Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/kern/vfs_lookup.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 1982, 1986, 1989, 1993 5 * The Regents of the University of California. All rights reserved. 6 * (c) UNIX System Laboratories, Inc. 7 * All or some portions of this file are derived from material licensed 8 * to the University of California by American Telephone and Telegraph 9 * Co. or Unix System Laboratories, Inc. and are reproduced herein with 10 * the permission of UNIX System Laboratories, Inc. 11 * 12 * Redistribution and use in source and binary forms, with or without 13 * modification, are permitted provided that the following conditions 14 * are met: 15 * 1. Redistributions of source code must retain the above copyright 16 * notice, this list of conditions and the following disclaimer. 17 * 2. Redistributions in binary form must reproduce the above copyright 18 * notice, this list of conditions and the following disclaimer in the 19 * documentation and/or other materials provided with the distribution. 20 * 3. Neither the name of the University nor the names of its contributors 21 * may be used to endorse or promote products derived from this software 22 * without specific prior written permission. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34 * SUCH DAMAGE. 35 * 36 * @(#)vfs_lookup.c 8.4 (Berkeley) 2/16/94 37 */ 38 39 #include <sys/cdefs.h> 40 __FBSDID("$FreeBSD$"); 41 42 #include "opt_capsicum.h" 43 #include "opt_ktrace.h" 44 45 #include <sys/param.h> 46 #include <sys/systm.h> 47 #include <sys/dirent.h> 48 #include <sys/kernel.h> 49 #include <sys/capsicum.h> 50 #include <sys/fcntl.h> 51 #include <sys/jail.h> 52 #include <sys/lock.h> 53 #include <sys/mutex.h> 54 #include <sys/namei.h> 55 #include <sys/vnode.h> 56 #include <sys/mount.h> 57 #include <sys/filedesc.h> 58 #include <sys/proc.h> 59 #include <sys/sdt.h> 60 #include <sys/syscallsubr.h> 61 #include <sys/sysctl.h> 62 #ifdef KTRACE 63 #include <sys/ktrace.h> 64 #endif 65 #ifdef INVARIANTS 66 #include <machine/_inttypes.h> 67 #endif 68 69 #include <security/audit/audit.h> 70 #include <security/mac/mac_framework.h> 71 72 #include <vm/uma.h> 73 74 #define NAMEI_DIAGNOSTIC 1 75 #undef NAMEI_DIAGNOSTIC 76 77 SDT_PROVIDER_DEFINE(vfs); 78 SDT_PROBE_DEFINE4(vfs, namei, lookup, entry, "struct vnode *", "char *", 79 "unsigned long", "bool"); 80 SDT_PROBE_DEFINE4(vfs, namei, lookup, return, "int", "struct vnode *", "bool", 81 "struct nameidata"); 82 83 /* Allocation zone for namei. */ 84 uma_zone_t namei_zone; 85 86 /* Placeholder vnode for mp traversal. */ 87 static struct vnode *vp_crossmp; 88 89 static int 90 crossmp_vop_islocked(struct vop_islocked_args *ap) 91 { 92 93 return (LK_SHARED); 94 } 95 96 static int 97 crossmp_vop_lock1(struct vop_lock1_args *ap) 98 { 99 struct vnode *vp; 100 struct lock *lk __unused; 101 const char *file __unused; 102 int flags, line __unused; 103 104 vp = ap->a_vp; 105 lk = vp->v_vnlock; 106 flags = ap->a_flags; 107 file = ap->a_file; 108 line = ap->a_line; 109 110 if ((flags & LK_SHARED) == 0) 111 panic("invalid lock request for crossmp"); 112 113 WITNESS_CHECKORDER(&lk->lock_object, LOP_NEWORDER, file, line, 114 flags & LK_INTERLOCK ? &VI_MTX(vp)->lock_object : NULL); 115 WITNESS_LOCK(&lk->lock_object, 0, file, line); 116 if ((flags & LK_INTERLOCK) != 0) 117 VI_UNLOCK(vp); 118 LOCK_LOG_LOCK("SLOCK", &lk->lock_object, 0, 0, ap->a_file, line); 119 return (0); 120 } 121 122 static int 123 crossmp_vop_unlock(struct vop_unlock_args *ap) 124 { 125 struct vnode *vp; 126 struct lock *lk __unused; 127 128 vp = ap->a_vp; 129 lk = vp->v_vnlock; 130 131 WITNESS_UNLOCK(&lk->lock_object, 0, LOCK_FILE, LOCK_LINE); 132 LOCK_LOG_LOCK("SUNLOCK", &lk->lock_object, 0, 0, LOCK_FILE, 133 LOCK_LINE); 134 return (0); 135 } 136 137 static struct vop_vector crossmp_vnodeops = { 138 .vop_default = &default_vnodeops, 139 .vop_islocked = crossmp_vop_islocked, 140 .vop_lock1 = crossmp_vop_lock1, 141 .vop_unlock = crossmp_vop_unlock, 142 }; 143 /* 144 * VFS_VOP_VECTOR_REGISTER(crossmp_vnodeops) is not used here since the vnode 145 * gets allocated early. See nameiinit for the direct call below. 146 */ 147 148 struct nameicap_tracker { 149 struct vnode *dp; 150 TAILQ_ENTRY(nameicap_tracker) nm_link; 151 }; 152 153 /* Zone for cap mode tracker elements used for dotdot capability checks. */ 154 MALLOC_DEFINE(M_NAMEITRACKER, "namei_tracker", "namei tracking for dotdot"); 155 156 static void 157 nameiinit(void *dummy __unused) 158 { 159 160 namei_zone = uma_zcreate("NAMEI", MAXPATHLEN, NULL, NULL, NULL, NULL, 161 UMA_ALIGN_PTR, 0); 162 vfs_vector_op_register(&crossmp_vnodeops); 163 getnewvnode("crossmp", NULL, &crossmp_vnodeops, &vp_crossmp); 164 } 165 SYSINIT(vfs, SI_SUB_VFS, SI_ORDER_SECOND, nameiinit, NULL); 166 167 static int lookup_cap_dotdot = 1; 168 SYSCTL_INT(_vfs, OID_AUTO, lookup_cap_dotdot, CTLFLAG_RWTUN, 169 &lookup_cap_dotdot, 0, 170 "enables \"..\" components in path lookup in capability mode"); 171 static int lookup_cap_dotdot_nonlocal = 1; 172 SYSCTL_INT(_vfs, OID_AUTO, lookup_cap_dotdot_nonlocal, CTLFLAG_RWTUN, 173 &lookup_cap_dotdot_nonlocal, 0, 174 "enables \"..\" components in path lookup in capability mode " 175 "on non-local mount"); 176 177 static void 178 nameicap_tracker_add(struct nameidata *ndp, struct vnode *dp) 179 { 180 struct nameicap_tracker *nt; 181 struct componentname *cnp; 182 183 if ((ndp->ni_lcf & NI_LCF_CAP_DOTDOT) == 0 || dp->v_type != VDIR) 184 return; 185 cnp = &ndp->ni_cnd; 186 nt = TAILQ_LAST(&ndp->ni_cap_tracker, nameicap_tracker_head); 187 if (nt != NULL && nt->dp == dp) 188 return; 189 nt = malloc(sizeof(*nt), M_NAMEITRACKER, M_WAITOK); 190 vhold(dp); 191 nt->dp = dp; 192 TAILQ_INSERT_TAIL(&ndp->ni_cap_tracker, nt, nm_link); 193 } 194 195 static void 196 nameicap_cleanup_from(struct nameidata *ndp, struct nameicap_tracker *first) 197 { 198 struct nameicap_tracker *nt, *nt1; 199 200 nt = first; 201 TAILQ_FOREACH_FROM_SAFE(nt, &ndp->ni_cap_tracker, nm_link, nt1) { 202 TAILQ_REMOVE(&ndp->ni_cap_tracker, nt, nm_link); 203 vdrop(nt->dp); 204 free(nt, M_NAMEITRACKER); 205 } 206 } 207 208 static void 209 nameicap_cleanup(struct nameidata *ndp) 210 { 211 KASSERT(TAILQ_EMPTY(&ndp->ni_cap_tracker) || 212 (ndp->ni_lcf & NI_LCF_CAP_DOTDOT) != 0, ("not strictrelative")); 213 nameicap_cleanup_from(ndp, NULL); 214 } 215 216 /* 217 * For dotdot lookups in capability mode, only allow the component 218 * lookup to succeed if the resulting directory was already traversed 219 * during the operation. This catches situations where already 220 * traversed directory is moved to different parent, and then we walk 221 * over it with dotdots. 