1// SPDX-License-Identifier: GPL-2.0-only 2/* 3 * 4 * Copyright (C) 2011 Novell Inc. 5 */ 6 7#include <uapi/linux/magic.h> 8#include <linux/fs.h> 9#include <linux/namei.h> 10#include <linux/xattr.h> 11#include <linux/mount.h> 12#include <linux/parser.h> 13#include <linux/module.h> 14#include <linux/statfs.h> 15#include <linux/seq_file.h> 16#include <linux/posix_acl_xattr.h> 17#include <linux/exportfs.h> 18#include "overlayfs.h" 19 20MODULE_AUTHOR("Miklos Szeredi <miklos@szeredi.hu>"); 21MODULE_DESCRIPTION("Overlay filesystem"); 22MODULE_LICENSE("GPL"); 23 24 25struct ovl_dir_cache; 26 27#define OVL_MAX_STACK 500 28 29static bool ovl_redirect_dir_def = IS_ENABLED(CONFIG_OVERLAY_FS_REDIRECT_DIR); 30module_param_named(redirect_dir, ovl_redirect_dir_def, bool, 0644); 31MODULE_PARM_DESC(redirect_dir, 32 "Default to on or off for the redirect_dir feature"); 33 34static bool ovl_redirect_always_follow = 35 IS_ENABLED(CONFIG_OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW); 36module_param_named(redirect_always_follow, ovl_redirect_always_follow, 37 bool, 0644); 38MODULE_PARM_DESC(redirect_always_follow, 39 "Follow redirects even if redirect_dir feature is turned off"); 40 41static bool ovl_index_def = IS_ENABLED(CONFIG_OVERLAY_FS_INDEX); 42module_param_named(index, ovl_index_def, bool, 0644); 43MODULE_PARM_DESC(index, 44 "Default to on or off for the inodes index feature"); 45 46static bool ovl_nfs_export_def = IS_ENABLED(CONFIG_OVERLAY_FS_NFS_EXPORT); 47module_param_named(nfs_export, ovl_nfs_export_def, bool, 0644); 48MODULE_PARM_DESC(nfs_export, 49 "Default to on or off for the NFS export feature"); 50 51static bool ovl_xino_auto_def = IS_ENABLED(CONFIG_OVERLAY_FS_XINO_AUTO); 52module_param_named(xino_auto, ovl_xino_auto_def, bool, 0644); 53MODULE_PARM_DESC(xino_auto, 54 "Auto enable xino feature"); 55 56static void ovl_entry_stack_free(struct ovl_entry *oe) 57{ 58 unsigned int i; 59 60 for (i = 0; i < oe->numlower; i++) 61 dput(oe->lowerstack[i].dentry); 62} 63 64static bool ovl_metacopy_def = IS_ENABLED(CONFIG_OVERLAY_FS_METACOPY); 65module_param_named(metacopy, ovl_metacopy_def, bool, 0644); 66MODULE_PARM_DESC(metacopy, 67 "Default to on or off for the metadata only copy up feature"); 68 69static void ovl_dentry_release(struct dentry *dentry) 70{ 71 struct ovl_entry *oe = dentry->d_fsdata; 72 73 if (oe) { 74 ovl_entry_stack_free(oe); 75 kfree_rcu(oe, rcu); 76 } 77} 78 79static struct dentry *ovl_d_real(struct dentry *dentry, 80 const struct inode *inode) 81{ 82 struct dentry *real = NULL, *lower; 83 84 /* It's an overlay file */ 85 if (inode && d_inode(dentry) == inode) 86 return dentry; 87 88 if (!d_is_reg(dentry)) { 89 if (!inode || inode == d_inode(dentry)) 90 return dentry; 91 goto bug; 92 } 93 94 real = ovl_dentry_upper(dentry); 95 if (real && (inode == d_inode(real))) 96 return real; 97 98 if (real && !inode && ovl_has_upperdata(d_inode(dentry))) 99 return real; 100 101 lower = ovl_dentry_lowerdata(dentry); 102 if (!lower) 103 goto bug; 104 real = lower; 105 106 /* Handle recursion */ 107 real = d_real(real, inode); 108 109 if (!inode || inode == d_inode(real)) 110 return real; 111bug: 112 WARN(1, "%s(%pd4, %s:%lu): real dentry (%p/%lu) not found\n", 113 __func__, dentry, inode ? inode->i_sb->s_id : "NULL", 114 inode ? inode->i_ino : 0, real, 115 real && d_inode(real) ? d_inode(real)->i_ino : 0); 116 return dentry; 117} 118 119static int ovl_revalidate_real(struct dentry *d, unsigned int flags, bool weak) 120{ 121 int ret = 1; 122 123 if (weak) { 124 if (d->d_flags & DCACHE_OP_WEAK_REVALIDATE) 125 ret = d->d_op->d_weak_revalidate(d, flags); 126 } else if (d->d_flags & DCACHE_OP_REVALIDATE) { 127 ret = d->d_op->d_revalidate(d, flags); 128 if (!ret) { 129 if (!(flags & LOOKUP_RCU)) 130 d_invalidate(d); 131 ret = -ESTALE; 132 } 133 } 134 return ret; 135} 136 137static int ovl_dentry_revalidate_common(struct dentry *dentry, 138 unsigned int flags, bool weak) 139{ 140 struct ovl_entry *oe = dentry->d_fsdata; 141 struct inode *inode = d_inode_rcu(dentry); 142 struct dentry *upper; 143 unsigned int i; 144 int ret = 1; 145 146 /* Careful in RCU mode */ 147 if (!inode) 148 return -ECHILD; 149 150 upper = ovl_i_dentry_upper(inode); 151 if (upper) 152 ret = ovl_revalidate_real(upper, flags, weak); 153 154 for (i = 0; ret > 0 && i < oe->numlower; i++) { 155 ret = ovl_revalidate_real(oe->lowerstack[i].dentry, flags, 156 weak); 157 } 158 return ret; 159} 160 161static int ovl_dentry_revalidate(struct dentry *dentry, unsigned int flags) 162{ 163 return ovl_dentry_revalidate_common(dentry, flags, false); 164} 165 166static int ovl_dentry_weak_revalidate(struct dentry *dentry, unsigned int flags) 167{ 168 return ovl_dentry_revalidate_common(dentry, flags, true); 169} 170 171static const struct dentry_operations ovl_dentry_operations = { 172 .d_release = ovl_dentry_release, 173 .d_real = ovl_d_real, 174 .d_revalidate = ovl_dentry_revalidate, 175 .d_weak_revalidate = ovl_dentry_weak_revalidate, 176}; 177 178static struct kmem_cache *ovl_inode_cachep; 179 180static struct inode *ovl_alloc_inode(struct super_block *sb) 181{ 182 struct ovl_inode *oi = kmem_cache_alloc(ovl_inode_cachep, GFP_KERNEL); 183 184 if (!oi) 185 return NULL; 186 187 oi->cache = NULL; 188 oi->redirect = NULL; 189 oi->version = 0; 190 oi->flags = 0; 191 oi->__upperdentry = NULL; 192 oi->lower = NULL; 193 oi->lowerdata = NULL; 194 mutex_init(&oi->lock); 195 196 return &oi->vfs_inode; 197} 198 199static void ovl_free_inode(struct inode *inode) 200{ 201 struct ovl_inode *oi = OVL_I(inode); 202 203 kfree(oi->redirect); 204 mutex_destroy(&oi->lock); 205 kmem_cache_free(ovl_inode_cachep, oi); 206} 207 208static void ovl_destroy_inode(struct inode *inode) 209{ 210 struct ovl_inode *oi = OVL_I(inode); 211 212 dput(oi->__upperdentry); 213 iput(oi->lower); 214 if (S_ISDIR(inode->i_mode)) 215 ovl_dir_cache_free(inode); 216 else 217 iput(oi->lowerdata); 218} 219 220static void ovl_free_fs(struct ovl_fs *ofs) 221{ 222 struct vfsmount **mounts; 223 unsigned i; 224 225 iput(ofs->workbasedir_trap); 226 iput(ofs->indexdir_trap); 227 iput(ofs->workdir_trap); 228 dput(ofs->whiteout); 229 dput(ofs->indexdir); 230 dput(ofs->workdir); 231 if (ofs->workdir_locked) 232 ovl_inuse_unlock(ofs->workbasedir); 233 dput(ofs->workbasedir); 234 if (ofs->upperdir_locked) 235 ovl_inuse_unlock(ovl_upper_mnt(ofs)->mnt_root); 236 237 /* Hack! Reuse ofs->layers as a vfsmount array before freeing it */ 238 mounts = (struct vfsmount **) ofs->layers; 239 for (i = 0; i < ofs->numlayer; i++) { 240 iput(ofs->layers[i].trap); 241 mounts[i] = ofs->layers[i].mnt; 242 } 243 kern_unmount_array(mounts, ofs->numlayer); 244 kfree(ofs->layers); 245 for (i = 0; i < ofs->numfs; i++) 246 free_anon_bdev(ofs->fs[i].pseudo_dev); 247 kfree(ofs->fs); 248 249 kfree(ofs->config.lowerdir); 250 kfree(ofs->config.upperdir); 251 kfree(ofs->config.workdir); 252 kfree(ofs->config.redirect_mode); 253 if (ofs->creator_cred) 254 put_cred(ofs->creator_cred); 255 kfree(ofs); 256} 257 258static void ovl_put_super(struct super_block *sb) 259{ 260 struct ovl_fs *ofs = sb->s_fs_info; 261 262 ovl_free_fs(ofs); 263} 264 265/* Sync real dirty inodes in upper filesystem (if it exists) */ 266static int ovl_sync_fs(struct super_block *sb, int wait) 267{ 268 struct ovl_fs *ofs = sb->s_fs_info; 269 struct super_block *upper_sb; 270 int ret; 271 272 ret = ovl_sync_status(ofs); 273 /* 274 * We have to always set the err, because the return value isn't 275 * checked in syncfs, and instead indirectly return an error via 276 * the sb's writeback errseq, which VFS inspects after this call. 277 */ 278 if (ret < 0) { 279 errseq_set(&sb->s_wb_err, -EIO); 280 return -EIO; 281 } 282 283 if (!ret) 284 return ret; 285 286 /* 287 * Not called for sync(2) call or an emergency sync (SB_I_SKIP_SYNC). 