old_name,
2422 : int recurse)
2423 : {
2424 : struct path old_path;
2425 0 : struct mount *mnt = NULL, *parent;
2426 : struct mountpoint *mp;
2427 : int err;
2428 0 : if (!old_name || !*old_name)
2429 : return -EINVAL;
2430 0 : err = kern_path(old_name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &old_path);
2431 0 : if (err)
2432 : return err;
2433 :
2434 0 : err = -EINVAL;
2435 0 : if (mnt_ns_loop(old_path.dentry))
2436 : goto out;
2437 :
2438 0 : mp = lock_mount(path);
2439 0 : if (IS_ERR(mp)) {
2440 0 : err = PTR_ERR(mp);
2441 0 : goto out;
2442 : }
2443 :
2444 0 : parent = real_mount(path->mnt);
2445 0 : if (!check_mnt(parent))
2446 : goto out2;
2447 :
2448 0 : mnt = __do_loopback(&old_path, recurse);
2449 0 : if (IS_ERR(mnt)) {
2450 0 : err = PTR_ERR(mnt);
2451 0 : goto out2;
2452 : }
2453 :
2454 0 : err = graft_tree(mnt, parent, mp);
2455 0 : if (err) {
2456 : lock_mount_hash();
2457 0 : umount_tree(mnt, UMOUNT_SYNC);
2458 : unlock_mount_hash();
2459 : }
2460 : out2:
2461 0 : unlock_mount(mp);
2462 : out:
2463 0 : path_put(&old_path);
2464 0 : return err;
2465 : }
2466 :
2467 0 : static struct file *open_detached_copy(struct path *path, bool recursive)
2468 : {
2469 0 : struct user_namespace *user_ns = current->nsproxy->mnt_ns->user_ns;
2470 0 : struct mnt_namespace *ns = alloc_mnt_ns(user_ns, true);
2471 : struct mount *mnt, *p;
2472 : struct file *file;
2473 :
2474 0 : if (IS_ERR(ns))
2475 : return ERR_CAST(ns);
2476 :
2477 : namespace_lock();
2478 0 : mnt = __do_loopback(path, recursive);
2479 0 : if (IS_ERR(mnt)) {
2480 0 : namespace_unlock();
2481 0 : free_mnt_ns(ns);
2482 0 : return ERR_CAST(mnt);
2483 : }
2484 :
2485 : lock_mount_hash();
2486 0 : for (p = mnt; p; p = next_mnt(p, mnt)) {
2487 0 : p->mnt_ns = ns;
2488 0 : ns->mounts++;
2489 : }
2490 0 : ns->root = mnt;
2491 0 : list_add_tail(&ns->list, &mnt->mnt_list);
2492 0 : mntget(&mnt->mnt);
2493 : unlock_mount_hash();
2494 0 : namespace_unlock();
2495 :
2496 0 : mntput(path->mnt);
2497 0 : path->mnt = &mnt->mnt;
2498 0 : file = dentry_open(path, O_PATH, current_cred());
2499 0 : if (IS_ERR(file))
2500 0 : dissolve_on_fput(path->mnt);
2501 : else
2502 0 : file->f_mode |= FMODE_NEED_UNMOUNT;
2503 : return file;
2504 : }
2505 :
2506 0 : SYSCALL_DEFINE3(open_tree, int, dfd, const char __user *, filename, unsigned, flags)
2507 : {
2508 : struct file *file;
2509 : struct path path;
2510 0 : int lookup_flags = LOOKUP_AUTOMOUNT | LOOKUP_FOLLOW;
2511 0 : bool detached = flags & OPEN_TREE_CLONE;
2512 : int error;
2513 : int fd;
2514 :
2515 : BUILD_BUG_ON(OPEN_TREE_CLOEXEC != O_CLOEXEC);
2516 :
2517 0 : if (flags & ~(AT_EMPTY_PATH | AT_NO_AUTOMOUNT | AT_RECURSIVE |
2518 : AT_SYMLINK_NOFOLLOW | OPEN_TREE_CLONE |
2519 : OPEN_TREE_CLOEXEC))
2520 : return -EINVAL;
2521 :
2522 0 : if ((flags & (AT_RECURSIVE | OPEN_TREE_CLONE)) == AT_RECURSIVE)
2523 : return -EINVAL;
2524 :
2525 0 : if (flags & AT_NO_AUTOMOUNT)
2526 0 : lookup_flags &= ~LOOKUP_AUTOMOUNT;
2527 0 : if (flags & AT_SYMLINK_NOFOLLOW)
2528 0 : lookup_flags &= ~LOOKUP_FOLLOW;
2529 0 : if (flags & AT_EMPTY_PATH)
2530 0 : lookup_flags |= LOOKUP_EMPTY;
2531 :
2532 0 : if (detached && !may_mount())
2533 : return -EPERM;
2534 :
2535 0 : fd = get_unused_fd_flags(flags & O_CLOEXEC);
2536 0 : if (fd < 0)
2537 0 : return fd;
2538 :
2539 0 : error = user_path_at(dfd, filename, lookup_flags, &path);
2540 0 : if (unlikely(error)) {
2541 0 : file = ERR_PTR(error);
2542 : } else {
2543 0 : if (detached)
2544 0 : file = open_detached_copy(&path, flags & AT_RECURSIVE);
2545 : else
2546 0 : file = dentry_open(&path, O_PATH, current_cred());
2547 0 : path_put(&path);
2548 : }
2549 0 : if (IS_ERR(file)) {
2550 0 : put_unused_fd(fd);
2551 0 : return PTR_ERR(file);
2552 : }
2553 0 : fd_install(fd, file);
2554 0 : return fd;
2555 : }
2556 :
2557 : /*
2558 : * Don't allow locked mount flags to be cleared.
2559 : *
2560 : * No locks need to be held here while testing the various MNT_LOCK
2561 : * flags because those flags can never be cleared once they are set.
2562 : */
2563 0 : static bool can_change_locked_flags(struct mount *mnt, unsigned int mnt_flags)
2564 : {
2565 0 : unsigned int fl = mnt->mnt.mnt_flags;
2566 :
2567 0 : if ((fl & MNT_LOCK_READONLY) &&
2568 0 : !(mnt_flags & MNT_READONLY))
2569 : return false;
2570 :
2571 0 : if ((fl & MNT_LOCK_NODEV) &&
2572 0 : !(mnt_flags & MNT_NODEV))
2573 : return false;
2574 :
2575 0 : if ((fl & MNT_LOCK_NOSUID) &&
2576 0 : !(mnt_flags & MNT_NOSUID))
2577 : return false;
2578 :
2579 0 : if ((fl & MNT_LOCK_NOEXEC) &&
2580 0 : !(mnt_flags & MNT_NOEXEC))
2581 : return false;
2582 :
2583 0 : if ((fl & MNT_LOCK_ATIME) &&
2584 0 : ((fl & MNT_ATIME_MASK) != (mnt_flags & MNT_ATIME_MASK)))
2585 : return false;
2586 :
2587 : return true;
2588 : }
2589 :
2590 0 : static int change_mount_ro_state(struct mount *mnt, unsigned int mnt_flags)
2591 : {
2592 0 : bool readonly_request = (mnt_flags & MNT_READONLY);
2593 :
2594 0 : if (readonly_request == __mnt_is_readonly(&mnt->mnt))
2595 : return 0;
2596 :
2597 0 : if (readonly_request)
2598 0 : return mnt_make_readonly(mnt);
2599 :
2600 0 : mnt->mnt.mnt_flags &= ~MNT_READONLY;
2601 0 : return 0;
2602 : }
2603 :
2604 : static void set_mount_attributes(struct mount *mnt, unsigned int mnt_flags)
2605 : {
2606 0 : mnt_flags |= mnt->mnt.mnt_flags & ~MNT_USER_SETTABLE_MASK;
2607 0 : mnt->mnt.mnt_flags = mnt_flags;
2608 0 : touch_mnt_namespace(mnt->mnt_ns);
2609 : }
2610 :
2611 0 : static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount *mnt)
2612 : {
2613 0 : struct super_block *sb = mnt->mnt_sb;
2614 :
2615 0 : if (!__mnt_is_readonly(mnt) &&
2616 0 : (!(sb->s_iflags & SB_I_TS_EXPIRY_WARNED)) &&
2617 0 : (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) {
2618 0 : char *buf = (char *)__get_free_page(GFP_KERNEL);
2619 0 : char *mntpath = buf ? d_path(mountpoint, buf, PAGE_SIZE) : ERR_PTR(-ENOMEM);
2620 :
2621 0 : pr_warn("%s filesystem being %s at %s supports timestamps until %ptTd (0x%llx)\n",
2622 : sb->s_type->name,
2623 : is_mounted(mnt) ? "remounted" : "mounted",
2624 : mntpath, &sb->s_time_max,
2625 : (unsigned long long)sb->s_time_max);
2626 :
2627 0 : free_page((unsigned long)buf);
2628 0 : sb->s_iflags |= SB_I_TS_EXPIRY_WARNED;
2629 : }
2630 0 : }
2631 :
2632 : /*
2633 : * Handle reconfiguration of the mountpoint only without alteration of the
2634 : * superblock it refers to. This is triggered by specifying MS_REMOUNT|MS_BIND
2635 : * to mount(2).
2636 : */
2637 0 : static int do_reconfigure_mnt(struct path *path, unsigned int mnt_flags)
2638 : {
2639 0 : struct super_block *sb = path->mnt->mnt_sb;
2640 0 : struct mount *mnt = real_mount(path->mnt);
2641 : int ret;
2642 :
2643 0 : if (!check_mnt(mnt))
2644 : return -EINVAL;
2645 :
2646 0 : if (path->dentry != mnt->mnt.mnt_root)
2647 : return -EINVAL;
2648 :
2649 0 : if (!can_change_locked_flags(mnt, mnt_flags))
2650 : return -EPERM;
2651 :
2652 : /*
2653 : * We're only checking whether the superblock is read-only not
2654 : * changing it, so only take down_read(&sb->s_umount).
2655 : */
2656 0 : down_read(&sb->s_umount);
2657 : lock_mount_hash();
2658 0 : ret = change_mount_ro_state(mnt, mnt_flags);
2659 0 : if (ret == 0)
2660 0 : set_mount_attributes(mnt, mnt_flags);
2661 : unlock_mount_hash();
2662 0 : up_read(&sb->s_umount);
2663 :
2664 0 : mnt_warn_timestamp_expiry(path, &mnt->mnt);
2665 :
2666 0 : return ret;
2667 : }
2668 :
2669 : /*
2670 : * change filesystem flags. dir should be a physical root of filesystem.
2671 : * If you've mounted a non-root directory somewhere and want to do remount
2672 : * on it - tough luck.
2673 : */
2674 0 : static int do_remount(struct path *path, int ms_flags, int sb_flags,
2675 : int mnt_flags, void *data)
2676 : {
2677 : int err;
2678 0 : struct super_block *sb = path->mnt->mnt_sb;
2679 0 : struct mount *mnt = real_mount(path->mnt);
2680 : struct fs_context *fc;
2681 :
2682 0 : if (!check_mnt(mnt))
2683 : return -EINVAL;
2684 :
2685 0 : if (path->dentry != path->mnt->mnt_root)
2686 : return -EINVAL;
2687 :
2688 0 : if (!can_change_locked_flags(mnt, mnt_flags))
2689 : return -EPERM;
2690 :
2691 0 : fc = fs_context_for_reconfigure(path->dentry, sb_flags, MS_RMT_MASK);
2692 0 : if (IS_ERR(fc))
2693 0 : return PTR_ERR(fc);
2694 :
2695 0 : fc->oldapi = true;
2696 0 : err = parse_monolithic_mount_data(fc, data);
2697 0 : if (!err) {
2698 0 : down_write(&sb->s_umount);
2699 0 : err = -EPERM;
2700 0 : if (ns_capable(sb->s_user_ns, CAP_SYS_ADMIN)) {
2701 0 : err = reconfigure_super(fc);
2702 0 : if (!err) {
2703 : lock_mount_hash();
2704 0 : set_mount_attributes(mnt, mnt_flags);
2705 : unlock_mount_hash();
2706 : }
2707 : }
2708 0 : up_write(&sb->s_umount);
2709 : }
2710 :
2711 0 : mnt_warn_timestamp_expiry(path, &mnt->mnt);
2712 :
2713 0 : put_fs_context(fc);
2714 : return err;
2715 : }
2716 :
2717 : static inline int tree_contains_unbindable(struct mount *mnt)
2718 : {
2719 : struct mount *p;
2720 0 : for (p = mnt; p; p = next_mnt(p, mnt)) {
2721 0 : if (IS_MNT_UNBINDABLE(p))
2722 : return 1;
2723 : }
2724 : return 0;
2725 : }
2726 :
2727 : /*
2728 : * Check that there aren't references to earlier/same mount namespaces in the
2729 : * specified subtree. Such references can act as pins for mount namespaces
2730 : * that aren't checked by the mount-cycle checking code, thereby allowing
2731 : * cycles to be made.
