/*

* linux/fs/namei.c

*

* Copyright (C) 1991, 1992 Linus Torvalds

*/

/*

* Some corrections by tytso.

*/

/* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname

* lookup logic.

*/

/* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture.

*/

#include <linux/init.h>

#include <linux/export.h>

#include <linux/kernel.h>

#include <linux/slab.h>

#include <linux/fs.h>

#include <linux/namei.h>

#include <linux/pagemap.h>

#include <linux/fsnotify.h>

#include <linux/personality.h>

#include <linux/security.h>

#include <linux/ima.h>

#include <linux/syscalls.h>

#include <linux/mount.h>

#include <linux/audit.h>

#include <linux/capability.h>

#include <linux/file.h>

#include <linux/fcntl.h>

#include <linux/device_cgroup.h>

#include <linux/fs_struct.h>

#include <linux/posix_acl.h>

#include <linux/hash.h>

#include <asm/uaccess.h>

#include "internal.h"

#include "mount.h"

/* [Feb-1997 T. Schoebel-Theuer]

* Fundamental changes in the pathname lookup mechanisms (namei)

* were necessary because of omirr. The reason is that omirr needs

* to know the _real_ pathname, not the user-supplied one, in case

* of symlinks (and also when transname replacements occur).

*

* The new code replaces the old recursive symlink resolution with

* an iterative one (in case of non-nested symlink chains). It does

* this with calls to <fs>_follow_link().

* As a side effect, dir_namei(), _namei() and follow_link() are now

* replaced with a single function lookup_dentry() that can handle all

* the special cases of the former code.

*

* With the new dcache, the pathname is stored at each inode, at least as

* long as the refcount of the inode is positive. As a side effect, the

* size of the dcache depends on the inode cache and thus is dynamic.

*

* [29-Apr-1998 C. Scott Ananian] Updated above description of symlink

* resolution to correspond with current state of the code.

*

* Note that the symlink resolution is not *completely* iterative.

* There is still a significant amount of tail- and mid- recursion in

* the algorithm. Also, note that <fs>_readlink() is not used in

* lookup_dentry(): lookup_dentry() on the result of <fs>_readlink()

* may return different results than <fs>_follow_link(). Many virtual

* filesystems (including /proc) exhibit this behavior.

*/

/* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation:

* New symlink semantics: when open() is called with flags O_CREAT | O_EXCL

* and the name already exists in form of a symlink, try to create the new

* name indicated by the symlink. The old code always complained that the

* name already exists, due to not following the symlink even if its target

* is nonexistent. The new semantics affects also mknod() and link() when

* the name is a symlink pointing to a non-existent name.

*

* I don't know which semantics is the right one, since I have no access

* to standards. But I found by trial that HP-UX 9.0 has the full "new"

* semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the

* "old" one. Personally, I think the new semantics is much more logical.

* Note that "ln old new" where "new" is a symlink pointing to a non-existing

* file does succeed in both HP-UX and SunOs, but not in Solaris

* and in the old Linux semantics.

*/

/* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink

* semantics. See the comments in "open_namei" and "do_link" below.

*

* [10-Sep-98 Alan Modra] Another symlink change.

*/

/* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks:

* inside the path - always follow.

* in the last component in creation/removal/renaming - never follow.

* if LOOKUP_FOLLOW passed - follow.

* if the pathname has trailing slashes - follow.

* otherwise - don't follow.

* (applied in that order).

*

* [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT

* restored for 2.4. This is the last surviving part of old 4.2BSD bug.

* During the 2.4 we need to fix the userland stuff depending on it -

* hopefully we will be able to get rid of that wart in 2.5. So far only

* XEmacs seems to be relying on it...

*/

/*

* [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland)

* implemented. Let's see if raised priority of ->s_vfs_rename_mutex gives

* any extra contention...

*/

/* In order to reduce some races, while at the same time doing additional

* checking and hopefully speeding things up, we copy filenames to the

* kernel data space before using them..

