1 /* 2 * linux/fs/namespace.c 3 * 4 * (C) Copyright Al Viro 2000, 2001 5 * Released under GPL v2. 6 * 7 * Based on code from fs/super.c, copyright Linus Torvalds and others. 8 * Heavily rewritten. 9 */ 10 11 #include <linux/syscalls.h> 12 #include <linux/export.h> 13 #include <linux/capability.h> 14 #include <linux/mnt_namespace.h> 15 #include <linux/user_namespace.h> 16 #include <linux/namei.h> 17 #include <linux/security.h> 18 #include <linux/idr.h> 19 #include <linux/init.h> /* init_rootfs */ 20 #include <linux/fs_struct.h> /* get_fs_root et.al. */ 21 #include <linux/fsnotify.h> /* fsnotify_vfsmount_delete */ 22 #include <linux/uaccess.h> 23 #include <linux/proc_ns.h> 24 #include <linux/magic.h> 25 #include <linux/bootmem.h> 26 #include <linux/task_work.h> 27 #include "pnode.h" 28 #include "internal.h" 29 30 static unsigned int m_hash_mask __read_mostly; 31 static unsigned int m_hash_shift __read_mostly; 32 static unsigned int mp_hash_mask __read_mostly; 33 static unsigned int mp_hash_shift __read_mostly; 34 35 static __initdata unsigned long mhash_entries; 36 static int __init set_mhash_entries(char *str) 37 { 38 if (!str) 39 return 0; 40 mhash_entries = simple_strtoul(str, &str, 0); 41 return 1; 42 } 43 __setup("mhash_entries=", set_mhash_entries); 44 45 static __initdata unsigned long mphash_entries; 46 static int __init set_mphash_entries(char *str) 47 { 48 if (!str) 49 return 0; 50 mphash_entries = simple_strtoul(str, &str, 0); 51 return 1; 52 } 53 __setup("mphash_entries=", set_mphash_entries); 54 55 static u64 event; 56 static DEFINE_IDA(mnt_id_ida); 57 static DEFINE_IDA(mnt_group_ida); 58 static DEFINE_SPINLOCK(mnt_id_lock); 59 static int mnt_id_start = 0; 60 static int mnt_group_start = 1; 61 62 static struct hlist_head *mount_hashtable __read_mostly; 63 static struct hlist_head *mountpoint_hashtable __read_mostly; 64 static struct kmem_cache *mnt_cache __read_mostly; 65 static DECLARE_RWSEM(namespace_sem); 66 67 /* /sys/fs */ 68 struct kobject *fs_kobj; 69 EXPORT_SYMBOL_GPL(fs_kobj); 70 71 /* 72 * vfsmount lock may be taken for read to prevent changes to the 73 * vfsmount hash, ie. during mountpoint lookups or walking back 74 * up the tree. 75 * 76 * It should be taken for write in all cases where the vfsmount 77 * tree or hash is modified or when a vfsmount structure is modified. 78 */ 79 __cacheline_aligned_in_smp DEFINE_SEQLOCK(mount_lock); 80 81 static inline struct hlist_head *m_hash(struct vfsmount *mnt, struct dentry *dentry) 82 { 83 unsigned long tmp = ((unsigned long)mnt / L1_CACHE_BYTES); 84 tmp += ((unsigned long)dentry / L1_CACHE_BYTES); 85 tmp = tmp + (tmp >> m_hash_shift); 86 return &mount_hashtable[tmp & m_hash_mask]; 87 } 88 89 static inline struct hlist_head *mp_hash(struct dentry *dentry) 90 { 91 unsigned long tmp = ((unsigned long)dentry / L1_CACHE_BYTES); 92 tmp = tmp + (tmp >> mp_hash_shift); 93 return &mountpoint_hashtable[tmp & mp_hash_mask]; 94 } 95 96 /* 97 * allocation is serialized by namespace_sem, but we need the spinlock to 98 * serialize with freeing. 99 */ 100 static int mnt_alloc_id(struct mount *mnt) 101 { 102 int res; 103 104 retry: 105 ida_pre_get(&mnt_id_ida, GFP_KERNEL); 106 spin_lock(&mnt_id_lock); 107 res = ida_get_new_above(&mnt_id_ida, mnt_id_start, &mnt->mnt_id); 108 if (!res) 109 mnt_id_start = mnt->mnt_id + 1; 110 spin_unlock(&mnt_id_lock); 111 if (res == -EAGAIN) 112 goto retry; 113 114 return res; 115 } 116 117 static void mnt_free_id(struct mount *mnt) 118 { 119 int id = mnt->mnt_id; 120 spin_lock(&mnt_id_lock); 121 ida_remove(&mnt_id_ida, id); 122 if (mnt_id_start > id) 123 mnt_id_start = id; 124 spin_unlock(&mnt_id_lock); 125 } 126 127 /* 128 * Allocate a new peer group ID 129 * 130 * mnt_group_ida is protected by namespace_sem 131 */ 132 static int mnt_alloc_group_id(struct mount *mnt) 133 { 134 int res; 135 136 if (!ida_pre_get(&mnt_group_ida, GFP_KERNEL)) 137 return -ENOMEM; 138 139 res = ida_get_new_above(&mnt_group_ida, 140 mnt_group_start, 141 &mnt->mnt_group_id); 142 if (!res) 143 mnt_group_start = mnt->mnt_group_id + 1; 144 145 return res; 146 } 147 148 /* 149 * Release a peer group ID 150 */ 151 void mnt_release_group_id(struct mount *mnt) 152 { 153 int id = mnt->mnt_group_id; 154 ida_remove(&mnt_group_ida, id); 155 if (mnt_group_start > id) 156 mnt_group_start = id; 157 mnt->mnt_group_id = 0; 158 } 159 160 /* 161 * vfsmount lock must be held for read 162 */ 163 static inline void mnt_add_count(struct mount *mnt, int n) 164 { 165 #ifdef CONFIG_SMP 166 this_cpu_add(mnt->mnt_pcp->mnt_count, n); 167 #else 168 preempt_disable(); 169 mnt->mnt_count += n; 170 preempt_enable(); 171 #endif 172 } 173 174 /* 175 * vfsmount lock must be held for write 176 */ 177 unsigned int mnt_get_count(struct mount *mnt) 178 { 179 #ifdef CONFIG_SMP 180 unsigned int count = 0; 181 int cpu; 182 183 for_each_possible_cpu(cpu) { 184 count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_count; 185 } 186 187 return count; 188 #else 189 return mnt->mnt_count; 190 #endif 191 } 192 193 static void drop_mountpoint(struct fs_pin *p) 194 { 195 struct mount *m = container_of(p, struct mount, mnt_umount); 196 dput(m->mnt_ex_mountpoint); 197 pin_remove(p); 198 mntput(&m->mnt); 199 } 200 201 static struct mount *alloc_vfsmnt(const char *name) 202 { 203 struct mount *mnt = kmem_cache_zalloc(mnt_cache, GFP_KERNEL); 204 if (mnt) { 205 int err; 206 207 err = mnt_alloc_id(mnt); 208 if (err) 209 goto out_free_cache; 210 211 if (name) { 212 mnt->mnt_devname = kstrdup_const(name, GFP_KERNEL); 213 if (!mnt->mnt_devname) 214 goto out_free_id; 215 } 216 217 #ifdef CONFIG_SMP 218 mnt->mnt_pcp = alloc_percpu(struct mnt_pcp); 219 if (!mnt->mnt_pcp) 220 goto out_free_devname; 221 222 this_cpu_add(mnt->mnt_pcp->mnt_count, 1); 223 #else 224 mnt->mnt_count = 1; 225 mnt->mnt_writers = 0; 226 #endif 227 228 INIT_HLIST_NODE(&mnt->mnt_hash); 229 INIT_LIST_HEAD(&mnt->mnt_child); 230 INIT_LIST_HEAD(&mnt->mnt_mounts); 231 INIT_LIST_HEAD(&mnt->mnt_list); 232 INIT_LIST_HEAD(&mnt->mnt_expire); 233 INIT_LIST_HEAD(&mnt->mnt_share); 234 INIT_LIST_HEAD(&mnt->mnt_slave_list); 235 INIT_LIST_HEAD(&mnt->mnt_slave); 236 INIT_HLIST_NODE(&mnt->mnt_mp_list); 237 #ifdef CONFIG_FSNOTIFY 238 INIT_HLIST_HEAD(&mnt->mnt_fsnotify_marks); 239 #endif 240 init_fs_pin(&mnt->mnt_umount, drop_mountpoint); 241 } 242 return mnt; 243 244 #ifdef CONFIG_SMP 245 out_free_devname: 246 kfree_const(mnt->mnt_devname); 247 #endif 248 out_free_id: 249 mnt_free_id(mnt); 250 out_free_cache: 251 kmem_cache_free(mnt_cache, mnt); 252 return NULL; 253 } 254 255 /* 256 * Most r/o checks on a fs are for operations that take 257 * discrete amounts of time, like a write() or unlink(). 258 * We must keep track of when those operations start 259 * (for permission checks) and when they end, so that 260 * we can determine when writes are able to occur to 261 * a filesystem. 262 */ 263 /* 264 * __mnt_is_readonly: check whether a mount is read-only 265 * @mnt: the mount to check for its write status 266 * 267 * This shouldn't be used directly ouside of the VFS. 268 * It does not guarantee that the filesystem will stay 269 * r/w, just that it is right *now*. This can not and 270 * should not be used in place of IS_RDONLY(inode). 271 * mnt_want/drop_write() will _keep_ the filesystem 272 * r/w. 273 */ 274 int __mnt_is_readonly(struct vfsmount *mnt) 275 { 276 if (mnt->mnt_flags & MNT_READONLY) 277 return 1; 278 if (mnt->mnt_sb->s_flags & MS_RDONLY) 279 return 1; 280 return 0; 281 } 282 EXPORT_SYMBOL_GPL(__mnt_is_readonly); 283 284 static inline void mnt_inc_writers(struct mount *mnt) 285 { 286 #ifdef CONFIG_SMP 287 this_cpu_inc(mnt->mnt_pcp->mnt_writers); 288 #else 289 mnt->mnt_writers++; 290 #endif 291 } 292 293 static inline void mnt_dec_writers(struct mount *mnt) 294 { 295 #ifdef CONFIG_SMP 296 this_cpu_dec(mnt->mnt_pcp->mnt_writers); 297 #else 298 mnt->mnt_writers--; 299 #endif 300 } 301 302 static unsigned int mnt_get_writers(struct mount *mnt) 303 { 304 #ifdef CONFIG_SMP 305 unsigned int count = 0; 306 int cpu; 307 308 for_each_possible_cpu(cpu) { 309 count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_writers; 310 } 311 312 return count; 313 #else 314 return mnt->mnt_writers; 315 #endif 316 } 317 318 static int mnt_is_readonly(struct vfsmount *mnt) 319 { 320 if (mnt->mnt_sb->s_readonly_remount) 321 return 1; 322 /* Order wrt setting s_flags/s_readonly_remount in do_remount() */ 323 smp_rmb(); 324 return __mnt_is_readonly(mnt); 325 } 326 327 /* 328 * Most r/o & frozen checks on a fs are for operations that take discrete 329 * amounts of time, like a write() or unlink(). We must keep track of when 330 * those operations start (for permission checks) and when they end, so that we 331 * can determine when writes are able to occur to a filesystem. 332 */ 333 /** 334 * __mnt_want_write - get write access to a mount without freeze protection 335 * @m: the mount on which to take a write 336 * 337 * This tells the low-level filesystem that a write is about to be performed to 338 * it, and makes sure that writes are allowed (mnt it read-write) before 339 * returning success. This operation does not protect against filesystem being 340 * frozen. When the write operation is finished, __mnt_drop_write() must be 341 * called. This is effectively a refcount. 342 */ 343 int __mnt_want_write(struct vfsmount *m) 344 { 345 struct mount *mnt = real_mount(m); 346 int ret = 0; 347 348 preempt_disable(); 349 mnt_inc_writers(mnt); 350 /* 351 * The store to mnt_inc_writers must be visible before we pass 352 * MNT_WRITE_HOLD loop below, so that the slowpath can see our 353 * incremented count after it has set MNT_WRITE_HOLD. 354 */ 355 smp_mb(); 356 while (ACCESS_ONCE(mnt->mnt.mnt_flags) & MNT_WRITE_HOLD) 357 cpu_relax(); 358 /* 359 * After the slowpath clears MNT_WRITE_HOLD, mnt_is_readonly will 360 * be set to match its requirements. So we must not load that until 361 * MNT_WRITE_HOLD is cleared. 362 */ 363 smp_rmb(); 364 if (mnt_is_readonly(m)) { 365 mnt_dec_writers(mnt); 366 ret = -EROFS; 367 } 368 preempt_enable(); 369 370 return ret; 371 } 372 373 /** 374 * mnt_want_write - get write access to a mount 375 * @m: the mount on which to take a write 376 * 377 * This tells the low-level filesystem that a write is about to be performed to 378 * it, and makes sure that writes are allowed (mount is read-write, filesystem 379 * is not frozen) before returning success. When the write operation is 380 * finished, mnt_drop_write() must be called. This is effectively a refcount. 381 */ 382 int mnt_want_write(struct vfsmount *m) 383 { 384 int ret; 385 386 sb_start_write(m->mnt_sb); 387 ret = __mnt_want_write(m); 388 if (ret) 389 sb_end_write(m->mnt_sb); 390 return ret; 391 } 392 EXPORT_SYMBOL_GPL(mnt_want_write); 393 394 /** 395 * mnt_clone_write - get write access to a mount 396 * @mnt: the mount on which to take a write 397 * 398 * This is effectively like mnt_want_write, except 399 * it must only be used to take an extra write reference 400 * on a mountpoint that we already know has a write reference 401 * on it. This allows some optimisation. 402 * 403 * After finished, mnt_drop_write must be called as usual to 404 * drop the reference. 405 */ 406 int mnt_clone_write(struct vfsmount *mnt) 407 { 408 /* superblock may be r/o */ 409 if (__mnt_is_readonly(mnt)) 410 return -EROFS; 411 preempt_disable(); 412 mnt_inc_writers(real_mount(mnt)); 413 preempt_enable(); 414 return 0; 415 } 416 EXPORT_SYMBOL_GPL(mnt_clone_write); 417 418 /** 419 * __mnt_want_write_file - get write access to a file's mount 420 * @file: the file who's mount on which to take a write 421 * 422 * This is like __mnt_want_write, but it takes a file and can 423 * do some optimisations if the file is open for write already 424 */ 425 int __mnt_want_write_file(struct file *file) 426 { 427 if (!