2732 : */
2733 0 : static bool check_for_nsfs_mounts(struct mount *subtree)
2734 : {
2735 : struct mount *p;
2736 0 : bool ret = false;
2737 :
2738 : lock_mount_hash();
2739 0 : for (p = subtree; p; p = next_mnt(p, subtree))
2740 0 : if (mnt_ns_loop(p->mnt.mnt_root))
2741 : goto out;
2742 :
2743 : ret = true;
2744 : out:
2745 : unlock_mount_hash();
2746 0 : return ret;
2747 : }
2748 :
2749 0 : static int do_set_group(struct path *from_path, struct path *to_path)
2750 : {
2751 : struct mount *from, *to;
2752 : int err;
2753 :
2754 0 : from = real_mount(from_path->mnt);
2755 0 : to = real_mount(to_path->mnt);
2756 :
2757 : namespace_lock();
2758 :
2759 0 : err = -EINVAL;
2760 : /* To and From must be mounted */
2761 0 : if (!is_mounted(&from->mnt))
2762 : goto out;
2763 0 : if (!is_mounted(&to->mnt))
2764 : goto out;
2765 :
2766 0 : err = -EPERM;
2767 : /* We should be allowed to modify mount namespaces of both mounts */
2768 0 : if (!ns_capable(from->mnt_ns->user_ns, CAP_SYS_ADMIN))
2769 : goto out;
2770 0 : if (!ns_capable(to->mnt_ns->user_ns, CAP_SYS_ADMIN))
2771 : goto out;
2772 :
2773 0 : err = -EINVAL;
2774 : /* To and From paths should be mount roots */
2775 0 : if (from_path->dentry != from_path->mnt->mnt_root)
2776 : goto out;
2777 0 : if (to_path->dentry != to_path->mnt->mnt_root)
2778 : goto out;
2779 :
2780 : /* Setting sharing groups is only allowed across same superblock */
2781 0 : if (from->mnt.mnt_sb != to->mnt.mnt_sb)
2782 : goto out;
2783 :
2784 : /* From mount root should be wider than To mount root */
2785 0 : if (!is_subdir(to->mnt.mnt_root, from->mnt.mnt_root))
2786 : goto out;
2787 :
2788 : /* From mount should not have locked children in place of To's root */
2789 0 : if (has_locked_children(from, to->mnt.mnt_root))
2790 : goto out;
2791 :
2792 : /* Setting sharing groups is only allowed on private mounts */
2793 0 : if (IS_MNT_SHARED(to) || IS_MNT_SLAVE(to))
2794 : goto out;
2795 :
2796 : /* From should not be private */
2797 0 : if (!IS_MNT_SHARED(from) && !IS_MNT_SLAVE(from))
2798 : goto out;
2799 :
2800 0 : if (IS_MNT_SLAVE(from)) {
2801 0 : struct mount *m = from->mnt_master;
2802 :
2803 0 : list_add(&to->mnt_slave, &m->mnt_slave_list);
2804 0 : to->mnt_master = m;
2805 : }
2806 :
2807 0 : if (IS_MNT_SHARED(from)) {
2808 0 : to->mnt_group_id = from->mnt_group_id;
2809 0 : list_add(&to->mnt_share, &from->mnt_share);
2810 : lock_mount_hash();
2811 : set_mnt_shared(to);
2812 : unlock_mount_hash();
2813 : }
2814 :
2815 : err = 0;
2816 : out:
2817 0 : namespace_unlock();
2818 0 : return err;
2819 : }
2820 :
2821 0 : static int do_move_mount(struct path *old_path, struct path *new_path)
2822 : {
2823 : struct mnt_namespace *ns;
2824 : struct mount *p;
2825 : struct mount *old;
2826 : struct mount *parent;
2827 : struct mountpoint *mp, *old_mp;
2828 : int err;
2829 : bool attached;
2830 :
2831 0 : mp = lock_mount(new_path);
2832 0 : if (IS_ERR(mp))
2833 0 : return PTR_ERR(mp);
2834 :
2835 0 : old = real_mount(old_path->mnt);
2836 0 : p = real_mount(new_path->mnt);
2837 0 : parent = old->mnt_parent;
2838 0 : attached = mnt_has_parent(old);
2839 0 : old_mp = old->mnt_mp;
2840 0 : ns = old->mnt_ns;
2841 :
2842 0 : err = -EINVAL;
2843 : /* The mountpoint must be in our namespace. */
2844 0 : if (!check_mnt(p))
2845 : goto out;
2846 :
2847 : /* The thing moved must be mounted... */
2848 0 : if (!is_mounted(&old->mnt))
2849 : goto out;
2850 :
2851 : /* ... and either ours or the root of anon namespace */
2852 0 : if (!(attached ? check_mnt(old) : is_anon_ns(ns)))
2853 : goto out;
2854 :
2855 0 : if (old->mnt.mnt_flags & MNT_LOCKED)
2856 : goto out;
2857 :
2858 0 : if (old_path->dentry != old_path->mnt->mnt_root)
2859 : goto out;
2860 :
2861 0 : if (d_is_dir(new_path->dentry) !=
2862 0 : d_is_dir(old_path->dentry))
2863 : goto out;
2864 : /*
2865 : * Don't move a mount residing in a shared parent.
2866 : */
2867 0 : if (attached && IS_MNT_SHARED(parent))
2868 : goto out;
2869 : /*
2870 : * Don't move a mount tree containing unbindable mounts to a destination
2871 : * mount which is shared.
2872 : */
2873 0 : if (IS_MNT_SHARED(p) && tree_contains_unbindable(old))
2874 : goto out;
2875 0 : err = -ELOOP;
2876 0 : if (!check_for_nsfs_mounts(old))
2877 : goto out;
2878 0 : for (; mnt_has_parent(p); p = p->mnt_parent)
2879 0 : if (p == old)
2880 : goto out;
2881 :
2882 0 : err = attach_recursive_mnt(old, real_mount(new_path->mnt), mp,
2883 : attached);
2884 0 : if (err)
2885 : goto out;
2886 :
2887 : /* if the mount is moved, it should no longer be expire
2888 : * automatically */
2889 0 : list_del_init(&old->mnt_expire);
2890 0 : if (attached)
2891 : put_mountpoint(old_mp);
2892 : out:
2893 0 : unlock_mount(mp);
2894 0 : if (!err) {
2895 0 : if (attached)
2896 0 : mntput_no_expire(parent);
2897 : else
2898 0 : free_mnt_ns(ns);
2899 : }
2900 : return err;
2901 : }
2902 :
2903 0 : static int do_move_mount_old(struct path *path, const char *old_name)
2904 : {
2905 : struct path old_path;
2906 : int err;
2907 :
2908 0 : if (!old_name || !*old_name)
2909 : return -EINVAL;
2910 :
2911 0 : err = kern_path(old_name, LOOKUP_FOLLOW, &old_path);
2912 0 : if (err)
2913 : return err;
2914 :
2915 0 : err = do_move_mount(&old_path, path);
2916 0 : path_put(&old_path);
2917 0 : return err;
2918 : }
2919 :
2920 : /*
2921 : * add a mount into a namespace's mount tree
2922 : */
2923 0 : static int do_add_mount(struct mount *newmnt, struct mountpoint *mp,
2924 : const struct path *path, int mnt_flags)
2925 : {
2926 0 : struct mount *parent = real_mount(path->mnt);
2927 :
2928 0 : mnt_flags &= ~MNT_INTERNAL_FLAGS;
2929 :
2930 0 : if (unlikely(!check_mnt(parent))) {
2931 : /* that's acceptable only for automounts done in private ns */
2932 0 : if (!(mnt_flags & MNT_SHRINKABLE))
2933 : return -EINVAL;
2934 : /* ... and for those we'd better have mountpoint still alive */
2935 0 : if (!parent->mnt_ns)
2936 : return -EINVAL;
2937 : }
2938 :
2939 : /* Refuse the same filesystem on the same mount point */
2940 0 : if (path->mnt->mnt_sb == newmnt->mnt.mnt_sb &&
2941 0 : path->mnt->mnt_root == path->dentry)
2942 : return -EBUSY;
2943 :
2944 0 : if (d_is_symlink(newmnt->mnt.mnt_root))
2945 : return -EINVAL;
2946 :
2947 0 : newmnt->mnt.mnt_flags = mnt_flags;
2948 0 : return graft_tree(newmnt, parent, mp);
2949 : }
2950 :
2951 : static bool mount_too_revealing(const struct super_block *sb, int *new_mnt_flags);
2952 :
2953 : /*
2954 : * Create a new mount using a superblock configuration and request it
2955 : * be added to the namespace tree.
2956 : */
2957 0 : static int do_new_mount_fc(struct fs_context *fc, struct path *mountpoint,
2958 : unsigned int mnt_flags)
2959 : {
2960 : struct vfsmount *mnt;
2961 : struct mountpoint *mp;
2962 0 : struct super_block *sb = fc->root->d_sb;
2963 : int error;
2964 :
2965 0 : error = security_sb_kern_mount(sb);
2966 0 : if (!error && mount_too_revealing(sb, &mnt_flags))
2967 0 : error = -EPERM;
2968 :
2969 0 : if (unlikely(error)) {
2970 0 : fc_drop_locked(fc);
2971 0 : return error;
2972 : }
2973 :
2974 0 : up_write(&sb->s_umount);
2975 :
2976 0 : mnt = vfs_create_mount(fc);
2977 0 : if (IS_ERR(mnt))
2978 0 : return PTR_ERR(mnt);
2979 :
2980 0 : mnt_warn_timestamp_expiry(mountpoint, mnt);
2981 :
2982 0 : mp = lock_mount(mountpoint);
2983 0 : if (IS_ERR(mp)) {
2984 0 : mntput(mnt);
2985 0 : return PTR_ERR(mp);
2986 : }
2987 0 : error = do_add_mount(real_mount(mnt), mp, mountpoint, mnt_flags);
2988 0 : unlock_mount(mp);
2989 0 : if (error < 0)
2990 : mntput(mnt);
2991 : return error;
2992 : }
2993 :
2994 : /*
2995 : * create a new mount for userspace and request it to be added into the
2996 : * namespace's tree
2997 : */
2998 0 : static int do_new_mount(struct path *path, const char *fstype, int sb_flags,
2999 : int mnt_flags, const char *name, void *data)
3000 : {
3001 : struct file_system_type *type;
3002 : struct fs_context *fc;
3003 0 : const char *subtype = NULL;
3004 0 : int err = 0;
3005 :
3006 0 : if (!fstype)
3007 : return -EINVAL;
3008 :
3009 0 : type = get_fs_type(fstype);
3010 0 : if (!type)
3011 : return -ENODEV;
3012 :
3013 0 : if (type->fs_flags & FS_HAS_SUBTYPE) {
3014 0 : subtype = strchr(fstype, '.');
3015 0 : if (subtype) {
3016 0 : subtype++;
3017 0 : if (!*subtype) {
3018 0 : put_filesystem(type);
3019 0 : return -EINVAL;
3020 : }
3021 : }
3022 : }
3023 :
3024 0 : fc = fs_context_for_mount(type, sb_flags);
3025 0 : put_filesystem(type);
3026 0 : if (IS_ERR(fc))
3027 0 : return PTR_ERR(fc);
3028 :
3029 0 : if (subtype)
3030 0 : err = vfs_parse_fs_string(fc, "subtype",
3031 : subtype, strlen(subtype));
3032 0 : if (!err && name)
3033 0 : err = vfs_parse_fs_string(fc, "source", name, strlen(name));
3034 0 : if (!err)
3035 0 : err = parse_monolithic_mount_data(fc, data);
3036 0 : if (!err && !mount_capable(fc))
3037 0 : err = -EPERM;
3038 0 : if (!err)
3039 0 : err = vfs_get_tree(fc);
3040 0 : if (!err)
3041 0 : err = do_new_mount_fc(fc, path, mnt_flags);
3042 :
3043 0 : put_fs_context(fc);
3044 0 : return err;
3045 : }
3046 :
3047 0 : int finish_automount(struct vfsmount *m, const struct path *path)
3048 : {
3049 0 : struct dentry *dentry = path->dentry;
3050 : struct mountpoint *mp;
3051 : struct mount *mnt;
3052 : int err;
3053 :
3054 0 : if (!m)
3055 : return 0;
3056 0 : if (IS_ERR(m))
3057 0 : return PTR_ERR(m);
3058 :
3059 0 : mnt = real_mount(m);
3060 : /* The new mount record should have at least 2 refs to prevent it being
3061 : * expired before we get a chance to add it
3062 : */
3063 0 : BUG_ON(mnt_get_count(mnt) < 2);
3064 :
3065 0 : if (m->mnt_sb == path->mnt->mnt_sb &&
3066 0 : m->mnt_root == dentry) {
3067 : err = -ELOOP;
3068 : goto discard;
3069 : }
3070 :
3071 : /*
3072 : * we don't want to use lock_mount() - in this case finding something
3073 : * that overmounts our mountpoint to be means "quitely drop what we've
3074 : * got", not "try to mount it on top".