*

* POSIX.1 2.4: an empty pathname is invalid (ENOENT).

* PATH_MAX includes the nul terminator --RR.

*/

#define EMBEDDED_NAME_MAX (PATH_MAX - sizeof(struct filename))

struct filename *

getname_flags(const char __user *filename, int flags, int *empty)

{

struct filename *result, *err;

int len;

long max;

char *kname;

result = audit_reusename(filename);

if (result)

return result;

result = __getname();

if (unlikely(!result))

return ERR_PTR(-ENOMEM);

result->refcnt = 1;

/*

* First, try to embed the struct filename inside the names_cache

* allocation

*/

kname = (char *)result + sizeof(*result);

result->name = kname;

result->separate = false;

max = EMBEDDED_NAME_MAX;

recopy:

len = strncpy_from_user(kname, filename, max);

if (unlikely(len < 0)) {

err = ERR_PTR(len);

goto error;

}

/*

* Uh-oh. We have a name that's approaching PATH_MAX. Allocate a

* separate struct filename so we can dedicate the entire

* names_cache allocation for the pathname, and re-do the copy from

* userland.

*/

if (len == EMBEDDED_NAME_MAX && max == EMBEDDED_NAME_MAX) {

kname = (char *)result;

result = kzalloc(sizeof(*result), GFP_KERNEL);

if (!result) {

err = ERR_PTR(-ENOMEM);

result = (struct filename *)kname;

goto error;

}

result->name = kname;

result->separate = true;

result->refcnt = 1;

max = PATH_MAX;

goto recopy;

}

/* The empty path is special. */

if (unlikely(!len)) {

if (empty)

*empty = 1;

err = ERR_PTR(-ENOENT);

if (!(flags & LOOKUP_EMPTY))

goto error;

}

err = ERR_PTR(-ENAMETOOLONG);

if (unlikely(len >= PATH_MAX))

goto error;

result->uptr = filename;

result->aname = NULL;

audit_getname(result);

return result;

error:

putname(result);

return err;

}

struct filename *

getname(const char __user * filename)

{

return getname_flags(filename, 0, NULL);

}

struct filename *

getname_kernel(const char * filename)

{

struct filename *result;

int len = strlen(filename) + 1;

result = __getname();

if (unlikely(!result))

return ERR_PTR(-ENOMEM);

if (len <= EMBEDDED_NAME_MAX) {

result->name = (char *)(result) + sizeof(*result);

result->separate = false;

} else if (len <= PATH_MAX) {

struct filename *tmp;

tmp = kmalloc(sizeof(*tmp), GFP_KERNEL);

if (unlikely(!tmp)) {

__putname(result);

return ERR_PTR(-ENOMEM);

}

tmp->name = (char *)result;

tmp->separate = true;

result = tmp;

} else {

__putname(result);

return ERR_PTR(-ENAMETOOLONG);

}

memcpy((char *)result->name, filename, len);

result->uptr = NULL;

result->aname = NULL;

result->refcnt = 1;

audit_getname(result);

return result;

}

void putname(struct filename *name)

{

BUG_ON(name->refcnt <= 0);

if (--name->refcnt > 0)

return;

if (name->separate) {

__putname(name->name);

kfree(name);

} else

__putname(name);

}

static int check_acl(struct inode *inode, int mask)

{

#ifdef CONFIG_FS_POSIX_ACL

struct posix_acl *acl;

if (mask & MAY_NOT_BLOCK) {

acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS);

if (!acl)

return -EAGAIN;

/* no ->get_acl() calls in RCU mode... */

if (acl == ACL_NOT_CACHED)

return -ECHILD;

return posix_acl_permission(inode, acl, mask & ~MAY_NOT_BLOCK);

}

acl = get_acl(inode, ACL_TYPE_ACCESS);

if (IS_ERR(acl))

return PTR_ERR(acl);

if (acl) {

int error = posix_acl_permission(inode, acl, mask);

posix_acl_release(acl);

return error;