(file->f_mode & FMODE_WRITER)) 428 return __mnt_want_write(file->f_path.mnt); 429 else 430 return mnt_clone_write(file->f_path.mnt); 431 } 432 433 /** 434 * mnt_want_write_file - get write access to a file's mount 435 * @file: the file who's mount on which to take a write 436 * 437 * This is like mnt_want_write, but it takes a file and can 438 * do some optimisations if the file is open for write already 439 */ 440 int mnt_want_write_file(struct file *file) 441 { 442 int ret; 443 444 sb_start_write(file->f_path.mnt->mnt_sb); 445 ret = __mnt_want_write_file(file); 446 if (ret) 447 sb_end_write(file->f_path.mnt->mnt_sb); 448 return ret; 449 } 450 EXPORT_SYMBOL_GPL(mnt_want_write_file); 451 452 /** 453 * __mnt_drop_write - give up write access to a mount 454 * @mnt: the mount on which to give up write access 455 * 456 * Tells the low-level filesystem that we are done 457 * performing writes to it. Must be matched with 458 * __mnt_want_write() call above. 459 */ 460 void __mnt_drop_write(struct vfsmount *mnt) 461 { 462 preempt_disable(); 463 mnt_dec_writers(real_mount(mnt)); 464 preempt_enable(); 465 } 466 467 /** 468 * mnt_drop_write - give up write access to a mount 469 * @mnt: the mount on which to give up write access 470 * 471 * Tells the low-level filesystem that we are done performing writes to it and 472 * also allows filesystem to be frozen again. Must be matched with 473 * mnt_want_write() call above. 474 */ 475 void mnt_drop_write(struct vfsmount *mnt) 476 { 477 __mnt_drop_write(mnt); 478 sb_end_write(mnt->mnt_sb); 479 } 480 EXPORT_SYMBOL_GPL(mnt_drop_write); 481 482 void __mnt_drop_write_file(struct file *file) 483 { 484 __mnt_drop_write(file->f_path.mnt); 485 } 486 487 void mnt_drop_write_file(struct file *file) 488 { 489 mnt_drop_write(file->f_path.mnt); 490 } 491 EXPORT_SYMBOL(mnt_drop_write_file); 492 493 static int mnt_make_readonly(struct mount *mnt) 494 { 495 int ret = 0; 496 497 lock_mount_hash(); 498 mnt->mnt.mnt_flags |= MNT_WRITE_HOLD; 499 /* 500 * After storing MNT_WRITE_HOLD, we'll read the counters. This store 501 * should be visible before we do. 502 */ 503 smp_mb(); 504 505 /* 506 * With writers on hold, if this value is zero, then there are 507 * definitely no active writers (although held writers may subsequently 508 * increment the count, they'll have to wait, and decrement it after 509 * seeing MNT_READONLY). 510 * 511 * It is OK to have counter incremented on one CPU and decremented on 512 * another: the sum will add up correctly. The danger would be when we 513 * sum up each counter, if we read a counter before it is incremented, 514 * but then read another CPU's count which it has been subsequently 515 * decremented from -- we would see more decrements than we should. 516 * MNT_WRITE_HOLD protects against this scenario, because 517 * mnt_want_write first increments count, then smp_mb, then spins on 518 * MNT_WRITE_HOLD, so it can't be decremented by another CPU while 519 * we're counting up here. 520 */ 521 if (mnt_get_writers(mnt) > 0) 522 ret = -EBUSY; 523 else 524 mnt->mnt.mnt_flags |= MNT_READONLY; 525 /* 526 * MNT_READONLY must become visible before ~MNT_WRITE_HOLD, so writers 527 * that become unheld will see MNT_READONLY. 528 */ 529 smp_wmb(); 530 mnt->mnt.mnt_flags &= ~MNT_WRITE_HOLD; 531 unlock_mount_hash(); 532 return ret; 533 } 534 535 static void __mnt_unmake_readonly(struct mount *mnt) 536 { 537 lock_mount_hash(); 538 mnt->mnt.mnt_flags &= ~MNT_READONLY; 539 unlock_mount_hash(); 540 } 541 542 int sb_prepare_remount_readonly(struct super_block *sb) 543 { 544 struct mount *mnt; 545 int err = 0; 546 547 /* Racy optimization. Recheck the counter under MNT_WRITE_HOLD */ 548 if (atomic_long_read(&sb->s_remove_count)) 549 return -EBUSY; 550 551 lock_mount_hash(); 552 list_for_each_entry(mnt, &sb->s_mounts, mnt_instance) { 553 if (!(mnt->mnt.mnt_flags & MNT_READONLY)) { 554 mnt->mnt.mnt_flags |= MNT_WRITE_HOLD; 555 smp_mb(); 556 if (mnt_get_writers(mnt) > 0) { 557 err = -EBUSY; 558 break; 559 } 560 } 561 } 562 if (!err && atomic_long_read(&sb->s_remove_count)) 563 err = -EBUSY; 564 565 if (!err) { 566 sb->s_readonly_remount = 1; 567 smp_wmb(); 568 } 569 list_for_each_entry(mnt, &sb->s_mounts, mnt_instance) { 570 if (mnt->mnt.mnt_flags & MNT_WRITE_HOLD) 571 mnt->mnt.mnt_flags &= ~MNT_WRITE_HOLD; 572 } 573 unlock_mount_hash(); 574 575 return err; 576 } 577 578 static void free_vfsmnt(struct mount *mnt) 579 { 580 kfree_const(mnt->mnt_devname); 581 #ifdef CONFIG_SMP 582 free_percpu(mnt->mnt_pcp); 583 #endif 584 kmem_cache_free(mnt_cache, mnt); 585 } 586 587 static void delayed_free_vfsmnt(struct rcu_head *head) 588 { 589 free_vfsmnt(container_of(head, struct mount, mnt_rcu)); 590 } 591 592 /* call under rcu_read_lock */ 593 bool legitimize_mnt(struct vfsmount *bastard, unsigned seq) 594 { 595 struct mount *mnt; 596 if (read_seqretry(&mount_lock, seq)) 597 return false; 598 if (bastard == NULL) 599 return true; 600 mnt = real_mount(bastard); 601 mnt_add_count(mnt, 1); 602 if (likely(!read_seqretry(&mount_lock, seq))) 603 return true; 604 if (bastard->mnt_flags & MNT_SYNC_UMOUNT) { 605 mnt_add_count(mnt, -1); 606 return false; 607 } 608 rcu_read_unlock(); 609 mntput(bastard); 610 rcu_read_lock(); 611 return false; 612 } 613 614 /* 615 * find the first mount at @dentry on vfsmount @mnt. 616 * call under rcu_read_lock() 617 */ 618 struct mount *__lookup_mnt(struct vfsmount *mnt, struct dentry *dentry) 619 { 620 struct hlist_head *head = m_hash(mnt, dentry); 621 struct mount *p; 622 623 hlist_for_each_entry_rcu(p, head, mnt_hash) 624 if (&p->mnt_parent->mnt == mnt && p->mnt_mountpoint == dentry) 625 return p; 626 return NULL; 627 } 628 629 /* 630 * find the last mount at @dentry on vfsmount @mnt. 631 * mount_lock must be held. 632 */ 633 struct mount *__lookup_mnt_last(struct vfsmount *mnt, struct dentry *dentry) 634 { 635 struct mount *p, *res = NULL; 636 p = __lookup_mnt(mnt, dentry); 637 if (!p) 638 goto out; 639 if (!(p->mnt.mnt_flags & MNT_UMOUNT)) 640 res = p; 641 hlist_for_each_entry_continue(p, mnt_hash) { 642 if (&p->mnt_parent->mnt != mnt || p->mnt_mountpoint != dentry) 643 break; 644 if (!(p->mnt.mnt_flags & MNT_UMOUNT)) 645 res = p; 646 } 647 out: 648 return res; 649 } 650 651 /* 652 * lookup_mnt - Return the first child mount mounted at path 653 * 654 * "First" means first mounted chronologically. If you create the 655 * following mounts: 656 * 657 * mount /dev/sda1 /mnt 658 * mount /dev/sda2 /mnt 659 * mount /dev/sda3 /mnt 660 * 661 * Then lookup_mnt() on the base /mnt dentry in the root mount will 662 * return successively the root dentry and vfsmount of /dev/sda1, then 663 * /dev/sda2, then /dev/sda3, then NULL. 664 * 665 * lookup_mnt takes a reference to the found vfsmount. 666 */ 667 struct vfsmount *lookup_mnt(struct path *path) 668 { 669 struct mount *child_mnt; 670 struct vfsmount *m; 671 unsigned seq; 672 673 rcu_read_lock(); 674 do { 675 seq = read_seqbegin(&mount_lock); 676 child_mnt = __lookup_mnt(path->mnt, path->dentry); 677 m = child_mnt ? &child_mnt->mnt : NULL; 678 } while (!legitimize_mnt(m, seq)); 679 rcu_read_unlock(); 680 return m; 681 } 682 683 /* 684 * __is_local_mountpoint - Test to see if dentry is a mountpoint in the 685 * current mount namespace. 686 * 687 * The common case is dentries are not mountpoints at all and that 688 * test is handled inline. For the slow case when we are actually 689 * dealing with a mountpoint of some kind, walk through all of the 690 * mounts in the current mount namespace and test to see if the dentry 691 * is a mountpoint. 692 * 693 * The mount_hashtable is not usable in the context because we 694 * need to identify all mounts that may be in the current mount 695 * namespace not just a mount that happens to have some specified 696 * parent mount. 697 */ 698 bool __is_local_mountpoint(struct dentry *dentry) 699 { 700 struct mnt_namespace *ns = current->nsproxy->mnt_ns; 701 struct mount *mnt; 702 bool is_covered = false; 703 704 if (!d_mountpoint(dentry)) 705 goto out; 706 707 down_read(&namespace_sem); 708 list_for_each_entry(mnt, &ns->list, mnt_list) { 709 is_covered = (mnt->mnt_mountpoint == dentry); 710 if (is_covered) 711 break; 712 } 713 up_read(&namespace_sem); 714 out: 715 return is_covered; 716 } 717 718 static struct mountpoint *lookup_mountpoint(struct dentry *dentry) 719 { 720 struct hlist_head *chain = mp_hash(dentry); 721 struct mountpoint *mp; 722 723 hlist_for_each_entry(mp, chain, m_hash) { 724 if (mp->m_dentry == dentry) { 725 /* might be worth a WARN_ON() */ 726 if (d_unlinked(dentry)) 727 return ERR_PTR(-ENOENT); 728 mp->m_count++; 729 return mp; 730 } 731 } 732 return NULL; 733 } 734 735 static struct mountpoint *new_mountpoint(struct dentry *dentry) 736 { 737 struct hlist_head *chain = mp_hash(dentry); 738 struct mountpoint *mp; 739 int ret; 740 741 mp = kmalloc(sizeof(struct mountpoint), GFP_KERNEL); 742 if (!mp) 743 return ERR_PTR(-ENOMEM); 744 745 ret = d_set_mounted(dentry); 746 if (ret) { 747 kfree(mp); 748 return ERR_PTR(ret); 749 } 750 751 mp->m_dentry = dentry; 752 mp->m_count = 1; 753 hlist_add_head(&mp->m_hash, chain); 754 INIT_HLIST_HEAD(&mp->m_list); 755 return mp; 756 } 757 758 static void put_mountpoint(struct mountpoint *mp) 759 { 760 if (!--mp->m_count) { 761 struct dentry *dentry = mp->m_dentry; 762 BUG_ON(!hlist_empty(&mp->m_list)); 763 spin_lock(&dentry->d_lock); 764 dentry->d_flags &= ~DCACHE_MOUNTED; 765 spin_unlock(&dentry->d_lock); 766 hlist_del(&mp->m_hash); 767 kfree(mp); 768 } 769 } 770 771 static inline int check_mnt(struct mount *mnt) 772 { 773 return mnt->mnt_ns == current->nsproxy->mnt_ns; 774 } 775 776 /* 777 * vfsmount lock must be held for write 778 */ 779 static void touch_mnt_namespace(struct mnt_namespace *ns) 780 { 781 if (ns) { 782 ns->event = ++event; 783 wake_up_interruptible(&ns->poll); 784 } 785 } 786 787 /* 788 * vfsmount lock must be held for write 789 */ 790 static void __touch_mnt_namespace(struct mnt_namespace *ns) 791 { 792 if (ns && ns->event != event) { 793 ns->event = event; 794 wake_up_interruptible(&ns->poll); 795 } 796 } 797 798 /* 799 * vfsmount lock must be held for write 800 */ 801 static void unhash_mnt(struct mount *mnt) 802 { 803 mnt->mnt_parent = mnt; 804 mnt->mnt_mountpoint = mnt->mnt.mnt_root; 805 list_del_init(&mnt->mnt_child); 806 hlist_del_init_rcu(&mnt->mnt_hash); 807 hlist_del_init(&mnt->mnt_mp_list); 808 put_mountpoint(mnt->mnt_mp); 809 mnt->mnt_mp = NULL; 810 } 811 812 /* 813 * vfsmount lock must be held for write 814 */ 815 static void detach_mnt(struct mount *mnt, struct path *old_path) 816 { 817 old_path->dentry = mnt->mnt_mountpoint; 818 old_path->mnt = &mnt->mnt_parent->mnt; 819 unhash_mnt(mnt); 820 } 821 822 /* 823 * vfsmount lock must be held for write 824 */ 825 static void umount_mnt(struct mount *mnt) 826 { 827 /* old mountpoint will be dropped when we can do that */ 828 mnt->mnt_ex_mountpoint = mnt->mnt_mountpoint; 829 unhash_mnt(mnt); 830 } 831 832 /* 833 * vfsmount lock must be held for write 834 */ 835 void mnt_set_mountpoint(struct mount *mnt, 836 struct mountpoint *mp, 837 struct mount *child_mnt) 838 { 839 mp->m_count++; 840 mnt_add_count(mnt, 1); /* essentially, that's mntget */ 841 child_mnt->mnt_mountpoint = dget(mp->m_dentry); 842 child_mnt->mnt_parent = mnt; 843 child_mnt->mnt_mp = mp; 844 hlist_add_head(&child_mnt->mnt_mp_list, &mp->m_list); 845 } 846 847 /* 848 * vfsmount lock must be held for write 849 */ 850 static void attach_mnt(struct mount *mnt, 851 struct mount *parent, 852 struct mountpoint *mp) 853 { 854 mnt_set_mountpoint(parent, mp, mnt); 855 hlist_add_head_rcu(&mnt->mnt_hash, m_hash(&parent->mnt, mp->m_dentry)); 856 list_add_tail(&mnt->mnt_child, &parent->mnt_mounts); 857 } 858 859 static void attach_shadowed(struct mount *mnt, 860 struct mount *parent, 861 struct mount *shadows) 862 { 863 if (shadows) { 864 hlist_add_behind_rcu(&mnt->mnt_hash, &shadows->mnt_hash); 865 list_add(&mnt->mnt_child, &shadows->mnt_child); 866 } else { 867 hlist_add_head_rcu(&mnt->mnt_hash, 868 m_hash(&parent->mnt, mnt->mnt_mountpoint)); 869 list_add_tail(&mnt->mnt_child, &parent->mnt_mounts); 870 } 871 } 872 873 /* 874 * vfsmount lock must be held for write 875 */ 876 static void commit_tree(struct mount *mnt, struct mount *shadows) 877 { 878 struct mount *parent = mnt->mnt_parent; 879 struct mount *m; 880 LIST_HEAD(head); 881 struct mnt_namespace *n = parent->mnt_ns; 882 883 BUG_ON(parent == mnt); 884 885 list_add_tail(&head, &mnt->mnt_list); 886 list_for_each_entry(m, &head, mnt_list) 887 m->mnt_ns = n; 888 889 list_splice(&head, n->list.prev); 890 891 attach_shadowed(mnt, parent, shadows); 892 touch_mnt_namespace(n); 893 } 894 895 static struct mount *next_mnt(struct mount *p, struct mount *root) 896 { 897 struct list_head *next = p->mnt_mounts.next; 898 if (next == &p->mnt_mounts) { 899 while (1) { 900 if (p == root) 901 return NULL; 902 next = p->mnt_child.next; 903 if (next != &p->mnt_parent->mnt_mounts) 904 break; 905 p = p->mnt_parent; 906 } 907 } 908 return list_entry(next, struct mount, mnt_child); 909 } 910 911 static struct mount *skip_mnt_tree(struct mount *p) 912 { 913 struct list_head *prev = p->mnt_mounts.prev; 914 while (prev != &p->mnt_mounts) { 915 p = list_entry(prev, struct mount, mnt_child); 916 prev = p->mnt_mounts.prev; 917 } 918 return p; 919 } 920 921 struct vfsmount * 922 vfs_kern_mount(struct file_system_type *type, int flags, const char *name, void *data) 923 { 924 struct mount *mnt; 925 struct dentry *root; 926 927 if (!type) 928 return ERR_PTR(-ENODEV); 929 930 mnt = alloc_vfsmnt(name); 931 if (!mnt) 932 return ERR_PTR(-ENOMEM); 933 934 if (flags & MS_KERNMOUNT) 935 mnt->mnt.mnt_flags = MNT_INTERNAL; 936 937 root = mount_fs(type, flags, name, data); 938 if (IS_ERR(root)) { 939 mnt_free_id(mnt); 940 free_vfsmnt(mnt); 941 return ERR_CAST(root); 942 } 943 944 mnt->mnt.mnt_root = root; 945 mnt->mnt.mnt_sb = root->d_sb; 946 mnt->mnt_mountpoint = mnt->mnt.mnt_root; 947 mnt->mnt_parent = mnt; 948 lock_mount_hash(); 949 list_add_tail(&mnt->mnt_instance, &root->d_sb->s_mounts); 950 unlock_mount_hash(); 951 return &mnt->mnt; 952 } 953 EXPORT_SYMBOL_GPL(vfs_kern_mount); 954 955 static struct mount *clone_mnt(struct mount *old, struct dentry *root, 956 int flag) 957 { 958 struct super_block *sb = old->mnt.mnt_sb; 959 struct mount *mnt; 960 int err; 961 962 mnt = alloc_vfsmnt(old->mnt_devname); 963 if (!mnt) 964 return ERR_PTR(-ENOMEM); 965 966 if (flag & (CL_SLAVE | CL_PRIVATE | CL_SHARED_TO_SLAVE)) 967 mnt->mnt_group_id = 0; /* not a peer of original */ 968 else 969 mnt->mnt_group_id = old->mnt_group_id; 970 971 if ((flag & CL_MAKE_SHARED) && !mnt->mnt_group_id) { 972 err = mnt_alloc_group_id(mnt); 973 if (err) 974 goto out_free; 975 } 976 977 mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~(MNT_WRITE_HOLD|MNT_MARKED); 978 /* Don't allow unprivileged users to change mount flags */ 979 if (flag & CL_UNPRIVILEGED) { 980 mnt->mnt.mnt_flags |= MNT_LOCK_ATIME; 981 982 if (mnt->mnt.mnt_flags & MNT_READONLY) 983 mnt->mnt.mnt_flags |= MNT_LOCK_READONLY; 984 985 if (mnt->mnt.mnt_flags & MNT_NODEV) 986 mnt->mnt.mnt_flags |= MNT_LOCK_NODEV; 987 988 if (mnt->mnt.mnt_flags & MNT_NOSUID) 989 mnt->mnt.mnt_flags |= MNT_LOCK_NOSUID; 990 991 if (mnt->mnt.mnt_flags & MNT_NOEXEC) 992 mnt->mnt.mnt_flags |= MNT_LOCK_NOEXEC; 993 } 994 995 /* Don't allow unprivileged users to reveal what is under a mount */ 996 if ((flag & CL_UNPRIVILEGED) && 997 (!(flag & CL_EXPIRE) || list_empty(&old->mnt_expire))) 998 mnt->mnt.mnt_flags |= MNT_LOCKED; 999 1000 atomic_inc(&sb->s_active); 1001 mnt->mnt.mnt_sb = sb; 1002 mnt->mnt.mnt_root = dget(root); 1003 mnt->mnt_mountpoint = mnt->mnt.mnt_root; 1004 mnt->mnt_parent = mnt; 1005 lock_mount_hash(); 1006 list_add_tail(&mnt->mnt_instance, &sb->s_mounts); 1007 unlock_mount_hash(); 1008 1009 if ((flag & CL_SLAVE) || 1010 ((flag & CL_SHARED_TO_SLAVE) && IS_MNT_SHARED(old))) { 1011 list_add(&mnt->mnt_slave, &old->mnt_slave_list); 1012 mnt->mnt_master = old; 1013 CLEAR_MNT_SHARED(mnt); 1014 } else if (!(flag & CL_PRIVATE)) { 1015 if ((flag & CL_MAKE_SHARED) || IS_MNT_SHARED(old)) 1016 list_add(&mnt->mnt_share, &old->mnt_share); 1017 if (IS_MNT_SLAVE(old)) 1018 list_add(&mnt->mnt_slave, &old->mnt_slave); 1019 mnt->mnt_master = old->mnt_master; 1020 } 1021 if (flag & CL_MAKE_SHARED) 1022 set_mnt_shared(mnt); 1023 1024 /* stick the duplicate mount on the same expiry list 1025 * as the original if that was on one */ 1026 if (flag & CL_EXPIRE) { 1027 if (!list_empty(&old->mnt_expire)) 1028 list_add(&mnt->mnt_expire, &old->mnt_expire); 1029 } 1030 1031 return mnt; 1032 1033 out_free: 1034 mnt_free_id(mnt); 1035 free_vfsmnt(mnt); 1036 return ERR_PTR(err); 1037 } 1038 1039 static void cleanup_mnt(struct mount *mnt) 1040 { 1041 /* 1042 * This probably indicates that somebody messed 1043 * up a mnt_want/drop_write() pair. If this 1044 * happens, the filesystem was probably unable 1045 * to make r/w->r/o transitions. 1046 */ 1047 /* 1048 * The locking used to deal with mnt_count decrement provides barriers, 1049 * so mnt_get_writers() below is safe. 1050 */ 1051 WARN_ON(mnt_get_writers(mnt)); 1052 if (unlikely(mnt->mnt_pins.first)) 1053 mnt_pin_kill(mnt); 1054 fsnotify_vfsmount_delete(&mnt->mnt); 1055 dput(mnt->mnt.mnt_root); 1056 deactivate_super(mnt->mnt.mnt_sb); 1057 mnt_free_id(mnt); 1058 call_rcu(&mnt->mnt_rcu, delayed_free_vfsmnt); 1059 } 1060 1061 static void __cleanup_mnt(struct rcu_head *head) 1062 { 1063 cleanup_mnt(container_of(head, struct mount, mnt_rcu)); 1064 } 1065 1066 static LLIST_HEAD(delayed_mntput_list); 1067 static void delayed_mntput(struct work_struct *unused) 1068 { 1069 struct llist_node *node = llist_del_all(&delayed_mntput_list); 1070 struct llist_node *next; 1071 1072 for (; node; node = next) { 1073 next = llist_next(node); 1074 cleanup_mnt(llist_entry(node, struct mount, mnt_llist)); 1075 } 1076 } 1077 static DECLARE_DELAYED_WORK(delayed_mntput_work, delayed_mntput); 1078 1079 static void mntput_no_expire(struct mount *mnt) 1080 { 1081 rcu_read_lock(); 1082 mnt_add_count(mnt, -1); 1083 if (likely(mnt->mnt_ns)) { /* shouldn't be the last one */ 1084 rcu_read_unlock(); 1085 return; 1086 } 1087 lock_mount_hash(); 1088 if (mnt_get_count(mnt)) { 1089 rcu_read_unlock(); 1090 unlock_mount_hash(); 1091 return; 1092 } 1093 if (unlikely(mnt->mnt.mnt_flags & MNT_DOOMED)) { 1094 rcu_read_unlock(); 1095 unlock_mount_hash(); 1096 return; 1097 } 1098 mnt->mnt.mnt_flags |= MNT_DOOMED; 1099 rcu_read_unlock(); 1100 1101 list_del(&mnt->mnt_instance); 1102 1103 if (unlikely(!list_empty(&mnt->mnt_mounts))) { 1104 struct mount *p, *tmp; 1105 list_for_each_entry_safe(p, tmp, &mnt->mnt_mounts, mnt_child) { 1106 umount_mnt(p); 1107 } 1108 } 1109 unlock_mount_hash(); 1110 1111 if (likely(!(mnt->mnt.mnt_flags & MNT_INTERNAL))) { 1112 struct task_struct *task = current; 1113 if (likely(!(task->flags & PF_KTHREAD))) { 1114 init_task_work(&mnt->mnt_rcu, __cleanup_mnt); 1115 if (!task_work_add(task, &mnt->mnt_rcu, true)) 1116 return; 1117 } 1118 if (llist_add(&mnt->mnt_llist, &delayed_mntput_list)) 1119 schedule_delayed_work(&delayed_mntput_work, 1); 1120 return; 1121 } 1122 cleanup_mnt(mnt); 1123 } 1124 1125 void mntput(struct vfsmount *mnt) 1126 { 1127 if (mnt) { 1128 struct mount *m = real_mount(mnt); 1129 /* avoid cacheline pingpong, hope gcc doesn't get "smart" */ 1130 if (unlikely(m->mnt_expiry_mark)) 1131 m->mnt_expiry_mark = 0; 1132 mntput_no_expire(m); 1133 } 1134 } 1135 EXPORT_SYMBOL(mntput); 1136 1137 struct vfsmount *mntget(struct vfsmount *mnt) 1138 { 1139 if (mnt) 1140 mnt_add_count(real_mount(mnt), 1); 1141 return mnt; 1142 } 1143 EXPORT_SYMBOL(mntget); 1144 1145 struct vfsmount *mnt_clone_internal(struct path *path) 1146 { 1147 struct mount *p; 1148 p = clone_mnt(real_mount(path->mnt), path->dentry, CL_PRIVATE); 1149 if (IS_ERR(p)) 1150 return ERR_CAST(p); 1151 p->mnt.mnt_flags |= MNT_INTERNAL; 1152 return &p->mnt; 1153 } 1154 1155 static inline void mangle(struct seq_file *m, const char *s) 1156 { 1157 seq_escape(m, s, " \t\n\\"); 1158 } 1159 1160 /* 1161 * Simple .show_options callback for filesystems which don't want to 1162 * implement more complex mount option showing. 1163 * 1164 * See also save_mount_options(). 1165 */ 1166 int generic_show_options(struct seq_file *m, struct dentry *root) 1167 { 1168 const char *options; 1169 1170 rcu_read_lock(); 1171 options = rcu_dereference(root->d_sb->s_options); 1172 1173 if (options != NULL && options[0]) { 1174 seq_putc(m, ','); 1175 mangle(m, options); 1176 } 1177 rcu_read_unlock(); 1178 1179 return 0; 1180 } 1181 EXPORT_SYMBOL(generic_show_options); 1182 1183 /* 1184 * If filesystem uses generic_show_options(), this function should be 1185 * called from the fill_super() callback. 1186 * 1187 * The .remount_fs callback usually needs to be handled in a special 1188 * way, to make sure, that previous options are not overwritten if the 1189 * remount fails. 1190 * 1191 * Also note, that if the filesystem's .remount_fs function doesn't 1192 * reset all options to their default value, but changes only newly 1193 * given options, then the displayed options will not reflect reality 1194 * any more. 1195 */ 1196 void save_mount_options(struct super_block *sb, char *options) 1197 { 1198 BUG_ON(sb->s_options); 1199 rcu_assign_pointer(sb->s_options, kstrdup(options, GFP_KERNEL)); 1200 } 1201 EXPORT_SYMBOL(save_mount_options); 1202 1203 void replace_mount_options(struct super_block *sb, char *options) 1204 { 1205 char *old = sb->s_options; 1206 rcu_assign_pointer(sb->s_options, options); 1207 if (old) { 1208 synchronize_rcu(); 1209 kfree(old); 1210 } 1211 } 1212 EXPORT_SYMBOL(replace_mount_options); 1213 1214 #ifdef CONFIG_PROC_FS 1215 /* iterator; we want it to have access to namespace_sem, thus here... */ 1216 static void *m_start(struct seq_file *m, loff_t *pos) 1217 { 1218 struct proc_mounts *p = proc_mounts(m); 1219 1220 down_read(&namespace_sem); 1221 if (p->cached_event == p->ns->event) { 1222 void *v = p->cached_mount; 1223 if (*pos == p->cached_index) 1224 return v; 1225 if (*pos == p->cached_index + 1) { 1226 v = seq_list_next(v, &p->ns->list, &p->cached_index); 1227 return p->cached_mount = v; 1228 } 1229 } 1230 1231 p->cached_event = p->ns->event; 1232 p->cached_mount = seq_list_start(&p->ns->list, *pos); 1233 p->cached_index = *pos; 1234 return p->cached_mount; 1235 } 1236 1237 static void *m_next(struct seq_file *m, void *v, loff_t *pos) 1238 { 1239 struct proc_mounts *p = proc_mounts(m); 1240 1241 p->cached_mount = seq_list_next(v, &p->ns->list, pos); 1242 p->cached_index = *pos; 1243 return p->cached_mount; 1244 } 1245 1246 static void m_stop(struct seq_file *m, void *v) 1247 { 1248 up_read(&namespace_sem); 1249 } 1250 1251 static int m_show(struct seq_file *m, void *v) 1252 { 1253 struct proc_mounts *p = proc_mounts(m); 1254 struct mount *r = list_entry(v, struct mount, mnt_list); 1255 return p->show(m, &r->mnt); 1256 } 1257 1258 const struct seq_operations mounts_op = { 1259 .start = m_start, 1260 .next = m_next, 1261 .stop = m_stop, 1262 .show = m_show, 1263 }; 1264 #endif /* CONFIG_PROC_FS */ 1265 1266 /** 1267 * may_umount_tree - check if a mount tree is busy 1268 * @mnt: root of mount tree 1269 * 1270 * This is called to check if a tree of mounts has any 1271 * open files, pwds, chroots or sub mounts that are 1272 * busy. 1273 */ 1274 int may_umount_tree(struct vfsmount *m) 1275 { 1276 struct mount *mnt = real_mount(m); 1277 int actual_refs = 0; 1278 int minimum_refs = 0; 1279 struct mount *p; 1280 BUG_ON(!m); 1281 1282 /* write lock needed for mnt_get_count */ 1283 lock_mount_hash(); 1284 for (p = mnt; p; p = next_mnt(p, mnt)) { 1285 actual_refs += mnt_get_count(p); 1286 minimum_refs += 2; 1287 } 1288 unlock_mount_hash(); 1289 1290 if (actual_refs > minimum_refs) 1291 return 0; 1292 1293 return 1; 1294 } 1295 1296 EXPORT_SYMBOL(may_umount_tree); 1297 1298 /** 1299 * may_umount - check if a mount point is busy 1300 * @mnt: root of mount 1301 * 1302 * This is called to check if a mount point has any 1303 * open files, pwds, chroots or sub mounts. If the 1304 * mount has sub mounts this will return busy 1305 * regardless of whether the sub mounts are busy. 1306 * 1307 * Doesn't take quota and stuff into account. IOW, in some cases it will 1308 * give false negatives. The main reason why it's here is that we need 1309 * a non-destructive way to look for easily umountable filesystems. 