3075 : */
3076 0 : inode_lock(dentry->d_inode);
3077 : namespace_lock();
3078 0 : if (unlikely(cant_mount(dentry))) {
3079 : err = -ENOENT;
3080 : goto discard_locked;
3081 : }
3082 : rcu_read_lock();
3083 0 : if (unlikely(__lookup_mnt(path->mnt, dentry))) {
3084 : rcu_read_unlock();
3085 0 : err = 0;
3086 0 : goto discard_locked;
3087 : }
3088 : rcu_read_unlock();
3089 0 : mp = get_mountpoint(dentry);
3090 0 : if (IS_ERR(mp)) {
3091 0 : err = PTR_ERR(mp);
3092 0 : goto discard_locked;
3093 : }
3094 :
3095 0 : err = do_add_mount(mnt, mp, path, path->mnt->mnt_flags | MNT_SHRINKABLE);
3096 0 : unlock_mount(mp);
3097 0 : if (unlikely(err))
3098 : goto discard;
3099 0 : mntput(m);
3100 0 : return 0;
3101 :
3102 : discard_locked:
3103 0 : namespace_unlock();
3104 0 : inode_unlock(dentry->d_inode);
3105 : discard:
3106 : /* remove m from any expiration list it may be on */
3107 0 : if (!list_empty(&mnt->mnt_expire)) {
3108 : namespace_lock();
3109 0 : list_del_init(&mnt->mnt_expire);
3110 0 : namespace_unlock();
3111 : }
3112 0 : mntput(m);
3113 0 : mntput(m);
3114 0 : return err;
3115 : }
3116 :
3117 : /**
3118 : * mnt_set_expiry - Put a mount on an expiration list
3119 : * @mnt: The mount to list.
3120 : * @expiry_list: The list to add the mount to.
3121 : */
3122 0 : void mnt_set_expiry(struct vfsmount *mnt, struct list_head *expiry_list)
3123 : {
3124 0 : namespace_lock();
3125 :
3126 0 : list_add_tail(&real_mount(mnt)->mnt_expire, expiry_list);
3127 :
3128 0 : namespace_unlock();
3129 0 : }
3130 : EXPORT_SYMBOL(mnt_set_expiry);
3131 :
3132 : /*
3133 : * process a list of expirable mountpoints with the intent of discarding any
3134 : * mountpoints that aren't in use and haven't been touched since last we came
3135 : * here
3136 : */
3137 0 : void mark_mounts_for_expiry(struct list_head *mounts)
3138 : {
3139 : struct mount *mnt, *next;
3140 0 : LIST_HEAD(graveyard);
3141 :
3142 0 : if (list_empty(mounts))
3143 0 : return;
3144 :
3145 : namespace_lock();
3146 : lock_mount_hash();
3147 :
3148 : /* extract from the expiration list every vfsmount that matches the
3149 : * following criteria:
3150 : * - only referenced by its parent vfsmount
3151 : * - still marked for expiry (marked on the last call here; marks are
3152 : * cleared by mntput())
3153 : */
3154 0 : list_for_each_entry_safe(mnt, next, mounts, mnt_expire) {
3155 0 : if (!xchg(&mnt->mnt_expiry_mark, 1) ||
3156 0 : propagate_mount_busy(mnt, 1))
3157 0 : continue;
3158 0 : list_move(&mnt->mnt_expire, &graveyard);
3159 : }
3160 0 : while (!list_empty(&graveyard)) {
3161 0 : mnt = list_first_entry(&graveyard, struct mount, mnt_expire);
3162 0 : touch_mnt_namespace(mnt->mnt_ns);
3163 0 : umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC);
3164 : }
3165 : unlock_mount_hash();
3166 0 : namespace_unlock();
3167 : }
3168 :
3169 : EXPORT_SYMBOL_GPL(mark_mounts_for_expiry);
3170 :
3171 : /*
3172 : * Ripoff of 'select_parent()'
3173 : *
3174 : * search the list of submounts for a given mountpoint, and move any
3175 : * shrinkable submounts to the 'graveyard' list.
3176 : */
3177 0 : static int select_submounts(struct mount *parent, struct list_head *graveyard)
3178 : {
3179 0 : struct mount *this_parent = parent;
3180 : struct list_head *next;
3181 0 : int found = 0;
3182 :
3183 : repeat:
3184 0 : next = this_parent->mnt_mounts.next;
3185 : resume:
3186 0 : while (next != &this_parent->mnt_mounts) {
3187 0 : struct list_head *tmp = next;
3188 0 : struct mount *mnt = list_entry(tmp, struct mount, mnt_child);
3189 :
3190 0 : next = tmp->next;
3191 0 : if (!(mnt->mnt.mnt_flags & MNT_SHRINKABLE))
3192 0 : continue;
3193 : /*
3194 : * Descend a level if the d_mounts list is non-empty.
3195 : */
3196 0 : if (!list_empty(&mnt->mnt_mounts)) {
3197 : this_parent = mnt;
3198 : goto repeat;
3199 : }
3200 :
3201 0 : if (!propagate_mount_busy(mnt, 1)) {
3202 0 : list_move_tail(&mnt->mnt_expire, graveyard);
3203 0 : found++;
3204 : }
3205 : }
3206 : /*
3207 : * All done at this level ... ascend and resume the search
3208 : */
3209 0 : if (this_parent != parent) {
3210 0 : next = this_parent->mnt_child.next;
3211 0 : this_parent = this_parent->mnt_parent;
3212 0 : goto resume;
3213 : }
3214 0 : return found;
3215 : }
3216 :
3217 : /*
3218 : * process a list of expirable mountpoints with the intent of discarding any
3219 : * submounts of a specific parent mountpoint
3220 : *
3221 : * mount_lock must be held for write
3222 : */
3223 0 : static void shrink_submounts(struct mount *mnt)
3224 : {
3225 0 : LIST_HEAD(graveyard);
3226 : struct mount *m;
3227 :
3228 : /* extract submounts of 'mountpoint' from the expiration list */
3229 0 : while (select_submounts(mnt, &graveyard)) {
3230 0 : while (!list_empty(&graveyard)) {
3231 0 : m = list_first_entry(&graveyard, struct mount,
3232 : mnt_expire);
3233 0 : touch_mnt_namespace(m->mnt_ns);
3234 0 : umount_tree(m, UMOUNT_PROPAGATE|UMOUNT_SYNC);
3235 : }
3236 : }
3237 0 : }
3238 :
3239 0 : static void *copy_mount_options(const void __user * data)
3240 : {
3241 : char *copy;
3242 : unsigned left, offset;
3243 :
3244 0 : if (!data)
3245 : return NULL;
3246 :
3247 0 : copy = kmalloc(PAGE_SIZE, GFP_KERNEL);
3248 0 : if (!copy)
3249 : return ERR_PTR(-ENOMEM);
3250 :
3251 0 : left = copy_from_user(copy, data, PAGE_SIZE);
3252 :
3253 : /*
3254 : * Not all architectures have an exact copy_from_user(). Resort to
3255 : * byte at a time.
3256 : */
3257 0 : offset = PAGE_SIZE - left;
3258 0 : while (left) {
3259 : char c;
3260 0 : if (get_user(c, (const char __user *)data + offset))
3261 : break;
3262 0 : copy[offset] = c;
3263 0 : left--;
3264 0 : offset++;
3265 : }
3266 :
3267 0 : if (left == PAGE_SIZE) {
3268 0 : kfree(copy);
3269 0 : return ERR_PTR(-EFAULT);
3270 : }
3271 :
3272 : return copy;
3273 : }
3274 :
3275 : static char *copy_mount_string(const void __user *data)
3276 : {
3277 0 : return data ? strndup_user(data, PATH_MAX) : NULL;
3278 : }
3279 :
3280 : /*
3281 : * Flags is a 32-bit value that allows up to 31 non-fs dependent flags to
3282 : * be given to the mount() call (ie: read-only, no-dev, no-suid etc).
3283 : *
3284 : * data is a (void *) that can point to any structure up to
3285 : * PAGE_SIZE-1 bytes, which can contain arbitrary fs-dependent
3286 : * information (or be NULL).
3287 : *
3288 : * Pre-0.97 versions of mount() didn't have a flags word.
3289 : * When the flags word was introduced its top half was required
3290 : * to have the magic value 0xC0ED, and this remained so until 2.4.0-test9.
3291 : * Therefore, if this magic number is present, it carries no information
3292 : * and must be discarded.