}

#endif

return -EAGAIN;

}

/*

* This does the basic permission checking

*/

static int acl_permission_check(struct inode *inode, int mask)

{

unsigned int mode = inode->i_mode;

if (likely(uid_eq(current_fsuid(), inode->i_uid)))

mode >>= 6;

else {

if (IS_POSIXACL(inode) && (mode & S_IRWXG)) {

int error = check_acl(inode, mask);

if (error != -EAGAIN)

return error;

}

if (in_group_p(inode->i_gid))

mode >>= 3;

}

/*

* If the DACs are ok we don't need any capability check.

*/

if ((mask & ~mode & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0)

return 0;

return -EACCES;

}

/**

* generic_permission - check for access rights on a Posix-like filesystem

* @inode: inode to check access rights for

* @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC, ...)

*

* Used to check for read/write/execute permissions on a file.

* We use "fsuid" for this, letting us set arbitrary permissions

* for filesystem access without changing the "normal" uids which

* are used for other things.

*

* generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk

* request cannot be satisfied (eg. requires blocking or too much complexity).

* It would then be called again in ref-walk mode.

*/

int generic_permission(struct inode *inode, int mask)

{

int ret;

/*

* Do the basic permission checks.

*/

ret = acl_permission_check(inode, mask);

if (ret != -EACCES)

return ret;

if (S_ISDIR(inode->i_mode)) {

/* DACs are overridable for directories */

if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))

return 0;

if (!(mask & MAY_WRITE))

if (capable_wrt_inode_uidgid(inode,

CAP_DAC_READ_SEARCH))

return 0;

return -EACCES;

}

/*

* Read/write DACs are always overridable.

* Executable DACs are overridable when there is

* at least one exec bit set.

*/

if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))

if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))

return 0;

/*

* Searching includes executable on directories, else just read.

*/

mask &= MAY_READ | MAY_WRITE | MAY_EXEC;

if (mask == MAY_READ)

if (capable_wrt_inode_uidgid(inode, CAP_DAC_READ_SEARCH))

return 0;

return -EACCES;

}

EXPORT_SYMBOL(generic_permission);

/*

* We _really_ want to just do "generic_permission()" without

* even looking at the inode->i_op values. So we keep a cache

* flag in inode->i_opflags, that says "this has not special

* permission function, use the fast case".

*/

static inline int do_inode_permission(struct inode *inode, int mask)

{

if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) {

if (likely(inode->i_op->permission))

return inode->i_op->permission(inode, mask);

/* This gets set once for the inode lifetime */

spin_lock(&inode->i_lock);

inode->i_opflags |= IOP_FASTPERM;

spin_unlock(&inode->i_lock);

}

return generic_permission(inode, mask);

}

/**

* __inode_permission - Check for access rights to a given inode

* @inode: Inode to check permission on

* @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)

*

* Check for read/write/execute permissions on an inode.

*

* When checking for MAY_APPEND, MAY_WRITE must also be set in @mask.

*

* This does not check for a read-only file system. You probably want

* inode_permission().

*/

int __inode_permission(struct inode *inode, int mask)

{

int retval;

if (unlikely(mask & MAY_WRITE)) {

/*

* Nobody gets write access to an immutable file.

*/

if (IS_IMMUTABLE(inode))

return -EACCES;

}

retval = do_inode_permission(inode, mask);

if (retval)

return retval;

retval = devcgroup_inode_permission(inode, mask);

if (retval)

return retval;

return security_inode_permission(inode, mask);

}

EXPORT_SYMBOL(__inode_permission);

/**

* sb_permission - Check superblock-level permissions

* @sb: Superblock of inode to check permission on

* @inode: Inode to check permission on

* @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)

*

* Separate out file-system wide checks from inode-specific permission checks.