1310 */ 1311 int may_umount(struct vfsmount *mnt) 1312 { 1313 int ret = 1; 1314 down_read(&namespace_sem); 1315 lock_mount_hash(); 1316 if (propagate_mount_busy(real_mount(mnt), 2)) 1317 ret = 0; 1318 unlock_mount_hash(); 1319 up_read(&namespace_sem); 1320 return ret; 1321 } 1322 1323 EXPORT_SYMBOL(may_umount); 1324 1325 static HLIST_HEAD(unmounted); /* protected by namespace_sem */ 1326 1327 static void namespace_unlock(void) 1328 { 1329 struct hlist_head head = unmounted; 1330 1331 if (likely(hlist_empty(&head))) { 1332 up_write(&namespace_sem); 1333 return; 1334 } 1335 1336 head.first->pprev = &head.first; 1337 INIT_HLIST_HEAD(&unmounted); 1338 up_write(&namespace_sem); 1339 1340 synchronize_rcu(); 1341 1342 group_pin_kill(&head); 1343 } 1344 1345 static inline void namespace_lock(void) 1346 { 1347 down_write(&namespace_sem); 1348 } 1349 1350 enum umount_tree_flags { 1351 UMOUNT_SYNC = 1, 1352 UMOUNT_PROPAGATE = 2, 1353 UMOUNT_CONNECTED = 4, 1354 }; 1355 /* 1356 * mount_lock must be held 1357 * namespace_sem must be held for write 1358 */ 1359 static void umount_tree(struct mount *mnt, enum umount_tree_flags how) 1360 { 1361 LIST_HEAD(tmp_list); 1362 struct mount *p; 1363 1364 if (how & UMOUNT_PROPAGATE) 1365 propagate_mount_unlock(mnt); 1366 1367 /* Gather the mounts to umount */ 1368 for (p = mnt; p; p = next_mnt(p, mnt)) { 1369 p->mnt.mnt_flags |= MNT_UMOUNT; 1370 list_move(&p->mnt_list, &tmp_list); 1371 } 1372 1373 /* Hide the mounts from mnt_mounts */ 1374 list_for_each_entry(p, &tmp_list, mnt_list) { 1375 list_del_init(&p->mnt_child); 1376 } 1377 1378 /* Add propogated mounts to the tmp_list */ 1379 if (how & UMOUNT_PROPAGATE) 1380 propagate_umount(&tmp_list); 1381 1382 while (!list_empty(&tmp_list)) { 1383 bool disconnect; 1384 p = list_first_entry(&tmp_list, struct mount, mnt_list); 1385 list_del_init(&p->mnt_expire); 1386 list_del_init(&p->mnt_list); 1387 __touch_mnt_namespace(p->mnt_ns); 1388 p->mnt_ns = NULL; 1389 if (how & UMOUNT_SYNC) 1390 p->mnt.mnt_flags |= MNT_SYNC_UMOUNT; 1391 1392 disconnect = !(((how & UMOUNT_CONNECTED) && 1393 mnt_has_parent(p) && 1394 (p->mnt_parent->mnt.mnt_flags & MNT_UMOUNT)) || 1395 IS_MNT_LOCKED_AND_LAZY(p)); 1396 1397 pin_insert_group(&p->mnt_umount, &p->mnt_parent->mnt, 1398 disconnect ? &unmounted : NULL); 1399 if (mnt_has_parent(p)) { 1400 mnt_add_count(p->mnt_parent, -1); 1401 if (!disconnect) { 1402 /* Don't forget about p */ 1403 list_add_tail(&p->mnt_child, &p->mnt_parent->mnt_mounts); 1404 } else { 1405 umount_mnt(p); 1406 } 1407 } 1408 change_mnt_propagation(p, MS_PRIVATE); 1409 } 1410 } 1411 1412 static void shrink_submounts(struct mount *mnt); 1413 1414 static int do_umount(struct mount *mnt, int flags) 1415 { 1416 struct super_block *sb = mnt->mnt.mnt_sb; 1417 int retval; 1418 1419 retval = security_sb_umount(&mnt->mnt, flags); 1420 if (retval) 1421 return retval; 1422 1423 /* 1424 * Allow userspace to request a mountpoint be expired rather than 1425 * unmounting unconditionally. Unmount only happens if: 1426 * (1) the mark is already set (the mark is cleared by mntput()) 1427 * (2) the usage count == 1 [parent vfsmount] + 1 [sys_umount] 1428 */ 1429 if (flags & MNT_EXPIRE) { 1430 if (&mnt->mnt == current->fs->root.mnt || 1431 flags & (MNT_FORCE | MNT_DETACH)) 1432 return -EINVAL; 1433 1434 /* 1435 * probably don't strictly need the lock here if we examined 1436 * all race cases, but it's a slowpath. 1437 */ 1438 lock_mount_hash(); 1439 if (mnt_get_count(mnt) != 2) { 1440 unlock_mount_hash(); 1441 return -EBUSY; 1442 } 1443 unlock_mount_hash(); 1444 1445 if (!xchg(&mnt->mnt_expiry_mark, 1)) 1446 return -EAGAIN; 1447 } 1448 1449 /* 1450 * If we may have to abort operations to get out of this 1451 * mount, and they will themselves hold resources we must 1452 * allow the fs to do things. In the Unix tradition of 1453 * 'Gee thats tricky lets do it in userspace' the umount_begin 1454 * might fail to complete on the first run through as other tasks 1455 * must return, and the like. Thats for the mount program to worry 1456 * about for the moment. 1457 */ 1458 1459 if (flags & MNT_FORCE && sb->s_op->umount_begin) { 1460 sb->s_op->umount_begin(sb); 1461 } 1462 1463 /* 1464 * No sense to grab the lock for this test, but test itself looks 1465 * somewhat bogus. Suggestions for better replacement? 1466 * Ho-hum... In principle, we might treat that as umount + switch 1467 * to rootfs. GC would eventually take care of the old vfsmount. 1468 * Actually it makes sense, especially if rootfs would contain a 1469 * /reboot - static binary that would close all descriptors and 1470 * call reboot(9). Then init(8) could umount root and exec /reboot. 1471 */ 1472 if (&mnt->mnt == current->fs->root.mnt && !(flags & MNT_DETACH)) { 1473 /* 1474 * Special case for "unmounting" root ... 1475 * we just try to remount it readonly. 1476 */ 1477 if (!capable(CAP_SYS_ADMIN)) 1478 return -EPERM; 1479 down_write(&sb->s_umount); 1480 if (!(sb->s_flags & MS_RDONLY)) 1481 retval = do_remount_sb(sb, MS_RDONLY, NULL, 0); 1482 up_write(&sb->s_umount); 1483 return retval; 1484 } 1485 1486 namespace_lock(); 1487 lock_mount_hash(); 1488 event++; 1489 1490 if (flags & MNT_DETACH) { 1491 if (!list_empty(&mnt->mnt_list)) 1492 umount_tree(mnt, UMOUNT_PROPAGATE); 1493 retval = 0; 1494 } else { 1495 shrink_submounts(mnt); 1496 retval = -EBUSY; 1497 if (!propagate_mount_busy(mnt, 2)) { 1498 if (!list_empty(&mnt->mnt_list)) 1499 umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC); 1500 retval = 0; 1501 } 1502 } 1503 unlock_mount_hash(); 1504 namespace_unlock(); 1505 return retval; 1506 } 1507 1508 /* 1509 * __detach_mounts - lazily unmount all mounts on the specified dentry 1510 * 1511 * During unlink, rmdir, and d_drop it is possible to loose the path 1512 * to an existing mountpoint, and wind up leaking the mount. 1513 * detach_mounts allows lazily unmounting those mounts instead of 1514 * leaking them. 1515 * 1516 * The caller may hold dentry->d_inode->i_mutex. 1517 */ 1518 void __detach_mounts(struct dentry *dentry) 1519 { 1520 struct mountpoint *mp; 1521 struct mount *mnt; 1522 1523 namespace_lock(); 1524 mp = lookup_mountpoint(dentry); 1525 if (IS_ERR_OR_NULL(mp)) 1526 goto out_unlock; 1527 1528 lock_mount_hash(); 1529 while (!hlist_empty(&mp->m_list)) { 1530 mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list); 1531 if (mnt->mnt.mnt_flags & MNT_UMOUNT) { 1532 struct mount *p, *tmp; 1533 list_for_each_entry_safe(p, tmp, &mnt->mnt_mounts, mnt_child) { 1534 hlist_add_head(&p->mnt_umount.s_list, &unmounted); 1535 umount_mnt(p); 1536 } 1537 } 1538 else umount_tree(mnt, UMOUNT_CONNECTED); 1539 } 1540 unlock_mount_hash(); 1541 put_mountpoint(mp); 1542 out_unlock: 1543 namespace_unlock(); 1544 } 1545 1546 /* 1547 * Is the caller allowed to modify his namespace? 1548 */ 1549 static inline bool may_mount(void) 1550 { 1551 return ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN); 1552 } 1553 1554 /* 1555 * Now umount can handle mount points as well as block devices. 1556 * This is important for filesystems which use unnamed block devices. 1557 * 1558 * We now support a flag for forced unmount like the other 'big iron' 1559 * unixes. Our API is identical to OSF/1 to avoid making a mess of AMD 1560 */ 1561 1562 SYSCALL_DEFINE2(umount, char __user *, name, int, flags) 1563 { 1564 struct path path; 1565 struct mount *mnt; 1566 int retval; 1567 int lookup_flags = 0; 1568 1569 if (flags & ~(MNT_FORCE | MNT_DETACH | MNT_EXPIRE | UMOUNT_NOFOLLOW)) 1570 return -EINVAL; 1571 1572 if (!may_mount()) 1573 return -EPERM; 1574 1575 if (!(flags & UMOUNT_NOFOLLOW)) 1576 lookup_flags |= LOOKUP_FOLLOW; 1577 1578 retval = user_path_mountpoint_at(AT_FDCWD, name, lookup_flags, &path); 1579 if (retval) 1580 goto out; 1581 mnt = real_mount(path.mnt); 1582 retval = -EINVAL; 1583 if (path.dentry != path.mnt->mnt_root) 1584 goto dput_and_out; 1585 if (!check_mnt(mnt)) 1586 goto dput_and_out; 1587 if (mnt->mnt.mnt_flags & MNT_LOCKED) 1588 goto dput_and_out; 1589 retval = -EPERM; 1590 if (flags & MNT_FORCE && !capable(CAP_SYS_ADMIN)) 1591 goto dput_and_out; 1592 1593 retval = do_umount(mnt, flags); 1594 dput_and_out: 1595 /* we mustn't call path_put() as that would clear mnt_expiry_mark */ 1596 dput(path.dentry); 1597 mntput_no_expire(mnt); 1598 out: 1599 return retval; 1600 } 1601 1602 #ifdef __ARCH_WANT_SYS_OLDUMOUNT 1603 1604 /* 1605 * The 2.0 compatible umount. No flags. 1606 */ 1607 SYSCALL_DEFINE1(oldumount, char __user *, name) 1608 { 1609 return sys_umount(name, 0); 1610 } 1611 1612 #endif 1613 1614 static bool is_mnt_ns_file(struct dentry *dentry) 1615 { 1616 /* Is this a proxy for a mount namespace? */ 1617 return dentry->d_op == &ns_dentry_operations && 1618 dentry->d_fsdata == &mntns_operations; 1619 } 1620 1621 struct mnt_namespace *to_mnt_ns(struct ns_common *ns) 1622 { 1623 return container_of(ns, struct mnt_namespace, ns); 1624 } 1625 1626 static bool mnt_ns_loop(struct dentry *dentry) 1627 { 1628 /* Could bind mounting the mount namespace inode cause a 1629 * mount namespace loop? 1630 */ 1631 struct mnt_namespace *mnt_ns; 1632 if (!is_mnt_ns_file(dentry)) 1633 return false; 1634 1635 mnt_ns = to_mnt_ns(get_proc_ns(dentry->d_inode)); 1636 return current->nsproxy->mnt_ns->seq >= mnt_ns->seq; 1637 } 1638 1639 struct mount *copy_tree(struct mount *mnt, struct dentry *dentry, 1640 int flag) 1641 { 1642 struct mount *res, *p, *q, *r, *parent; 1643 1644 if (!(flag & CL_COPY_UNBINDABLE) && IS_MNT_UNBINDABLE(mnt)) 1645 return ERR_PTR(-EINVAL); 1646 1647 if (!(flag & CL_COPY_MNT_NS_FILE) && is_mnt_ns_file(dentry)) 1648 return ERR_PTR(-EINVAL); 1649 1650 res = q = clone_mnt(mnt, dentry, flag); 1651 if (IS_ERR(q)) 1652 return q; 1653 1654 q->mnt_mountpoint = mnt->mnt_mountpoint; 1655 1656 p = mnt; 1657 list_for_each_entry(r, &mnt->mnt_mounts, mnt_child) { 1658 struct mount *s; 1659 if (!is_subdir(r->mnt_mountpoint, dentry)) 1660 continue; 1661 1662 for (s = r; s; s = next_mnt(s, r)) { 1663 struct mount *t = NULL; 1664 if (!(flag & CL_COPY_UNBINDABLE) && 1665 IS_MNT_UNBINDABLE(s)) { 1666 s = skip_mnt_tree(s); 1667 continue; 1668 } 1669 if (!