3293 : */
3294 0 : int path_mount(const char *dev_name, struct path *path,
3295 : const char *type_page, unsigned long flags, void *data_page)
3296 : {
3297 0 : unsigned int mnt_flags = 0, sb_flags;
3298 : int ret;
3299 :
3300 : /* Discard magic */
3301 0 : if ((flags & MS_MGC_MSK) == MS_MGC_VAL)
3302 0 : flags &= ~MS_MGC_MSK;
3303 :
3304 : /* Basic sanity checks */
3305 0 : if (data_page)
3306 0 : ((char *)data_page)[PAGE_SIZE - 1] = 0;
3307 :
3308 0 : if (flags & MS_NOUSER)
3309 : return -EINVAL;
3310 :
3311 0 : ret = security_sb_mount(dev_name, path, type_page, flags, data_page);
3312 : if (ret)
3313 : return ret;
3314 0 : if (!may_mount())
3315 : return -EPERM;
3316 0 : if (flags & SB_MANDLOCK)
3317 0 : warn_mandlock();
3318 :
3319 : /* Default to relatime unless overriden */
3320 0 : if (!(flags & MS_NOATIME))
3321 0 : mnt_flags |= MNT_RELATIME;
3322 :
3323 : /* Separate the per-mountpoint flags */
3324 0 : if (flags & MS_NOSUID)
3325 0 : mnt_flags |= MNT_NOSUID;
3326 0 : if (flags & MS_NODEV)
3327 0 : mnt_flags |= MNT_NODEV;
3328 0 : if (flags & MS_NOEXEC)
3329 0 : mnt_flags |= MNT_NOEXEC;
3330 0 : if (flags & MS_NOATIME)
3331 0 : mnt_flags |= MNT_NOATIME;
3332 0 : if (flags & MS_NODIRATIME)
3333 0 : mnt_flags |= MNT_NODIRATIME;
3334 0 : if (flags & MS_STRICTATIME)
3335 0 : mnt_flags &= ~(MNT_RELATIME | MNT_NOATIME);
3336 0 : if (flags & MS_RDONLY)
3337 0 : mnt_flags |= MNT_READONLY;
3338 0 : if (flags & MS_NOSYMFOLLOW)
3339 0 : mnt_flags |= MNT_NOSYMFOLLOW;
3340 :
3341 : /* The default atime for remount is preservation */
3342 0 : if ((flags & MS_REMOUNT) &&
3343 : ((flags & (MS_NOATIME | MS_NODIRATIME | MS_RELATIME |
3344 : MS_STRICTATIME)) == 0)) {
3345 0 : mnt_flags &= ~MNT_ATIME_MASK;
3346 0 : mnt_flags |= path->mnt->mnt_flags & MNT_ATIME_MASK;
3347 : }
3348 :
3349 0 : sb_flags = flags & (SB_RDONLY |
3350 : SB_SYNCHRONOUS |
3351 : SB_MANDLOCK |
3352 : SB_DIRSYNC |
3353 : SB_SILENT |
3354 : SB_POSIXACL |
3355 : SB_LAZYTIME |
3356 : SB_I_VERSION);
3357 :
3358 0 : if ((flags & (MS_REMOUNT | MS_BIND)) == (MS_REMOUNT | MS_BIND))
3359 0 : return do_reconfigure_mnt(path, mnt_flags);
3360 0 : if (flags & MS_REMOUNT)
3361 0 : return do_remount(path, flags, sb_flags, mnt_flags, data_page);
3362 0 : if (flags & MS_BIND)
3363 0 : return do_loopback(path, dev_name, flags & MS_REC);
3364 0 : if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
3365 0 : return do_change_type(path, flags);
3366 0 : if (flags & MS_MOVE)
3367 0 : return do_move_mount_old(path, dev_name);
3368 :
3369 0 : return do_new_mount(path, type_page, sb_flags, mnt_flags, dev_name,
3370 : data_page);
3371 : }
3372 :
3373 0 : long do_mount(const char *dev_name, const char __user *dir_name,
3374 : const char *type_page, unsigned long flags, void *data_page)
3375 : {
3376 : struct path path;
3377 : int ret;
3378 :
3379 0 : ret = user_path_at(AT_FDCWD, dir_name, LOOKUP_FOLLOW, &path);
3380 0 : if (ret)
3381 0 : return ret;
3382 0 : ret = path_mount(dev_name, &path, type_page, flags, data_page);
3383 0 : path_put(&path);
3384 0 : return ret;
3385 : }
3386 :
3387 : static struct ucounts *inc_mnt_namespaces(struct user_namespace *ns)
3388 : {
3389 1 : return inc_ucount(ns, current_euid(), UCOUNT_MNT_NAMESPACES);
3390 : }
3391 :
3392 : static void dec_mnt_namespaces(struct ucounts *ucounts)
3393 : {
3394 0 : dec_ucount(ucounts, UCOUNT_MNT_NAMESPACES);
3395 : }
3396 :
3397 0 : static void free_mnt_ns(struct mnt_namespace *ns)
3398 : {
3399 0 : if (!is_anon_ns(ns))
3400 0 : ns_free_inum(&ns->ns);
3401 0 : dec_mnt_namespaces(ns->ucounts);
3402 0 : put_user_ns(ns->user_ns);
3403 0 : kfree(ns);
3404 0 : }
3405 :
3406 : /*
3407 : * Assign a sequence number so we can detect when we attempt to bind
3408 : * mount a reference to an older mount namespace into the current
3409 : * mount namespace, preventing reference counting loops. A 64bit
3410 : * number incrementing at 10Ghz will take 12,427 years to wrap which
3411 : * is effectively never, so we can ignore the possibility.
3412 : */
3413 : static atomic64_t mnt_ns_seq = ATOMIC64_INIT(1);
3414 :
3415 1 : static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns, bool anon)
3416 : {
3417 : struct mnt_namespace *new_ns;
3418 : struct ucounts *ucounts;
3419 : int ret;
3420 :
3421 1 : ucounts = inc_mnt_namespaces(user_ns);
3422 1 : if (!ucounts)
3423 : return ERR_PTR(-ENOSPC);
3424 :
3425 1 : new_ns = kzalloc(sizeof(struct mnt_namespace), GFP_KERNEL_ACCOUNT);
3426 1 : if (!new_ns) {
3427 0 : dec_mnt_namespaces(ucounts);
3428 0 : return ERR_PTR(-ENOMEM);
3429 : }
3430 1 : if (!anon) {
3431 2 : ret = ns_alloc_inum(&new_ns->ns);
3432 1 : if (ret) {
3433 0 : kfree(new_ns);
3434 0 : dec_mnt_namespaces(ucounts);
3435 0 : return ERR_PTR(ret);
3436 : }
3437 : }
3438 1 : new_ns->ns.ops = &mntns_operations;
3439 1 : if (!anon)
3440 1 : new_ns->seq = atomic64_add_return(1, &mnt_ns_seq);
3441 2 : refcount_set(&new_ns->ns.count, 1);
3442 2 : INIT_LIST_HEAD(&new_ns->list);
3443 1 : init_waitqueue_head(&new_ns->poll);
3444 1 : spin_lock_init(&new_ns->ns_lock);
3445 1 : new_ns->user_ns = get_user_ns(user_ns);
3446 1 : new_ns->ucounts = ucounts;
3447 1 : return new_ns;
3448 : }
3449 :
3450 : __latent_entropy
3451 0 : struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns,
3452 : struct user_namespace *user_ns, struct fs_struct *new_fs)
3453 : {
3454 : struct mnt_namespace *new_ns;
3455 0 : struct vfsmount *rootmnt = NULL, *pwdmnt = NULL;
3456 : struct mount *p, *q;
3457 : struct mount *old;
3458 : struct mount *new;
3459 : int copy_flags;
3460 :
3461 0 : BUG_ON(!ns);
3462 :
3463 0 : if (likely(!(flags & CLONE_NEWNS))) {
3464 0 : get_mnt_ns(ns);
3465 0 : return ns;
3466 : }
3467 :
3468 0 : old = ns->root;
3469 :
3470 0 : new_ns = alloc_mnt_ns(user_ns, false);
3471 0 : if (IS_ERR(new_ns))
3472 : return new_ns;
3473 :
3474 : namespace_lock();
3475 : /* First pass: copy the tree topology */
3476 0 : copy_flags = CL_COPY_UNBINDABLE | CL_EXPIRE;
3477 0 : if (user_ns != ns->user_ns)
3478 0 : copy_flags |= CL_SHARED_TO_SLAVE;
3479 0 : new = copy_tree(old, old->mnt.mnt_root, copy_flags);
3480 0 : if (IS_ERR(new)) {
3481 0 : namespace_unlock();
3482 0 : free_mnt_ns(new_ns);
3483 0 : return ERR_CAST(new);
3484 : }
3485 0 : if (user_ns != ns->user_ns) {
3486 : lock_mount_hash();
3487 0 : lock_mnt_tree(new);
3488 : unlock_mount_hash();
3489 : }
3490 0 : new_ns->root = new;
3491 0 : list_add_tail(&new_ns->list, &new->mnt_list);
3492 :
3493 : /*
3494 : * Second pass: switch the tsk->fs->* elements and mark new vfsmounts
3495 : * as belonging to new namespace. We have already acquired a private
3496 : * fs_struct, so tsk->fs->lock is not needed.
3497 : */
3498 0 : p = old;
3499 0 : q = new;
3500 0 : while (p) {
3501 0 : q->mnt_ns = new_ns;
3502 0 : new_ns->mounts++;
3503 0 : if (new_fs) {
3504 0 : if (&p->mnt == new_fs->root.mnt) {
3505 0 : new_fs->root.mnt = mntget(&q->mnt);
3506 0 : rootmnt = &p->mnt;
3507 : }
3508 0 : if (&p->mnt == new_fs->pwd.mnt) {
3509 0 : new_fs->pwd.mnt = mntget(&q->mnt);
3510 0 : pwdmnt = &p->mnt;
3511 : }
3512 : }
3513 0 : p = next_mnt(p, old);
3514 0 : q = next_mnt(q, new);
3515 0 : if (!q)
3516 : break;
3517 : // an mntns binding we'd skipped?
3518 0 : while (p->mnt.mnt_root != q->mnt.mnt_root)
3519 0 : p = next_mnt(skip_mnt_tree(p), old);
3520 : }
3521 0 : namespace_unlock();
3522 :
3523 0 : if (rootmnt)
3524 : mntput(rootmnt);
3525 0 : if (pwdmnt)
3526 : mntput(pwdmnt);
3527 :
3528 : return new_ns;
3529 : }
3530 :
3531 0 : struct dentry *mount_subtree(struct vfsmount *m, const char *name)
3532 : {
3533 0 : struct mount *mnt = real_mount(m);
3534 : struct mnt_namespace *ns;
3535 : struct super_block *s;
3536 : struct path path;
3537 : int err;
3538 :
3539 0 : ns = alloc_mnt_ns(&init_user_ns, true);
3540 0 : if (IS_ERR(ns)) {
3541 : mntput(m);
3542 : return ERR_CAST(ns);
3543 : }
3544 0 : mnt->mnt_ns = ns;
3545 0 : ns->root = mnt;
3546 0 : ns->mounts++;
3547 0 : list_add(&mnt->mnt_list, &ns->list);
3548 :
3549 0 : err = vfs_path_lookup(m->mnt_root, m,
3550 : name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &path);
3551 :
3552 0 : put_mnt_ns(ns);
3553 :
3554 0 : if (err)
3555 0 : return ERR_PTR(err);
3556 :
3557 : /* trade a vfsmount reference for active sb one */
3558 0 : s = path.mnt->mnt_sb;
3559 0 : atomic_inc(&s->s_active);
3560 0 : mntput(path.mnt);
3561 : /* lock the sucker */
3562 0 : down_write(&s->s_umount);
3563 : /* ... and return the root of (sub)tree on it */
3564 0 : return path.dentry;
3565 : }
3566 : EXPORT_SYMBOL(mount_subtree);
3567 :
3568 0 : SYSCALL_DEFINE5(mount, char __user *, dev_name, char __user *, dir_name,
3569 : char __user *, type, unsigned long, flags, void __user *, data)
3570 : {
3571 : int ret;
3572 : char *kernel_type;
3573 : char *kernel_dev;
3574 : void *options;
3575 :
3576 0 : kernel_type = copy_mount_string(type);
3577 0 : ret = PTR_ERR(kernel_type);
3578 0 : if (IS_ERR(kernel_type))
3579 : goto out_type;
3580 :
3581 0 : kernel_dev = copy_mount_string(dev_name);
3582 0 : ret = PTR_ERR(kernel_dev);
3583 0 : if (IS_ERR(kernel_dev))
3584 : goto out_dev;
3585 :
3586 0 : options = copy_mount_options(data);
3587 0 : ret = PTR_ERR(options);
3588 0 : if (IS_ERR(options))
3589 : goto out_data;
3590 :
3591 0 : ret = do_mount(kernel_dev, dir_name, kernel_type, flags, options);
3592 :
3593 0 : kfree(options);
3594 : out_data:
3595 0 : kfree(kernel_dev);
3596 : out_dev:
3597 0 : kfree(kernel_type);
3598 : out_type:
3599 0 : return ret;
3600 : }
3601 :
3602 : #define FSMOUNT_VALID_FLAGS \
3603 : (MOUNT_ATTR_RDONLY | MOUNT_ATTR_NOSUID | MOUNT_ATTR_NODEV | \
3604 : MOUNT_ATTR_NOEXEC | MOUNT_ATTR__ATIME | MOUNT_ATTR_NODIRATIME | \
3605 : MOUNT_ATTR_NOSYMFOLLOW)
3606 :
3607 : #define MOUNT_SETATTR_VALID_FLAGS (FSMOUNT_VALID_FLAGS | MOUNT_ATTR_IDMAP)
3608 :
3609 : #define MOUNT_SETATTR_PROPAGATION_FLAGS \
3610 : (MS_UNBINDABLE | MS_PRIVATE | MS_SLAVE | MS_SHARED)
3611 :
3612 0 : static unsigned int attr_flags_to_mnt_flags(u64 attr_flags)
3613 : {
3614 0 : unsigned int mnt_flags = 0;
3615 :
3616 0 : if (attr_flags & MOUNT_ATTR_RDONLY)
3617 0 : mnt_flags |= MNT_READONLY;
3618 0 : if (attr_flags & MOUNT_ATTR_NOSUID)
3619 0 : mnt_flags |= MNT_NOSUID;
3620 0 : if (attr_flags & MOUNT_ATTR_NODEV)
3621 0 : mnt_flags |= MNT_NODEV;
3622 0 : if (attr_flags & MOUNT_ATTR_NOEXEC)
3623 0 : mnt_flags |= MNT_NOEXEC;
3624 0 : if (attr_flags & MOUNT_ATTR_NODIRATIME)
3625 0 : mnt_flags |= MNT_NODIRATIME;
3626 0 : if (attr_flags & MOUNT_ATTR_NOSYMFOLLOW)
3627 0 : mnt_flags |= MNT_NOSYMFOLLOW;
3628 :
3629 0 : return mnt_flags;
3630 : }
3631 :
3632 : /*
3633 : * Create a kernel mount representation for a new, prepared superblock
3634 : * (specified by fs_fd) and attach to an open_tree-like file descriptor.