288 * All the super blocks will be iterated, including upper_sb. 289 * 290 * If this is a syncfs(2) call, then we do need to call 291 * sync_filesystem() on upper_sb, but enough if we do it when being 292 * called with wait == 1. 293 */ 294 if (!wait) 295 return 0; 296 297 upper_sb = ovl_upper_mnt(ofs)->mnt_sb; 298 299 down_read(&upper_sb->s_umount); 300 ret = sync_filesystem(upper_sb); 301 up_read(&upper_sb->s_umount); 302 303 return ret; 304} 305 306/** 307 * ovl_statfs 308 * @sb: The overlayfs super block 309 * @buf: The struct kstatfs to fill in with stats 310 * 311 * Get the filesystem statistics. As writes always target the upper layer 312 * filesystem pass the statfs to the upper filesystem (if it exists) 313 */ 314static int ovl_statfs(struct dentry *dentry, struct kstatfs *buf) 315{ 316 struct ovl_fs *ofs = dentry->d_sb->s_fs_info; 317 struct dentry *root_dentry = dentry->d_sb->s_root; 318 struct path path; 319 int err; 320 321 ovl_path_real(root_dentry, &path); 322 323 err = vfs_statfs(&path, buf); 324 if (!err) { 325 buf->f_namelen = ofs->namelen; 326 buf->f_type = OVERLAYFS_SUPER_MAGIC; 327 } 328 329 return err; 330} 331 332/* Will this overlay be forced to mount/remount ro? */ 333static bool ovl_force_readonly(struct ovl_fs *ofs) 334{ 335 return (!ovl_upper_mnt(ofs) || !ofs->workdir); 336} 337 338static const char *ovl_redirect_mode_def(void) 339{ 340 return ovl_redirect_dir_def ? "on" : "off"; 341} 342 343static const char * const ovl_xino_str[] = { 344 "off", 345 "auto", 346 "on", 347}; 348 349static inline int ovl_xino_def(void) 350{ 351 return ovl_xino_auto_def ? OVL_XINO_AUTO : OVL_XINO_OFF; 352} 353 354/** 355 * ovl_show_options 356 * 357 * Prints the mount options for a given superblock. 358 * Returns zero; does not fail. 359 */ 360static int ovl_show_options(struct seq_file *m, struct dentry *dentry) 361{ 362 struct super_block *sb = dentry->d_sb; 363 struct ovl_fs *ofs = sb->s_fs_info; 364 365 seq_show_option(m, "lowerdir", ofs->config.lowerdir); 366 if (ofs->config.upperdir) { 367 seq_show_option(m, "upperdir", ofs->config.upperdir); 368 seq_show_option(m, "workdir", ofs->config.workdir); 369 } 370 if (ofs->config.default_permissions) 371 seq_puts(m, ",default_permissions"); 372 if (strcmp(ofs->config.redirect_mode, ovl_redirect_mode_def()) != 0) 373 seq_printf(m, ",redirect_dir=%s", ofs->config.redirect_mode); 374 if (ofs->config.index != ovl_index_def) 375 seq_printf(m, ",index=%s", ofs->config.index ? "on" : "off"); 376 if (ofs->config.nfs_export != ovl_nfs_export_def) 377 seq_printf(m, ",nfs_export=%s", ofs->config.nfs_export ? 378 "on" : "off"); 379 if (ofs->config.xino != ovl_xino_def() && !ovl_same_fs(sb)) 380 seq_printf(m, ",xino=%s", ovl_xino_str[ofs->config.xino]); 381 if (ofs->config.metacopy != ovl_metacopy_def) 382 seq_printf(m, ",metacopy=%s", 383 ofs->config.metacopy ? "on" : "off"); 384 if (ofs->config.ovl_volatile) 385 seq_puts(m, ",volatile"); 386 return 0; 387} 388 389static int ovl_remount(struct super_block *sb, int *flags, char *data) 390{ 391 struct ovl_fs *ofs = sb->s_fs_info; 392 struct super_block *upper_sb; 393 int ret = 0; 394 395 if (!(*flags & SB_RDONLY) && ovl_force_readonly(ofs)) 396 return -EROFS; 397 398 if (*flags & SB_RDONLY && !sb_rdonly(sb)) { 399 upper_sb = ovl_upper_mnt(ofs)->mnt_sb; 400 if (ovl_should_sync(ofs)) { 401 down_read(&upper_sb->s_umount); 402 ret = sync_filesystem(upper_sb); 403 up_read(&upper_sb->s_umount); 404 } 405 } 406 407 return ret; 408} 409 410static const struct super_operations ovl_super_operations = { 411 .alloc_inode = ovl_alloc_inode, 412 .free_inode = ovl_free_inode, 413 .destroy_inode = ovl_destroy_inode, 414 .drop_inode = generic_delete_inode, 415 .put_super = ovl_put_super, 416 .sync_fs = ovl_sync_fs, 417 .statfs = ovl_statfs, 418 .show_options = ovl_show_options, 419 .remount_fs = ovl_remount, 420}; 421 422enum { 423 OPT_LOWERDIR, 424 OPT_UPPERDIR, 425 OPT_WORKDIR, 426 OPT_DEFAULT_PERMISSIONS, 427 OPT_REDIRECT_DIR, 428 OPT_INDEX_ON, 429 OPT_INDEX_OFF, 430 OPT_NFS_EXPORT_ON, 431 OPT_NFS_EXPORT_OFF, 432 OPT_XINO_ON, 433 OPT_XINO_OFF, 434 OPT_XINO_AUTO, 435 OPT_METACOPY_ON, 436 OPT_METACOPY_OFF, 437 OPT_VOLATILE, 438 OPT_ERR, 439}; 440 441static const match_table_t ovl_tokens = { 442 {OPT_LOWERDIR, "lowerdir=%s"}, 443 {OPT_UPPERDIR, "upperdir=%s"}, 444 {OPT_WORKDIR, "workdir=%s"}, 445 {OPT_DEFAULT_PERMISSIONS, "default_permissions"}, 446 {OPT_REDIRECT_DIR, "redirect_dir=%s"}, 447 {OPT_INDEX_ON, "index=on"}, 448 {OPT_INDEX_OFF, "index=off"}, 449 {OPT_NFS_EXPORT_ON, "nfs_export=on"}, 450 {OPT_NFS_EXPORT_OFF, "nfs_export=off"}, 451 {OPT_XINO_ON, "xino=on"}, 452 {OPT_XINO_OFF, "xino=off"}, 453 {OPT_XINO_AUTO, "xino=auto"}, 454 {OPT_METACOPY_ON, "metacopy=on"}, 455 {OPT_METACOPY_OFF, "metacopy=off"}, 456 {OPT_VOLATILE, "volatile"}, 457 {OPT_ERR, NULL} 458}; 459 460static char *ovl_next_opt(char **s) 461{ 462 char *sbegin = *s; 463 char *p; 464 465 if (sbegin == NULL) 466 return NULL; 467 468 for (p = sbegin; *p; p++) { 469 if (*p == '\\') { 470 p++; 471 if (!*p) 472 break; 473 } else if (*p == ',') { 474 *p = '\0'; 475 *s = p + 1; 476 return sbegin; 477 } 478 } 479 *s = NULL; 480 return sbegin; 481} 482 483static int ovl_parse_redirect_mode(struct ovl_config *config, const char *mode) 484{ 485 if (strcmp(mode, "on") == 0) { 486 config->redirect_dir = true; 487 /* 488 * Does not make sense to have redirect creation without 489 * redirect following. 490 */ 491 config->redirect_follow = true; 492 } else if (strcmp(mode, "follow") == 0) { 493 config->redirect_follow = true; 494 } else if (strcmp(mode, "off") == 0) { 495 if (ovl_redirect_always_follow) 496 config->redirect_follow = true; 497 } else if (strcmp(mode, "nofollow") != 0) { 498 pr_err("bad mount option \"redirect_dir=%s\"\n", 499 mode); 500 return -EINVAL; 501 } 502 503 return 0; 504} 505 506static int ovl_parse_opt(char *opt, struct ovl_config *config) 507{ 508 char *p; 509 int err; 510 bool metacopy_opt = false, redirect_opt = false; 511 bool nfs_export_opt = false, index_opt = false; 512 513 config->redirect_mode = kstrdup(ovl_redirect_mode_def(), GFP_KERNEL); 514 if (!config->redirect_mode) 515 return -ENOMEM; 516 517 while ((p = ovl_next_opt(&opt)) != NULL) { 518 int token; 519 substring_t args[MAX_OPT_ARGS]; 520 521 if (!