(flag & CL_COPY_MNT_NS_FILE) && 1670 is_mnt_ns_file(s->mnt.mnt_root)) { 1671 s = skip_mnt_tree(s); 1672 continue; 1673 } 1674 while (p != s->mnt_parent) { 1675 p = p->mnt_parent; 1676 q = q->mnt_parent; 1677 } 1678 p = s; 1679 parent = q; 1680 q = clone_mnt(p, p->mnt.mnt_root, flag); 1681 if (IS_ERR(q)) 1682 goto out; 1683 lock_mount_hash(); 1684 list_add_tail(&q->mnt_list, &res->mnt_list); 1685 mnt_set_mountpoint(parent, p->mnt_mp, q); 1686 if (!list_empty(&parent->mnt_mounts)) { 1687 t = list_last_entry(&parent->mnt_mounts, 1688 struct mount, mnt_child); 1689 if (t->mnt_mp != p->mnt_mp) 1690 t = NULL; 1691 } 1692 attach_shadowed(q, parent, t); 1693 unlock_mount_hash(); 1694 } 1695 } 1696 return res; 1697 out: 1698 if (res) { 1699 lock_mount_hash(); 1700 umount_tree(res, UMOUNT_SYNC); 1701 unlock_mount_hash(); 1702 } 1703 return q; 1704 } 1705 1706 /* Caller should check returned pointer for errors */ 1707 1708 struct vfsmount *collect_mounts(struct path *path) 1709 { 1710 struct mount *tree; 1711 namespace_lock(); 1712 if (!check_mnt(real_mount(path->mnt))) 1713 tree = ERR_PTR(-EINVAL); 1714 else 1715 tree = copy_tree(real_mount(path->mnt), path->dentry, 1716 CL_COPY_ALL | CL_PRIVATE); 1717 namespace_unlock(); 1718 if (IS_ERR(tree)) 1719 return ERR_CAST(tree); 1720 return &tree->mnt; 1721 } 1722 1723 void drop_collected_mounts(struct vfsmount *mnt) 1724 { 1725 namespace_lock(); 1726 lock_mount_hash(); 1727 umount_tree(real_mount(mnt), UMOUNT_SYNC); 1728 unlock_mount_hash(); 1729 namespace_unlock(); 1730 } 1731 1732 /** 1733 * clone_private_mount - create a private clone of a path 1734 * 1735 * This creates a new vfsmount, which will be the clone of @path. The new will 1736 * not be attached anywhere in the namespace and will be private (i.e. changes 1737 * to the originating mount won't be propagated into this). 1738 * 1739 * Release with mntput(). 1740 */ 1741 struct vfsmount *clone_private_mount(struct path *path) 1742 { 1743 struct mount *old_mnt = real_mount(path->mnt); 1744 struct mount *new_mnt; 1745 1746 if (IS_MNT_UNBINDABLE(old_mnt)) 1747 return ERR_PTR(-EINVAL); 1748 1749 down_read(&namespace_sem); 1750 new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE); 1751 up_read(&namespace_sem); 1752 if (IS_ERR(new_mnt)) 1753 return ERR_CAST(new_mnt); 1754 1755 return &new_mnt->mnt; 1756 } 1757 EXPORT_SYMBOL_GPL(clone_private_mount); 1758 1759 int iterate_mounts(int (*f)(struct vfsmount *, void *), void *arg, 1760 struct vfsmount *root) 1761 { 1762 struct mount *mnt; 1763 int res = f(root, arg); 1764 if (res) 1765 return res; 1766 list_for_each_entry(mnt, &real_mount(root)->mnt_list, mnt_list) { 1767 res = f(&mnt->mnt, arg); 1768 if (res) 1769 return res; 1770 } 1771 return 0; 1772 } 1773 1774 static void cleanup_group_ids(struct mount *mnt, struct mount *end) 1775 { 1776 struct mount *p; 1777 1778 for (p = mnt; p != end; p = next_mnt(p, mnt)) { 1779 if (p->mnt_group_id && !IS_MNT_SHARED(p)) 1780 mnt_release_group_id(p); 1781 } 1782 } 1783 1784 static int invent_group_ids(struct mount *mnt, bool recurse) 1785 { 1786 struct mount *p; 1787 1788 for (p = mnt; p; p = recurse ? next_mnt(p, mnt) : NULL) { 1789 if (!p->mnt_group_id && !IS_MNT_SHARED(p)) { 1790 int err = mnt_alloc_group_id(p); 1791 if (err) { 1792 cleanup_group_ids(mnt, p); 1793 return err; 1794 } 1795 } 1796 } 1797 1798 return 0; 1799 } 1800 1801 /* 1802 * @source_mnt : mount tree to be attached 1803 * @nd : place the mount tree @source_mnt is attached 1804 * @parent_nd : if non-null, detach the source_mnt from its parent and 1805 * store the parent mount and mountpoint dentry. 1806 * (done when source_mnt is moved) 1807 * 1808 * NOTE: in the table below explains the semantics when a source mount 1809 * of a given type is attached to a destination mount of a given type. 1810 * --------------------------------------------------------------------------- 1811 * | BIND MOUNT OPERATION | 1812 * |************************************************************************** 1813 * | source-->| shared | private | slave | unbindable | 1814 * | dest | | | | | 1815 * | | | | | | | 1816 * | v | | | | | 1817 * |************************************************************************** 1818 * | shared | shared (++) | shared (+) | shared(+++)| invalid | 1819 * | | | | | | 1820 * |non-shared| shared (+) | private | slave (*) | invalid | 1821 * *************************************************************************** 1822 * A bind operation clones the source mount and mounts the clone on the 1823 * destination mount. 1824 * 1825 * (++) the cloned mount is propagated to all the mounts in the propagation 1826 * tree of the destination mount and the cloned mount is added to 1827 * the peer group of the source mount. 1828 * (+) the cloned mount is created under the destination mount and is marked 1829 * as shared. The cloned mount is added to the peer group of the source 1830 * mount. 1831 * (+++) the mount is propagated to all the mounts in the propagation tree 1832 * of the destination mount and the cloned mount is made slave 1833 * of the same master as that of the source mount. The cloned mount 1834 * is marked as 'shared and slave'. 1835 * (*) the cloned mount is made a slave of the same master as that of the 1836 * source mount. 1837 * 1838 * --------------------------------------------------------------------------- 1839 * | MOVE MOUNT OPERATION | 1840 * |************************************************************************** 1841 * | source-->| shared | private | slave | unbindable | 1842 * | dest | | | | | 1843 * | | | | | | | 1844 * | v | | | | | 1845 * |************************************************************************** 1846 * | shared | shared (+) | shared (+) | shared(+++) | invalid | 1847 * | | | | | | 1848 * |non-shared| shared (+*) | private | slave (*) | unbindable | 1849 * *************************************************************************** 1850 * 1851 * (+) the mount is moved to the destination. And is then propagated to 1852 * all the mounts in the propagation tree of the destination mount. 1853 * (+*) the mount is moved to the destination. 1854 * (+++) the mount is moved to the destination and is then propagated to 1855 * all the mounts belonging to the destination mount's propagation tree. 1856 * the mount is marked as 'shared and slave'. 1857 * (*) the mount continues to be a slave at the new location. 1858 * 1859 * if the source mount is a tree, the operations explained above is 1860 * applied to each mount in the tree. 1861 * Must be called without spinlocks held, since this function can sleep 1862 * in allocations. 1863 */ 1864 static int attach_recursive_mnt(struct mount *source_mnt, 1865 struct mount *dest_mnt, 1866 struct mountpoint *dest_mp, 1867 struct path *parent_path) 1868 { 1869 HLIST_HEAD(tree_list); 1870 struct mount *child, *p; 1871 struct hlist_node *n; 1872 int err; 1873 1874 if (IS_MNT_SHARED(dest_mnt)) { 1875 err = invent_group_ids(source_mnt, true); 1876 if (err) 1877 goto out; 1878 err = propagate_mnt(dest_mnt, dest_mp, source_mnt, &tree_list); 1879 lock_mount_hash(); 1880 if (err) 1881 goto out_cleanup_ids; 1882 for (p = source_mnt; p; p = next_mnt(p, source_mnt)) 1883 set_mnt_shared(p); 1884 } else { 1885 lock_mount_hash(); 1886 } 1887 if (parent_path) { 1888 detach_mnt(source_mnt, parent_path); 1889 attach_mnt(source_mnt, dest_mnt, dest_mp); 1890 touch_mnt_namespace(source_mnt->mnt_ns); 1891 } else { 1892 mnt_set_mountpoint(dest_mnt, dest_mp, source_mnt); 1893 commit_tree(source_mnt, NULL); 1894 } 1895 1896 hlist_for_each_entry_safe(child, n, &tree_list, mnt_hash) { 1897 struct mount *q; 1898 hlist_del_init(&child->mnt_hash); 1899 q = __lookup_mnt_last(&child->mnt_parent->mnt, 1900 child->mnt_mountpoint); 1901 commit_tree(child, q); 1902 } 1903 unlock_mount_hash(); 1904 1905 return 0; 1906 1907 out_cleanup_ids: 1908 while (!hlist_empty(&tree_list)) { 1909 child = hlist_entry(tree_list.first, struct mount, mnt_hash); 1910 umount_tree(child, UMOUNT_SYNC); 1911 } 1912 unlock_mount_hash(); 1913 cleanup_group_ids(source_mnt, NULL); 1914 out: 1915 return err; 1916 } 1917 1918 static struct mountpoint *lock_mount(struct path *path) 1919 { 1920 struct vfsmount *mnt; 1921 struct dentry *dentry = path->dentry; 1922 retry: 1923 mutex_lock(&dentry->d_inode->i_mutex); 1924 if (unlikely(cant_mount(dentry))) { 1925 mutex_unlock(&dentry->d_inode->i_mutex); 1926 return ERR_PTR(-ENOENT); 1927 } 1928 namespace_lock(); 1929 mnt = lookup_mnt(path); 1930 if (likely(!mnt)) { 1931 struct mountpoint *mp = lookup_mountpoint(dentry); 1932 if (!mp) 1933 mp = new_mountpoint(dentry); 1934 if (IS_ERR(mp)) { 1935 namespace_unlock(); 1936 mutex_unlock(&dentry->d_inode->i_mutex); 1937 return mp; 1938 } 1939 return mp; 1940 } 1941 namespace_unlock(); 1942 mutex_unlock(&path->dentry->d_inode->i_mutex); 1943 path_put(path); 1944 path->mnt = mnt; 1945 dentry = path->dentry = dget(mnt->mnt_root); 1946 goto retry; 1947 } 1948 1949 static void unlock_mount(struct mountpoint *where) 1950 { 1951 struct dentry *dentry = where->m_dentry; 1952 put_mountpoint(where); 1953 namespace_unlock(); 1954 mutex_unlock(&dentry->d_inode->i_mutex); 1955 } 1956 1957 static int graft_tree(struct mount *mnt, struct mount *p, struct mountpoint *mp) 1958 { 1959 if (mnt->mnt.mnt_sb->s_flags & MS_NOUSER) 1960 return -EINVAL; 1961 1962 if (d_is_dir(mp->m_dentry) != 1963 d_is_dir(mnt->mnt.mnt_root)) 1964 return -ENOTDIR; 1965 1966 return attach_recursive_mnt(mnt, p, mp, NULL); 1967 } 1968 1969 /* 1970 * Sanity check the flags to change_mnt_propagation. 1971 */ 1972 1973 static int flags_to_propagation_type(int flags) 1974 { 1975 int type = flags & ~(MS_REC | MS_SILENT); 1976 1977 /* Fail if any non-propagation flags are set */ 1978 if (type & ~(MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE)) 1979 return 0; 1980 /* Only one propagation flag should be set */ 1981 if (!is_power_of_2(type)) 1982 return 0; 1983 return type; 1984 } 1985 1986 /* 1987 * recursively change the type of the mountpoint. 1988 */ 1989 static int do_change_type(struct path *path, int flag) 1990 { 1991 struct mount *m; 1992 struct mount *mnt = real_mount(path->mnt); 1993 int recurse = flag & MS_REC; 1994 int type; 1995 int err = 0; 1996 1997 if (path->dentry != path->mnt->mnt_root) 1998 return -EINVAL; 1999 2000 type = flags_to_propagation_type(flag); 2001 if (!type) 2002 return -EINVAL; 2003 2004 namespace_lock(); 2005 if (type == MS_SHARED) { 2006 err = invent_group_ids(mnt, recurse); 2007 if (err) 2008 goto out_unlock; 2009 } 2010 2011 lock_mount_hash(); 2012 for (m = mnt; m; m = (recurse ? next_mnt(m, mnt) : NULL)) 2013 change_mnt_propagation(m, type); 2014 unlock_mount_hash(); 2015 2016 out_unlock: 2017 namespace_unlock(); 2018 return err; 2019 } 2020 2021 static bool has_locked_children(struct mount *mnt, struct dentry *dentry) 2022 { 2023 struct mount *child; 2024 list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { 2025 if (!is_subdir(child->mnt_mountpoint, dentry)) 2026 continue; 2027 2028 if (child->mnt.mnt_flags & MNT_LOCKED) 2029 return true; 2030 } 2031 return false; 2032 } 2033 2034 /* 2035 * do loopback mount. 2036 */ 2037 static int do_loopback(struct path *path, const char *old_name, 2038 int recurse) 2039 { 2040 struct path old_path; 2041 struct mount *mnt = NULL, *old, *parent; 2042 struct mountpoint *mp; 2043 int err; 2044 if (!old_name || !