3635 : */
3636 0 : SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags,
3637 : unsigned int, attr_flags)
3638 : {
3639 : struct mnt_namespace *ns;
3640 : struct fs_context *fc;
3641 : struct file *file;
3642 : struct path newmount;
3643 : struct mount *mnt;
3644 : struct fd f;
3645 0 : unsigned int mnt_flags = 0;
3646 : long ret;
3647 :
3648 0 : if (!may_mount())
3649 : return -EPERM;
3650 :
3651 0 : if ((flags & ~(FSMOUNT_CLOEXEC)) != 0)
3652 : return -EINVAL;
3653 :
3654 0 : if (attr_flags & ~FSMOUNT_VALID_FLAGS)
3655 : return -EINVAL;
3656 :
3657 0 : mnt_flags = attr_flags_to_mnt_flags(attr_flags);
3658 :
3659 0 : switch (attr_flags & MOUNT_ATTR__ATIME) {
3660 : case MOUNT_ATTR_STRICTATIME:
3661 : break;
3662 : case MOUNT_ATTR_NOATIME:
3663 0 : mnt_flags |= MNT_NOATIME;
3664 0 : break;
3665 : case MOUNT_ATTR_RELATIME:
3666 0 : mnt_flags |= MNT_RELATIME;
3667 0 : break;
3668 : default:
3669 : return -EINVAL;
3670 : }
3671 :
3672 0 : f = fdget(fs_fd);
3673 0 : if (!f.file)
3674 : return -EBADF;
3675 :
3676 0 : ret = -EINVAL;
3677 0 : if (f.file->f_op != &fscontext_fops)
3678 : goto err_fsfd;
3679 :
3680 0 : fc = f.file->private_data;
3681 :
3682 0 : ret = mutex_lock_interruptible(&fc->uapi_mutex);
3683 0 : if (ret < 0)
3684 : goto err_fsfd;
3685 :
3686 : /* There must be a valid superblock or we can't mount it */
3687 0 : ret = -EINVAL;
3688 0 : if (!fc->root)
3689 : goto err_unlock;
3690 :
3691 0 : ret = -EPERM;
3692 0 : if (mount_too_revealing(fc->root->d_sb, &mnt_flags)) {
3693 0 : pr_warn("VFS: Mount too revealing\n");
3694 0 : goto err_unlock;
3695 : }
3696 :
3697 0 : ret = -EBUSY;
3698 0 : if (fc->phase != FS_CONTEXT_AWAITING_MOUNT)
3699 : goto err_unlock;
3700 :
3701 0 : if (fc->sb_flags & SB_MANDLOCK)
3702 0 : warn_mandlock();
3703 :
3704 0 : newmount.mnt = vfs_create_mount(fc);
3705 0 : if (IS_ERR(newmount.mnt)) {
3706 0 : ret = PTR_ERR(newmount.mnt);
3707 0 : goto err_unlock;
3708 : }
3709 0 : newmount.dentry = dget(fc->root);
3710 0 : newmount.mnt->mnt_flags = mnt_flags;
3711 :
3712 : /* We've done the mount bit - now move the file context into more or
3713 : * less the same state as if we'd done an fspick(). We don't want to
3714 : * do any memory allocation or anything like that at this point as we
3715 : * don't want to have to handle any errors incurred.
3716 : */
3717 0 : vfs_clean_context(fc);
3718 :
3719 0 : ns = alloc_mnt_ns(current->nsproxy->mnt_ns->user_ns, true);
3720 0 : if (IS_ERR(ns)) {
3721 0 : ret = PTR_ERR(ns);
3722 0 : goto err_path;
3723 : }
3724 0 : mnt = real_mount(newmount.mnt);
3725 0 : mnt->mnt_ns = ns;
3726 0 : ns->root = mnt;
3727 0 : ns->mounts = 1;
3728 0 : list_add(&mnt->mnt_list, &ns->list);
3729 0 : mntget(newmount.mnt);
3730 :
3731 : /* Attach to an apparent O_PATH fd with a note that we need to unmount
3732 : * it, not just simply put it.
3733 : */
3734 0 : file = dentry_open(&newmount, O_PATH, fc->cred);
3735 0 : if (IS_ERR(file)) {
3736 0 : dissolve_on_fput(newmount.mnt);
3737 0 : ret = PTR_ERR(file);
3738 0 : goto err_path;
3739 : }
3740 0 : file->f_mode |= FMODE_NEED_UNMOUNT;
3741 :
3742 0 : ret = get_unused_fd_flags((flags & FSMOUNT_CLOEXEC) ? O_CLOEXEC : 0);
3743 0 : if (ret >= 0)
3744 0 : fd_install(ret, file);
3745 : else
3746 0 : fput(file);
3747 :
3748 : err_path:
3749 0 : path_put(&newmount);
3750 : err_unlock:
3751 0 : mutex_unlock(&fc->uapi_mutex);
3752 : err_fsfd:
3753 0 : fdput(f);
3754 : return ret;
3755 : }
3756 :
3757 : /*
3758 : * Move a mount from one place to another. In combination with
3759 : * fsopen()/fsmount() this is used to install a new mount and in combination
3760 : * with open_tree(OPEN_TREE_CLONE [| AT_RECURSIVE]) it can be used to copy
3761 : * a mount subtree.
3762 : *
3763 : * Note the flags value is a combination of MOVE_MOUNT_* flags.
3764 : */
3765 0 : SYSCALL_DEFINE5(move_mount,
3766 : int, from_dfd, const char __user *, from_pathname,
3767 : int, to_dfd, const char __user *, to_pathname,
3768 : unsigned int, flags)
3769 : {
3770 : struct path from_path, to_path;
3771 : unsigned int lflags;
3772 0 : int ret = 0;
3773 :
3774 0 : if (!may_mount())
3775 : return -EPERM;
3776 :
3777 0 : if (flags & ~MOVE_MOUNT__MASK)
3778 : return -EINVAL;
3779 :
3780 : /* If someone gives a pathname, they aren't permitted to move
3781 : * from an fd that requires unmount as we can't get at the flag
3782 : * to clear it afterwards.
3783 : */
3784 0 : lflags = 0;
3785 0 : if (flags & MOVE_MOUNT_F_SYMLINKS) lflags |= LOOKUP_FOLLOW;
3786 0 : if (flags & MOVE_MOUNT_F_AUTOMOUNTS) lflags |= LOOKUP_AUTOMOUNT;
3787 0 : if (flags & MOVE_MOUNT_F_EMPTY_PATH) lflags |= LOOKUP_EMPTY;
3788 :
3789 0 : ret = user_path_at(from_dfd, from_pathname, lflags, &from_path);
3790 0 : if (ret < 0)
3791 0 : return ret;
3792 :
3793 0 : lflags = 0;
3794 0 : if (flags & MOVE_MOUNT_T_SYMLINKS) lflags |= LOOKUP_FOLLOW;
3795 0 : if (flags & MOVE_MOUNT_T_AUTOMOUNTS) lflags |= LOOKUP_AUTOMOUNT;
3796 0 : if (flags & MOVE_MOUNT_T_EMPTY_PATH) lflags |= LOOKUP_EMPTY;
3797 :
3798 0 : ret = user_path_at(to_dfd, to_pathname, lflags, &to_path);
3799 0 : if (ret < 0)
3800 : goto out_from;
3801 :
3802 0 : ret = security_move_mount(&from_path, &to_path);
3803 : if (ret < 0)
3804 : goto out_to;
3805 :
3806 0 : if (flags & MOVE_MOUNT_SET_GROUP)
3807 0 : ret = do_set_group(&from_path, &to_path);
3808 : else
3809 0 : ret = do_move_mount(&from_path, &to_path);
3810 :
3811 : out_to:
3812 0 : path_put(&to_path);
3813 : out_from:
3814 0 : path_put(&from_path);
3815 0 : return ret;
3816 : }
3817 :
3818 : /*
3819 : * Return true if path is reachable from root
3820 : *
3821 : * namespace_sem or mount_lock is held
3822 : */
3823 0 : bool is_path_reachable(struct mount *mnt, struct dentry *dentry,
3824 : const struct path *root)
3825 : {
3826 0 : while (&mnt->mnt != root->mnt && mnt_has_parent(mnt)) {
3827 0 : dentry = mnt->mnt_mountpoint;
3828 0 : mnt = mnt->mnt_parent;
3829 : }
3830 0 : return &mnt->mnt == root->mnt && is_subdir(dentry, root->dentry);
3831 : }
3832 :
3833 0 : bool path_is_under(const struct path *path1, const struct path *path2)
3834 : {
3835 : bool res;
3836 0 : read_seqlock_excl(&mount_lock);
3837 0 : res = is_path_reachable(real_mount(path1->mnt), path1->dentry, path2);
3838 0 : read_sequnlock_excl(&mount_lock);
3839 0 : return res;
3840 : }
3841 : EXPORT_SYMBOL(path_is_under);
3842 :
3843 : /*
3844 : * pivot_root Semantics:
3845 : * Moves the root file system of the current process to the directory put_old,
3846 : * makes new_root as the new root file system of the current process, and sets
3847 : * root/cwd of all processes which had them on the current root to new_root.
3848 : *
3849 : * Restrictions:
3850 : * The new_root and put_old must be directories, and must not be on the
3851 : * same file system as the current process root. The put_old must be
3852 : * underneath new_root, i.e. adding a non-zero number of /.. to the string
3853 : * pointed to by put_old must yield the same directory as new_root. No other
3854 : * file system may be mounted on put_old. After all, new_root is a mountpoint.
3855 : *
3856 : * Also, the current root cannot be on the 'rootfs' (initial ramfs) filesystem.
3857 : * See Documentation/filesystems/ramfs-rootfs-initramfs.rst for alternatives
3858 : * in this situation.
3859 : *
3860 : * Notes:
3861 : * - we don't move root/cwd if they are not at the root (reason: if something
3862 : * cared enough to change them, it's probably wrong to force them elsewhere)
3863 : * - it's okay to pick a root that isn't the root of a file system, e.g.