222 * 223 * Also allow to force failure of dotdot lookups for non-local 224 * filesystems, where external agents might assist local lookups to 225 * escape the compartment. 226 */ 227 static int 228 nameicap_check_dotdot(struct nameidata *ndp, struct vnode *dp) 229 { 230 struct nameicap_tracker *nt; 231 struct mount *mp; 232 233 if (dp == NULL || dp->v_type != VDIR || (ndp->ni_lcf & 234 NI_LCF_STRICTRELATIVE) == 0) 235 return (0); 236 if ((ndp->ni_lcf & NI_LCF_CAP_DOTDOT) == 0) 237 return (ENOTCAPABLE); 238 mp = dp->v_mount; 239 if (lookup_cap_dotdot_nonlocal == 0 && mp != NULL && 240 (mp->mnt_flag & MNT_LOCAL) == 0) 241 return (ENOTCAPABLE); 242 TAILQ_FOREACH_REVERSE(nt, &ndp->ni_cap_tracker, nameicap_tracker_head, 243 nm_link) { 244 if (dp == nt->dp) { 245 nt = TAILQ_NEXT(nt, nm_link); 246 if (nt != NULL) 247 nameicap_cleanup_from(ndp, nt); 248 return (0); 249 } 250 } 251 return (ENOTCAPABLE); 252 } 253 254 static void 255 namei_cleanup_cnp(struct componentname *cnp) 256 { 257 258 uma_zfree(namei_zone, cnp->cn_pnbuf); 259 #ifdef DIAGNOSTIC 260 cnp->cn_pnbuf = NULL; 261 cnp->cn_nameptr = NULL; 262 #endif 263 } 264 265 static int 266 namei_handle_root(struct nameidata *ndp, struct vnode **dpp) 267 { 268 struct componentname *cnp; 269 270 cnp = &ndp->ni_cnd; 271 if ((ndp->ni_lcf & NI_LCF_STRICTRELATIVE) != 0) { 272 #ifdef KTRACE 273 if (KTRPOINT(curthread, KTR_CAPFAIL)) 274 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 275 #endif 276 return (ENOTCAPABLE); 277 } 278 while (*(cnp->cn_nameptr) == '/') { 279 cnp->cn_nameptr++; 280 ndp->ni_pathlen--; 281 } 282 *dpp = ndp->ni_rootdir; 283 vrefact(*dpp); 284 return (0); 285 } 286 287 static int 288 namei_setup(struct nameidata *ndp, struct vnode **dpp, struct pwd **pwdp) 289 { 290 struct componentname *cnp; 291 struct thread *td; 292 struct pwd *pwd; 293 int error; 294 bool startdir_used; 295 296 cnp = &ndp->ni_cnd; 297 td = cnp->cn_thread; 298 299 startdir_used = false; 300 *pwdp = NULL; 301 *dpp = NULL; 302 303 #ifdef CAPABILITY_MODE 304 /* 305 * In capability mode, lookups must be restricted to happen in 306 * the subtree with the root specified by the file descriptor: 307 * - The root must be real file descriptor, not the pseudo-descriptor 308 * AT_FDCWD. 309 * - The passed path must be relative and not absolute. 310 * - If lookup_cap_dotdot is disabled, path must not contain the 311 * '..' components. 312 * - If lookup_cap_dotdot is enabled, we verify that all '..' 313 * components lookups result in the directories which were 314 * previously walked by us, which prevents an escape from 315 * the relative root. 316 */ 317 if (IN_CAPABILITY_MODE(td) && (cnp->cn_flags & NOCAPCHECK) == 0) { 318 ndp->ni_lcf |= NI_LCF_STRICTRELATIVE; 319 ndp->ni_resflags |= NIRES_STRICTREL; 320 if (ndp->ni_dirfd == AT_FDCWD) { 321 #ifdef KTRACE 322 if (KTRPOINT(td, KTR_CAPFAIL)) 323 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 324 #endif 325 return (ECAPMODE); 326 } 327 } 328 #endif 329 error = 0; 330 331 /* 332 * Get starting point for the translation. 333 */ 334 pwd = pwd_hold(td); 335 /* 336 * The reference on ni_rootdir is acquired in the block below to avoid 337 * back-to-back atomics for absolute lookups. 338 */ 339 ndp->ni_rootdir = pwd->pwd_rdir; 340 ndp->ni_topdir = pwd->pwd_jdir; 341 342 if (cnp->cn_pnbuf[0] == '/') { 343 ndp->ni_resflags |= NIRES_ABS; 344 error = namei_handle_root(ndp, dpp); 345 } else { 346 if (ndp->ni_startdir != NULL) { 347 *dpp = ndp->ni_startdir; 348 startdir_used = true; 349 } else if (ndp->ni_dirfd == AT_FDCWD) { 350 *dpp = pwd->pwd_cdir; 351 vrefact(*dpp); 352 } else { 353 if (cnp->cn_flags & AUDITVNODE1) 354 AUDIT_ARG_ATFD1(ndp->ni_dirfd); 355 if (cnp->cn_flags & AUDITVNODE2) 356 AUDIT_ARG_ATFD2(ndp->ni_dirfd); 357 358 error = fgetvp_lookup(ndp->ni_dirfd, ndp, dpp); 359 } 360 if (error == 0 && (*dpp)->v_type != VDIR && 361 (cnp->cn_pnbuf[0] != '\0' || 362 (cnp->cn_flags & EMPTYPATH) == 0)) 363 error = ENOTDIR; 364 } 365 if (error == 0 && (cnp->cn_flags & RBENEATH) != 0) { 366 if (cnp->cn_pnbuf[0] == '/') { 367 error = ENOTCAPABLE; 368 } else if ((ndp->ni_lcf & NI_LCF_STRICTRELATIVE) == 0) { 369 ndp->ni_lcf |= NI_LCF_STRICTRELATIVE | 370 NI_LCF_CAP_DOTDOT; 371 } 372 } 373 374 /* 375 * If we are auditing the kernel pathname, save the user pathname. 376 */ 377 if (cnp->cn_flags & AUDITVNODE1) 378 AUDIT_ARG_UPATH1_VP(td, ndp->ni_rootdir, *dpp, cnp->cn_pnbuf); 379 if (cnp->cn_flags & AUDITVNODE2) 380 AUDIT_ARG_UPATH2_VP(td, ndp->ni_rootdir, *dpp, cnp->cn_pnbuf); 381 if (ndp->ni_startdir != NULL && !startdir_used) 382 vrele(ndp->ni_startdir); 383 if (error != 0) { 384 if (*dpp != NULL) 385 vrele(*dpp); 386 pwd_drop(pwd); 387 return (error); 388 } 389 if ((ndp->ni_lcf & NI_LCF_STRICTRELATIVE) != 0 && 390 lookup_cap_dotdot != 0) 391 ndp->ni_lcf |= NI_LCF_CAP_DOTDOT; 392 SDT_PROBE4(vfs, namei, lookup, entry, *dpp, cnp->cn_pnbuf, 393 cnp->cn_flags, false); 394 *pwdp = pwd; 395 return (0); 396 } 397 398 static int 399 namei_getpath(struct nameidata *ndp) 400 { 401 struct componentname *cnp; 402 int error; 403 404 cnp = &ndp->ni_cnd; 405 406 /* 407 * Get a buffer for the name to be translated, and copy the 408 * name into the buffer. 409 */ 410 cnp->cn_pnbuf = uma_zalloc(namei_zone, M_WAITOK); 411 if (ndp->ni_segflg == UIO_SYSSPACE) { 412 error = copystr(ndp->ni_dirp, cnp->cn_pnbuf, MAXPATHLEN, 413 &ndp->ni_pathlen); 414 } else { 415 error = copyinstr(ndp->ni_dirp, cnp->cn_pnbuf, MAXPATHLEN, 416 &ndp->ni_pathlen); 417 } 418 419 if (__predict_false(error != 0)) 420 return (error); 421 422 cnp->cn_nameptr = cnp->cn_pnbuf; 423 return (0); 424 } 425 426 static int 427 namei_emptypath(struct nameidata *ndp) 428 { 429 struct componentname *cnp; 430 struct pwd *pwd; 431 struct vnode *dp; 432 int error; 433 434 cnp = &ndp->ni_cnd; 435 MPASS(*cnp->cn_pnbuf == '\0'); 436 MPASS((cnp->cn_flags & EMPTYPATH) != 0); 437 MPASS((cnp->cn_flags & (LOCKPARENT | WANTPARENT)) == 0); 438 439 ndp->ni_resflags |= NIRES_EMPTYPATH; 440 error = namei_setup(ndp, &dp, &pwd); 441 if (error != 0) { 442 namei_cleanup_cnp(cnp); 443 goto errout; 444 } 445 446 /* 447 * Usecount on dp already provided by namei_setup. 