*old_name) 2045 return -EINVAL; 2046 err = kern_path(old_name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &old_path); 2047 if (err) 2048 return err; 2049 2050 err = -EINVAL; 2051 if (mnt_ns_loop(old_path.dentry)) 2052 goto out; 2053 2054 mp = lock_mount(path); 2055 err = PTR_ERR(mp); 2056 if (IS_ERR(mp)) 2057 goto out; 2058 2059 old = real_mount(old_path.mnt); 2060 parent = real_mount(path->mnt); 2061 2062 err = -EINVAL; 2063 if (IS_MNT_UNBINDABLE(old)) 2064 goto out2; 2065 2066 if (!check_mnt(parent)) 2067 goto out2; 2068 2069 if (!check_mnt(old) && old_path.dentry->d_op != &ns_dentry_operations) 2070 goto out2; 2071 2072 if (!recurse && has_locked_children(old, old_path.dentry)) 2073 goto out2; 2074 2075 if (recurse) 2076 mnt = copy_tree(old, old_path.dentry, CL_COPY_MNT_NS_FILE); 2077 else 2078 mnt = clone_mnt(old, old_path.dentry, 0); 2079 2080 if (IS_ERR(mnt)) { 2081 err = PTR_ERR(mnt); 2082 goto out2; 2083 } 2084 2085 mnt->mnt.mnt_flags &= ~MNT_LOCKED; 2086 2087 err = graft_tree(mnt, parent, mp); 2088 if (err) { 2089 lock_mount_hash(); 2090 umount_tree(mnt, UMOUNT_SYNC); 2091 unlock_mount_hash(); 2092 } 2093 out2: 2094 unlock_mount(mp); 2095 out: 2096 path_put(&old_path); 2097 return err; 2098 } 2099 2100 static int change_mount_flags(struct vfsmount *mnt, int ms_flags) 2101 { 2102 int error = 0; 2103 int readonly_request = 0; 2104 2105 if (ms_flags & MS_RDONLY) 2106 readonly_request = 1; 2107 if (readonly_request == __mnt_is_readonly(mnt)) 2108 return 0; 2109 2110 if (readonly_request) 2111 error = mnt_make_readonly(real_mount(mnt)); 2112 else 2113 __mnt_unmake_readonly(real_mount(mnt)); 2114 return error; 2115 } 2116 2117 /* 2118 * change filesystem flags. dir should be a physical root of filesystem. 2119 * If you've mounted a non-root directory somewhere and want to do remount 2120 * on it - tough luck. 2121 */ 2122 static int do_remount(struct path *path, int flags, int mnt_flags, 2123 void *data) 2124 { 2125 int err; 2126 struct super_block *sb = path->mnt->mnt_sb; 2127 struct mount *mnt = real_mount(path->mnt); 2128 2129 if (!check_mnt(mnt)) 2130 return -EINVAL; 2131 2132 if (path->dentry != path->mnt->mnt_root) 2133 return -EINVAL; 2134 2135 /* Don't allow changing of locked mnt flags. 2136 * 2137 * No locks need to be held here while testing the various 2138 * MNT_LOCK flags because those flags can never be cleared 2139 * once they are set. 2140 */ 2141 if ((mnt->mnt.mnt_flags & MNT_LOCK_READONLY) && 2142 !(mnt_flags & MNT_READONLY)) { 2143 return -EPERM; 2144 } 2145 if ((mnt->mnt.mnt_flags & MNT_LOCK_NODEV) && 2146 !(mnt_flags & MNT_NODEV)) { 2147 /* Was the nodev implicitly added in mount? */ 2148 if ((mnt->mnt_ns->user_ns != &init_user_ns) && 2149 !(sb->s_type->fs_flags & FS_USERNS_DEV_MOUNT)) { 2150 mnt_flags |= MNT_NODEV; 2151 } else { 2152 return -EPERM; 2153 } 2154 } 2155 if ((mnt->mnt.mnt_flags & MNT_LOCK_NOSUID) && 2156 !(mnt_flags & MNT_NOSUID)) { 2157 return -EPERM; 2158 } 2159 if ((mnt->mnt.mnt_flags & MNT_LOCK_NOEXEC) && 2160 !(mnt_flags & MNT_NOEXEC)) { 2161 return -EPERM; 2162 } 2163 if ((mnt->mnt.mnt_flags & MNT_LOCK_ATIME) && 2164 ((mnt->mnt.mnt_flags & MNT_ATIME_MASK) != (mnt_flags & MNT_ATIME_MASK))) { 2165 return -EPERM; 2166 } 2167 2168 err = security_sb_remount(sb, data); 2169 if (err) 2170 return err; 2171 2172 down_write(&sb->s_umount); 2173 if (flags & MS_BIND) 2174 err = change_mount_flags(path->mnt, flags); 2175 else if (!capable(CAP_SYS_ADMIN)) 2176 err = -EPERM; 2177 else 2178 err = do_remount_sb(sb, flags, data, 0); 2179 if (!err) { 2180 lock_mount_hash(); 2181 mnt_flags |= mnt->mnt.mnt_flags & ~MNT_USER_SETTABLE_MASK; 2182 mnt->mnt.mnt_flags = mnt_flags; 2183 touch_mnt_namespace(mnt->mnt_ns); 2184 unlock_mount_hash(); 2185 } 2186 up_write(&sb->s_umount); 2187 return err; 2188 } 2189 2190 static inline int tree_contains_unbindable(struct mount *mnt) 2191 { 2192 struct mount *p; 2193 for (p = mnt; p; p = next_mnt(p, mnt)) { 2194 if (IS_MNT_UNBINDABLE(p)) 2195 return 1; 2196 } 2197 return 0; 2198 } 2199 2200 static int do_move_mount(struct path *path, const char *old_name) 2201 { 2202 struct path old_path, parent_path; 2203 struct mount *p; 2204 struct mount *old; 2205 struct mountpoint *mp; 2206 int err; 2207 if (!old_name || !*old_name) 2208 return -EINVAL; 2209 err = kern_path(old_name, LOOKUP_FOLLOW, &old_path); 2210 if (err) 2211 return err; 2212 2213 mp = lock_mount(path); 2214 err = PTR_ERR(mp); 2215 if (IS_ERR(mp)) 2216 goto out; 2217 2218 old = real_mount(old_path.mnt); 2219 p = real_mount(path->mnt); 2220 2221 err = -EINVAL; 2222 if (!check_mnt(p) || !check_mnt(old)) 2223 goto out1; 2224 2225 if (old->mnt.mnt_flags & MNT_LOCKED) 2226 goto out1; 2227 2228 err = -EINVAL; 2229 if (old_path.dentry != old_path.mnt->mnt_root) 2230 goto out1; 2231 2232 if (!mnt_has_parent(old)) 2233 goto out1; 2234 2235 if (d_is_dir(path->dentry) != 2236 d_is_dir(old_path.dentry)) 2237 goto out1; 2238 /* 2239 * Don't move a mount residing in a shared parent. 2240 */ 2241 if (IS_MNT_SHARED(old->mnt_parent)) 2242 goto out1; 2243 /* 2244 * Don't move a mount tree containing unbindable mounts to a destination 2245 * mount which is shared. 2246 */ 2247 if (IS_MNT_SHARED(p) && tree_contains_unbindable(old)) 2248 goto out1; 2249 err = -ELOOP; 2250 for (; mnt_has_parent(p); p = p->mnt_parent) 2251 if (p == old) 2252 goto out1; 2253 2254 err = attach_recursive_mnt(old, real_mount(path->mnt), mp, &parent_path); 2255 if (err) 2256 goto out1; 2257 2258 /* if the mount is moved, it should no longer be expire 2259 * automatically */ 2260 list_del_init(&old->mnt_expire); 2261 out1: 2262 unlock_mount(mp); 2263 out: 2264 if (!err) 2265 path_put(&parent_path); 2266 path_put(&old_path); 2267 return err; 2268 } 2269 2270 static struct vfsmount *fs_set_subtype(struct vfsmount *mnt, const char *fstype) 2271 { 2272 int err; 2273 const char *subtype = strchr(fstype, '.'); 2274 if (subtype) { 2275 subtype++; 2276 err = -EINVAL; 2277 if (!subtype[0]) 2278 goto err; 2279 } else 2280 subtype = ""; 2281 2282 mnt->mnt_sb->s_subtype = kstrdup(subtype, GFP_KERNEL); 2283 err = -ENOMEM; 2284 if (!mnt->mnt_sb->s_subtype) 2285 goto err; 2286 return mnt; 2287 2288 err: 2289 mntput(mnt); 2290 return ERR_PTR(err); 2291 } 2292 2293 /* 2294 * add a mount into a namespace's mount tree 2295 */ 2296 static int do_add_mount(struct mount *newmnt, struct path *path, int mnt_flags) 2297 { 2298 struct mountpoint *mp; 2299 struct mount *parent; 2300 int err; 2301 2302 mnt_flags &= ~MNT_INTERNAL_FLAGS; 2303 2304 mp = lock_mount(path); 2305 if (IS_ERR(mp)) 2306 return PTR_ERR(mp); 2307 2308 parent = real_mount(path->mnt); 2309 err = -EINVAL; 2310 if (unlikely(!check_mnt(parent))) { 2311 /* that's acceptable only for automounts done in private ns */ 2312 if (!(mnt_flags & MNT_SHRINKABLE)) 2313 goto unlock; 2314 /* ... and for those we'd better have mountpoint still alive */ 2315 if (!parent->mnt_ns) 2316 goto unlock; 2317 } 2318 2319 /* Refuse the same filesystem on the same mount point */ 2320 err = -EBUSY; 2321 if (path->mnt->mnt_sb == newmnt->mnt.mnt_sb && 2322 path->mnt->mnt_root == path->dentry) 2323 goto unlock; 2324 2325 err = -EINVAL; 2326 if (d_is_symlink(newmnt->mnt.mnt_root)) 2327 goto unlock; 2328 2329 newmnt->mnt.mnt_flags = mnt_flags; 2330 err = graft_tree(newmnt, parent, mp); 2331 2332 unlock: 2333 unlock_mount(mp); 2334 return err; 2335 } 2336 2337 static bool fs_fully_visible(struct file_system_type *fs_type, int *new_mnt_flags); 2338 2339 /* 2340 * create a new mount for userspace and request it to be added into the 2341 * namespace's tree 2342 */ 2343 static int do_new_mount(struct path *path, const char *fstype, int flags, 2344 int mnt_flags, const char *name, void *data) 2345 { 2346 struct file_system_type *type; 2347 struct user_namespace *user_ns = current->nsproxy->mnt_ns->user_ns; 2348 struct vfsmount *mnt; 2349 int err; 2350 2351 if (!fstype) 2352 return -EINVAL; 2353 2354 type = get_fs_type(fstype); 2355 if (!type) 2356 return -ENODEV; 2357 2358 if (user_ns != &init_user_ns) { 2359 if (!(type->fs_flags & FS_USERNS_MOUNT)) { 2360 put_filesystem(type); 2361 return -EPERM; 2362 } 2363 /* Only in special cases allow devices from mounts 2364 * created outside the initial user namespace. 2365 */ 2366 if (!(type->fs_flags & FS_USERNS_DEV_MOUNT)) { 2367 flags |= MS_NODEV; 2368 mnt_flags |= MNT_NODEV | MNT_LOCK_NODEV; 2369 } 2370 if (type->fs_flags & FS_USERNS_VISIBLE) { 2371 if (!fs_fully_visible(type, &mnt_flags)) 2372 return -EPERM; 2373 } 2374 } 2375 2376 mnt = vfs_kern_mount(type, flags, name, data); 2377 if (!IS_ERR(mnt) && (type->fs_flags & FS_HAS_SUBTYPE) && 2378 !mnt->mnt_sb->s_subtype) 2379 mnt = fs_set_subtype(mnt, fstype); 2380 2381 put_filesystem(type); 2382 if (IS_ERR(mnt)) 2383 return PTR_ERR(mnt); 2384 2385 err = do_add_mount(real_mount(mnt), path, mnt_flags); 2386 if (err) 2387 mntput(mnt); 2388 return err; 2389 } 2390 2391 int finish_automount(struct vfsmount *m, struct path *path) 2392 { 2393 struct mount *mnt = real_mount(m); 2394 int err; 2395 /* The new mount record should have at least 2 refs to prevent it being 2396 * expired before we get a chance to add it 2397 */ 2398 BUG_ON(mnt_get_count(mnt) < 2); 2399 2400 if (m->mnt_sb == path->mnt->mnt_sb && 2401 m->mnt_root == path->dentry) { 2402 err = -ELOOP; 2403 goto fail; 2404 } 2405 2406 err = do_add_mount(mnt, path, path->mnt->mnt_flags | MNT_SHRINKABLE); 2407 if (!err) 2408 return 0; 2409 fail: 2410 /* remove m from any expiration list it may be on */ 2411 if (!list_empty(&mnt->mnt_expire)) { 2412 namespace_lock(); 2413 list_del_init(&mnt->mnt_expire); 2414 namespace_unlock(); 2415 } 2416 mntput(m); 2417 mntput(m); 2418 return err; 2419 } 2420 2421 /** 2422 * mnt_set_expiry - Put a mount on an expiration list 2423 * @mnt: The mount to list. 2424 * @expiry_list: The list to add the mount to. 2425 */ 2426 void mnt_set_expiry(struct vfsmount *mnt, struct list_head *expiry_list) 2427 { 2428 namespace_lock(); 2429 2430 list_add_tail(&real_mount(mnt)->mnt_expire, expiry_list); 2431 2432 namespace_unlock(); 2433 } 2434 EXPORT_SYMBOL(mnt_set_expiry); 2435 2436 /* 2437 * process a list of expirable mountpoints with the intent of discarding any 2438 * mountpoints that aren't in use and haven't been touched since last we came 2439 * here 2440 */ 2441 void mark_mounts_for_expiry(struct list_head *mounts) 2442 { 2443 struct mount *mnt, *next; 2444 LIST_HEAD(graveyard); 2445 2446 if (list_empty(mounts)) 2447 return; 2448 2449 namespace_lock(); 2450 lock_mount_hash(); 2451 2452 /* extract from the expiration list every vfsmount that matches the 2453 * following criteria: 2454 * - only referenced by its parent vfsmount 2455 * - still marked for expiry (marked on the last call here; marks are 2456 * cleared by mntput()) 2457 */ 2458 list_for_each_entry_safe(mnt, next, mounts, mnt_expire) { 2459 if (!xchg(&mnt->mnt_expiry_mark, 1) || 2460 propagate_mount_busy(mnt, 1)) 2461 continue; 2462 list_move(&mnt->mnt_expire, &graveyard); 2463 } 2464 while (!list_empty(&graveyard)) { 2465 mnt = list_first_entry(&graveyard, struct mount, mnt_expire); 2466 touch_mnt_namespace(mnt->mnt_ns); 2467 umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC); 2468 } 2469 unlock_mount_hash(); 2470 namespace_unlock(); 2471 } 2472 2473 EXPORT_SYMBOL_GPL(mark_mounts_for_expiry); 2474 2475 /* 2476 * Ripoff of 'select_parent()' 2477 * 2478 * search the list of submounts for a given mountpoint, and move any 2479 * shrinkable submounts to the 'graveyard' list. 2480 */ 2481 static int select_submounts(struct mount *parent, struct list_head *graveyard) 2482 { 2483 struct mount *this_parent = parent; 2484 struct list_head *next; 2485 int found = 0; 2486 2487 repeat: 2488 next = this_parent->mnt_mounts.next; 2489 resume: 2490 while (next != &this_parent->mnt_mounts) { 2491 struct list_head *tmp = next; 2492 struct mount *mnt = list_entry(tmp, struct mount, mnt_child); 2493 2494 next = tmp->next; 2495 if (!