3864 : * /nfs/my_root where /nfs is the mount point. It must be a mountpoint,
3865 : * though, so you may need to say mount --bind /nfs/my_root /nfs/my_root
3866 : * first.
3867 : */
3868 0 : SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
3869 : const char __user *, put_old)
3870 : {
3871 : struct path new, old, root;
3872 : struct mount *new_mnt, *root_mnt, *old_mnt, *root_parent, *ex_parent;
3873 : struct mountpoint *old_mp, *root_mp;
3874 : int error;
3875 :
3876 0 : if (!may_mount())
3877 : return -EPERM;
3878 :
3879 0 : error = user_path_at(AT_FDCWD, new_root,
3880 : LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &new);
3881 0 : if (error)
3882 : goto out0;
3883 :
3884 0 : error = user_path_at(AT_FDCWD, put_old,
3885 : LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &old);
3886 0 : if (error)
3887 : goto out1;
3888 :
3889 0 : error = security_sb_pivotroot(&old, &new);
3890 : if (error)
3891 : goto out2;
3892 :
3893 0 : get_fs_root(current->fs, &root);
3894 0 : old_mp = lock_mount(&old);
3895 0 : error = PTR_ERR(old_mp);
3896 0 : if (IS_ERR(old_mp))
3897 : goto out3;
3898 :
3899 0 : error = -EINVAL;
3900 0 : new_mnt = real_mount(new.mnt);
3901 0 : root_mnt = real_mount(root.mnt);
3902 0 : old_mnt = real_mount(old.mnt);
3903 0 : ex_parent = new_mnt->mnt_parent;
3904 0 : root_parent = root_mnt->mnt_parent;
3905 0 : if (IS_MNT_SHARED(old_mnt) ||
3906 0 : IS_MNT_SHARED(ex_parent) ||
3907 0 : IS_MNT_SHARED(root_parent))
3908 : goto out4;
3909 0 : if (!check_mnt(root_mnt) || !check_mnt(new_mnt))
3910 : goto out4;
3911 0 : if (new_mnt->mnt.mnt_flags & MNT_LOCKED)
3912 : goto out4;
3913 0 : error = -ENOENT;
3914 0 : if (d_unlinked(new.dentry))
3915 : goto out4;
3916 0 : error = -EBUSY;
3917 0 : if (new_mnt == root_mnt || old_mnt == root_mnt)
3918 : goto out4; /* loop, on the same file system */
3919 0 : error = -EINVAL;
3920 0 : if (root.mnt->mnt_root != root.dentry)
3921 : goto out4; /* not a mountpoint */
3922 0 : if (!mnt_has_parent(root_mnt))
3923 : goto out4; /* not attached */
3924 0 : if (new.mnt->mnt_root != new.dentry)
3925 : goto out4; /* not a mountpoint */
3926 0 : if (!mnt_has_parent(new_mnt))
3927 : goto out4; /* not attached */
3928 : /* make sure we can reach put_old from new_root */
3929 0 : if (!is_path_reachable(old_mnt, old.dentry, &new))
3930 : goto out4;
3931 : /* make certain new is below the root */
3932 0 : if (!is_path_reachable(new_mnt, new.dentry, &root))
3933 : goto out4;
3934 0 : lock_mount_hash();
3935 0 : umount_mnt(new_mnt);
3936 0 : root_mp = unhash_mnt(root_mnt); /* we'll need its mountpoint */
3937 0 : if (root_mnt->mnt.mnt_flags & MNT_LOCKED) {
3938 0 : new_mnt->mnt.mnt_flags |= MNT_LOCKED;
3939 0 : root_mnt->mnt.mnt_flags &= ~MNT_LOCKED;
3940 : }
3941 : /* mount old root on put_old */
3942 0 : attach_mnt(root_mnt, old_mnt, old_mp);
3943 : /* mount new_root on / */
3944 0 : attach_mnt(new_mnt, root_parent, root_mp);
3945 0 : mnt_add_count(root_parent, -1);
3946 0 : touch_mnt_namespace(current->nsproxy->mnt_ns);
3947 : /* A moved mount should not expire automatically */
3948 0 : list_del_init(&new_mnt->mnt_expire);
3949 0 : put_mountpoint(root_mp);
3950 : unlock_mount_hash();
3951 0 : chroot_fs_refs(&root, &new);
3952 0 : error = 0;
3953 : out4:
3954 0 : unlock_mount(old_mp);
3955 0 : if (!error)
3956 0 : mntput_no_expire(ex_parent);
3957 : out3:
3958 0 : path_put(&root);
3959 : out2:
3960 0 : path_put(&old);
3961 : out1:
3962 0 : path_put(&new);
3963 : out0:
3964 0 : return error;
3965 : }
3966 :
3967 : static unsigned int recalc_flags(struct mount_kattr *kattr, struct mount *mnt)
3968 : {
3969 0 : unsigned int flags = mnt->mnt.mnt_flags;
3970 :
3971 : /* flags to clear */
3972 0 : flags &= ~kattr->attr_clr;
3973 : /* flags to raise */
3974 0 : flags |= kattr->attr_set;
3975 :
3976 : return flags;
3977 : }
3978 :
3979 0 : static int can_idmap_mount(const struct mount_kattr *kattr, struct mount *mnt)
3980 : {
3981 0 : struct vfsmount *m = &mnt->mnt;
3982 0 : struct user_namespace *fs_userns = m->mnt_sb->s_user_ns;
3983 :
3984 0 : if (!kattr->mnt_idmap)
3985 : return 0;
3986 :
3987 : /*
3988 : * Creating an idmapped mount with the filesystem wide idmapping
3989 : * doesn't make sense so block that. We don't allow mushy semantics.
3990 : */
3991 0 : if (!check_fsmapping(kattr->mnt_idmap, m->mnt_sb))
3992 : return -EINVAL;
3993 :
3994 : /*
3995 : * Once a mount has been idmapped we don't allow it to change its
3996 : * mapping. It makes things simpler and callers can just create
3997 : * another bind-mount they can idmap if they want to.
3998 : */
3999 0 : if (is_idmapped_mnt(m))
4000 : return -EPERM;
4001 :
4002 : /* The underlying filesystem doesn't support idmapped mounts yet. */
4003 0 : if (!(m->mnt_sb->s_type->fs_flags & FS_ALLOW_IDMAP))
4004 : return -EINVAL;
4005 :
4006 : /* We're not controlling the superblock. */
4007 0 : if (!ns_capable(fs_userns, CAP_SYS_ADMIN))
4008 : return -EPERM;
4009 :
4010 : /* Mount has already been visible in the filesystem hierarchy. */
4011 0 : if (!is_anon_ns(mnt->mnt_ns))
4012 : return -EINVAL;
4013 :
4014 : return 0;
4015 : }
4016 :
4017 : /**
4018 : * mnt_allow_writers() - check whether the attribute change allows writers
4019 : * @kattr: the new mount attributes
4020 : * @mnt: the mount to which @kattr will be applied
4021 : *
4022 : * Check whether thew new mount attributes in @kattr allow concurrent writers.
4023 : *
4024 : * Return: true if writers need to be held, false if not
4025 : */
4026 : static inline bool mnt_allow_writers(const struct mount_kattr *kattr,
4027 : const struct mount *mnt)
4028 : {
4029 0 : return (!(kattr->attr_set & MNT_READONLY) ||
4030 0 : (mnt->mnt.mnt_flags & MNT_READONLY)) &&
4031 0 : !kattr->mnt_idmap;
4032 : }
4033 :
4034 0 : static int mount_setattr_prepare(struct mount_kattr *kattr, struct mount *mnt)
4035 : {
4036 : struct mount *m;
4037 : int err;
4038 :
4039 0 : for (m = mnt; m; m = next_mnt(m, mnt)) {
4040 0 : if (!can_change_locked_flags(m, recalc_flags(kattr, m))) {
4041 : err = -EPERM;
4042 : break;
4043 : }
4044 :
4045 0 : err = can_idmap_mount(kattr, m);
4046 0 : if (err)
4047 : break;
4048 :
4049 0 : if (!mnt_allow_writers(kattr, m)) {
4050 0 : err = mnt_hold_writers(m);
4051 0 : if (err)
4052 : break;
4053 : }
4054 :
4055 0 : if (!kattr->recurse)
4056 : return 0;
4057 : }
4058 :
4059 0 : if (err) {
4060 : struct mount *p;
4061 :
4062 : /*
4063 : * If we had to call mnt_hold_writers() MNT_WRITE_HOLD will
4064 : * be set in @mnt_flags. The loop unsets MNT_WRITE_HOLD for all
4065 : * mounts and needs to take care to include the first mount.
4066 : */
4067 0 : for (p = mnt; p; p = next_mnt(p, mnt)) {
4068 : /* If we had to hold writers unblock them. */
4069 0 : if (p->mnt.mnt_flags & MNT_WRITE_HOLD)
4070 0 : mnt_unhold_writers(p);
4071 :
4072 : /*
4073 : * We're done once the first mount we changed got
4074 : * MNT_WRITE_HOLD unset.
4075 : */
4076 0 : if (p == m)
4077 : break;
4078 : }
4079 : }
4080 : return err;
4081 : }
4082 :
4083 : static void do_idmap_mount(const struct mount_kattr *kattr, struct mount *mnt)
4084 : {
4085 0 : if (!kattr->mnt_idmap)
4086 : return;
4087 :
4088 : /*
4089 : * Pairs with smp_load_acquire() in mnt_idmap().
4090 : *
4091 : * Since we only allow a mount to change the idmapping once and
4092 : * verified this in can_idmap_mount() we know that the mount has
4093 : * @nop_mnt_idmap attached to it. So there's no need to drop any
4094 : * references.
4095 : */
4096 0 : smp_store_release(&mnt->mnt.mnt_idmap, mnt_idmap_get(kattr->mnt_idmap));
4097 : }
4098 :
4099 0 : static void mount_setattr_commit(struct mount_kattr *kattr, struct mount *mnt)
4100 : {
4101 : struct mount *m;
4102 :
4103 0 : for (m = mnt; m; m = next_mnt(m, mnt)) {
4104 : unsigned int flags;
4105 :
4106 0 : do_idmap_mount(kattr, m);
4107 0 : flags = recalc_flags(kattr, m);
4108 0 : WRITE_ONCE(m->mnt.mnt_flags, flags);
4109 :
4110 : /* If we had to hold writers unblock them. */
4111 0 : if (m->mnt.mnt_flags & MNT_WRITE_HOLD)
4112 0 : mnt_unhold_writers(m);
4113 :
4114 0 : if (kattr->propagation)
4115 0 : change_mnt_propagation(m, kattr->propagation);
4116 0 : if (!kattr->recurse)
4117 : break;
4118 : }
4119 0 : touch_mnt_namespace(mnt->mnt_ns);
4120 0 : }
4121 :
4122 0 : static int do_mount_setattr(struct path *path, struct mount_kattr *kattr)
4123 : {
4124 0 : struct mount *mnt = real_mount(path->mnt);
4125 0 : int err = 0;
4126 :
4127 0 : if (path->dentry != mnt->mnt.mnt_root)
4128 : return -EINVAL;
4129 :
4130 0 : if (kattr->mnt_userns) {
4131 : struct mnt_idmap *mnt_idmap;
4132 :
4133 0 : mnt_idmap = alloc_mnt_idmap(kattr->mnt_userns);
4134 0 : if (IS_ERR(mnt_idmap))
4135 0 : return PTR_ERR(mnt_idmap);
4136 0 : kattr->mnt_idmap = mnt_idmap;
4137 : }
4138 :
4139 0 : if (kattr->propagation) {
4140 : /*
4141 : * Only take namespace_lock() if we're actually changing
4142 : * propagation.