448 */ 449 ndp->ni_vp = dp; 450 namei_cleanup_cnp(cnp); 451 pwd_drop(pwd); 452 NDVALIDATE(ndp); 453 if ((cnp->cn_flags & LOCKLEAF) != 0) { 454 VOP_LOCK(dp, (cnp->cn_flags & LOCKSHARED) != 0 ? 455 LK_SHARED : LK_EXCLUSIVE); 456 if (VN_IS_DOOMED(dp)) { 457 vput(dp); 458 error = ENOENT; 459 goto errout; 460 } 461 } 462 SDT_PROBE4(vfs, namei, lookup, return, 0, ndp->ni_vp, false, ndp); 463 return (0); 464 465 errout: 466 SDT_PROBE4(vfs, namei, lookup, return, error, NULL, false, ndp); 467 return (error); 468 } 469 470 /* 471 * Convert a pathname into a pointer to a locked vnode. 472 * 473 * The FOLLOW flag is set when symbolic links are to be followed 474 * when they occur at the end of the name translation process. 475 * Symbolic links are always followed for all other pathname 476 * components other than the last. 477 * 478 * The segflg defines whether the name is to be copied from user 479 * space or kernel space. 480 * 481 * Overall outline of namei: 482 * 483 * copy in name 484 * get starting directory 485 * while (!done && !error) { 486 * call lookup to search path. 487 * if symbolic link, massage name in buffer and continue 488 * } 489 */ 490 int 491 namei(struct nameidata *ndp) 492 { 493 char *cp; /* pointer into pathname argument */ 494 struct vnode *dp; /* the directory we are searching */ 495 struct iovec aiov; /* uio for reading symbolic links */ 496 struct componentname *cnp; 497 struct thread *td; 498 struct pwd *pwd; 499 struct uio auio; 500 int error, linklen; 501 enum cache_fpl_status status; 502 503 cnp = &ndp->ni_cnd; 504 td = cnp->cn_thread; 505 #ifdef INVARIANTS 506 KASSERT(cnp->cn_thread == curthread, 507 ("namei not using curthread")); 508 KASSERT((ndp->ni_debugflags & NAMEI_DBG_CALLED) == 0, 509 ("%s: repeated call to namei without NDREINIT", __func__)); 510 KASSERT(ndp->ni_debugflags == NAMEI_DBG_INITED, 511 ("%s: bad debugflags %d", __func__, ndp->ni_debugflags)); 512 ndp->ni_debugflags |= NAMEI_DBG_CALLED; 513 if (ndp->ni_startdir != NULL) 514 ndp->ni_debugflags |= NAMEI_DBG_HADSTARTDIR; 515 if (cnp->cn_flags & FAILIFEXISTS) { 516 KASSERT(cnp->cn_nameiop == CREATE, 517 ("%s: FAILIFEXISTS passed for op %d", __func__, cnp->cn_nameiop)); 518 /* 519 * The limitation below is to restrict hairy corner cases. 520 */ 521 KASSERT((cnp->cn_flags & (LOCKPARENT | LOCKLEAF)) == LOCKPARENT, 522 ("%s: FAILIFEXISTS must be passed with LOCKPARENT and without LOCKLEAF", 523 __func__)); 524 } 525 /* 526 * For NDVALIDATE. 527 * 528 * While NDINIT may seem like a more natural place to do it, there are 529 * callers which directly modify flags past invoking init. 530 */ 531 cnp->cn_origflags = cnp->cn_flags; 532 #endif 533 ndp->ni_cnd.cn_cred = ndp->ni_cnd.cn_thread->td_ucred; 534 KASSERT(ndp->ni_resflags == 0, ("%s: garbage in ni_resflags: %x\n", 535 __func__, ndp->ni_resflags)); 536 KASSERT(cnp->cn_cred && td->td_proc, ("namei: bad cred/proc")); 537 KASSERT((cnp->cn_flags & NAMEI_INTERNAL_FLAGS) == 0, 538 ("namei: unexpected flags: %" PRIx64 "\n", 539 cnp->cn_flags & NAMEI_INTERNAL_FLAGS)); 540 if (cnp->cn_flags & NOCACHE) 541 KASSERT(cnp->cn_nameiop != LOOKUP, 542 ("%s: NOCACHE passed with LOOKUP", __func__)); 543 MPASS(ndp->ni_startdir == NULL || ndp->ni_startdir->v_type == VDIR || 544 ndp->ni_startdir->v_type == VBAD); 545 546 ndp->ni_lcf = 0; 547 ndp->ni_loopcnt = 0; 548 ndp->ni_vp = NULL; 549 550 error = namei_getpath(ndp); 551 if (__predict_false(error != 0)) { 552 namei_cleanup_cnp(cnp); 553 SDT_PROBE4(vfs, namei, lookup, return, error, NULL, 554 false, ndp); 555 return (error); 556 } 557 558 #ifdef KTRACE 559 if (KTRPOINT(td, KTR_NAMEI)) { 560 ktrnamei(cnp->cn_pnbuf); 561 } 562 #endif 563 TSNAMEI(curthread->td_proc->p_pid, cnp->cn_pnbuf); 564 565 /* 566 * First try looking up the target without locking any vnodes. 567 * 568 * We may need to start from scratch or pick up where it left off. 569 */ 570 error = cache_fplookup(ndp, &status, &pwd); 571 switch (status) { 572 case CACHE_FPL_STATUS_UNSET: 573 __assert_unreachable(); 574 break; 575 case CACHE_FPL_STATUS_HANDLED: 576 if (error == 0) 577 NDVALIDATE(ndp); 578 return (error); 579 case CACHE_FPL_STATUS_PARTIAL: 580 TAILQ_INIT(&ndp->ni_cap_tracker); 581 dp = ndp->ni_startdir; 582 break; 583 case CACHE_FPL_STATUS_DESTROYED: 584 ndp->ni_loopcnt = 0; 585 error = namei_getpath(ndp); 586 if (__predict_false(error != 0)) { 587 namei_cleanup_cnp(cnp); 588 return (error); 589 } 590 /* FALLTHROUGH */ 591 case CACHE_FPL_STATUS_ABORTED: 592 TAILQ_INIT(&ndp->ni_cap_tracker); 593 MPASS(ndp->ni_lcf == 0); 594 if (*cnp->cn_pnbuf == '\0') { 595 if ((cnp->cn_flags & EMPTYPATH) != 0) { 596 return (namei_emptypath(ndp)); 597 } 598 namei_cleanup_cnp(cnp); 599 SDT_PROBE4(vfs, namei, lookup, return, ENOENT, NULL, 600 false, ndp); 601 return (ENOENT); 602 } 603 error = namei_setup(ndp, &dp, &pwd); 604 if (error != 0) { 605 namei_cleanup_cnp(cnp); 606 return (error); 607 } 608 break; 609 } 610 611 /* 612 * Locked lookup. 613 */ 614 for (;;) { 615 ndp->ni_startdir = dp; 616 error = lookup(ndp); 617 if (error != 0) 618 goto out; 619 620 /* 621 * If not a symbolic link, we're done. 622 */ 623 if ((cnp->cn_flags & ISSYMLINK) == 0) { 624 SDT_PROBE4(vfs, namei, lookup, return, error, 625 (error == 0 ? ndp->ni_vp : NULL), false, ndp); 626 if ((cnp->cn_flags & (SAVENAME | SAVESTART)) == 0) { 627 namei_cleanup_cnp(cnp); 628 } else 629 cnp->cn_flags |= HASBUF; 630 nameicap_cleanup(ndp); 631 pwd_drop(pwd); 632 if (error == 0) 633 NDVALIDATE(ndp); 634 return (error); 635 } 636 if (ndp->ni_loopcnt++ >= MAXSYMLINKS) { 637 error = ELOOP; 638 break; 639 } 640 #ifdef MAC 641 if ((cnp->cn_flags & NOMACCHECK) == 0) { 642 error = mac_vnode_check_readlink(td->td_ucred, 643 ndp->ni_vp); 644 if (error != 0) 645 break; 646 } 647 #endif 648 if (ndp->ni_pathlen > 1) 649 cp = uma_zalloc(namei_zone, M_WAITOK); 650 else 651 cp = cnp->cn_pnbuf; 652 aiov.iov_base = cp; 653 aiov.iov_len = MAXPATHLEN; 654 auio.uio_iov = &aiov; 655 auio.uio_iovcnt = 1; 656 auio.uio_offset = 0; 657 auio.uio_rw = UIO_READ; 658 auio.uio_segflg = UIO_SYSSPACE; 659 auio.uio_td = td; 660 auio.uio_resid = MAXPATHLEN; 661 error = VOP_READLINK(ndp->ni_vp, &auio, cnp->cn_cred); 662 if (error != 0) { 663 if (ndp->ni_pathlen > 1) 664 uma_zfree(namei_zone, cp); 665 break; 666 } 667 linklen = MAXPATHLEN - auio.uio_resid; 668 if (linklen == 0) { 669 if (ndp->ni_pathlen > 1) 670 uma_zfree(namei_zone, cp); 671 error = ENOENT; 672 break; 673 } 674 if (linklen + ndp->ni_pathlen > MAXPATHLEN) { 675 if (ndp->ni_pathlen > 1) 676 uma_zfree(namei_zone, cp); 677 error = ENAMETOOLONG; 678 break; 679 } 680 if (ndp->ni_pathlen > 1) { 681 bcopy(ndp->ni_next, cp + linklen, ndp->ni_pathlen); 682 uma_zfree(namei_zone, cnp->cn_pnbuf); 683 cnp->cn_pnbuf = cp; 684 } else 685 cnp->cn_pnbuf[linklen] = '\0'; 686 ndp->ni_pathlen += linklen; 687 vput(ndp->ni_vp); 688 dp = ndp->ni_dvp; 689 /* 690 * Check if root directory should replace current directory. 