(mnt->mnt.mnt_flags & MNT_SHRINKABLE)) 2496 continue; 2497 /* 2498 * Descend a level if the d_mounts list is non-empty. 2499 */ 2500 if (!list_empty(&mnt->mnt_mounts)) { 2501 this_parent = mnt; 2502 goto repeat; 2503 } 2504 2505 if (!propagate_mount_busy(mnt, 1)) { 2506 list_move_tail(&mnt->mnt_expire, graveyard); 2507 found++; 2508 } 2509 } 2510 /* 2511 * All done at this level ... ascend and resume the search 2512 */ 2513 if (this_parent != parent) { 2514 next = this_parent->mnt_child.next; 2515 this_parent = this_parent->mnt_parent; 2516 goto resume; 2517 } 2518 return found; 2519 } 2520 2521 /* 2522 * process a list of expirable mountpoints with the intent of discarding any 2523 * submounts of a specific parent mountpoint 2524 * 2525 * mount_lock must be held for write 2526 */ 2527 static void shrink_submounts(struct mount *mnt) 2528 { 2529 LIST_HEAD(graveyard); 2530 struct mount *m; 2531 2532 /* extract submounts of 'mountpoint' from the expiration list */ 2533 while (select_submounts(mnt, &graveyard)) { 2534 while (!list_empty(&graveyard)) { 2535 m = list_first_entry(&graveyard, struct mount, 2536 mnt_expire); 2537 touch_mnt_namespace(m->mnt_ns); 2538 umount_tree(m, UMOUNT_PROPAGATE|UMOUNT_SYNC); 2539 } 2540 } 2541 } 2542 2543 /* 2544 * Some copy_from_user() implementations do not return the exact number of 2545 * bytes remaining to copy on a fault. But copy_mount_options() requires that. 2546 * Note that this function differs from copy_from_user() in that it will oops 2547 * on bad values of `to', rather than returning a short copy. 2548 */ 2549 static long exact_copy_from_user(void *to, const void __user * from, 2550 unsigned long n) 2551 { 2552 char *t = to; 2553 const char __user *f = from; 2554 char c; 2555 2556 if (!access_ok(VERIFY_READ, from, n)) 2557 return n; 2558 2559 while (n) { 2560 if (__get_user(c, f)) { 2561 memset(t, 0, n); 2562 break; 2563 } 2564 *t++ = c; 2565 f++; 2566 n--; 2567 } 2568 return n; 2569 } 2570 2571 int copy_mount_options(const void __user * data, unsigned long *where) 2572 { 2573 int i; 2574 unsigned long page; 2575 unsigned long size; 2576 2577 *where = 0; 2578 if (!data) 2579 return 0; 2580 2581 if (!(page = __get_free_page(GFP_KERNEL))) 2582 return -ENOMEM; 2583 2584 /* We only care that *some* data at the address the user 2585 * gave us is valid. Just in case, we'll zero 2586 * the remainder of the page. 2587 */ 2588 /* copy_from_user cannot cross TASK_SIZE ! */ 2589 size = TASK_SIZE - (unsigned long)data; 2590 if (size > PAGE_SIZE) 2591 size = PAGE_SIZE; 2592 2593 i = size - exact_copy_from_user((void *)page, data, size); 2594 if (!i) { 2595 free_page(page); 2596 return -EFAULT; 2597 } 2598 if (i != PAGE_SIZE) 2599 memset((char *)page + i, 0, PAGE_SIZE - i); 2600 *where = page; 2601 return 0; 2602 } 2603 2604 char *copy_mount_string(const void __user *data) 2605 { 2606 return data ? strndup_user(data, PAGE_SIZE) : NULL; 2607 } 2608 2609 /* 2610 * Flags is a 32-bit value that allows up to 31 non-fs dependent flags to 2611 * be given to the mount() call (ie: read-only, no-dev, no-suid etc). 2612 * 2613 * data is a (void *) that can point to any structure up to 2614 * PAGE_SIZE-1 bytes, which can contain arbitrary fs-dependent 2615 * information (or be NULL). 2616 * 2617 * Pre-0.97 versions of mount() didn't have a flags word. 2618 * When the flags word was introduced its top half was required 2619 * to have the magic value 0xC0ED, and this remained so until 2.4.0-test9. 2620 * Therefore, if this magic number is present, it carries no information 2621 * and must be discarded. 2622 */ 2623 long do_mount(const char *dev_name, const char __user *dir_name, 2624 const char *type_page, unsigned long flags, void *data_page) 2625 { 2626 struct path path; 2627 int retval = 0; 2628 int mnt_flags = 0; 2629 2630 /* Discard magic */ 2631 if ((flags & MS_MGC_MSK) == MS_MGC_VAL) 2632 flags &= ~MS_MGC_MSK; 2633 2634 /* Basic sanity checks */ 2635 if (data_page) 2636 ((char *)data_page)[PAGE_SIZE - 1] = 0; 2637 2638 /* ... and get the mountpoint */ 2639 retval = user_path(dir_name, &path); 2640 if (retval) 2641 return retval; 2642 2643 retval = security_sb_mount(dev_name, &path, 2644 type_page, flags, data_page); 2645 if (!retval && !may_mount()) 2646 retval = -EPERM; 2647 if (retval) 2648 goto dput_out; 2649 2650 /* Default to relatime unless overriden */ 2651 if (!(flags & MS_NOATIME)) 2652 mnt_flags |= MNT_RELATIME; 2653 2654 /* Separate the per-mountpoint flags */ 2655 if (flags & MS_NOSUID) 2656 mnt_flags |= MNT_NOSUID; 2657 if (flags & MS_NODEV) 2658 mnt_flags |= MNT_NODEV; 2659 if (flags & MS_NOEXEC) 2660 mnt_flags |= MNT_NOEXEC; 2661 if (flags & MS_NOATIME) 2662 mnt_flags |= MNT_NOATIME; 2663 if (flags & MS_NODIRATIME) 2664 mnt_flags |= MNT_NODIRATIME; 2665 if (flags & MS_STRICTATIME) 2666 mnt_flags &= ~(MNT_RELATIME | MNT_NOATIME); 2667 if (flags & MS_RDONLY) 2668 mnt_flags |= MNT_READONLY; 2669 2670 /* The default atime for remount is preservation */ 2671 if ((flags & MS_REMOUNT) && 2672 ((flags & (MS_NOATIME | MS_NODIRATIME | MS_RELATIME | 2673 MS_STRICTATIME)) == 0)) { 2674 mnt_flags &= ~MNT_ATIME_MASK; 2675 mnt_flags |= path.mnt->mnt_flags & MNT_ATIME_MASK; 2676 } 2677 2678 flags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE | MS_BORN | 2679 MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT | 2680 MS_STRICTATIME); 2681 2682 if (flags & MS_REMOUNT) 2683 retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags, 2684 data_page); 2685 else if (flags & MS_BIND) 2686 retval = do_loopback(&path, dev_name, flags & MS_REC); 2687 else if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE)) 2688 retval = do_change_type(&path, flags); 2689 else if (flags & MS_MOVE) 2690 retval = do_move_mount(&path, dev_name); 2691 else 2692 retval = do_new_mount(&path, type_page, flags, mnt_flags, 2693 dev_name, data_page); 2694 dput_out: 2695 path_put(&path); 2696 return retval; 2697 } 2698 2699 static void free_mnt_ns(struct mnt_namespace *ns) 2700 { 2701 ns_free_inum(&ns->ns); 2702 put_user_ns(ns->user_ns); 2703 kfree(ns); 2704 } 2705 2706 /* 2707 * Assign a sequence number so we can detect when we attempt to bind 2708 * mount a reference to an older mount namespace into the current 2709 * mount namespace, preventing reference counting loops. A 64bit 2710 * number incrementing at 10Ghz will take 12,427 years to wrap which 2711 * is effectively never, so we can ignore the possibility. 2712 */ 2713 static atomic64_t mnt_ns_seq = ATOMIC64_INIT(1); 2714 2715 static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns) 2716 { 2717 struct mnt_namespace *new_ns; 2718 int ret; 2719 2720 new_ns = kmalloc(sizeof(struct mnt_namespace), GFP_KERNEL); 2721 if (!new_ns) 2722 return ERR_PTR(-ENOMEM); 2723 ret = ns_alloc_inum(&new_ns->ns); 2724 if (ret) { 2725 kfree(new_ns); 2726 return ERR_PTR(ret); 2727 } 2728 new_ns->ns.ops = &mntns_operations; 2729 new_ns->seq = atomic64_add_return(1, &mnt_ns_seq); 2730 atomic_set(&new_ns->count, 1); 2731 new_ns->root = NULL; 2732 INIT_LIST_HEAD(&new_ns->list); 2733 init_waitqueue_head(&new_ns->poll); 2734 new_ns->event = 0; 2735 new_ns->user_ns = get_user_ns(user_ns); 2736 return new_ns; 2737 } 2738 2739 struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns, 2740 struct user_namespace *user_ns, struct fs_struct *new_fs) 2741 { 2742 struct mnt_namespace *new_ns; 2743 struct vfsmount *rootmnt = NULL, *pwdmnt = NULL; 2744 struct mount *p, *q; 2745 struct mount *old; 2746 struct mount *new; 2747 int copy_flags; 2748 2749 BUG_ON(!ns); 2750 2751 if (likely(!(flags & CLONE_NEWNS))) { 2752 get_mnt_ns(ns); 2753 return ns; 2754 } 2755 2756 old = ns->root; 2757 2758 new_ns = alloc_mnt_ns(user_ns); 2759 if (IS_ERR(new_ns)) 2760 return new_ns; 2761 2762 namespace_lock(); 2763 /* First pass: copy the tree topology */ 2764 copy_flags = CL_COPY_UNBINDABLE | CL_EXPIRE; 2765 if (user_ns != ns->user_ns) 2766 copy_flags |= CL_SHARED_TO_SLAVE | CL_UNPRIVILEGED; 2767 new = copy_tree(old, old->mnt.mnt_root, copy_flags); 2768 if (IS_ERR(new)) { 2769 namespace_unlock(); 2770 free_mnt_ns(new_ns); 2771 return ERR_CAST(new); 2772 } 2773 new_ns->root = new; 2774 list_add_tail(&new_ns->list, &new->mnt_list); 2775 2776 /* 2777 * Second pass: switch the tsk->fs->* elements and mark new vfsmounts 2778 * as belonging to new namespace. We have already acquired a private 2779 * fs_struct, so tsk->fs->lock is not needed. 2780 */ 2781 p = old; 2782 q = new; 2783 while (p) { 2784 q->mnt_ns = new_ns; 2785 if (new_fs) { 2786 if (&p->mnt == new_fs->root.mnt) { 2787 new_fs->root.mnt = mntget(&q->mnt); 2788 rootmnt = &p->mnt; 2789 } 2790 if (&p->mnt == new_fs->pwd.mnt) { 2791 new_fs->pwd.mnt = mntget(&q->mnt); 2792 pwdmnt = &p->mnt; 2793 } 2794 } 2795 p = next_mnt(p, old); 2796 q = next_mnt(q, new); 2797 if (!q) 2798 break; 2799 while (p->mnt.mnt_root != q->mnt.mnt_root) 2800 p = next_mnt(p, old); 2801 } 2802 namespace_unlock(); 2803 2804 if (rootmnt) 2805 mntput(rootmnt); 2806 if (pwdmnt) 2807 mntput(pwdmnt); 2808 2809 return new_ns; 2810 } 2811 2812 /** 2813 * create_mnt_ns - creates a private namespace and adds a root filesystem 2814 * @mnt: pointer to the new root filesystem mountpoint 2815 */ 2816 static struct mnt_namespace *create_mnt_ns(struct vfsmount *m) 2817 { 2818 struct mnt_namespace *new_ns = alloc_mnt_ns(&init_user_ns); 2819 if (!IS_ERR(new_ns)) { 2820 struct mount *mnt = real_mount(m); 2821 mnt->mnt_ns = new_ns; 2822 new_ns->root = mnt; 2823 list_add(&mnt->mnt_list, &new_ns->list); 2824 } else { 2825 mntput(m); 2826 } 2827 return new_ns; 2828 } 2829 2830 struct dentry *mount_subtree(struct vfsmount *mnt, const char *name) 2831 { 2832 struct mnt_namespace *ns; 2833 struct super_block *s; 2834 struct path path; 2835 int err; 2836 2837 ns = create_mnt_ns(mnt); 2838 if (IS_ERR(ns)) 2839 return ERR_CAST(ns); 2840 2841 err = vfs_path_lookup(mnt->mnt_root, mnt, 2842 name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &path); 2843 2844 put_mnt_ns(ns); 2845 2846 if (err) 2847 return ERR_PTR(err); 2848 2849 /* trade a vfsmount reference for active sb one */ 2850 s = path.mnt->mnt_sb; 2851 atomic_inc(&s->s_active); 2852 mntput(path.mnt); 2853 /* lock the sucker */ 2854 down_write(&s->s_umount); 2855 /* ... and return the root of (sub)tree on it */ 2856 return path.dentry; 2857 } 2858 EXPORT_SYMBOL(mount_subtree); 2859 2860 SYSCALL_DEFINE5(mount, char __user *, dev_name, char __user *, dir_name, 2861 char __user *, type, unsigned long, flags, void __user *, data) 2862 { 2863 int ret; 2864 char *kernel_type; 2865 char *kernel_dev; 2866 unsigned long data_page; 2867 2868 kernel_type = copy_mount_string(type); 2869 ret = PTR_ERR(kernel_type); 2870 if (IS_ERR(kernel_type)) 2871 goto out_type; 2872 2873 kernel_dev = copy_mount_string(dev_name); 2874 ret = PTR_ERR(kernel_dev); 2875 if (IS_ERR(kernel_dev)) 2876 goto out_dev; 2877 2878 ret = copy_mount_options(data, &data_page); 2879 if (ret < 0) 2880 goto out_data; 2881 2882 ret = do_mount(kernel_dev, dir_name, kernel_type, flags, 2883 (void *) data_page); 2884 2885 free_page(data_page); 2886 out_data: 2887 kfree(kernel_dev); 2888 out_dev: 2889 kfree(kernel_type); 2890 out_type: 2891 return ret; 2892 } 2893 2894 /* 2895 * Return true if path is reachable from root 2896 * 2897 * namespace_sem or mount_lock is held 2898 */ 2899 bool is_path_reachable(struct mount *mnt, struct dentry *dentry, 2900 const struct path *root) 2901 { 2902 while (&mnt->mnt != root->mnt && mnt_has_parent(mnt)) { 2903 dentry = mnt->mnt_mountpoint; 2904 mnt = mnt->mnt_parent; 2905 } 2906 return &mnt->mnt == root->mnt && is_subdir(dentry, root->dentry); 2907 } 2908 2909 int path_is_under(struct path *path1, struct path *path2) 2910 { 2911 int res; 2912 read_seqlock_excl(&mount_lock); 2913 res = is_path_reachable(real_mount(path1->mnt), path1->dentry, path2); 2914 read_sequnlock_excl(&mount_lock); 2915 return res; 2916 } 2917 EXPORT_SYMBOL(path_is_under); 2918 2919 /* 2920 * pivot_root Semantics: 2921 * Moves the root file system of the current process to the directory put_old, 2922 * makes new_root as the new root file system of the current process, and sets 2923 * root/cwd of all processes which had them on the current root to new_root. 2924 * 2925 * Restrictions: 2926 * The new_root and put_old must be directories, and must not be on the 2927 * same file system as the current process root. The put_old must be 2928 * underneath new_root, i.e. adding a non-zero number of /.. to the string 2929 * pointed to by put_old must yield the same directory as new_root. No other 2930 * file system may be mounted on put_old. After all, new_root is a mountpoint. 