*/

static int sb_permission(struct super_block *sb, struct inode *inode, int mask)

{

if (unlikely(mask & MAY_WRITE)) {

umode_t mode = inode->i_mode;

/* Nobody gets write access to a read-only fs. */

if ((sb->s_flags & MS_RDONLY) &&

(S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))

return -EROFS;

}

return 0;

}

/**

* inode_permission - Check for access rights to a given inode

* @inode: Inode to check permission on

* @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)

*

* Check for read/write/execute permissions on an inode. We use fs[ug]id for

* this, letting us set arbitrary permissions for filesystem access without

* changing the "normal" UIDs which are used for other things.

*

* When checking for MAY_APPEND, MAY_WRITE must also be set in @mask.

*/

int inode_permission(struct inode *inode, int mask)

{

int retval;

retval = sb_permission(inode->i_sb, inode, mask);

if (retval)

return retval;

return __inode_permission(inode, mask);

}

EXPORT_SYMBOL(inode_permission);

/**

* path_get - get a reference to a path

* @path: path to get the reference to

*

* Given a path increment the reference count to the dentry and the vfsmount.

*/

void path_get(const struct path *path)

{

mntget(path->mnt);

dget(path->dentry);

}

EXPORT_SYMBOL(path_get);

/**

* path_put - put a reference to a path

* @path: path to put the reference to

*

* Given a path decrement the reference count to the dentry and the vfsmount.

*/

void path_put(const struct path *path)

{

dput(path->dentry);

mntput(path->mnt);

}

EXPORT_SYMBOL(path_put);

struct nameidata {

struct path path;

struct qstr last;

struct path root;

struct inode *inode; /* path.dentry.d_inode */

unsigned int flags;

unsigned seq, m_seq;

int last_type;

unsigned depth;

struct file *base;

char *saved_names[MAX_NESTED_LINKS + 1];

};

/*

* Path walking has 2 modes, rcu-walk and ref-walk (see

* Documentation/filesystems/path-lookup.txt). In situations when we can't

* continue in RCU mode, we attempt to drop out of rcu-walk mode and grab

* normal reference counts on dentries and vfsmounts to transition to rcu-walk

* mode. Refcounts are grabbed at the last known good point before rcu-walk

* got stuck, so ref-walk may continue from there. If this is not successful

* (eg. a seqcount has changed), then failure is returned and it's up to caller

* to restart the path walk from the beginning in ref-walk mode.

*/

/**

* unlazy_walk - try to switch to ref-walk mode.

* @nd: nameidata pathwalk data

* @dentry: child of nd->path.dentry or NULL

* Returns: 0 on success, -ECHILD on failure

*

* unlazy_walk attempts to legitimize the current nd->path, nd->root and dentry

* for ref-walk mode. @dentry must be a path found by a do_lookup call on

* @nd or NULL. Must be called from rcu-walk context.

*/

static int unlazy_walk(struct nameidata *nd, struct dentry *dentry)

{

struct fs_struct *fs = current->fs;

struct dentry *parent = nd->path.dentry;

BUG_ON(!(nd->flags & LOOKUP_RCU));

/*

* After legitimizing the bastards, terminate_walk()

* will do the right thing for non-RCU mode, and all our

* subsequent exit cases should rcu_read_unlock()

* before returning. Do vfsmount first; if dentry

* can't be legitimized, just set nd->path.dentry to NULL

* and rely on dput(NULL) being a no-op.

*/

if (!legitimize_mnt(nd->path.mnt, nd->m_seq))

return -ECHILD;

nd->flags &= ~LOOKUP_RCU;

if (!lockref_get_not_dead(&parent->d_lockref)) {

nd->path.dentry = NULL;

goto out;

}

/*

* For a negative lookup, the lookup sequence point is the parents

* sequence point, and it only needs to revalidate the parent dentry.

*

* For a positive lookup, we need to move both the parent and the

* dentry from the RCU domain to be properly refcounted. And the

* sequence number in the dentry validates *both* dentry counters,

* since we checked the sequence number of the parent after we got

* the child sequence number. So we know the parent must still

* be valid if the child sequence number is still valid.