*p) 522 continue; 523 524 token = match_token(p, ovl_tokens, args); 525 switch (token) { 526 case OPT_UPPERDIR: 527 kfree(config->upperdir); 528 config->upperdir = match_strdup(&args[0]); 529 if (!config->upperdir) 530 return -ENOMEM; 531 break; 532 533 case OPT_LOWERDIR: 534 kfree(config->lowerdir); 535 config->lowerdir = match_strdup(&args[0]); 536 if (!config->lowerdir) 537 return -ENOMEM; 538 break; 539 540 case OPT_WORKDIR: 541 kfree(config->workdir); 542 config->workdir = match_strdup(&args[0]); 543 if (!config->workdir) 544 return -ENOMEM; 545 break; 546 547 case OPT_DEFAULT_PERMISSIONS: 548 config->default_permissions = true; 549 break; 550 551 case OPT_REDIRECT_DIR: 552 kfree(config->redirect_mode); 553 config->redirect_mode = match_strdup(&args[0]); 554 if (!config->redirect_mode) 555 return -ENOMEM; 556 redirect_opt = true; 557 break; 558 559 case OPT_INDEX_ON: 560 config->index = true; 561 index_opt = true; 562 break; 563 564 case OPT_INDEX_OFF: 565 config->index = false; 566 index_opt = true; 567 break; 568 569 case OPT_NFS_EXPORT_ON: 570 config->nfs_export = true; 571 nfs_export_opt = true; 572 break; 573 574 case OPT_NFS_EXPORT_OFF: 575 config->nfs_export = false; 576 nfs_export_opt = true; 577 break; 578 579 case OPT_XINO_ON: 580 config->xino = OVL_XINO_ON; 581 break; 582 583 case OPT_XINO_OFF: 584 config->xino = OVL_XINO_OFF; 585 break; 586 587 case OPT_XINO_AUTO: 588 config->xino = OVL_XINO_AUTO; 589 break; 590 591 case OPT_METACOPY_ON: 592 config->metacopy = true; 593 metacopy_opt = true; 594 break; 595 596 case OPT_METACOPY_OFF: 597 config->metacopy = false; 598 metacopy_opt = true; 599 break; 600 601 case OPT_VOLATILE: 602 config->ovl_volatile = true; 603 break; 604 605 default: 606 pr_err("unrecognized mount option \"%s\" or missing value\n", 607 p); 608 return -EINVAL; 609 } 610 } 611 612 /* Workdir/index are useless in non-upper mount */ 613 if (!config->upperdir) { 614 if (config->workdir) { 615 pr_info("option \"workdir=%s\" is useless in a non-upper mount, ignore\n", 616 config->workdir); 617 kfree(config->workdir); 618 config->workdir = NULL; 619 } 620 if (config->index && index_opt) { 621 pr_info("option \"index=on\" is useless in a non-upper mount, ignore\n"); 622 index_opt = false; 623 } 624 config->index = false; 625 } 626 627 if (!config->upperdir && config->ovl_volatile) { 628 pr_info("option \"volatile\" is meaningless in a non-upper mount, ignoring it.\n"); 629 config->ovl_volatile = false; 630 } 631 632 err = ovl_parse_redirect_mode(config, config->redirect_mode); 633 if (err) 634 return err; 635 636 /* 637 * This is to make the logic below simpler. It doesn't make any other 638 * difference, since config->redirect_dir is only used for upper. 639 */ 640 if (!config->upperdir && config->redirect_follow) 641 config->redirect_dir = true; 642 643 /* Resolve metacopy -> redirect_dir dependency */ 644 if (config->metacopy && !config->redirect_dir) { 645 if (metacopy_opt && redirect_opt) { 646 pr_err("conflicting options: metacopy=on,redirect_dir=%s\n", 647 config->redirect_mode); 648 return -EINVAL; 649 } 650 if (redirect_opt) { 651 /* 652 * There was an explicit redirect_dir=... that resulted 653 * in this conflict. 654 */ 655 pr_info("disabling metacopy due to redirect_dir=%s\n", 656 config->redirect_mode); 657 config->metacopy = false; 658 } else { 659 /* Automatically enable redirect otherwise. */ 660 config->redirect_follow = config->redirect_dir = true; 661 } 662 } 663 664 /* Resolve nfs_export -> index dependency */ 665 if (config->nfs_export && !config->index) { 666 if (!config->upperdir && config->redirect_follow) { 667 pr_info("NFS export requires \"redirect_dir=nofollow\" on non-upper mount, falling back to nfs_export=off.\n"); 668 config->nfs_export = false; 669 } else if (nfs_export_opt && index_opt) { 670 pr_err("conflicting options: nfs_export=on,index=off\n"); 671 return -EINVAL; 672 } else if (index_opt) { 673 /* 674 * There was an explicit index=off that resulted 675 * in this conflict. 676 */ 677 pr_info("disabling nfs_export due to index=off\n"); 678 config->nfs_export = false; 679 } else { 680 /* Automatically enable index otherwise. */ 681 config->index = true; 682 } 683 } 684 685 /* Resolve nfs_export -> !metacopy dependency */ 686 if (config->nfs_export && config->metacopy) { 687 if (nfs_export_opt && metacopy_opt) { 688 pr_err("conflicting options: nfs_export=on,metacopy=on\n"); 689 return -EINVAL; 690 } 691 if (metacopy_opt) { 692 /* 693 * There was an explicit metacopy=on that resulted 694 * in this conflict. 695 */ 696 pr_info("disabling nfs_export due to metacopy=on\n"); 697 config->nfs_export = false; 698 } else { 699 /* 700 * There was an explicit nfs_export=on that resulted 701 * in this conflict. 702 */ 703 pr_info("disabling metacopy due to nfs_export=on\n"); 704 config->metacopy = false; 705 } 706 } 707 708 return 0; 709} 710 711#define OVL_WORKDIR_NAME "work" 712#define OVL_INDEXDIR_NAME "index" 713 714static struct dentry *ovl_workdir_create(struct ovl_fs *ofs, 715 const char *name, bool persist) 716{ 717 struct inode *dir = ofs->workbasedir->d_inode; 718 struct vfsmount *mnt = ovl_upper_mnt(ofs); 719 struct dentry *work; 720 int err; 721 bool retried = false; 722 723 inode_lock_nested(dir, I_MUTEX_PARENT); 724retry: 725 work = lookup_one_len(name, ofs->workbasedir, strlen(name)); 726 727 if (!IS_ERR(work)) { 728 struct iattr attr = { 729 .ia_valid = ATTR_MODE, 730 .ia_mode = S_IFDIR | 0, 731 }; 732 733 if (work->d_inode) { 734 err = -EEXIST; 735 if (retried) 736 goto out_dput; 737 738 if (persist) 739 goto out_unlock; 740 741 retried = true; 742 err = ovl_workdir_cleanup(dir, mnt, work, 0); 743 dput(work); 744 if (err == -EINVAL) { 745 work = ERR_PTR(err); 746 goto out_unlock; 747 } 748 goto retry; 749 } 750 751 err = ovl_mkdir_real(dir, &work, attr.ia_mode); 752 if (err) 753 goto out_dput; 754 755 /* Weird filesystem returning with hashed negative (kernfs)? */ 756 err = -EINVAL; 757 if (d_really_is_negative(work)) 758 goto out_dput; 759 760 /* 761 * Try to remove POSIX ACL xattrs from workdir. We are good if: 762 * 763 * a) success (there was a POSIX ACL xattr and was removed) 764 * b) -ENODATA (there was no POSIX ACL xattr) 765 * c) -EOPNOTSUPP (POSIX ACL xattrs are not supported) 766 * 767 * There are various other error values that could effectively 768 * mean that the xattr doesn't exist (e.g. -ERANGE is returned 769 * if the xattr name is too long), but the set of filesystems 770 * allowed as upper are limited to "normal" ones, where checking 771 * for the above two errors is sufficient. 772 */ 773 err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_DEFAULT); 774 if (err && err != -ENODATA && err != -EOPNOTSUPP) 775 goto out_dput; 776 777 err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_ACCESS); 778 if (err && err != -ENODATA && err != -EOPNOTSUPP) 779 goto out_dput; 780 781 /* Clear any inherited mode bits */ 782 inode_lock(work->d_inode); 783 err = notify_change(work, &attr, NULL); 784 inode_unlock(work->d_inode); 785 if (err) 786 goto out_dput; 787 } else { 788 err = PTR_ERR(work); 789 goto out_err; 790 } 791out_unlock: 792 inode_unlock(dir); 793 return work; 794 795out_dput: 796 dput(work); 797out_err: 798 pr_warn("failed to create directory %s/%s (errno: %i); mounting read-only\n", 799 ofs->config.workdir, name, -err); 800 work = NULL; 801 goto out_unlock; 802} 803 804static void ovl_unescape(char *s) 805{ 806 char *d = s; 807 808 for (;; s++, d++) { 809 if (*s == '\\') 810 s++; 811 *d = *s; 812 if (!