691 */ 692 cnp->cn_nameptr = cnp->cn_pnbuf; 693 if (*(cnp->cn_nameptr) == '/') { 694 vrele(dp); 695 error = namei_handle_root(ndp, &dp); 696 if (error != 0) 697 goto out; 698 } 699 } 700 vput(ndp->ni_vp); 701 ndp->ni_vp = NULL; 702 vrele(ndp->ni_dvp); 703 out: 704 MPASS(error != 0); 705 SDT_PROBE4(vfs, namei, lookup, return, error, NULL, false, ndp); 706 namei_cleanup_cnp(cnp); 707 nameicap_cleanup(ndp); 708 pwd_drop(pwd); 709 return (error); 710 } 711 712 static int 713 compute_cn_lkflags(struct mount *mp, int lkflags, int cnflags) 714 { 715 716 if (mp == NULL || ((lkflags & LK_SHARED) && 717 (!(mp->mnt_kern_flag & MNTK_LOOKUP_SHARED) || 718 ((cnflags & ISDOTDOT) && 719 (mp->mnt_kern_flag & MNTK_LOOKUP_EXCL_DOTDOT))))) { 720 lkflags &= ~LK_SHARED; 721 lkflags |= LK_EXCLUSIVE; 722 } 723 lkflags |= LK_NODDLKTREAT; 724 return (lkflags); 725 } 726 727 static __inline int 728 needs_exclusive_leaf(struct mount *mp, int flags) 729 { 730 731 /* 732 * Intermediate nodes can use shared locks, we only need to 733 * force an exclusive lock for leaf nodes. 734 */ 735 if ((flags & (ISLASTCN | LOCKLEAF)) != (ISLASTCN | LOCKLEAF)) 736 return (0); 737 738 /* Always use exclusive locks if LOCKSHARED isn't set. */ 739 if (!(flags & LOCKSHARED)) 740 return (1); 741 742 /* 743 * For lookups during open(), if the mount point supports 744 * extended shared operations, then use a shared lock for the 745 * leaf node, otherwise use an exclusive lock. 746 */ 747 if ((flags & ISOPEN) != 0) 748 return (!MNT_EXTENDED_SHARED(mp)); 749 750 /* 751 * Lookup requests outside of open() that specify LOCKSHARED 752 * only need a shared lock on the leaf vnode. 753 */ 754 return (0); 755 } 756 757 /* 758 * Various filesystems expect to be able to copy a name component with length 759 * bounded by NAME_MAX into a directory entry buffer of size MAXNAMLEN. Make 760 * sure that these are the same size. 761 */ 762 _Static_assert(MAXNAMLEN == NAME_MAX, 763 "MAXNAMLEN and NAME_MAX have different values"); 764 765 /* 766 * Search a pathname. 767 * This is a very central and rather complicated routine. 768 * 769 * The pathname is pointed to by ni_ptr and is of length ni_pathlen. 770 * The starting directory is taken from ni_startdir. The pathname is 771 * descended until done, or a symbolic link is encountered. The variable 772 * ni_more is clear if the path is completed; it is set to one if a 773 * symbolic link needing interpretation is encountered. 774 * 775 * The flag argument is LOOKUP, CREATE, RENAME, or DELETE depending on 776 * whether the name is to be looked up, created, renamed, or deleted. 777 * When CREATE, RENAME, or DELETE is specified, information usable in 778 * creating, renaming, or deleting a directory entry may be calculated. 779 * If flag has LOCKPARENT or'ed into it, the parent directory is returned 780 * locked. If flag has WANTPARENT or'ed into it, the parent directory is 781 * returned unlocked. Otherwise the parent directory is not returned. If 782 * the target of the pathname exists and LOCKLEAF is or'ed into the flag 783 * the target is returned locked, otherwise it is returned unlocked. 784 * When creating or renaming and LOCKPARENT is specified, the target may not 785 * be ".". When deleting and LOCKPARENT is specified, the target may be ".". 786 * 787 * Overall outline of lookup: 788 * 789 * dirloop: 790 * identify next component of name at ndp->ni_ptr 791 * handle degenerate case where name is null string 792 * if .. and crossing mount points and on mounted filesys, find parent 793 * call VOP_LOOKUP routine for next component name 794 * directory vnode returned in ni_dvp, unlocked unless LOCKPARENT set 795 * component vnode returned in ni_vp (if it exists), locked. 796 * if result vnode is mounted on and crossing mount points, 797 * find mounted on vnode 798 * if more components of name, do next level at dirloop 799 * return the answer in ni_vp, locked if LOCKLEAF set 800 * if LOCKPARENT set, return locked parent in ni_dvp 801 * if WANTPARENT set, return unlocked parent in ni_dvp 802 */ 803 int 804 lookup(struct nameidata *ndp) 805 { 806 char *cp; /* pointer into pathname argument */ 807 char *prev_ni_next; /* saved ndp->ni_next */ 808 char *nulchar; /* location of '\0' in cn_pnbuf */ 809 struct vnode *dp = NULL; /* the directory we are searching */ 810 struct vnode *tdp; /* saved dp */ 811 struct mount *mp; /* mount table entry */ 812 struct prison *pr; 813 size_t prev_ni_pathlen; /* saved ndp->ni_pathlen */ 814 int docache; /* == 0 do not cache last component */ 815 int wantparent; /* 1 => wantparent or lockparent flag */ 816 int rdonly; /* lookup read-only flag bit */ 817 int error = 0; 818 int dpunlocked = 0; /* dp has already been unlocked */ 819 int relookup = 0; /* do not consume the path component */ 820 struct componentname *cnp = &ndp->ni_cnd; 821 int lkflags_save; 822 int ni_dvp_unlocked; 823 824 /* 825 * Setup: break out flag bits into variables. 826 */ 827 ni_dvp_unlocked = 0; 828 wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT); 829 KASSERT(cnp->cn_nameiop == LOOKUP || wantparent, 830 ("CREATE, DELETE, RENAME require LOCKPARENT or WANTPARENT.")); 831 /* 832 * When set to zero, docache causes the last component of the 833 * pathname to be deleted from the cache and the full lookup 834 * of the name to be done (via VOP_CACHEDLOOKUP()). Often 835 * filesystems need some pre-computed values that are made 836 * during the full lookup, for instance UFS sets dp->i_offset. 837 * 838 * The docache variable is set to zero when requested by the 839 * NOCACHE flag and for all modifying operations except CREATE. 840 */ 841 docache = (cnp->cn_flags & NOCACHE) ^ NOCACHE; 842 if (cnp->cn_nameiop == DELETE || 843 (wantparent && cnp->cn_nameiop != CREATE && 844 cnp->cn_nameiop != LOOKUP)) 845 docache = 0; 846 rdonly = cnp->cn_flags & RDONLY; 847 cnp->cn_flags &= ~ISSYMLINK; 848 ndp->ni_dvp = NULL; 849 /* 850 * We use shared locks until we hit the parent of the last cn then 851 * we adjust based on the requesting flags. 