4143 : */
4144 : namespace_lock();
4145 0 : if (kattr->propagation == MS_SHARED) {
4146 0 : err = invent_group_ids(mnt, kattr->recurse);
4147 0 : if (err) {
4148 0 : namespace_unlock();
4149 0 : return err;
4150 : }
4151 : }
4152 : }
4153 :
4154 0 : err = -EINVAL;
4155 : lock_mount_hash();
4156 :
4157 : /* Ensure that this isn't anything purely vfs internal. */
4158 0 : if (!is_mounted(&mnt->mnt))
4159 : goto out;
4160 :
4161 : /*
4162 : * If this is an attached mount make sure it's located in the callers
4163 : * mount namespace. If it's not don't let the caller interact with it.
4164 : * If this is a detached mount make sure it has an anonymous mount
4165 : * namespace attached to it, i.e. we've created it via OPEN_TREE_CLONE.
4166 : */
4167 0 : if (!(mnt_has_parent(mnt) ? check_mnt(mnt) : is_anon_ns(mnt->mnt_ns)))
4168 : goto out;
4169 :
4170 : /*
4171 : * First, we get the mount tree in a shape where we can change mount
4172 : * properties without failure. If we succeeded to do so we commit all
4173 : * changes and if we failed we clean up.
4174 : */
4175 0 : err = mount_setattr_prepare(kattr, mnt);
4176 0 : if (!err)
4177 0 : mount_setattr_commit(kattr, mnt);
4178 :
4179 : out:
4180 : unlock_mount_hash();
4181 :
4182 0 : if (kattr->propagation) {
4183 0 : if (err)
4184 0 : cleanup_group_ids(mnt, NULL);
4185 0 : namespace_unlock();
4186 : }
4187 :
4188 : return err;
4189 : }
4190 :
4191 0 : static int build_mount_idmapped(const struct mount_attr *attr, size_t usize,
4192 : struct mount_kattr *kattr, unsigned int flags)
4193 : {
4194 0 : int err = 0;
4195 : struct ns_common *ns;
4196 : struct user_namespace *mnt_userns;
4197 : struct fd f;
4198 :
4199 0 : if (!((attr->attr_set | attr->attr_clr) & MOUNT_ATTR_IDMAP))
4200 : return 0;
4201 :
4202 : /*
4203 : * We currently do not support clearing an idmapped mount. If this ever
4204 : * is a use-case we can revisit this but for now let's keep it simple
4205 : * and not allow it.
4206 : */
4207 0 : if (attr->attr_clr & MOUNT_ATTR_IDMAP)
4208 : return -EINVAL;
4209 :
4210 0 : if (attr->userns_fd > INT_MAX)
4211 : return -EINVAL;
4212 :
4213 0 : f = fdget(attr->userns_fd);
4214 0 : if (!f.file)
4215 : return -EBADF;
4216 :
4217 0 : if (!proc_ns_file(f.file)) {
4218 : err = -EINVAL;
4219 : goto out_fput;
4220 : }
4221 :
4222 0 : ns = get_proc_ns(file_inode(f.file));
4223 0 : if (ns->ops->type != CLONE_NEWUSER) {
4224 : err = -EINVAL;
4225 : goto out_fput;
4226 : }
4227 :
4228 : /*
4229 : * The initial idmapping cannot be used to create an idmapped
4230 : * mount. We use the initial idmapping as an indicator of a mount
4231 : * that is not idmapped. It can simply be passed into helpers that
4232 : * are aware of idmapped mounts as a convenient shortcut. A user
4233 : * can just create a dedicated identity mapping to achieve the same
4234 : * result.
4235 : */
4236 0 : mnt_userns = container_of(ns, struct user_namespace, ns);
4237 0 : if (mnt_userns == &init_user_ns) {
4238 : err = -EPERM;
4239 : goto out_fput;
4240 : }
4241 :
4242 : /* We're not controlling the target namespace. */
4243 0 : if (!ns_capable(mnt_userns, CAP_SYS_ADMIN)) {
4244 : err = -EPERM;
4245 : goto out_fput;
4246 : }
4247 :
4248 0 : kattr->mnt_userns = get_user_ns(mnt_userns);
4249 :
4250 : out_fput:
4251 0 : fdput(f);
4252 : return err;
4253 : }
4254 :
4255 0 : static int build_mount_kattr(const struct mount_attr *attr, size_t usize,
4256 : struct mount_kattr *kattr, unsigned int flags)
4257 : {
4258 0 : unsigned int lookup_flags = LOOKUP_AUTOMOUNT | LOOKUP_FOLLOW;
4259 :
4260 0 : if (flags & AT_NO_AUTOMOUNT)
4261 0 : lookup_flags &= ~LOOKUP_AUTOMOUNT;
4262 0 : if (flags & AT_SYMLINK_NOFOLLOW)
4263 0 : lookup_flags &= ~LOOKUP_FOLLOW;
4264 0 : if (flags & AT_EMPTY_PATH)
4265 0 : lookup_flags |= LOOKUP_EMPTY;
4266 :
4267 0 : *kattr = (struct mount_kattr) {
4268 : .lookup_flags = lookup_flags,
4269 0 : .recurse = !!(flags & AT_RECURSIVE),
4270 : };
4271 :
4272 0 : if (attr->propagation & ~MOUNT_SETATTR_PROPAGATION_FLAGS)
4273 : return -EINVAL;
4274 0 : if (hweight32(attr->propagation & MOUNT_SETATTR_PROPAGATION_FLAGS) > 1)
4275 : return -EINVAL;
4276 0 : kattr->propagation = attr->propagation;
4277 :
4278 0 : if ((attr->attr_set | attr->attr_clr) & ~MOUNT_SETATTR_VALID_FLAGS)
4279 : return -EINVAL;
4280 :
4281 0 : kattr->attr_set = attr_flags_to_mnt_flags(attr->attr_set);
4282 0 : kattr->attr_clr = attr_flags_to_mnt_flags(attr->attr_clr);
4283 :
4284 : /*
4285 : * Since the MOUNT_ATTR_<atime> values are an enum, not a bitmap,
4286 : * users wanting to transition to a different atime setting cannot
4287 : * simply specify the atime setting in @attr_set, but must also
4288 : * specify MOUNT_ATTR__ATIME in the @attr_clr field.
4289 : * So ensure that MOUNT_ATTR__ATIME can't be partially set in
4290 : * @attr_clr and that @attr_set can't have any atime bits set if
4291 : * MOUNT_ATTR__ATIME isn't set in @attr_clr.
4292 : */
4293 0 : if (attr->attr_clr & MOUNT_ATTR__ATIME) {
4294 0 : if ((attr->attr_clr & MOUNT_ATTR__ATIME) != MOUNT_ATTR__ATIME)
4295 : return -EINVAL;
4296 :
4297 : /*
4298 : * Clear all previous time settings as they are mutually
4299 : * exclusive.
4300 : */
4301 0 : kattr->attr_clr |= MNT_RELATIME | MNT_NOATIME;
4302 0 : switch (attr->attr_set & MOUNT_ATTR__ATIME) {
4303 : case MOUNT_ATTR_RELATIME:
4304 0 : kattr->attr_set |= MNT_RELATIME;
4305 : break;
4306 : case MOUNT_ATTR_NOATIME:
4307 0 : kattr->attr_set |= MNT_NOATIME;
4308 : break;
4309 : case MOUNT_ATTR_STRICTATIME:
4310 : break;
4311 : default:
4312 : return -EINVAL;
4313 : }
4314 : } else {
4315 0 : if (attr->attr_set & MOUNT_ATTR__ATIME)
4316 : return -EINVAL;
4317 : }
4318 :
4319 0 : return build_mount_idmapped(attr, usize, kattr, flags);
4320 : }
4321 :
4322 : static void finish_mount_kattr(struct mount_kattr *kattr)
4323 : {
4324 0 : put_user_ns(kattr->mnt_userns);
4325 0 : kattr->mnt_userns = NULL;
4326 :
4327 0 : if (kattr->mnt_idmap)
4328 0 : mnt_idmap_put(kattr->mnt_idmap);
4329 : }
4330 :
4331 0 : SYSCALL_DEFINE5(mount_setattr, int, dfd, const char __user *, path,
4332 : unsigned int, flags, struct mount_attr __user *, uattr,
4333 : size_t, usize)
4334 : {
4335 : int err;
4336 : struct path target;
4337 : struct mount_attr attr;
4338 : struct mount_kattr kattr;
4339 :
4340 : BUILD_BUG_ON(sizeof(struct mount_attr) != MOUNT_ATTR_SIZE_VER0);
4341 :
4342 0 : if (flags & ~(AT_EMPTY_PATH |
4343 : AT_RECURSIVE |
4344 : AT_SYMLINK_NOFOLLOW |
4345 : AT_NO_AUTOMOUNT))
4346 : return -EINVAL;
4347 :
4348 0 : if (unlikely(usize > PAGE_SIZE))
4349 : return -E2BIG;
4350 0 : if (unlikely(usize < MOUNT_ATTR_SIZE_VER0))
4351 : return -EINVAL;
4352 :
4353 0 : if (!may_mount())
4354 : return -EPERM;
4355 :
4356 0 : err = copy_struct_from_user(&attr, sizeof(attr), uattr, usize);
4357 0 : if (err)
4358 0 : return err;
4359 :
4360 : /* Don't bother walking through the mounts if this is a nop. */
4361 0 : if (attr.attr_set == 0 &&
4362 0 : attr.attr_clr == 0 &&
4363 0 : attr.propagation == 0)
4364 : return 0;
4365 :
4366 0 : err = build_mount_kattr(&attr, usize, &kattr, flags);
4367 0 : if (err)
4368 0 : return err;
4369 :
4370 0 : err = user_path_at(dfd, path, kattr.lookup_flags, &target);
4371 0 : if (!err) {
4372 0 : err = do_mount_setattr(&target, &kattr);
4373 0 : path_put(&target);
4374 : }
4375 0 : finish_mount_kattr(&kattr);
4376 0 : return err;
4377 : }
4378 :
4379 1 : static void __init init_mount_tree(void)
4380 : {
4381 : struct vfsmount *mnt;
4382 : struct mount *m;
4383 : struct mnt_namespace *ns;
4384 : struct path root;
4385 :
4386 1 : mnt = vfs_kern_mount(&rootfs_fs_type, 0, "rootfs", NULL);
4387 1 : if (IS_ERR(mnt))
4388 0 : panic("Can't create rootfs");
4389 :
4390 1 : ns = alloc_mnt_ns(&init_user_ns, false);
4391 1 : if (IS_ERR(ns))
4392 0 : panic("Can't allocate initial namespace");
4393 1 : m = real_mount(mnt);
4394 1 : m->mnt_ns = ns;
4395 1 : ns->root = m;
4396 1 : ns->mounts = 1;
4397 2 : list_add(&m->mnt_list, &ns->list);
4398 1 : init_task.nsproxy->mnt_ns = ns;
4399 1 : get_mnt_ns(ns);
4400 :
4401 1 : root.mnt = mnt;
4402 1 : root.dentry = mnt->mnt_root;
4403 1 : mnt->mnt_flags |= MNT_LOCKED;
4404 :
4405 1 : set_fs_pwd(current->fs, &root);
4406 1 : set_fs_root(current->fs, &root);
4407 1 : }
4408 :
4409 1 : void __init mnt_init(void)
4410 : {
4411 : int err;
4412 :
4413 1 : mnt_cache = kmem_cache_create("mnt_cache", sizeof(struct mount),
4414 : 0, SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT, NULL);
4415 :
4416 1 : mount_hashtable = alloc_large_system_hash("Mount-cache",
4417 : sizeof(struct hlist_head),
4418 : mhash_entries, 19,
4419 : HASH_ZERO,
4420 : &m_hash_shift, &m_hash_mask, 0, 0);
4421 1 : mountpoint_hashtable = alloc_large_system_hash("Mountpoint-cache",
4422 : sizeof(struct hlist_head),
4423 : mphash_entries, 19,
4424 : HASH_ZERO,
4425 : &mp_hash_shift, &mp_hash_mask, 0, 0);
4426 :