*s) 813 break; 814 } 815} 816 817static int ovl_mount_dir_noesc(const char *name, struct path *path) 818{ 819 int err = -EINVAL; 820 821 if (!*name) { 822 pr_err("empty lowerdir\n"); 823 goto out; 824 } 825 err = kern_path(name, LOOKUP_FOLLOW, path); 826 if (err) { 827 pr_err("failed to resolve '%s': %i\n", name, err); 828 goto out; 829 } 830 err = -EINVAL; 831 if (ovl_dentry_weird(path->dentry)) { 832 pr_err("filesystem on '%s' not supported\n", name); 833 goto out_put; 834 } 835 if (!d_is_dir(path->dentry)) { 836 pr_err("'%s' not a directory\n", name); 837 goto out_put; 838 } 839 return 0; 840 841out_put: 842 path_put_init(path); 843out: 844 return err; 845} 846 847static int ovl_mount_dir(const char *name, struct path *path) 848{ 849 int err = -ENOMEM; 850 char *tmp = kstrdup(name, GFP_KERNEL); 851 852 if (tmp) { 853 ovl_unescape(tmp); 854 err = ovl_mount_dir_noesc(tmp, path); 855 856 if (!err && path->dentry->d_flags & DCACHE_OP_REAL) { 857 pr_err("filesystem on '%s' not supported as upperdir\n", 858 tmp); 859 path_put_init(path); 860 err = -EINVAL; 861 } 862 kfree(tmp); 863 } 864 return err; 865} 866 867static int ovl_check_namelen(struct path *path, struct ovl_fs *ofs, 868 const char *name) 869{ 870 struct kstatfs statfs; 871 int err = vfs_statfs(path, &statfs); 872 873 if (err) 874 pr_err("statfs failed on '%s'\n", name); 875 else 876 ofs->namelen = max(ofs->namelen, statfs.f_namelen); 877 878 return err; 879} 880 881static int ovl_lower_dir(const char *name, struct path *path, 882 struct ovl_fs *ofs, int *stack_depth) 883{ 884 int fh_type; 885 int err; 886 887 err = ovl_mount_dir_noesc(name, path); 888 if (err) 889 return err; 890 891 err = ovl_check_namelen(path, ofs, name); 892 if (err) 893 return err; 894 895 *stack_depth = max(*stack_depth, path->mnt->mnt_sb->s_stack_depth); 896 897 /* 898 * The inodes index feature and NFS export need to encode and decode 899 * file handles, so they require that all layers support them. 900 */ 901 fh_type = ovl_can_decode_fh(path->dentry->d_sb); 902 if ((ofs->config.nfs_export || 903 (ofs->config.index && ofs->config.upperdir)) && !fh_type) { 904 ofs->config.index = false; 905 ofs->config.nfs_export = false; 906 pr_warn("fs on '%s' does not support file handles, falling back to index=off,nfs_export=off.\n", 907 name); 908 } 909 910 /* Check if lower fs has 32bit inode numbers */ 911 if (fh_type != FILEID_INO32_GEN) 912 ofs->xino_mode = -1; 913 914 return 0; 915} 916 917/* Workdir should not be subdir of upperdir and vice versa */ 918static bool ovl_workdir_ok(struct dentry *workdir, struct dentry *upperdir) 919{ 920 bool ok = false; 921 922 if (workdir != upperdir) { 923 ok = (lock_rename(workdir, upperdir) == NULL); 924 unlock_rename(workdir, upperdir); 925 } 926 return ok; 927} 928 929static unsigned int ovl_split_lowerdirs(char *str) 930{ 931 unsigned int ctr = 1; 932 char *s, *d; 933 934 for (s = d = str;; s++, d++) { 935 if (*s == '\\') { 936 s++; 937 } else if (*s == ':') { 938 *d = '\0'; 939 ctr++; 940 continue; 941 } 942 *d = *s; 943 if (!*s) 944 break; 945 } 946 return ctr; 947} 948 949static int __maybe_unused 950ovl_posix_acl_xattr_get(const struct xattr_handler *handler, 951 struct dentry *dentry, struct inode *inode, 952 const char *name, void *buffer, size_t size) 953{ 954 return ovl_xattr_get(dentry, inode, handler->name, buffer, size); 955} 956 957static int __maybe_unused 958ovl_posix_acl_xattr_set(const struct xattr_handler *handler, 959 struct dentry *dentry, struct inode *inode, 960 const char *name, const void *value, 961 size_t size, int flags) 962{ 963 struct dentry *workdir = ovl_workdir(dentry); 964 struct inode *realinode = ovl_inode_real(inode); 965 struct posix_acl *acl = NULL; 966 int err; 967 968 /* Check that everything is OK before copy-up */ 969 if (value) { 970 acl = posix_acl_from_xattr(&init_user_ns, value, size); 971 if (IS_ERR(acl)) 972 return PTR_ERR(acl); 973 } 974 err = -EOPNOTSUPP; 975 if (!IS_POSIXACL(d_inode(workdir))) 976 goto out_acl_release; 977 if (!realinode->i_op->set_acl) 978 goto out_acl_release; 979 if (handler->flags == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode)) { 980 err = acl ? -EACCES : 0; 981 goto out_acl_release; 982 } 983 err = -EPERM; 984 if (!inode_owner_or_capable(inode)) 985 goto out_acl_release; 986 987 posix_acl_release(acl); 988 989 /* 990 * Check if sgid bit needs to be cleared (actual setacl operation will 991 * be done with mounter's capabilities and so that won't do it for us). 992 */ 993 if (unlikely(inode->i_mode & S_ISGID) && 994 handler->flags == ACL_TYPE_ACCESS && 995 !in_group_p(inode->i_gid) && 996 !capable_wrt_inode_uidgid(inode, CAP_FSETID)) { 997 struct iattr iattr = { .ia_valid = ATTR_KILL_SGID }; 998 999 err = ovl_setattr(dentry, &iattr); 1000 if (err) 1001 return err; 1002 } 1003 1004 err = ovl_xattr_set(dentry, inode, handler->name, value, size, flags); 1005 if (!err) 1006 ovl_copyattr(ovl_inode_real(inode), inode); 1007 1008 return err; 1009 1010out_acl_release: 1011 posix_acl_release(acl); 1012 return err; 1013} 1014 1015static int ovl_own_xattr_get(const struct xattr_handler *handler, 1016 struct dentry *dentry, struct inode *inode, 1017 const char *name, void *buffer, size_t size) 1018{ 1019 return -EOPNOTSUPP; 1020} 1021 1022static int ovl_own_xattr_set(const struct xattr_handler *handler, 1023 struct dentry *dentry, struct inode *inode, 1024 const char *name, const void *value, 1025 size_t size, int flags) 1026{ 1027 return -EOPNOTSUPP; 1028} 1029 1030static int ovl_other_xattr_get(const struct xattr_handler *handler, 1031 struct dentry *dentry, struct inode *inode, 1032 const char *name, void *buffer, size_t size) 1033{ 1034 return ovl_xattr_get(dentry, inode, name, buffer, size); 1035} 1036 1037static int ovl_other_xattr_set(const struct xattr_handler *handler, 1038 struct dentry *dentry, struct inode *inode, 1039 const char *name, const void *value, 1040 size_t size, int flags) 1041{ 1042 return ovl_xattr_set(dentry, inode, name, value, size, flags); 1043} 1044 1045static const struct xattr_handler __maybe_unused 1046ovl_posix_acl_access_xattr_handler = { 1047 .name = XATTR_NAME_POSIX_ACL_ACCESS, 1048 .flags = ACL_TYPE_ACCESS, 1049 .get = ovl_posix_acl_xattr_get, 1050 .set = ovl_posix_acl_xattr_set, 1051}; 1052 1053static const struct xattr_handler __maybe_unused 1054ovl_posix_acl_default_xattr_handler = { 1055 .name = XATTR_NAME_POSIX_ACL_DEFAULT, 1056 .flags = ACL_TYPE_DEFAULT, 1057 .get = ovl_posix_acl_xattr_get, 1058 .set = ovl_posix_acl_xattr_set, 1059}; 1060 1061static const struct xattr_handler ovl_own_xattr_handler = { 1062 .prefix = OVL_XATTR_PREFIX, 1063 .get = ovl_own_xattr_get, 1064 .set = ovl_own_xattr_set, 1065}; 1066 1067static const struct xattr_handler ovl_other_xattr_handler = { 1068 .prefix = "", /* catch all */ 1069 .get = ovl_other_xattr_get, 1070 .set = ovl_other_xattr_set, 1071}; 1072 1073static const struct xattr_handler *ovl_xattr_handlers[] = { 1074#ifdef CONFIG_FS_POSIX_ACL 1075 &ovl_posix_acl_access_xattr_handler, 1076 &ovl_posix_acl_default_xattr_handler, 1077#endif 1078 &ovl_own_xattr_handler, 1079 &ovl_other_xattr_handler, 1080 NULL 1081}; 1082 1083static int ovl_setup_trap(struct super_block *sb, struct dentry *dir, 1084 struct inode **ptrap, const char *name) 1085{ 1086 struct inode *trap; 1087 int err; 1088 1089 trap = ovl_get_trap_inode(sb, dir); 1090 err = PTR_ERR_OR_ZERO(trap); 1091 if (err) { 1092 if (err == -ELOOP) 1093 pr_err("conflicting %s path\n", name); 1094 return err; 1095 } 1096 1097 *ptrap = trap; 1098 return 0; 1099} 1100 1101/* 1102 * Determine how we treat concurrent use of upperdir/workdir based on the 1103 * index feature. This is papering over mount leaks of container runtimes, 1104 * for example, an old overlay mount is leaked and now its upperdir is 1105 * attempted to be used as a lower layer in a new overlay mount. 