852 */ 853 cnp->cn_lkflags = LK_SHARED; 854 dp = ndp->ni_startdir; 855 ndp->ni_startdir = NULLVP; 856 vn_lock(dp, 857 compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | LK_RETRY, 858 cnp->cn_flags)); 859 860 dirloop: 861 /* 862 * Search a new directory. 863 * 864 * The last component of the filename is left accessible via 865 * cnp->cn_nameptr for callers that need the name. Callers needing 866 * the name set the SAVENAME flag. When done, they assume 867 * responsibility for freeing the pathname buffer. 868 * 869 * Store / as a temporary sentinel so that we only have one character 870 * to test for. Pathnames tend to be short so this should not be 871 * resulting in cache misses. 872 */ 873 nulchar = &cnp->cn_nameptr[ndp->ni_pathlen - 1]; 874 KASSERT(*nulchar == '\0', 875 ("%s: expected nul at %p; string [%s]\n", __func__, nulchar, 876 cnp->cn_pnbuf)); 877 *nulchar = '/'; 878 for (cp = cnp->cn_nameptr; *cp != '/'; cp++) { 879 KASSERT(*cp != '\0', 880 ("%s: encountered unexpected nul; string [%s]\n", __func__, 881 cnp->cn_nameptr)); 882 continue; 883 } 884 *nulchar = '\0'; 885 cnp->cn_namelen = cp - cnp->cn_nameptr; 886 if (cnp->cn_namelen > NAME_MAX) { 887 error = ENAMETOOLONG; 888 goto bad; 889 } 890 #ifdef NAMEI_DIAGNOSTIC 891 { char c = *cp; 892 *cp = '\0'; 893 printf("{%s}: ", cnp->cn_nameptr); 894 *cp = c; } 895 #endif 896 prev_ni_pathlen = ndp->ni_pathlen; 897 ndp->ni_pathlen -= cnp->cn_namelen; 898 KASSERT(ndp->ni_pathlen <= PATH_MAX, 899 ("%s: ni_pathlen underflow to %zd\n", __func__, ndp->ni_pathlen)); 900 prev_ni_next = ndp->ni_next; 901 ndp->ni_next = cp; 902 903 /* 904 * Replace multiple slashes by a single slash and trailing slashes 905 * by a null. This must be done before VOP_LOOKUP() because some 906 * fs's don't know about trailing slashes. Remember if there were 907 * trailing slashes to handle symlinks, existing non-directories 908 * and non-existing files that won't be directories specially later. 909 */ 910 while (*cp == '/' && (cp[1] == '/' || cp[1] == '\0')) { 911 cp++; 912 ndp->ni_pathlen--; 913 if (*cp == '\0') { 914 *ndp->ni_next = '\0'; 915 cnp->cn_flags |= TRAILINGSLASH; 916 } 917 } 918 ndp->ni_next = cp; 919 920 cnp->cn_flags |= MAKEENTRY; 921 if (*cp == '\0' && docache == 0) 922 cnp->cn_flags &= ~MAKEENTRY; 923 if (cnp->cn_namelen == 2 && 924 cnp->cn_nameptr[1] == '.' && cnp->cn_nameptr[0] == '.') 925 cnp->cn_flags |= ISDOTDOT; 926 else 927 cnp->cn_flags &= ~ISDOTDOT; 928 if (*ndp->ni_next == 0) 929 cnp->cn_flags |= ISLASTCN; 930 else 931 cnp->cn_flags &= ~ISLASTCN; 932 933 if ((cnp->cn_flags & ISLASTCN) != 0 && 934 cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.' && 935 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 936 error = EINVAL; 937 goto bad; 938 } 939 940 nameicap_tracker_add(ndp, dp); 941 942 /* 943 * Check for degenerate name (e.g. / or "") 944 * which is a way of talking about a directory, 945 * e.g. like "/." or ".". 946 */ 947 if (cnp->cn_nameptr[0] == '\0') { 948 if (dp->v_type != VDIR) { 949 error = ENOTDIR; 950 goto bad; 951 } 952 if (cnp->cn_nameiop != LOOKUP) { 953 error = EISDIR; 954 goto bad; 955 } 956 if (wantparent) { 957 ndp->ni_dvp = dp; 958 VREF(dp); 959 } 960 ndp->ni_vp = dp; 961 962 if (cnp->cn_flags & AUDITVNODE1) 963 AUDIT_ARG_VNODE1(dp); 964 else if (cnp->cn_flags & AUDITVNODE2) 965 AUDIT_ARG_VNODE2(dp); 966 967 if (!(cnp->cn_flags & (LOCKPARENT | LOCKLEAF))) 968 VOP_UNLOCK(dp); 969 /* XXX This should probably move to the top of function. */ 970 if (cnp->cn_flags & SAVESTART) 971 panic("lookup: SAVESTART"); 972 goto success; 973 } 974 975 /* 976 * Handle "..": five special cases. 977 * 0. If doing a capability lookup and lookup_cap_dotdot is 978 * disabled, return ENOTCAPABLE. 979 * 1. Return an error if this is the last component of 980 * the name and the operation is DELETE or RENAME. 981 * 2. If at root directory (e.g. after chroot) 982 * or at absolute root directory 983 * then ignore it so can't get out. 984 * 3. If this vnode is the root of a mounted 985 * filesystem, then replace it with the 986 * vnode which was mounted on so we take the 987 * .. in the other filesystem. 988 * 4. If the vnode is the top directory of 989 * the jail or chroot, don't let them out. 990 * 5. If doing a capability lookup and lookup_cap_dotdot is 991 * enabled, return ENOTCAPABLE if the lookup would escape 992 * from the initial file descriptor directory. Checks are 993 * done by ensuring that namei() already traversed the 994 * result of dotdot lookup. 995 */ 996 if (cnp->cn_flags & ISDOTDOT) { 997 if ((ndp->ni_lcf & (NI_LCF_STRICTRELATIVE | NI_LCF_CAP_DOTDOT)) 998 == NI_LCF_STRICTRELATIVE) { 999 #ifdef KTRACE 1000 if (KTRPOINT(curthread, KTR_CAPFAIL)) 1001 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 1002 #endif 1003 error = ENOTCAPABLE; 1004 goto bad; 1005 } 1006 if ((cnp->cn_flags & ISLASTCN) != 0 && 1007 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 1008 error = EINVAL; 1009 goto bad; 1010 } 1011 for (;;) { 1012 for (pr = cnp->cn_cred->cr_prison; pr != NULL; 1013 pr = pr->pr_parent) 1014 if (dp == pr->pr_root) 1015 break; 1016 if (dp == ndp->ni_rootdir || 1017 dp == ndp->ni_topdir || 1018 dp == rootvnode || 1019 pr != NULL || 1020 ((dp->v_vflag & VV_ROOT) != 0 && 1021 (cnp->cn_flags & NOCROSSMOUNT) != 0)) { 1022 ndp->ni_dvp = dp; 1023 ndp->ni_vp = dp; 1024 VREF(dp); 1025 goto nextname; 1026 } 1027 if ((dp->v_vflag & VV_ROOT) == 0) 1028 break; 1029 if (VN_IS_DOOMED(dp)) { /* forced unmount */ 1030 error = ENOENT; 1031 goto bad; 1032 } 1033 tdp = dp; 1034 dp = dp->v_mount->mnt_vnodecovered; 1035 VREF(dp); 1036 vput(tdp); 1037 vn_lock(dp, 1038 compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | 1039 LK_RETRY, ISDOTDOT)); 1040 error = nameicap_check_dotdot(ndp, dp); 1041 if (error != 0) { 1042 #ifdef KTRACE 1043 if (KTRPOINT(curthread, KTR_CAPFAIL)) 1044 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 1045 #endif 1046 goto bad; 1047 } 1048 } 1049 } 1050 1051 /* 1052 * We now have a segment name to search for, and a directory to search. 1053 */ 1054 unionlookup: 1055 #ifdef MAC 1056 error = mac_vnode_check_lookup(cnp->cn_thread->td_ucred, dp, cnp); 1057 if (error) 1058 goto bad; 1059 #endif 1060 ndp->ni_dvp = dp; 1061 ndp->ni_vp = NULL; 1062 ASSERT_VOP_LOCKED(dp, "lookup"); 1063 /* 1064 * If we have a shared lock we may need to upgrade the lock for the 1065 * last operation. 