4427 1 : if (!mount_hashtable || !mountpoint_hashtable)
4428 0 : panic("Failed to allocate mount hash table\n");
4429 :
4430 1 : kernfs_init();
4431 :
4432 1 : err = sysfs_init();
4433 1 : if (err)
4434 0 : printk(KERN_WARNING "%s: sysfs_init error: %d\n",
4435 : __func__, err);
4436 1 : fs_kobj = kobject_create_and_add("fs", NULL);
4437 1 : if (!fs_kobj)
4438 0 : printk(KERN_WARNING "%s: kobj create error\n", __func__);
4439 1 : shmem_init();
4440 1 : init_rootfs();
4441 1 : init_mount_tree();
4442 1 : }
4443 :
4444 0 : void put_mnt_ns(struct mnt_namespace *ns)
4445 : {
4446 0 : if (!refcount_dec_and_test(&ns->ns.count))
4447 : return;
4448 0 : drop_collected_mounts(&ns->root->mnt);
4449 0 : free_mnt_ns(ns);
4450 : }
4451 :
4452 8 : struct vfsmount *kern_mount(struct file_system_type *type)
4453 : {
4454 : struct vfsmount *mnt;
4455 8 : mnt = vfs_kern_mount(type, SB_KERNMOUNT, type->name, NULL);
4456 8 : if (!IS_ERR(mnt)) {
4457 : /*
4458 : * it is a longterm mount, don't release mnt until
4459 : * we unmount before file sys is unregistered
4460 : */
4461 8 : real_mount(mnt)->mnt_ns = MNT_NS_INTERNAL;
4462 : }
4463 8 : return mnt;
4464 : }
4465 : EXPORT_SYMBOL_GPL(kern_mount);
4466 :
4467 0 : void kern_unmount(struct vfsmount *mnt)
4468 : {
4469 : /* release long term mount so mount point can be released */
4470 0 : if (!IS_ERR(mnt)) {
4471 0 : mnt_make_shortterm(mnt);
4472 0 : synchronize_rcu(); /* yecchhh... */
4473 : mntput(mnt);
4474 : }
4475 0 : }
4476 : EXPORT_SYMBOL(kern_unmount);
4477 :
4478 0 : void kern_unmount_array(struct vfsmount *mnt[], unsigned int num)
4479 : {
4480 : unsigned int i;
4481 :
4482 0 : for (i = 0; i < num; i++)
4483 0 : mnt_make_shortterm(mnt[i]);
4484 : synchronize_rcu_expedited();
4485 0 : for (i = 0; i < num; i++)
4486 0 : mntput(mnt[i]);
4487 0 : }
4488 : EXPORT_SYMBOL(kern_unmount_array);
4489 :
4490 0 : bool our_mnt(struct vfsmount *mnt)
4491 : {
4492 0 : return check_mnt(real_mount(mnt));
4493 : }
4494 :
4495 0 : bool current_chrooted(void)
4496 : {
4497 : /* Does the current process have a non-standard root */
4498 : struct path ns_root;
4499 : struct path fs_root;
4500 : bool chrooted;
4501 :
4502 : /* Find the namespace root */
4503 0 : ns_root.mnt = ¤t->nsproxy->mnt_ns->root->mnt;
4504 0 : ns_root.dentry = ns_root.mnt->mnt_root;
4505 0 : path_get(&ns_root);
4506 0 : while (d_mountpoint(ns_root.dentry) && follow_down_one(&ns_root))
4507 : ;
4508 :
4509 0 : get_fs_root(current->fs, &fs_root);
4510 :
4511 0 : chrooted = !path_equal(&fs_root, &ns_root);
4512 :
4513 0 : path_put(&fs_root);
4514 0 : path_put(&ns_root);
4515 :
4516 0 : return chrooted;
4517 : }
4518 :
4519 0 : static bool mnt_already_visible(struct mnt_namespace *ns,
4520 : const struct super_block *sb,
4521 : int *new_mnt_flags)
4522 : {
4523 0 : int new_flags = *new_mnt_flags;
4524 : struct mount *mnt;
4525 0 : bool visible = false;
4526 :
4527 0 : down_read(&namespace_sem);
4528 0 : lock_ns_list(ns);
4529 0 : list_for_each_entry(mnt, &ns->list, mnt_list) {
4530 : struct mount *child;
4531 : int mnt_flags;
4532 :
4533 0 : if (mnt_is_cursor(mnt))
4534 0 : continue;
4535 :
4536 0 : if (mnt->mnt.mnt_sb->s_type != sb->s_type)
4537 0 : continue;
4538 :
4539 : /* This mount is not fully visible if it's root directory
4540 : * is not the root directory of the filesystem.
4541 : */
4542 0 : if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root)
4543 0 : continue;
4544 :
4545 : /* A local view of the mount flags */
4546 0 : mnt_flags = mnt->mnt.mnt_flags;
4547 :
4548 : /* Don't miss readonly hidden in the superblock flags */
4549 0 : if (sb_rdonly(mnt->mnt.mnt_sb))
4550 0 : mnt_flags |= MNT_LOCK_READONLY;
4551 :
4552 : /* Verify the mount flags are equal to or more permissive
4553 : * than the proposed new mount.
4554 : */
4555 0 : if ((mnt_flags & MNT_LOCK_READONLY) &&
4556 0 : !(new_flags & MNT_READONLY))
4557 0 : continue;
4558 0 : if ((mnt_flags & MNT_LOCK_ATIME) &&
4559 0 : ((mnt_flags & MNT_ATIME_MASK) != (new_flags & MNT_ATIME_MASK)))
4560 0 : continue;
4561 :
4562 : /* This mount is not fully visible if there are any
4563 : * locked child mounts that cover anything except for
4564 : * empty directories.
4565 : */
4566 0 : list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
4567 0 : struct inode *inode = child->mnt_mountpoint->d_inode;
4568 : /* Only worry about locked mounts */
4569 0 : if (!(child->mnt.mnt_flags & MNT_LOCKED))
4570 0 : continue;
4571 : /* Is the directory permanetly empty? */
4572 0 : if (!is_empty_dir_inode(inode))
4573 : goto next;
4574 : }
4575 : /* Preserve the locked attributes */
4576 0 : *new_mnt_flags |= mnt_flags & (MNT_LOCK_READONLY | \
4577 : MNT_LOCK_ATIME);
4578 0 : visible = true;
4579 : goto found;
4580 : next: ;
4581 : }
4582 : found:
4583 0 : unlock_ns_list(ns);
4584 0 : up_read(&namespace_sem);
4585 0 : return visible;
4586 : }
4587 :
4588 0 : static bool mount_too_revealing(const struct super_block *sb, int *new_mnt_flags)
4589 : {
4590 0 : const unsigned long required_iflags = SB_I_NOEXEC | SB_I_NODEV;
4591 0 : struct mnt_namespace *ns = current->nsproxy->mnt_ns;
4592 : unsigned long s_iflags;
4593 :
4594 0 : if (ns->user_ns == &init_user_ns)
4595 : return false;
4596 :
4597 : /* Can this filesystem be too revealing? */
4598 0 : s_iflags = sb->s_iflags;
4599 0 : if (!(s_iflags & SB_I_USERNS_VISIBLE))
4600 : return false;
4601 :
4602 0 : if ((s_iflags & required_iflags) != required_iflags) {
4603 0 : WARN_ONCE(1, "Expected s_iflags to contain 0x%lx\n",
4604 : required_iflags);
4605 : return true;
4606 : }
4607 :
4608 0 : return !mnt_already_visible(ns, sb, new_mnt_flags);
4609 : }
4610 :
4611 0 : bool mnt_may_suid(struct vfsmount *mnt)
4612 : {
4613 : /*
4614 : * Foreign mounts (accessed via fchdir or through /proc
4615 : * symlinks) are always treated as if they are nosuid. This
4616 : * prevents namespaces from trusting potentially unsafe
4617 : * suid/sgid bits, file caps, or security labels that originate
4618 : * in other namespaces.
4619 : */
4620 0 : return !(mnt->mnt_flags & MNT_NOSUID) && check_mnt(real_mount(mnt)) &&
4621 0 : current_in_userns(mnt->mnt_sb->s_user_ns);
4622 : }
4623 :
4624 0 : static struct ns_common *mntns_get(struct task_struct *task)
4625 : {
4626 0 : struct ns_common *ns = NULL;
4627 : struct nsproxy *nsproxy;
4628 :
4629 0 : task_lock(task);
4630 0 : nsproxy = task->nsproxy;
4631 0 : if (nsproxy) {
4632 0 : ns = &nsproxy->mnt_ns->ns;
4633 0 : get_mnt_ns(to_mnt_ns(ns));
4634 : }
4635 0 : task_unlock(task);
4636 :
4637 0 : return ns;
4638 : }
4639 :
4640 0 : static void mntns_put(struct ns_common *ns)
4641 : {
4642 0 : put_mnt_ns(to_mnt_ns(ns));
4643 0 : }
4644 :
4645 0 : static int mntns_install(struct nsset *nsset, struct ns_common *ns)
4646 : {
4647 0 : struct nsproxy *nsproxy = nsset->nsproxy;
4648 0 : struct fs_struct *fs = nsset->fs;
4649 0 : struct mnt_namespace *mnt_ns = to_mnt_ns(ns), *old_mnt_ns;
4650 0 : struct user_namespace *user_ns = nsset->cred->user_ns;
4651 : struct path root;
4652 : int err;
4653 :
4654 0 : if (!ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN) ||
4655 0 : !ns_capable(user_ns, CAP_SYS_CHROOT) ||
4656 0 : !ns_capable(user_ns, CAP_SYS_ADMIN))
4657 : return -EPERM;
4658 :
4659 0 : if (is_anon_ns(mnt_ns))
4660 : return -EINVAL;
4661 :
4662 0 : if (fs->users != 1)
4663 : return -EINVAL;
4664 :
4665 0 : get_mnt_ns(mnt_ns);
4666 0 : old_mnt_ns = nsproxy->mnt_ns;
4667 0 : nsproxy->mnt_ns = mnt_ns;
4668 :
4669 : /* Find the root */
4670 0 : err = vfs_path_lookup(mnt_ns->root->mnt.mnt_root, &mnt_ns->root->mnt,
4671 : "/", LOOKUP_DOWN, &root);
4672 0 : if (err) {
4673 : /* revert to old namespace */
4674 0 : nsproxy->mnt_ns = old_mnt_ns;
4675 0 : put_mnt_ns(mnt_ns);
4676 0 : return err;
4677 : }
4678 :
4679 0 : put_mnt_ns(old_mnt_ns);
4680 :
4681 : /* Update the pwd and root */
4682 0 : set_fs_pwd(fs, &root);
4683 0 : set_fs_root(fs, &root);
4684 :
4685 0 : path_put(&root);
4686 0 : return 0;
4687 : }
4688 :
4689 0 : static struct user_namespace *mntns_owner(struct ns_common *ns)
4690 : {
4691 0 : return to_mnt_ns(ns)->user_ns;
4692 : }
4693 :
4694 : const struct proc_ns_operations mntns_operations = {
4695 : .name = "mnt",
4696 : .type = CLONE_NEWNS,
4697 : .get = mntns_get,
4698 : .put = mntns_put,
4699 : .install = mntns_install,
4700 : .owner = mntns_owner,
4701 : };
4702 :
4703 : #ifdef CONFIG_SYSCTL
4704 : static struct ctl_table fs_namespace_sysctls[] = {
4705 : {
4706 : .procname = "mount-max",
4707 : .data = &sysctl_mount_max,
4708 : .maxlen = sizeof(unsigned int),
4709 : .mode = 0644,
4710 : .proc_handler = proc_dointvec_minmax,
4711 : .extra1 = SYSCTL_ONE,
4712 : },
4713 : { }
4714 : };
4715 :
4716 1 : static int __init init_fs_namespace_sysctls(void)
4717 : {
4718 1 : register_sysctl_init("fs", fs_namespace_sysctls);
4719 1 : return 0;
4720 : }
4721 : fs_initcall(init_fs_namespace_sysctls);
4722 :
4723 : #endif /* CONFIG_SYSCTL */
|