1106 */ 1107static int ovl_report_in_use(struct ovl_fs *ofs, const char *name) 1108{ 1109 if (ofs->config.index) { 1110 pr_err("%s is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.\n", 1111 name); 1112 return -EBUSY; 1113 } else { 1114 pr_warn("%s is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior.\n", 1115 name); 1116 return 0; 1117 } 1118} 1119 1120static int ovl_get_upper(struct super_block *sb, struct ovl_fs *ofs, 1121 struct ovl_layer *upper_layer, struct path *upperpath) 1122{ 1123 struct vfsmount *upper_mnt; 1124 int err; 1125 1126 err = ovl_mount_dir(ofs->config.upperdir, upperpath); 1127 if (err) 1128 goto out; 1129 1130 /* Upper fs should not be r/o */ 1131 if (sb_rdonly(upperpath->mnt->mnt_sb)) { 1132 pr_err("upper fs is r/o, try multi-lower layers mount\n"); 1133 err = -EINVAL; 1134 goto out; 1135 } 1136 1137 err = ovl_check_namelen(upperpath, ofs, ofs->config.upperdir); 1138 if (err) 1139 goto out; 1140 1141 err = ovl_setup_trap(sb, upperpath->dentry, &upper_layer->trap, 1142 "upperdir"); 1143 if (err) 1144 goto out; 1145 1146 upper_mnt = clone_private_mount(upperpath); 1147 err = PTR_ERR(upper_mnt); 1148 if (IS_ERR(upper_mnt)) { 1149 pr_err("failed to clone upperpath\n"); 1150 goto out; 1151 } 1152 1153 /* Don't inherit atime flags */ 1154 upper_mnt->mnt_flags &= ~(MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME); 1155 upper_layer->mnt = upper_mnt; 1156 upper_layer->idx = 0; 1157 upper_layer->fsid = 0; 1158 1159 /* 1160 * Inherit SB_NOSEC flag from upperdir. 1161 * 1162 * This optimization changes behavior when a security related attribute 1163 * (suid/sgid/security.*) is changed on an underlying layer. This is 1164 * okay because we don't yet have guarantees in that case, but it will 1165 * need careful treatment once we want to honour changes to underlying 1166 * filesystems. 1167 */ 1168 if (upper_mnt->mnt_sb->s_flags & SB_NOSEC) 1169 sb->s_flags |= SB_NOSEC; 1170 1171 if (ovl_inuse_trylock(ovl_upper_mnt(ofs)->mnt_root)) { 1172 ofs->upperdir_locked = true; 1173 } else { 1174 err = ovl_report_in_use(ofs, "upperdir"); 1175 if (err) 1176 goto out; 1177 } 1178 1179 err = 0; 1180out: 1181 return err; 1182} 1183 1184/* 1185 * Returns 1 if RENAME_WHITEOUT is supported, 0 if not supported and 1186 * negative values if error is encountered. 1187 */ 1188static int ovl_check_rename_whiteout(struct dentry *workdir) 1189{ 1190 struct inode *dir = d_inode(workdir); 1191 struct dentry *temp; 1192 struct dentry *dest; 1193 struct dentry *whiteout; 1194 struct name_snapshot name; 1195 int err; 1196 1197 inode_lock_nested(dir, I_MUTEX_PARENT); 1198 1199 temp = ovl_create_temp(workdir, OVL_CATTR(S_IFREG | 0)); 1200 err = PTR_ERR(temp); 1201 if (IS_ERR(temp)) 1202 goto out_unlock; 1203 1204 dest = ovl_lookup_temp(workdir); 1205 err = PTR_ERR(dest); 1206 if (IS_ERR(dest)) { 1207 dput(temp); 1208 goto out_unlock; 1209 } 1210 1211 /* Name is inline and stable - using snapshot as a copy helper */ 1212 take_dentry_name_snapshot(&name, temp); 1213 err = ovl_do_rename(dir, temp, dir, dest, RENAME_WHITEOUT); 1214 if (err) { 1215 if (err == -EINVAL) 1216 err = 0; 1217 goto cleanup_temp; 1218 } 1219 1220 whiteout = lookup_one_len(name.name.name, workdir, name.name.len); 1221 err = PTR_ERR(whiteout); 1222 if (IS_ERR(whiteout)) 1223 goto cleanup_temp; 1224 1225 err = ovl_is_whiteout(whiteout); 1226 1227 /* Best effort cleanup of whiteout and temp file */ 1228 if (err) 1229 ovl_cleanup(dir, whiteout); 1230 dput(whiteout); 1231 1232cleanup_temp: 1233 ovl_cleanup(dir, temp); 1234 release_dentry_name_snapshot(&name); 1235 dput(temp); 1236 dput(dest); 1237 1238out_unlock: 1239 inode_unlock(dir); 1240 1241 return err; 1242} 1243 1244static struct dentry *ovl_lookup_or_create(struct dentry *parent, 1245 const char *name, umode_t mode) 1246{ 1247 size_t len = strlen(name); 1248 struct dentry *child; 1249 1250 inode_lock_nested(parent->d_inode, I_MUTEX_PARENT); 1251 child = lookup_one_len(name, parent, len); 1252 if (!IS_ERR(child) && !child->d_inode) 1253 child = ovl_create_real(parent->d_inode, child, 1254 OVL_CATTR(mode)); 1255 inode_unlock(parent->d_inode); 1256 dput(parent); 1257 1258 return child; 1259} 1260 1261/* 1262 * Creates $workdir/work/incompat/volatile/dirty file if it is not already 1263 * present. 1264 */ 1265static int ovl_create_volatile_dirty(struct ovl_fs *ofs) 1266{ 1267 unsigned int ctr; 1268 struct dentry *d = dget(ofs->workbasedir); 1269 static const char *const volatile_path[] = { 1270 OVL_WORKDIR_NAME, "incompat", "volatile", "dirty" 1271 }; 1272 const char *const *name = volatile_path; 1273 1274 for (ctr = ARRAY_SIZE(volatile_path); ctr; ctr--, name++) { 1275 d = ovl_lookup_or_create(d, *name, ctr > 1 ? S_IFDIR : S_IFREG); 1276 if (IS_ERR(d)) 1277 return PTR_ERR(d); 1278 } 1279 dput(d); 1280 return 0; 1281} 1282 1283static int ovl_make_workdir(struct super_block *sb, struct ovl_fs *ofs, 1284 struct path *workpath) 1285{ 1286 struct vfsmount *mnt = ovl_upper_mnt(ofs); 1287 struct dentry *temp, *workdir; 1288 bool rename_whiteout; 1289 bool d_type; 1290 int fh_type; 1291 int err; 1292 1293 err = mnt_want_write(mnt); 1294 if (err) 1295 return err; 1296 1297 workdir = ovl_workdir_create(ofs, OVL_WORKDIR_NAME, false); 1298 err = PTR_ERR(workdir); 1299 if (IS_ERR_OR_NULL(workdir)) 1300 goto out; 1301 1302 ofs->workdir = workdir; 1303 1304 err = ovl_setup_trap(sb, ofs->workdir, &ofs->workdir_trap, "workdir"); 1305 if (err) 1306 goto out; 1307 1308 /* 1309 * Upper should support d_type, else whiteouts are visible. Given 1310 * workdir and upper are on same fs, we can do iterate_dir() on 1311 * workdir. This check requires successful creation of workdir in 1312 * previous step. 1313 */ 1314 err = ovl_check_d_type_supported(workpath); 1315 if (err < 0) 1316 goto out; 1317 1318 d_type = err; 1319 if (!d_type) 1320 pr_warn("upper fs needs to support d_type.\n"); 1321 1322 /* Check if upper/work fs supports O_TMPFILE */ 1323 temp = ovl_do_tmpfile(ofs->workdir, S_IFREG | 0); 1324 ofs->tmpfile = !IS_ERR(temp); 1325 if (ofs->tmpfile) 1326 dput(temp); 1327 else 1328 pr_warn("upper fs does not support tmpfile.\n"); 1329 1330 1331 /* Check if upper/work fs supports RENAME_WHITEOUT */ 1332 err = ovl_check_rename_whiteout(ofs->workdir); 1333 if (err < 0) 1334 goto out; 1335 1336 rename_whiteout = err; 1337 if (!rename_whiteout) 1338 pr_warn("upper fs does not support RENAME_WHITEOUT.