1066 */ 1067 if ((cnp->cn_flags & LOCKPARENT) && (cnp->cn_flags & ISLASTCN) && 1068 dp != vp_crossmp && VOP_ISLOCKED(dp) == LK_SHARED) 1069 vn_lock(dp, LK_UPGRADE|LK_RETRY); 1070 if (VN_IS_DOOMED(dp)) { 1071 error = ENOENT; 1072 goto bad; 1073 } 1074 /* 1075 * If we're looking up the last component and we need an exclusive 1076 * lock, adjust our lkflags. 1077 */ 1078 if (needs_exclusive_leaf(dp->v_mount, cnp->cn_flags)) 1079 cnp->cn_lkflags = LK_EXCLUSIVE; 1080 #ifdef NAMEI_DIAGNOSTIC 1081 vn_printf(dp, "lookup in "); 1082 #endif 1083 lkflags_save = cnp->cn_lkflags; 1084 cnp->cn_lkflags = compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags, 1085 cnp->cn_flags); 1086 error = VOP_LOOKUP(dp, &ndp->ni_vp, cnp); 1087 cnp->cn_lkflags = lkflags_save; 1088 if (error != 0) { 1089 KASSERT(ndp->ni_vp == NULL, ("leaf should be empty")); 1090 #ifdef NAMEI_DIAGNOSTIC 1091 printf("not found\n"); 1092 #endif 1093 if ((error == ENOENT) && 1094 (dp->v_vflag & VV_ROOT) && (dp->v_mount != NULL) && 1095 (dp->v_mount->mnt_flag & MNT_UNION)) { 1096 tdp = dp; 1097 dp = dp->v_mount->mnt_vnodecovered; 1098 VREF(dp); 1099 vput(tdp); 1100 vn_lock(dp, 1101 compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | 1102 LK_RETRY, cnp->cn_flags)); 1103 nameicap_tracker_add(ndp, dp); 1104 goto unionlookup; 1105 } 1106 1107 if (error == ERELOOKUP) { 1108 vref(dp); 1109 ndp->ni_vp = dp; 1110 error = 0; 1111 relookup = 1; 1112 goto good; 1113 } 1114 1115 if (error != EJUSTRETURN) 1116 goto bad; 1117 /* 1118 * At this point, we know we're at the end of the 1119 * pathname. If creating / renaming, we can consider 1120 * allowing the file or directory to be created / renamed, 1121 * provided we're not on a read-only filesystem. 1122 */ 1123 if (rdonly) { 1124 error = EROFS; 1125 goto bad; 1126 } 1127 /* trailing slash only allowed for directories */ 1128 if ((cnp->cn_flags & TRAILINGSLASH) && 1129 !(cnp->cn_flags & WILLBEDIR)) { 1130 error = ENOENT; 1131 goto bad; 1132 } 1133 if ((cnp->cn_flags & LOCKPARENT) == 0) 1134 VOP_UNLOCK(dp); 1135 /* 1136 * We return with ni_vp NULL to indicate that the entry 1137 * doesn't currently exist, leaving a pointer to the 1138 * (possibly locked) directory vnode in ndp->ni_dvp. 1139 */ 1140 if (cnp->cn_flags & SAVESTART) { 1141 ndp->ni_startdir = ndp->ni_dvp; 1142 VREF(ndp->ni_startdir); 1143 } 1144 goto success; 1145 } 1146 1147 good: 1148 #ifdef NAMEI_DIAGNOSTIC 1149 printf("found\n"); 1150 #endif 1151 dp = ndp->ni_vp; 1152 1153 /* 1154 * Check to see if the vnode has been mounted on; 1155 * if so find the root of the mounted filesystem. 1156 */ 1157 while ((dp->v_type == VDIR || dp->v_type == VREG) && 1158 (mp = dp->v_mountedhere) && (cnp->cn_flags & NOCROSSMOUNT) == 0) { 1159 if (vfs_busy(mp, 0)) 1160 continue; 1161 vput(dp); 1162 if (dp != ndp->ni_dvp) 1163 vput(ndp->ni_dvp); 1164 else 1165 vrele(ndp->ni_dvp); 1166 vrefact(vp_crossmp); 1167 ndp->ni_dvp = vp_crossmp; 1168 error = VFS_ROOT(mp, compute_cn_lkflags(mp, cnp->cn_lkflags, 1169 cnp->cn_flags), &tdp); 1170 vfs_unbusy(mp); 1171 if (vn_lock(vp_crossmp, LK_SHARED | LK_NOWAIT)) 1172 panic("vp_crossmp exclusively locked or reclaimed"); 1173 if (error) { 1174 dpunlocked = 1; 1175 goto bad2; 1176 } 1177 ndp->ni_vp = dp = tdp; 1178 } 1179 1180 /* 1181 * Check for symbolic link 1182 */ 1183 if ((dp->v_type == VLNK) && 1184 ((cnp->cn_flags & FOLLOW) || (cnp->cn_flags & TRAILINGSLASH) || 1185 *ndp->ni_next == '/')) { 1186 cnp->cn_flags |= ISSYMLINK; 1187 if (VN_IS_DOOMED(dp)) { 1188 /* 1189 * We can't know whether the directory was mounted with 1190 * NOSYMFOLLOW, so we can't follow safely. 1191 */ 1192 error = ENOENT; 1193 goto bad2; 1194 } 1195 if (dp->v_mount->mnt_flag & MNT_NOSYMFOLLOW) { 1196 error = EACCES; 1197 goto bad2; 1198 } 1199 /* 1200 * Symlink code always expects an unlocked dvp. 1201 */ 1202 if (ndp->ni_dvp != ndp->ni_vp) { 1203 VOP_UNLOCK(ndp->ni_dvp); 1204 ni_dvp_unlocked = 1; 1205 } 1206 goto success; 1207 } 1208 1209 nextname: 1210 /* 1211 * Not a symbolic link that we will follow. Continue with the 1212 * next component if there is any; otherwise, we're done. 1213 */ 1214 KASSERT((cnp->cn_flags & ISLASTCN) || *ndp->ni_next == '/', 1215 ("lookup: invalid path state.")); 1216 if (relookup) { 1217 relookup = 0; 1218 ndp->ni_pathlen = prev_ni_pathlen; 1219 ndp->ni_next = prev_ni_next; 1220 if (ndp->ni_dvp != dp) 1221 vput(ndp->ni_dvp); 1222 else 1223 vrele(ndp->ni_dvp); 1224 goto dirloop; 1225 } 1226 if (cnp->cn_flags & ISDOTDOT) { 1227 error = nameicap_check_dotdot(ndp, ndp->ni_vp); 1228 if (error != 0) { 1229 #ifdef KTRACE 1230 if (KTRPOINT(curthread, KTR_CAPFAIL)) 1231 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 1232 #endif 1233 goto bad2; 1234 } 1235 } 1236 if (*ndp->ni_next == '/') { 1237 cnp->cn_nameptr = ndp->ni_next; 1238 while (*cnp->cn_nameptr == '/') { 1239 cnp->cn_nameptr++; 1240 ndp->ni_pathlen--; 1241 } 1242 if (ndp->ni_dvp != dp) 1243 vput(ndp->ni_dvp); 1244 else 1245 vrele(ndp->ni_dvp); 1246 goto dirloop; 1247 } 1248 /* 1249 * If we're processing a path with a trailing slash, 1250 * check that the end result is a directory. 1251 */ 1252 if ((cnp->cn_flags & TRAILINGSLASH) && dp->v_type != VDIR) { 1253 error = ENOTDIR; 1254 goto bad2; 1255 } 1256 /* 1257 * Disallow directory write attempts on read-only filesystems. 1258 */ 1259 if (rdonly && 1260 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 1261 error = EROFS; 1262 goto bad2; 1263 } 1264 if (cnp->cn_flags & SAVESTART) { 1265 ndp->ni_startdir = ndp->ni_dvp; 1266 VREF(ndp->ni_startdir); 1267 } 1268 if (!wantparent) { 1269 ni_dvp_unlocked = 2; 1270 if (ndp->ni_dvp != dp) 1271 vput(ndp->ni_dvp); 1272 else 1273 vrele(ndp->ni_dvp); 1274 } else if ((cnp->cn_flags & LOCKPARENT) == 0 && ndp->ni_dvp != dp) { 1275 VOP_UNLOCK(ndp->ni_dvp); 1276 ni_dvp_unlocked = 1; 1277 } 1278 1279 if (cnp->cn_flags & AUDITVNODE1) 1280 AUDIT_ARG_VNODE1(dp); 1281 else if (cnp->cn_flags & AUDITVNODE2) 1282 AUDIT_ARG_VNODE2(dp); 1283 1284 if ((cnp->cn_flags & LOCKLEAF) == 0) 1285 VOP_UNLOCK(dp); 1286 success: 1287 /* 1288 * FIXME: for lookups which only cross a mount point to fetch the 1289 * root vnode, ni_dvp will be set to vp_crossmp. This can be a problem 1290 * if either WANTPARENT or LOCKPARENT is set. 1291 */ 1292 /* 1293 * Because of shared lookup we may have the vnode shared locked, but 1294 * the caller may want it to be exclusively locked. 