2931 * 2932 * Also, the current root cannot be on the 'rootfs' (initial ramfs) filesystem. 2933 * See Documentation/filesystems/ramfs-rootfs-initramfs.txt for alternatives 2934 * in this situation. 2935 * 2936 * Notes: 2937 * - we don't move root/cwd if they are not at the root (reason: if something 2938 * cared enough to change them, it's probably wrong to force them elsewhere) 2939 * - it's okay to pick a root that isn't the root of a file system, e.g. 2940 * /nfs/my_root where /nfs is the mount point. It must be a mountpoint, 2941 * though, so you may need to say mount --bind /nfs/my_root /nfs/my_root 2942 * first. 2943 */ 2944 SYSCALL_DEFINE2(pivot_root, const char __user *, new_root, 2945 const char __user *, put_old) 2946 { 2947 struct path new, old, parent_path, root_parent, root; 2948 struct mount *new_mnt, *root_mnt, *old_mnt; 2949 struct mountpoint *old_mp, *root_mp; 2950 int error; 2951 2952 if (!may_mount()) 2953 return -EPERM; 2954 2955 error = user_path_dir(new_root, &new); 2956 if (error) 2957 goto out0; 2958 2959 error = user_path_dir(put_old, &old); 2960 if (error) 2961 goto out1; 2962 2963 error = security_sb_pivotroot(&old, &new); 2964 if (error) 2965 goto out2; 2966 2967 get_fs_root(current->fs, &root); 2968 old_mp = lock_mount(&old); 2969 error = PTR_ERR(old_mp); 2970 if (IS_ERR(old_mp)) 2971 goto out3; 2972 2973 error = -EINVAL; 2974 new_mnt = real_mount(new.mnt); 2975 root_mnt = real_mount(root.mnt); 2976 old_mnt = real_mount(old.mnt); 2977 if (IS_MNT_SHARED(old_mnt) || 2978 IS_MNT_SHARED(new_mnt->mnt_parent) || 2979 IS_MNT_SHARED(root_mnt->mnt_parent)) 2980 goto out4; 2981 if (!check_mnt(root_mnt) || !check_mnt(new_mnt)) 2982 goto out4; 2983 if (new_mnt->mnt.mnt_flags & MNT_LOCKED) 2984 goto out4; 2985 error = -ENOENT; 2986 if (d_unlinked(new.dentry)) 2987 goto out4; 2988 error = -EBUSY; 2989 if (new_mnt == root_mnt || old_mnt == root_mnt) 2990 goto out4; /* loop, on the same file system */ 2991 error = -EINVAL; 2992 if (root.mnt->mnt_root != root.dentry) 2993 goto out4; /* not a mountpoint */ 2994 if (!mnt_has_parent(root_mnt)) 2995 goto out4; /* not attached */ 2996 root_mp = root_mnt->mnt_mp; 2997 if (new.mnt->mnt_root != new.dentry) 2998 goto out4; /* not a mountpoint */ 2999 if (!mnt_has_parent(new_mnt)) 3000 goto out4; /* not attached */ 3001 /* make sure we can reach put_old from new_root */ 3002 if (!is_path_reachable(old_mnt, old.dentry, &new)) 3003 goto out4; 3004 /* make certain new is below the root */ 3005 if (!is_path_reachable(new_mnt, new.dentry, &root)) 3006 goto out4; 3007 root_mp->m_count++; /* pin it so it won't go away */ 3008 lock_mount_hash(); 3009 detach_mnt(new_mnt, &parent_path); 3010 detach_mnt(root_mnt, &root_parent); 3011 if (root_mnt->mnt.mnt_flags & MNT_LOCKED) { 3012 new_mnt->mnt.mnt_flags |= MNT_LOCKED; 3013 root_mnt->mnt.mnt_flags &= ~MNT_LOCKED; 3014 } 3015 /* mount old root on put_old */ 3016 attach_mnt(root_mnt, old_mnt, old_mp); 3017 /* mount new_root on / */ 3018 attach_mnt(new_mnt, real_mount(root_parent.mnt), root_mp); 3019 touch_mnt_namespace(current->nsproxy->mnt_ns); 3020 /* A moved mount should not expire automatically */ 3021 list_del_init(&new_mnt->mnt_expire); 3022 unlock_mount_hash(); 3023 chroot_fs_refs(&root, &new); 3024 put_mountpoint(root_mp); 3025 error = 0; 3026 out4: 3027 unlock_mount(old_mp); 3028 if (!error) { 3029 path_put(&root_parent); 3030 path_put(&parent_path); 3031 } 3032 out3: 3033 path_put(&root); 3034 out2: 3035 path_put(&old); 3036 out1: 3037 path_put(&new); 3038 out0: 3039 return error; 3040 } 3041 3042 static void __init init_mount_tree(void) 3043 { 3044 struct vfsmount *mnt; 3045 struct mnt_namespace *ns; 3046 struct path root; 3047 struct file_system_type *type; 3048 3049 type = get_fs_type("rootfs"); 3050 if (!type) 3051 panic("Can't find rootfs type"); 3052 mnt = vfs_kern_mount(type, 0, "rootfs", NULL); 3053 put_filesystem(type); 3054 if (IS_ERR(mnt)) 3055 panic("Can't create rootfs"); 3056 3057 ns = create_mnt_ns(mnt); 3058 if (IS_ERR(ns)) 3059 panic("Can't allocate initial namespace"); 3060 3061 init_task.nsproxy->mnt_ns = ns; 3062 get_mnt_ns(ns); 3063 3064 root.mnt = mnt; 3065 root.dentry = mnt->mnt_root; 3066 mnt->mnt_flags |= MNT_LOCKED; 3067 3068 set_fs_pwd(current->fs, &root); 3069 set_fs_root(current->fs, &root); 3070 } 3071 3072 void __init mnt_init(void) 3073 { 3074 unsigned u; 3075 int err; 3076 3077 mnt_cache = kmem_cache_create("mnt_cache", sizeof(struct mount), 3078 0, SLAB_HWCACHE_ALIGN | SLAB_PANIC, NULL); 3079 3080 mount_hashtable = alloc_large_system_hash("Mount-cache", 3081 sizeof(struct hlist_head), 3082 mhash_entries, 19, 3083 0, 3084 &m_hash_shift, &m_hash_mask, 0, 0); 3085 mountpoint_hashtable = alloc_large_system_hash("Mountpoint-cache", 3086 sizeof(struct hlist_head), 3087 mphash_entries, 19, 3088 0, 3089 &mp_hash_shift, &mp_hash_mask, 0, 0); 3090 3091 if (!mount_hashtable || !mountpoint_hashtable) 3092 panic("Failed to allocate mount hash table\n"); 3093 3094 for (u = 0; u <= m_hash_mask; u++) 3095 INIT_HLIST_HEAD(&mount_hashtable[u]); 3096 for (u = 0; u <= mp_hash_mask; u++) 3097 INIT_HLIST_HEAD(&mountpoint_hashtable[u]); 3098 3099 kernfs_init(); 3100 3101 err = sysfs_init(); 3102 if (err) 3103 printk(KERN_WARNING "%s: sysfs_init error: %d\n", 3104 __func__, err); 3105 fs_kobj = kobject_create_and_add("fs", NULL); 3106 if (!fs_kobj) 3107 printk(KERN_WARNING "%s: kobj create error\n", __func__); 3108 init_rootfs(); 3109 init_mount_tree(); 3110 } 3111 3112 void put_mnt_ns(struct mnt_namespace *ns) 3113 { 3114 if (!atomic_dec_and_test(&ns->count)) 3115 return; 3116 drop_collected_mounts(&ns->root->mnt); 3117 free_mnt_ns(ns); 3118 } 3119 3120 struct vfsmount *kern_mount_data(struct file_system_type *type, void *data) 3121 { 3122 struct vfsmount *mnt; 3123 mnt = vfs_kern_mount(type, MS_KERNMOUNT, type->name, data); 3124 if (!IS_ERR(mnt)) { 3125 /* 3126 * it is a longterm mount, don't release mnt until 3127 * we unmount before file sys is unregistered 3128 */ 3129 real_mount(mnt)->mnt_ns = MNT_NS_INTERNAL; 3130 } 3131 return mnt; 3132 } 3133 EXPORT_SYMBOL_GPL(kern_mount_data); 3134 3135 void kern_unmount(struct vfsmount *mnt) 3136 { 3137 /* release long term mount so mount point can be released */ 3138 if (!IS_ERR_OR_NULL(mnt)) { 3139 real_mount(mnt)->mnt_ns = NULL; 3140 synchronize_rcu(); /* yecchhh... */ 3141 mntput(mnt); 3142 } 3143 } 3144 EXPORT_SYMBOL(kern_unmount); 3145 3146 bool our_mnt(struct vfsmount *mnt) 3147 { 3148 return check_mnt(real_mount(mnt)); 3149 } 3150 3151 bool current_chrooted(void) 3152 { 3153 /* Does the current process have a non-standard root */ 3154 struct path ns_root; 3155 struct path fs_root; 3156 bool chrooted; 3157 3158 /* Find the namespace root */ 3159 ns_root.mnt = ¤t->nsproxy->mnt_ns->root->mnt; 3160 ns_root.dentry = ns_root.mnt->mnt_root; 3161 path_get(&ns_root); 3162 while (d_mountpoint(ns_root.dentry) && follow_down_one(&ns_root)) 3163 ; 3164 3165 get_fs_root(current->fs, &fs_root); 3166 3167 chrooted = !path_equal(&fs_root, &ns_root); 3168 3169 path_put(&fs_root); 3170 path_put(&ns_root); 3171 3172 return chrooted; 3173 } 3174 3175 static bool fs_fully_visible(struct file_system_type *type, int *new_mnt_flags) 3176 { 3177 struct mnt_namespace *ns = current->nsproxy->mnt_ns; 3178 int new_flags = *new_mnt_flags; 3179 struct mount *mnt; 3180 bool visible = false; 3181 3182 if (unlikely(!ns)) 3183 return false; 3184 3185 down_read(&namespace_sem); 3186 list_for_each_entry(mnt, &ns->list, mnt_list) { 3187 struct mount *child; 3188 if (mnt->mnt.mnt_sb->s_type != type) 3189 continue; 3190 3191 /* This mount is not fully visible if it's root directory 3192 * is not the root directory of the filesystem. 3193 */ 3194 if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root) 3195 continue; 3196 3197 /* Verify the mount flags are equal to or more permissive 3198 * than the proposed new mount. 3199 */ 3200 if ((mnt->mnt.mnt_flags & MNT_LOCK_READONLY) && 3201 !(new_flags & MNT_READONLY)) 3202 continue; 3203 if ((mnt->mnt.mnt_flags & MNT_LOCK_NODEV) && 3204 !(new_flags & MNT_NODEV)) 3205 continue; 3206 if ((mnt->mnt.mnt_flags & MNT_LOCK_ATIME) && 3207 ((mnt->mnt.mnt_flags & MNT_ATIME_MASK) != (new_flags & MNT_ATIME_MASK))) 3208 continue; 3209 3210 /* This mount is not fully visible if there are any 3211 * locked child mounts that cover anything except for 3212 * empty directories. 3213 */ 3214 list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { 3215 struct inode *inode = child->mnt_mountpoint->d_inode; 3216 /* Only worry about locked mounts */ 3217 if (!(mnt->mnt.mnt_flags & MNT_LOCKED)) 3218 continue; 3219 /* Is the directory permanetly empty? */ 3220 if (!is_empty_dir_inode(inode)) 3221 goto next; 3222 } 3223 /* Preserve the locked attributes */ 3224 *new_mnt_flags |= mnt->mnt.mnt_flags & (MNT_LOCK_READONLY | \ 3225 MNT_LOCK_NODEV | \ 3226 MNT_LOCK_ATIME); 3227 visible = true; 3228 goto found; 3229 next: ; 3230 } 3231 found: 3232 up_read(&namespace_sem); 3233 return visible; 3234 } 3235 3236 static struct ns_common *mntns_get(struct task_struct *task) 3237 { 3238 struct ns_common *ns = NULL; 3239 struct nsproxy *nsproxy; 3240 3241 task_lock(task); 3242 nsproxy = task->nsproxy; 3243 if (nsproxy) { 3244 ns = &nsproxy->mnt_ns->ns; 3245 get_mnt_ns(to_mnt_ns(ns)); 3246 } 3247 task_unlock(task); 3248 3249 return ns; 3250 } 3251 3252 static void mntns_put(struct ns_common *ns) 3253 { 3254 put_mnt_ns(to_mnt_ns(ns)); 3255 } 3256 3257 static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns) 3258 { 3259 struct fs_struct *fs = current->fs; 3260 struct mnt_namespace *mnt_ns = to_mnt_ns(ns); 3261 struct path root; 3262 3263 if (!ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN) || 3264 !ns_capable(current_user_ns(), CAP_SYS_CHROOT) || 3265 !ns_capable(current_user_ns(), CAP_SYS_ADMIN)) 3266 return -EPERM; 3267 3268 if (fs->users != 1) 3269 return -EINVAL; 3270 3271 get_mnt_ns(mnt_ns); 3272 put_mnt_ns(nsproxy->mnt_ns); 3273 nsproxy->mnt_ns = mnt_ns; 3274 3275 /* Find the root */ 3276 root.mnt = &mnt_ns->root->mnt; 3277 root.dentry = mnt_ns->root->mnt.mnt_root; 3278 path_get(&root); 3279 while(d_mountpoint(root.dentry) && follow_down_one(&root)) 3280 ; 3281 3282 /* Update the pwd and root */ 3283 set_fs_pwd(fs, &root); 3284 set_fs_root(fs, &root); 3285 3286 path_put(&root); 3287 return 0; 3288 } 3289 3290 const struct proc_ns_operations mntns_operations = { 3291 .name = "mnt", 3292 .type = CLONE_NEWNS, 3293 .get = mntns_get, 3294 .put = mntns_put, 3295 .install = mntns_install, 3296 }; 3297
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.