\n"); 1339 1340 /* 1341 * Check if upper/work fs supports trusted.overlay.* xattr 1342 */ 1343 err = ovl_do_setxattr(ofs, ofs->workdir, OVL_XATTR_OPAQUE, "0", 1); 1344 if (err) { 1345 ofs->noxattr = true; 1346 ofs->config.index = false; 1347 ofs->config.metacopy = false; 1348 pr_warn("upper fs does not support xattr, falling back to index=off and metacopy=off.\n"); 1349 err = 0; 1350 } else { 1351 ovl_do_removexattr(ofs, ofs->workdir, OVL_XATTR_OPAQUE); 1352 } 1353 1354 /* 1355 * We allowed sub-optimal upper fs configuration and don't want to break 1356 * users over kernel upgrade, but we never allowed remote upper fs, so 1357 * we can enforce strict requirements for remote upper fs. 1358 */ 1359 if (ovl_dentry_remote(ofs->workdir) && 1360 (!d_type || !rename_whiteout || ofs->noxattr)) { 1361 pr_err("upper fs missing required features.\n"); 1362 err = -EINVAL; 1363 goto out; 1364 } 1365 1366 /* 1367 * For volatile mount, create a incompat/volatile/dirty file to keep 1368 * track of it. 1369 */ 1370 if (ofs->config.ovl_volatile) { 1371 err = ovl_create_volatile_dirty(ofs); 1372 if (err < 0) { 1373 pr_err("Failed to create volatile/dirty file.\n"); 1374 goto out; 1375 } 1376 } 1377 1378 /* Check if upper/work fs supports file handles */ 1379 fh_type = ovl_can_decode_fh(ofs->workdir->d_sb); 1380 if (ofs->config.index && !fh_type) { 1381 ofs->config.index = false; 1382 pr_warn("upper fs does not support file handles, falling back to index=off.\n"); 1383 } 1384 1385 /* Check if upper fs has 32bit inode numbers */ 1386 if (fh_type != FILEID_INO32_GEN) 1387 ofs->xino_mode = -1; 1388 1389 /* NFS export of r/w mount depends on index */ 1390 if (ofs->config.nfs_export && !ofs->config.index) { 1391 pr_warn("NFS export requires \"index=on\", falling back to nfs_export=off.\n"); 1392 ofs->config.nfs_export = false; 1393 } 1394out: 1395 mnt_drop_write(mnt); 1396 return err; 1397} 1398 1399static int ovl_get_workdir(struct super_block *sb, struct ovl_fs *ofs, 1400 struct path *upperpath) 1401{ 1402 int err; 1403 struct path workpath = { }; 1404 1405 err = ovl_mount_dir(ofs->config.workdir, &workpath); 1406 if (err) 1407 goto out; 1408 1409 err = -EINVAL; 1410 if (upperpath->mnt != workpath.mnt) { 1411 pr_err("workdir and upperdir must reside under the same mount\n"); 1412 goto out; 1413 } 1414 if (!ovl_workdir_ok(workpath.dentry, upperpath->dentry)) { 1415 pr_err("workdir and upperdir must be separate subtrees\n"); 1416 goto out; 1417 } 1418 1419 ofs->workbasedir = dget(workpath.dentry); 1420 1421 if (ovl_inuse_trylock(ofs->workbasedir)) { 1422 ofs->workdir_locked = true; 1423 } else { 1424 err = ovl_report_in_use(ofs, "workdir"); 1425 if (err) 1426 goto out; 1427 } 1428 1429 err = ovl_setup_trap(sb, ofs->workbasedir, &ofs->workbasedir_trap, 1430 "workdir"); 1431 if (err) 1432 goto out; 1433 1434 err = ovl_make_workdir(sb, ofs, &workpath); 1435 1436out: 1437 path_put(&workpath); 1438 1439 return err; 1440} 1441 1442static int ovl_get_indexdir(struct super_block *sb, struct ovl_fs *ofs, 1443 struct ovl_entry *oe, struct path *upperpath) 1444{ 1445 struct vfsmount *mnt = ovl_upper_mnt(ofs); 1446 struct dentry *indexdir; 1447 int err; 1448 1449 err = mnt_want_write(mnt); 1450 if (err) 1451 return err; 1452 1453 /* Verify lower root is upper root origin */ 1454 err = ovl_verify_origin(ofs, upperpath->dentry, 1455 oe->lowerstack[0].dentry, true); 1456 if (err) { 1457 pr_err("failed to verify upper root origin\n"); 1458 goto out; 1459 } 1460 1461 /* index dir will act also as workdir */ 1462 iput(ofs->workdir_trap); 1463 ofs->workdir_trap = NULL; 1464 dput(ofs->workdir); 1465 ofs->workdir = NULL; 1466 indexdir = ovl_workdir_create(ofs, OVL_INDEXDIR_NAME, true); 1467 if (IS_ERR(indexdir)) { 1468 err = PTR_ERR(indexdir); 1469 } else if (indexdir) { 1470 ofs->indexdir = indexdir; 1471 ofs->workdir = dget(indexdir); 1472 1473 err = ovl_setup_trap(sb, ofs->indexdir, &ofs->indexdir_trap, 1474 "indexdir"); 1475 if (err) 1476 goto out; 1477 1478 /* 1479 * Verify upper root is exclusively associated with index dir. 1480 * Older kernels stored upper fh in "trusted.overlay.origin" 1481 * xattr. If that xattr exists, verify that it is a match to 1482 * upper dir file handle. In any case, verify or set xattr 1483 * "trusted.overlay.upper" to indicate that index may have 1484 * directory entries. 1485 */ 1486 if (ovl_check_origin_xattr(ofs, ofs->indexdir)) { 1487 err = ovl_verify_set_fh(ofs, ofs->indexdir, 1488 OVL_XATTR_ORIGIN, 1489 upperpath->dentry, true, false); 1490 if (err) 1491 pr_err("failed to verify index dir 'origin' xattr\n"); 1492 } 1493 err = ovl_verify_upper(ofs, ofs->indexdir, upperpath->dentry, 1494 true); 1495 if (err) 1496 pr_err("failed to verify index dir 'upper' xattr\n"); 1497 1498 /* Cleanup bad/stale/orphan index entries */ 1499 if (!err) 1500 err = ovl_indexdir_cleanup(ofs); 1501 } 1502 if (err || !ofs->indexdir) 1503 pr_warn("try deleting index dir or mounting with '-o index=off' to disable inodes index.\n"); 1504 1505out: 1506 mnt_drop_write(mnt); 1507 return err; 1508} 1509 1510static bool ovl_lower_uuid_ok(struct ovl_fs *ofs, const uuid_t *uuid) 1511{ 1512 unsigned int i; 1513 1514 if (!ofs->config.nfs_export && !ovl_upper_mnt(ofs)) 1515 return true; 1516 1517 /* 1518 * We allow using single lower with null uuid for index and nfs_export 1519 * for example to support those features with single lower squashfs. 1520 * To avoid regressions in setups of overlay with re-formatted lower 1521 * squashfs, do not allow decoding origin with lower null uuid unless 1522 * user opted-in to one of the new features that require following the 1523 * lower inode of non-dir upper. 1524 */ 1525 if (!ofs->config.index && !ofs->config.metacopy && !ofs->config.xino && 1526 uuid_is_null(uuid)) 1527 return false; 1528 1529 for (i = 0; i < ofs->numfs; i++) { 1530 /* 1531 * We use uuid to associate an overlay lower file handle with a 1532 * lower layer, so we can accept lower fs with null uuid as long 1533 * as all lower layers with null uuid are on the same fs. 1534 * if we detect multiple lower fs with the same uuid, we 1535 * disable lower file handle decoding on all of them. 1536 */ 1537 if (ofs->fs[i].is_lower && 1538 uuid_equal(&ofs->fs[i].sb->s_uuid, uuid)) { 1539 ofs->fs[i].bad_uuid = true; 1540 return false; 1541 } 1542 } 1543 return true; 1544} 1545 1546/* Get a unique fsid for the layer */ 1547static int ovl_get_fsid(struct ovl_fs *ofs, const struct path *path) 1548{ 1549 struct super_block *sb = path->mnt->mnt_sb; 1550 unsigned int i; 1551 dev_t dev; 1552 int err; 1553 bool bad_uuid = false; 1554 1555 for (i = 0; i < ofs->numfs; i++) { 1556 if (ofs->fs[i].sb == sb) 1557 return i; 1558 } 1559 1560 if (!ovl_lower_uuid_ok(ofs, &sb->s_uuid)) { 1561 bad_uuid = true; 1562 if (ofs->config.index || ofs->config.nfs_export) { 1563 ofs->config.index = false; 1564 ofs->config.nfs_export = false; 1565 pr_warn("%s uuid detected in lower fs '%pd2', falling back to index=off,nfs_export=off.