1295 */ 1296 if (needs_exclusive_leaf(dp->v_mount, cnp->cn_flags) && 1297 VOP_ISLOCKED(dp) != LK_EXCLUSIVE) { 1298 vn_lock(dp, LK_UPGRADE | LK_RETRY); 1299 if (VN_IS_DOOMED(dp)) { 1300 error = ENOENT; 1301 goto bad2; 1302 } 1303 } 1304 if (ndp->ni_vp != NULL) { 1305 if ((cnp->cn_flags & ISDOTDOT) == 0) 1306 nameicap_tracker_add(ndp, ndp->ni_vp); 1307 if ((cnp->cn_flags & (FAILIFEXISTS | ISSYMLINK)) == FAILIFEXISTS) 1308 goto bad_eexist; 1309 } 1310 return (0); 1311 1312 bad2: 1313 if (ni_dvp_unlocked != 2) { 1314 if (dp != ndp->ni_dvp && !ni_dvp_unlocked) 1315 vput(ndp->ni_dvp); 1316 else 1317 vrele(ndp->ni_dvp); 1318 } 1319 bad: 1320 if (!dpunlocked) 1321 vput(dp); 1322 ndp->ni_vp = NULL; 1323 return (error); 1324 bad_eexist: 1325 /* 1326 * FAILIFEXISTS handling. 1327 * 1328 * XXX namei called with LOCKPARENT but not LOCKLEAF has the strange 1329 * behaviour of leaving the vnode unlocked if the target is the same 1330 * vnode as the parent. 1331 */ 1332 MPASS((cnp->cn_flags & ISSYMLINK) == 0); 1333 if (ndp->ni_vp == ndp->ni_dvp) 1334 vrele(ndp->ni_dvp); 1335 else 1336 vput(ndp->ni_dvp); 1337 vrele(ndp->ni_vp); 1338 ndp->ni_dvp = NULL; 1339 ndp->ni_vp = NULL; 1340 NDFREE(ndp, NDF_ONLY_PNBUF); 1341 return (EEXIST); 1342 } 1343 1344 /* 1345 * relookup - lookup a path name component 1346 * Used by lookup to re-acquire things. 1347 */ 1348 int 1349 relookup(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp) 1350 { 1351 struct vnode *dp = NULL; /* the directory we are searching */ 1352 int rdonly; /* lookup read-only flag bit */ 1353 int error = 0; 1354 1355 KASSERT(cnp->cn_flags & ISLASTCN, 1356 ("relookup: Not given last component.")); 1357 /* 1358 * Setup: break out flag bits into variables. 1359 */ 1360 KASSERT((cnp->cn_flags & (LOCKPARENT | WANTPARENT)) != 0, 1361 ("relookup: parent not wanted")); 1362 rdonly = cnp->cn_flags & RDONLY; 1363 cnp->cn_flags &= ~ISSYMLINK; 1364 dp = dvp; 1365 cnp->cn_lkflags = LK_EXCLUSIVE; 1366 vn_lock(dp, LK_EXCLUSIVE | LK_RETRY); 1367 1368 /* 1369 * Search a new directory. 1370 * 1371 * The last component of the filename is left accessible via 1372 * cnp->cn_nameptr for callers that need the name. Callers needing 1373 * the name set the SAVENAME flag. When done, they assume 1374 * responsibility for freeing the pathname buffer. 1375 */ 1376 #ifdef NAMEI_DIAGNOSTIC 1377 printf("{%s}: ", cnp->cn_nameptr); 1378 #endif 1379 1380 /* 1381 * Check for "" which represents the root directory after slash 1382 * removal. 1383 */ 1384 if (cnp->cn_nameptr[0] == '\0') { 1385 /* 1386 * Support only LOOKUP for "/" because lookup() 1387 * can't succeed for CREATE, DELETE and RENAME. 1388 */ 1389 KASSERT(cnp->cn_nameiop == LOOKUP, ("nameiop must be LOOKUP")); 1390 KASSERT(dp->v_type == VDIR, ("dp is not a directory")); 1391 1392 if (!(cnp->cn_flags & LOCKLEAF)) 1393 VOP_UNLOCK(dp); 1394 *vpp = dp; 1395 /* XXX This should probably move to the top of function. */ 1396 if (cnp->cn_flags & SAVESTART) 1397 panic("lookup: SAVESTART"); 1398 return (0); 1399 } 1400 1401 if (cnp->cn_flags & ISDOTDOT) 1402 panic ("relookup: lookup on dot-dot"); 1403 1404 /* 1405 * We now have a segment name to search for, and a directory to search. 1406 */ 1407 #ifdef NAMEI_DIAGNOSTIC 1408 vn_printf(dp, "search in "); 1409 #endif 1410 if ((error = VOP_LOOKUP(dp, vpp, cnp)) != 0) { 1411 KASSERT(*vpp == NULL, ("leaf should be empty")); 1412 if (error != EJUSTRETURN) 1413 goto bad; 1414 /* 1415 * If creating and at end of pathname, then can consider 1416 * allowing file to be created. 1417 */ 1418 if (rdonly) { 1419 error = EROFS; 1420 goto bad; 1421 } 1422 /* ASSERT(dvp == ndp->ni_startdir) */ 1423 if (cnp->cn_flags & SAVESTART) 1424 VREF(dvp); 1425 if ((cnp->cn_flags & LOCKPARENT) == 0) 1426 VOP_UNLOCK(dp); 1427 /* 1428 * We return with ni_vp NULL to indicate that the entry 1429 * doesn't currently exist, leaving a pointer to the 1430 * (possibly locked) directory vnode in ndp->ni_dvp. 1431 */ 1432 return (0); 1433 } 1434 1435 dp = *vpp; 1436 1437 /* 1438 * Disallow directory write attempts on read-only filesystems. 1439 */ 1440 if (rdonly && 1441 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 1442 if (dvp == dp) 1443 vrele(dvp); 1444 else 1445 vput(dvp); 1446 error = EROFS; 1447 goto bad; 1448 } 1449 /* 1450 * Set the parent lock/ref state to the requested state. 1451 */ 1452 if ((cnp->cn_flags & LOCKPARENT) == 0 && dvp != dp) 1453 VOP_UNLOCK(dvp); 1454 /* 1455 * Check for symbolic link 1456 */ 1457 KASSERT(dp->v_type != VLNK || !(cnp->cn_flags & FOLLOW), 1458 ("relookup: symlink found.\n")); 1459 1460 /* ASSERT(dvp == ndp->ni_startdir) */ 1461 if (cnp->cn_flags & SAVESTART) 1462 VREF(dvp); 1463 1464 if ((cnp->cn_flags & LOCKLEAF) == 0) 1465 VOP_UNLOCK(dp); 1466 return (0); 1467 bad: 1468 vput(dp); 1469 *vpp = NULL; 1470 return (error); 1471 } 1472 1473 /* 1474 * Free data allocated by namei(); see namei(9) for details. 1475 */ 1476 void 1477 NDFREE_PNBUF(struct nameidata *ndp) 1478 { 1479 1480 if ((ndp->ni_cnd.cn_flags & HASBUF) != 0) { 1481 MPASS((ndp->ni_cnd.cn_flags & (SAVENAME | SAVESTART)) != 0); 1482 uma_zfree(namei_zone, ndp->ni_cnd.cn_pnbuf); 1483 ndp->ni_cnd.cn_flags &= ~HASBUF; 1484 } 1485 } 1486 1487 /* 1488 * NDFREE_PNBUF replacement for callers that know there is no buffer. 1489 * 1490 * This is a hack. Preferably the VFS layer would not produce anything more 1491 * than it was asked to do. Unfortunately several non-LOOKUP cases can add the 1492 * HASBUF flag to the result. Even then an interface could be implemented where 1493 * the caller specifies what they expected to see in the result and what they 1494 * are going to take care of. 1495 * 1496 * In the meantime provide this kludge as a trivial replacement for NDFREE_PNBUF 1497 * calls scattered throughout the kernel where we know for a fact the flag must not 1498 * be seen. 1499 */ 1500 #ifdef INVARIANTS 1501 void 1502 NDFREE_NOTHING(struct nameidata *ndp) 1503 { 1504 struct componentname *cnp; 1505 1506 cnp = &ndp->ni_cnd; 1507 KASSERT(cnp->cn_nameiop == LOOKUP, ("%s: got non-LOOKUP op %d\n", 1508 __func__, cnp->cn_nameiop)); 1509 KASSERT((cnp->cn_flags & (SAVENAME | HASBUF)) == 0, 1510 ("%s: bad flags \%" PRIx64 "\n", __func__, cnp->cn_flags)); 1511 } 1512 #endif 1513 1514 void 1515 (NDFREE)(struct nameidata *ndp, const u_int flags) 1516 { 1517 int unlock_dvp; 1518 int unlock_vp; 1519 1520 unlock_dvp = 0; 1521 unlock_vp = 0; 1522 1523 if (!(flags & NDF_NO_FREE_PNBUF)) { 1524 NDFREE_PNBUF(ndp); 1525 } 1526 if (!