*/

if (!dentry) {

if (read_seqcount_retry(&parent->d_seq, nd->seq))

goto out;

BUG_ON(nd->inode != parent->d_inode);

} else {

if (!lockref_get_not_dead(&dentry->d_lockref))

goto out;

if (read_seqcount_retry(&dentry->d_seq, nd->seq))

goto drop_dentry;

}

/*

* Sequence counts matched. Now make sure that the root is

* still valid and get it if required.

*/

if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {

spin_lock(&fs->lock);

if (nd->root.mnt != fs->root.mnt || nd->root.dentry != fs->root.dentry)

goto unlock_and_drop_dentry;

path_get(&nd->root);

spin_unlock(&fs->lock);

}

rcu_read_unlock();

return 0;

unlock_and_drop_dentry:

spin_unlock(&fs->lock);

drop_dentry:

rcu_read_unlock();

dput(dentry);

goto drop_root_mnt;

out:

rcu_read_unlock();

drop_root_mnt:

if (!(nd->flags & LOOKUP_ROOT))

nd->root.mnt = NULL;

return -ECHILD;

}

static inline int d_revalidate(struct dentry *dentry, unsigned int flags)

{

return dentry->d_op->d_revalidate(dentry, flags);

}

/**

* complete_walk - successful completion of path walk

* @nd: pointer nameidata

*

* If we had been in RCU mode, drop out of it and legitimize nd->path.

* Revalidate the final result, unless we'd already done that during

* the path walk or the filesystem doesn't ask for it. Return 0 on

* success, -error on failure. In case of failure caller does not

* need to drop nd->path.

*/

static int complete_walk(struct nameidata *nd)

{

struct dentry *dentry = nd->path.dentry;

int status;

if (nd->flags & LOOKUP_RCU) {

nd->flags &= ~LOOKUP_RCU;

if (!(nd->flags & LOOKUP_ROOT))

nd->root.mnt = NULL;

if (!legitimize_mnt(nd->path.mnt, nd->m_seq)) {

rcu_read_unlock();

return -ECHILD;

}

if (unlikely(!lockref_get_not_dead(&dentry->d_lockref))) {

rcu_read_unlock();

mntput(nd->path.mnt);

return -ECHILD;

}

if (read_seqcount_retry(&dentry->d_seq, nd->seq)) {

rcu_read_unlock();

dput(dentry);

mntput(nd->path.mnt);

return -ECHILD;

}

rcu_read_unlock();

}

if (likely(!(nd->flags & LOOKUP_JUMPED)))

return 0;

if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE)))

return 0;

status = dentry->d_op->d_weak_revalidate(dentry, nd->flags);

if (status > 0)

return 0;

if (!status)

status = -ESTALE;

path_put(&nd->path);

return status;

}

static __always_inline void set_root(struct nameidata *nd)

{

get_fs_root(current->fs, &nd->root);

}

static int link_path_walk(const char *, struct nameidata *);

static __always_inline unsigned set_root_rcu(struct nameidata *nd)

{

struct fs_struct *fs = current->fs;

unsigned seq, res;

do {

seq = read_seqcount_begin(&fs->seq);

nd->root = fs->root;

res = __read_seqcount_begin(&nd->root.dentry->d_seq);

} while (read_seqcount_retry(&fs->seq, seq));

return res;

}

static void path_put_conditional(struct path *path, struct nameidata *nd)

{

dput(path->dentry);

if (path->mnt != nd->path.mnt)

mntput(path->mnt);

}

static inline void path_to_nameidata(const struct path *path,

struct nameidata *nd)

{

if (!(nd->flags & LOOKUP_RCU)) {

dput(nd->path.dentry);

if (nd->path.mnt != path->mnt)

mntput(nd->path.mnt);

}

nd->path.mnt = path->mnt;

nd->path.dentry = path->dentry;

}

/*

* Helper to directly jump to a known parsed path from ->follow_link,

* caller must have taken a reference to path beforehand.