\n", 1566 uuid_is_null(&sb->s_uuid) ? "null" : 1567 "conflicting", 1568 path->dentry); 1569 } 1570 } 1571 1572 err = get_anon_bdev(&dev); 1573 if (err) { 1574 pr_err("failed to get anonymous bdev for lowerpath\n"); 1575 return err; 1576 } 1577 1578 ofs->fs[ofs->numfs].sb = sb; 1579 ofs->fs[ofs->numfs].pseudo_dev = dev; 1580 ofs->fs[ofs->numfs].bad_uuid = bad_uuid; 1581 1582 return ofs->numfs++; 1583} 1584 1585static int ovl_get_layers(struct super_block *sb, struct ovl_fs *ofs, 1586 struct path *stack, unsigned int numlower, 1587 struct ovl_layer *layers) 1588{ 1589 int err; 1590 unsigned int i; 1591 1592 err = -ENOMEM; 1593 ofs->fs = kcalloc(numlower + 1, sizeof(struct ovl_sb), GFP_KERNEL); 1594 if (ofs->fs == NULL) 1595 goto out; 1596 1597 /* idx/fsid 0 are reserved for upper fs even with lower only overlay */ 1598 ofs->numfs++; 1599 1600 /* 1601 * All lower layers that share the same fs as upper layer, use the same 1602 * pseudo_dev as upper layer. Allocate fs[0].pseudo_dev even for lower 1603 * only overlay to simplify ovl_fs_free(). 1604 * is_lower will be set if upper fs is shared with a lower layer. 1605 */ 1606 err = get_anon_bdev(&ofs->fs[0].pseudo_dev); 1607 if (err) { 1608 pr_err("failed to get anonymous bdev for upper fs\n"); 1609 goto out; 1610 } 1611 1612 if (ovl_upper_mnt(ofs)) { 1613 ofs->fs[0].sb = ovl_upper_mnt(ofs)->mnt_sb; 1614 ofs->fs[0].is_lower = false; 1615 } 1616 1617 for (i = 0; i < numlower; i++) { 1618 struct vfsmount *mnt; 1619 struct inode *trap; 1620 int fsid; 1621 1622 err = fsid = ovl_get_fsid(ofs, &stack[i]); 1623 if (err < 0) 1624 goto out; 1625 1626 /* 1627 * Check if lower root conflicts with this overlay layers before 1628 * checking if it is in-use as upperdir/workdir of "another" 1629 * mount, because we do not bother to check in ovl_is_inuse() if 1630 * the upperdir/workdir is in fact in-use by our 1631 * upperdir/workdir. 1632 */ 1633 err = ovl_setup_trap(sb, stack[i].dentry, &trap, "lowerdir"); 1634 if (err) 1635 goto out; 1636 1637 if (ovl_is_inuse(stack[i].dentry)) { 1638 err = ovl_report_in_use(ofs, "lowerdir"); 1639 if (err) { 1640 iput(trap); 1641 goto out; 1642 } 1643 } 1644 1645 mnt = clone_private_mount(&stack[i]); 1646 err = PTR_ERR(mnt); 1647 if (IS_ERR(mnt)) { 1648 pr_err("failed to clone lowerpath\n"); 1649 iput(trap); 1650 goto out; 1651 } 1652 1653 /* 1654 * Make lower layers R/O. That way fchmod/fchown on lower file 1655 * will fail instead of modifying lower fs. 1656 */ 1657 mnt->mnt_flags |= MNT_READONLY | MNT_NOATIME; 1658 1659 layers[ofs->numlayer].trap = trap; 1660 layers[ofs->numlayer].mnt = mnt; 1661 layers[ofs->numlayer].idx = ofs->numlayer; 1662 layers[ofs->numlayer].fsid = fsid; 1663 layers[ofs->numlayer].fs = &ofs->fs[fsid]; 1664 ofs->numlayer++; 1665 ofs->fs[fsid].is_lower = true; 1666 } 1667 1668 /* 1669 * When all layers on same fs, overlay can use real inode numbers. 1670 * With mount option "xino=<on|auto>", mounter declares that there are 1671 * enough free high bits in underlying fs to hold the unique fsid. 1672 * If overlayfs does encounter underlying inodes using the high xino 1673 * bits reserved for fsid, it emits a warning and uses the original 1674 * inode number or a non persistent inode number allocated from a 1675 * dedicated range. 1676 */ 1677 if (ofs->numfs - !ovl_upper_mnt(ofs) == 1) { 1678 if (ofs->config.xino == OVL_XINO_ON) 1679 pr_info("\"xino=on\" is useless with all layers on same fs, ignore.\n"); 1680 ofs->xino_mode = 0; 1681 } else if (ofs->config.xino == OVL_XINO_OFF) { 1682 ofs->xino_mode = -1; 1683 } else if (ofs->xino_mode < 0) { 1684 /* 1685 * This is a roundup of number of bits needed for encoding 1686 * fsid, where fsid 0 is reserved for upper fs (even with 1687 * lower only overlay) +1 extra bit is reserved for the non 1688 * persistent inode number range that is used for resolving 1689 * xino lower bits overflow. 1690 */ 1691 BUILD_BUG_ON(ilog2(OVL_MAX_STACK) > 30); 1692 ofs->xino_mode = ilog2(ofs->numfs - 1) + 2; 1693 } 1694 1695 if (ofs->xino_mode > 0) { 1696 pr_info("\"xino\" feature enabled using %d upper inode bits.\n", 1697 ofs->xino_mode); 1698 } 1699 1700 err = 0; 1701out: 1702 return err; 1703} 1704 1705static struct ovl_entry *ovl_get_lowerstack(struct super_block *sb, 1706 const char *lower, unsigned int numlower, 1707 struct ovl_fs *ofs, struct ovl_layer *layers) 1708{ 1709 int err; 1710 struct path *stack = NULL; 1711 unsigned int i; 1712 struct ovl_entry *oe; 1713 1714 if (!ofs->config.upperdir && numlower == 1) { 1715 pr_err("at least 2 lowerdir are needed while upperdir nonexistent\n"); 1716 return ERR_PTR(-EINVAL); 1717 } 1718 1719 stack = kcalloc(numlower, sizeof(struct path), GFP_KERNEL); 1720 if (!stack) 1721 return ERR_PTR(-ENOMEM); 1722 1723 err = -EINVAL; 1724 for (i = 0; i < numlower; i++) { 1725 err = ovl_lower_dir(lower, &stack[i], ofs, &sb->s_stack_depth); 1726 if (err) 1727 goto out_err; 1728 1729 lower = strchr(lower, '\0') + 1; 1730 } 1731 1732 err = -EINVAL; 1733 sb->s_stack_depth++; 1734 if (sb->s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) { 1735 pr_err("maximum fs stacking depth exceeded\n"); 1736 goto out_err; 1737 } 1738 1739 err = ovl_get_layers(sb, ofs, stack, numlower, layers); 1740 if (err) 1741 goto out_err; 1742 1743 err = -ENOMEM; 1744 oe = ovl_alloc_entry(numlower); 1745 if (!oe) 1746 goto out_err; 1747 1748 for (i = 0; i < numlower; i++) { 1749 oe->lowerstack[i].dentry = dget(stack[i].dentry); 1750 oe->lowerstack[i].layer = &ofs->layers[i+1]; 1751 } 1752 1753out: 1754 for (i = 0; i < numlower; i++) 1755 path_put(&stack[i]); 1756 kfree(stack); 1757 1758 return oe; 1759 1760out_err: 1761 oe = ERR_PTR(err); 1762 goto out; 1763} 1764 1765/* 1766 * Check if this layer root is a descendant of: 1767 * - another layer of this overlayfs instance 1768 * - upper/work dir of any overlayfs instance 1769 */ 1770static int ovl_check_layer(struct super_block *sb, struct ovl_fs *ofs, 1771 struct dentry *dentry, const char *name, 1772 bool is_lower) 1773{ 1774 struct dentry *next = dentry, *parent; 1775 int err = 0; 1776 1777 if (!dentry) 1778 return 0; 1779 1780 parent = dget_parent(next); 1781 1782 /* Walk back ancestors to root (inclusive) looking for traps */ 1783 while (!err && parent != next) { 1784 if (is_lower && ovl_lookup_trap_inode(sb, parent)) { 1785 err = -ELOOP; 1786 pr_err("overlapping %s path\n", name); 1787 } else if (ovl_is_inuse(parent)) { 1788 err = ovl_report_in_use(ofs, name); 1789 } 1790 next = parent; 1791 parent = dget_parent(next); 1792 dput(next); 1793 } 1794 1795 dput(parent); 1796 1797 return err; 1798} 1799 1800/* 1801 * Check if any of the layers or work dirs overlap. 1802 */ 1803static int ovl_check_overlapping_layers(struct super_block *sb, 1804 struct ovl_fs *ofs) 1805{ 1806 int i, err; 1807 1808 if (ovl_upper_mnt(ofs)) { 1809 err = ovl_check_layer(sb, ofs, ovl_upper_mnt(ofs)->mnt_root, 1810 "upperdir", false); 1811 if (err) 1812 return err; 1813 1814 /* 1815 * Checking workbasedir avoids hitting ovl_is_inuse(parent) of 1816 * this instance and covers overlapping work and index dirs, 1817 * unless work or index dir have been moved since created inside 1818 * workbasedir. In that case, we already have their traps in 1819 * inode cache and we will catch that case on lookup. 