(flags & NDF_NO_VP_UNLOCK) && 1527 (ndp->ni_cnd.cn_flags & LOCKLEAF) && ndp->ni_vp) 1528 unlock_vp = 1; 1529 if (!(flags & NDF_NO_DVP_UNLOCK) && 1530 (ndp->ni_cnd.cn_flags & LOCKPARENT) && 1531 ndp->ni_dvp != ndp->ni_vp) 1532 unlock_dvp = 1; 1533 if (!(flags & NDF_NO_VP_RELE) && ndp->ni_vp) { 1534 if (unlock_vp) { 1535 vput(ndp->ni_vp); 1536 unlock_vp = 0; 1537 } else 1538 vrele(ndp->ni_vp); 1539 ndp->ni_vp = NULL; 1540 } 1541 if (unlock_vp) 1542 VOP_UNLOCK(ndp->ni_vp); 1543 if (!(flags & NDF_NO_DVP_RELE) && 1544 (ndp->ni_cnd.cn_flags & (LOCKPARENT|WANTPARENT))) { 1545 if (unlock_dvp) { 1546 vput(ndp->ni_dvp); 1547 unlock_dvp = 0; 1548 } else 1549 vrele(ndp->ni_dvp); 1550 ndp->ni_dvp = NULL; 1551 } 1552 if (unlock_dvp) 1553 VOP_UNLOCK(ndp->ni_dvp); 1554 if (!(flags & NDF_NO_STARTDIR_RELE) && 1555 (ndp->ni_cnd.cn_flags & SAVESTART)) { 1556 vrele(ndp->ni_startdir); 1557 ndp->ni_startdir = NULL; 1558 } 1559 } 1560 1561 #ifdef INVARIANTS 1562 /* 1563 * Validate the final state of ndp after the lookup. 1564 * 1565 * Historically filesystems were allowed to modify cn_flags. Most notably they 1566 * can add SAVENAME to the request, resulting in HASBUF and pushing subsequent 1567 * clean up to the consumer. In practice this seems to only concern != LOOKUP 1568 * operations. 1569 * 1570 * As a step towards stricter API contract this routine validates the state to 1571 * clean up. Note validation is a work in progress with the intent of becoming 1572 * stricter over time. 1573 */ 1574 #define NDMODIFYINGFLAGS (LOCKLEAF | LOCKPARENT | WANTPARENT | SAVENAME | SAVESTART | HASBUF) 1575 void 1576 NDVALIDATE(struct nameidata *ndp) 1577 { 1578 struct componentname *cnp; 1579 u_int64_t used, orig; 1580 1581 cnp = &ndp->ni_cnd; 1582 orig = cnp->cn_origflags; 1583 used = cnp->cn_flags; 1584 switch (cnp->cn_nameiop) { 1585 case LOOKUP: 1586 /* 1587 * For plain lookup we require strict conformance -- nothing 1588 * to clean up if it was not requested by the caller. 1589 */ 1590 orig &= NDMODIFYINGFLAGS; 1591 used &= NDMODIFYINGFLAGS; 1592 if ((orig & (SAVENAME | SAVESTART)) != 0) 1593 orig |= HASBUF; 1594 if (orig != used) { 1595 goto out_mismatch; 1596 } 1597 break; 1598 case CREATE: 1599 case DELETE: 1600 case RENAME: 1601 /* 1602 * Some filesystems set SAVENAME to provoke HASBUF, accommodate 1603 * for it until it gets fixed. 1604 */ 1605 orig &= NDMODIFYINGFLAGS; 1606 orig |= (SAVENAME | HASBUF); 1607 used &= NDMODIFYINGFLAGS; 1608 used |= (SAVENAME | HASBUF); 1609 if (orig != used) { 1610 goto out_mismatch; 1611 } 1612 break; 1613 } 1614 return; 1615 out_mismatch: 1616 panic("%s: mismatched flags for op %d: added %" PRIx64 ", " 1617 "removed %" PRIx64" (%" PRIx64" != %" PRIx64"; stored %" PRIx64" != %" PRIx64")", 1618 __func__, cnp->cn_nameiop, used & ~orig, orig &~ used, 1619 orig, used, cnp->cn_origflags, cnp->cn_flags); 1620 } 1621 #endif 1622 1623 /* 1624 * Determine if there is a suitable alternate filename under the specified 1625 * prefix for the specified path. If the create flag is set, then the 1626 * alternate prefix will be used so long as the parent directory exists. 1627 * This is used by the various compatibility ABIs so that Linux binaries prefer 1628 * files under /compat/linux for example. The chosen path (whether under 1629 * the prefix or under /) is returned in a kernel malloc'd buffer pointed 1630 * to by pathbuf. The caller is responsible for free'ing the buffer from 1631 * the M_TEMP bucket if one is returned. 1632 */ 1633 int 1634 kern_alternate_path(struct thread *td, const char *prefix, const char *path, 1635 enum uio_seg pathseg, char **pathbuf, int create, int dirfd) 1636 { 1637 struct nameidata nd, ndroot; 1638 char *ptr, *buf, *cp; 1639 size_t len, sz; 1640 int error; 1641 1642 buf = (char *) malloc(MAXPATHLEN, M_TEMP, M_WAITOK); 1643 *pathbuf = buf; 1644 1645 /* Copy the prefix into the new pathname as a starting point. */ 1646 len = strlcpy(buf, prefix, MAXPATHLEN); 1647 if (len >= MAXPATHLEN) { 1648 *pathbuf = NULL; 1649 free(buf, M_TEMP); 1650 return (EINVAL); 1651 } 1652 sz = MAXPATHLEN - len; 1653 ptr = buf + len; 1654 1655 /* Append the filename to the prefix. */ 1656 if (pathseg == UIO_SYSSPACE) 1657 error = copystr(path, ptr, sz, &len); 1658 else 1659 error = copyinstr(path, ptr, sz, &len); 1660 1661 if (error) { 1662 *pathbuf = NULL; 1663 free(buf, M_TEMP); 1664 return (error); 1665 } 1666 1667 /* Only use a prefix with absolute pathnames. */ 1668 if (*ptr != '/') { 1669 error = EINVAL; 1670 goto keeporig; 1671 } 1672 1673 if (dirfd != AT_FDCWD) { 1674 /* 1675 * We want the original because the "prefix" is 1676 * included in the already opened dirfd. 1677 */ 1678 bcopy(ptr, buf, len); 1679 return (0); 1680 } 1681 1682 /* 1683 * We know that there is a / somewhere in this pathname. 1684 * Search backwards for it, to find the file's parent dir 1685 * to see if it exists in the alternate tree. If it does, 1686 * and we want to create a file (cflag is set). We don't 1687 * need to worry about the root comparison in this case. 1688 */ 1689 1690 if (create) { 1691 for (cp = &ptr[len] - 1; *cp != '/'; cp--); 1692 *cp = '\0'; 1693 1694 NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_SYSSPACE, buf, td); 1695 error = namei(&nd); 1696 *cp = '/'; 1697 if (error != 0) 1698 goto keeporig; 1699 } else { 1700 NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_SYSSPACE, buf, td); 1701 1702 error = namei(&nd); 1703 if (error != 0) 1704 goto keeporig; 1705 1706 /* 1707 * We now compare the vnode of the prefix to the one 1708 * vnode asked. If they resolve to be the same, then we 1709 * ignore the match so that the real root gets used. 1710 * This avoids the problem of traversing "../.." to find the 1711 * root directory and never finding it, because "/" resolves 1712 * to the emulation root directory. This is expensive :-( 1713 */ 1714 NDINIT(&ndroot, LOOKUP, FOLLOW, UIO_SYSSPACE, prefix, 1715 td); 1716 1717 /* We shouldn't ever get an error from this namei(). */ 1718 error = namei(&ndroot); 1719 if (error == 0) { 1720 if (nd.ni_vp == ndroot.ni_vp) 1721 error = ENOENT; 1722 1723 NDFREE(&ndroot, NDF_ONLY_PNBUF); 1724 vrele(ndroot.ni_vp); 1725 } 1726 } 1727 1728 NDFREE(&nd, NDF_ONLY_PNBUF); 1729 vrele(nd.ni_vp); 1730 1731 keeporig: 1732 /* If there was an error, use the original path name. */ 1733 if (error) 1734 bcopy(ptr, buf, len); 1735 return (error); 1736 }
Cache object: 25067d2023bd58f514fef68763601411
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]