*/

void nd_jump_link(struct nameidata *nd, struct path *path)

{

path_put(&nd->path);

nd->path = *path;

nd->inode = nd->path.dentry->d_inode;

nd->flags |= LOOKUP_JUMPED;

}

void nd_set_link(struct nameidata *nd, char *path)

{

nd->saved_names[nd->depth] = path;

}

EXPORT_SYMBOL(nd_set_link);

char *nd_get_link(struct nameidata *nd)

{

return nd->saved_names[nd->depth];

}

EXPORT_SYMBOL(nd_get_link);

static inline void put_link(struct nameidata *nd, struct path *link, void *cookie)

{

struct inode *inode = link->dentry->d_inode;

if (inode->i_op->put_link)

inode->i_op->put_link(link->dentry, nd, cookie);

path_put(link);

}

int sysctl_protected_symlinks __read_mostly = 0;

int sysctl_protected_hardlinks __read_mostly = 0;

/**

* may_follow_link - Check symlink following for unsafe situations

* @link: The path of the symlink

* @nd: nameidata pathwalk data

*

* In the case of the sysctl_protected_symlinks sysctl being enabled,

* CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is

* in a sticky world-writable directory. This is to protect privileged

* processes from failing races against path names that may change out

* from under them by way of other users creating malicious symlinks.

* It will permit symlinks to be followed only when outside a sticky

* world-writable directory, or when the uid of the symlink and follower

* match, or when the directory owner matches the symlink's owner.

*

* Returns 0 if following the symlink is allowed, -ve on error.

*/

static inline int may_follow_link(struct path *link, struct nameidata *nd)

{

const struct inode *inode;

const struct inode *parent;

if (!sysctl_protected_symlinks)

return 0;

/* Allowed if owner and follower match. */

inode = link->dentry->d_inode;

if (uid_eq(current_cred()->fsuid, inode->i_uid))

return 0;

/* Allowed if parent directory not sticky and world-writable. */

parent = nd->path.dentry->d_inode;

if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))

return 0;

/* Allowed if parent directory and link owner match. */

if (uid_eq(parent->i_uid, inode->i_uid))

return 0;

audit_log_link_denied("follow_link", link);

path_put_conditional(link, nd);

path_put(&nd->path);

return -EACCES;

}

/**

* safe_hardlink_source - Check for safe hardlink conditions

* @inode: the source inode to hardlink from

*

* Return false if at least one of the following conditions:

* - inode is not a regular file

* - inode is setuid

* - inode is setgid and group-exec

* - access failure for read and write

*

* Otherwise returns true.

*/

static bool safe_hardlink_source(struct inode *inode)

{

umode_t mode = inode->i_mode;

/* Special files should not get pinned to the filesystem. */

if (!S_ISREG(mode))

return false;

/* Setuid files should not get pinned to the filesystem. */

if (mode & S_ISUID)

return false;

/* Executable setgid files should not get pinned to the filesystem. */

if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))

return false;

/* Hardlinking to unreadable or unwritable sources is dangerous. */

if (inode_permission(inode, MAY_READ | MAY_WRITE))

return false;

return true;

}

/**

* may_linkat - Check permissions for creating a hardlink

* @link: the source to hardlink from

*

* Block hardlink when all of:

* - sysctl_protected_hardlinks enabled

* - fsuid does not match inode

* - hardlink source is unsafe (see safe_hardlink_source() above)

* - not CAP_FOWNER

*

* Returns 0 if successful, -ve on error.

*/

static int may_linkat(struct path *link)

{

const struct cred *cred;

struct inode *inode;

if (!sysctl_protected_hardlinks)

return 0;

cred = current_cred();

inode = link->dentry->d_inode;

/* Source inode owner (or CAP_FOWNER) can hardlink all they like,

* otherwise, it must be a safe source.

*/

if (uid_eq(cred->fsuid, inode->i_uid) || safe_hardlink_source(inode) ||

capable(CAP_FOWNER))

return 0;

audit_log_link_denied("linkat", link);

return -EPERM;

}

static __always_inline int

follow_link(struct path *link, struct nameidata *nd, void **p)

{

struct dentry *dentry = link->dentry;

int error;

char *s;

BUG_ON(nd->flags & LOOKUP_RCU);

if (link->mnt == nd->path.mnt)

mntget(link->mnt);

error = -ELOOP;

if (unlikely(current->total_link_count >= 40))

goto out_put_nd_path;

cond_resched();

current->total_link_count++;

touch_atime(link);

nd_set_link(nd, NULL);

error = security_inode_follow_link(link->dentry, nd);

if (error)

goto out_put_nd_path;

nd->last_type = LAST_BIND;

*p = dentry->d_inode->i_op->follow_link(dentry, nd);

error = PTR_ERR(*p);

if (IS_ERR(*p))

goto out_put_nd_path;

error = 0;

s = nd_get_link(nd);

if (s) {

if (unlikely(IS_ERR(s))) {

path_put(&nd->path);

put_link(nd, link, *p);

return PTR_ERR(s);

}

if (*s == '/') {

if (!nd->root.mnt)

set_root(nd);

path_put(&nd->path);

nd->path = nd->root;

path_get(&nd->root);

nd->flags |= LOOKUP_JUMPED;

}

nd->inode = nd->path.dentry->d_inode;

error = link_path_walk(s, nd);

if (unlikely(error))

put_link(nd, link, *p);

}

return error;

out_put_nd_path:

*p = NULL;

path_put(&nd->path);

path_put(link);

return error;

}

static int follow_up_rcu(struct path *path)

{

struct mount *mnt = real_mount(path->mnt);

struct mount *parent;

struct dentry *mountpoint;

parent = mnt->mnt_parent;

if (&parent->mnt == path->mnt)

return 0;

mountpoint = mnt->mnt_mountpoint;

path->dentry = mountpoint;

path->mnt = &parent->mnt;

return 1;

}

/*

* follow_up - Find the mountpoint of path's vfsmount

*

* Given a path, find the mountpoint of its source file system.

* Replace @path with the path of the mountpoint in the parent mount.

* Up is towards /.

*

* Return 1 if we went up a level and 0 if we were already at the

* root.

*/

int follow_up(struct path *path)

{

struct mount *mnt = real_mount(path->mnt);

struct mount *parent;

struct dentry *mountpoint;

read_seqlock_excl(&mount_lock);

parent = mnt->mnt_parent;

if (parent == mnt) {

read_sequnlock_excl(&mount_lock);

return 0;

}

mntget(&parent->mnt);

mountpoint = dget(mnt->mnt_mountpoint);

read_sequnlock_excl(&mount_lock);

dput(path->dentry);

path->dentry = mountpoint;

mntput(path->mnt);

path->mnt = &parent->mnt;

return 1;

}

EXPORT_SYMBOL(follow_up);

/*

* Perform an automount

* - return -EISDIR to tell follow_managed() to stop and return the path we

* were called with.

*/

static int follow_automount(struct path *path, unsigned flags,

bool *need_mntput)

{

struct vfsmount *mnt;

int err;

if (!path->dentry->d_op || !path->dentry->d_op->d_automount)

return -EREMOTE;

/* We don't want to mount if someone's just doing a stat -

* unless they're stat'ing a directory and appended a '/' to

* the name.

*

* We do, however, want to mount if someone wants to open or

* create a file of any type under the mountpoint, wants to

* traverse through the mountpoint or wants to open the

* mounted directory. Also, autofs may mark negative dentries

* as being automount points. These will need the attentions

* of the daemon to instantiate them before they can be used.

*/

if (!(flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |

LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&

path->dentry->d_inode)

return -EISDIR;

current->total_link_count++;

if (current->total_link_count >= 40)

return -ELOOP;

mnt = path->dentry->d_op->d_automount(path);

if (IS_ERR(mnt)) {

/*