1820 */ 1821 err = ovl_check_layer(sb, ofs, ofs->workbasedir, "workdir", 1822 false); 1823 if (err) 1824 return err; 1825 } 1826 1827 for (i = 1; i < ofs->numlayer; i++) { 1828 err = ovl_check_layer(sb, ofs, 1829 ofs->layers[i].mnt->mnt_root, 1830 "lowerdir", true); 1831 if (err) 1832 return err; 1833 } 1834 1835 return 0; 1836} 1837 1838static struct dentry *ovl_get_root(struct super_block *sb, 1839 struct dentry *upperdentry, 1840 struct ovl_entry *oe) 1841{ 1842 struct dentry *root; 1843 struct ovl_path *lowerpath = &oe->lowerstack[0]; 1844 unsigned long ino = d_inode(lowerpath->dentry)->i_ino; 1845 int fsid = lowerpath->layer->fsid; 1846 struct ovl_inode_params oip = { 1847 .upperdentry = upperdentry, 1848 .lowerpath = lowerpath, 1849 }; 1850 1851 root = d_make_root(ovl_new_inode(sb, S_IFDIR, 0)); 1852 if (!root) 1853 return NULL; 1854 1855 root->d_fsdata = oe; 1856 1857 if (upperdentry) { 1858 /* Root inode uses upper st_ino/i_ino */ 1859 ino = d_inode(upperdentry)->i_ino; 1860 fsid = 0; 1861 ovl_dentry_set_upper_alias(root); 1862 if (ovl_is_impuredir(sb, upperdentry)) 1863 ovl_set_flag(OVL_IMPURE, d_inode(root)); 1864 } 1865 1866 /* Root is always merge -> can have whiteouts */ 1867 ovl_set_flag(OVL_WHITEOUTS, d_inode(root)); 1868 ovl_dentry_set_flag(OVL_E_CONNECTED, root); 1869 ovl_set_upperdata(d_inode(root)); 1870 ovl_inode_init(d_inode(root), &oip, ino, fsid); 1871 ovl_dentry_init_flags(root, upperdentry, DCACHE_OP_WEAK_REVALIDATE); 1872 1873 return root; 1874} 1875 1876static int ovl_fill_super(struct super_block *sb, void *data, int silent) 1877{ 1878 struct path upperpath = { }; 1879 struct dentry *root_dentry; 1880 struct ovl_entry *oe; 1881 struct ovl_fs *ofs; 1882 struct ovl_layer *layers; 1883 struct cred *cred; 1884 char *splitlower = NULL; 1885 unsigned int numlower; 1886 int err; 1887 1888 sb->s_d_op = &ovl_dentry_operations; 1889 1890 err = -ENOMEM; 1891 ofs = kzalloc(sizeof(struct ovl_fs), GFP_KERNEL); 1892 if (!ofs) 1893 goto out; 1894 1895 ofs->creator_cred = cred = prepare_creds(); 1896 if (!cred) 1897 goto out_err; 1898 1899 /* Is there a reason anyone would want not to share whiteouts? */ 1900 ofs->share_whiteout = true; 1901 1902 ofs->config.index = ovl_index_def; 1903 ofs->config.nfs_export = ovl_nfs_export_def; 1904 ofs->config.xino = ovl_xino_def(); 1905 ofs->config.metacopy = ovl_metacopy_def; 1906 err = ovl_parse_opt((char *) data, &ofs->config); 1907 if (err) 1908 goto out_err; 1909 1910 err = -EINVAL; 1911 if (!ofs->config.lowerdir) { 1912 if (!silent) 1913 pr_err("missing 'lowerdir'\n"); 1914 goto out_err; 1915 } 1916 1917 err = -ENOMEM; 1918 splitlower = kstrdup(ofs->config.lowerdir, GFP_KERNEL); 1919 if (!splitlower) 1920 goto out_err; 1921 1922 numlower = ovl_split_lowerdirs(splitlower); 1923 if (numlower > OVL_MAX_STACK) { 1924 pr_err("too many lower directories, limit is %d\n", 1925 OVL_MAX_STACK); 1926 goto out_err; 1927 } 1928 1929 layers = kcalloc(numlower + 1, sizeof(struct ovl_layer), GFP_KERNEL); 1930 if (!layers) 1931 goto out_err; 1932 1933 ofs->layers = layers; 1934 /* Layer 0 is reserved for upper even if there's no upper */ 1935 ofs->numlayer = 1; 1936 1937 sb->s_stack_depth = 0; 1938 sb->s_maxbytes = MAX_LFS_FILESIZE; 1939 atomic_long_set(&ofs->last_ino, 1); 1940 /* Assume underlaying fs uses 32bit inodes unless proven otherwise */ 1941 if (ofs->config.xino != OVL_XINO_OFF) { 1942 ofs->xino_mode = BITS_PER_LONG - 32; 1943 if (!ofs->xino_mode) { 1944 pr_warn("xino not supported on 32bit kernel, falling back to xino=off.\n"); 1945 ofs->config.xino = OVL_XINO_OFF; 1946 } 1947 } 1948 1949 /* alloc/destroy_inode needed for setting up traps in inode cache */ 1950 sb->s_op = &ovl_super_operations; 1951 1952 if (ofs->config.upperdir) { 1953 struct super_block *upper_sb; 1954 1955 if (!ofs->config.workdir) { 1956 pr_err("missing 'workdir'\n"); 1957 goto out_err; 1958 } 1959 1960 err = ovl_get_upper(sb, ofs, &layers[0], &upperpath); 1961 if (err) 1962 goto out_err; 1963 1964 upper_sb = ovl_upper_mnt(ofs)->mnt_sb; 1965 if (!ovl_should_sync(ofs)) { 1966 ofs->errseq = errseq_sample(&upper_sb->s_wb_err); 1967 if (errseq_check(&upper_sb->s_wb_err, ofs->errseq)) { 1968 err = -EIO; 1969 pr_err("Cannot mount volatile when upperdir has an unseen error. Sync upperdir fs to clear state.\n"); 1970 goto out_err; 1971 } 1972 } 1973 1974 err = ovl_get_workdir(sb, ofs, &upperpath); 1975 if (err) 1976 goto out_err; 1977 1978 if (!ofs->workdir) 1979 sb->s_flags |= SB_RDONLY; 1980 1981 sb->s_stack_depth = upper_sb->s_stack_depth; 1982 sb->s_time_gran = upper_sb->s_time_gran; 1983 } 1984 oe = ovl_get_lowerstack(sb, splitlower, numlower, ofs, layers); 1985 err = PTR_ERR(oe); 1986 if (IS_ERR(oe)) 1987 goto out_err; 1988 1989 /* If the upper fs is nonexistent, we mark overlayfs r/o too */ 1990 if (!ovl_upper_mnt(ofs)) 1991 sb->s_flags |= SB_RDONLY; 1992 1993 if (!ovl_force_readonly(ofs) && ofs->config.index) { 1994 err = ovl_get_indexdir(sb, ofs, oe, &upperpath); 1995 if (err) 1996 goto out_free_oe; 1997 1998 /* Force r/o mount with no index dir */ 1999 if (!ofs->indexdir) 2000 sb->s_flags |= SB_RDONLY; 2001 } 2002 2003 err = ovl_check_overlapping_layers(sb, ofs); 2004 if (err) 2005 goto out_free_oe; 2006 2007 /* Show index=off in /proc/mounts for forced r/o mount */ 2008 if (!ofs->indexdir) { 2009 ofs->config.index = false; 2010 if (ovl_upper_mnt(ofs) && ofs->config.nfs_export) { 2011 pr_warn("NFS export requires an index dir, falling back to nfs_export=off.\n"); 2012 ofs->config.nfs_export = false; 2013 } 2014 } 2015 2016 if (ofs->config.metacopy && ofs->config.nfs_export) { 2017 pr_warn("NFS export is not supported with metadata only copy up, falling back to nfs_export=off.\n"); 2018 ofs->config.nfs_export = false; 2019 } 2020 2021 if (ofs->config.nfs_export) 2022 sb->s_export_op = &ovl_export_operations; 2023 2024 /* Never override disk quota limits or use reserved space */ 2025 cap_lower(cred->cap_effective, CAP_SYS_RESOURCE); 2026 2027 sb->s_magic = OVERLAYFS_SUPER_MAGIC; 2028 sb->s_xattr = ovl_xattr_handlers; 2029 sb->s_fs_info = ofs; 2030 sb->s_flags |= SB_POSIXACL; 2031 sb->s_iflags |= SB_I_SKIP_SYNC; 2032 2033 err = -ENOMEM; 2034 root_dentry = ovl_get_root(sb, upperpath.dentry, oe); 2035 if (!root_dentry) 2036 goto out_free_oe; 2037 2038 mntput(upperpath.mnt); 2039 kfree(splitlower); 2040 2041 sb->s_root = root_dentry; 2042 2043 return 0; 2044 2045out_free_oe: 2046 ovl_entry_stack_free(oe); 2047 kfree(oe); 2048out_err: 2049 kfree(splitlower); 2050 path_put(&upperpath); 2051 ovl_free_fs(ofs); 2052out: 2053 return err; 2054} 2055 2056static struct dentry *ovl_mount(struct file_system_type *fs_type, int flags, 2057 const char *dev_name, void *raw_data) 2058{ 2059 return mount_nodev(fs_type, flags, raw_data, ovl_fill_super); 2060} 2061 2062static struct file_system_type ovl_fs_type = { 2063 .owner = THIS_MODULE, 2064 .name = "overlay", 2065 .mount = ovl_mount, 2066 .kill_sb = kill_anon_super, 2067}; 2068MODULE_ALIAS_FS("overlay"); 2069 2070static void ovl_inode_init_once(void *foo) 2071{ 2072 struct ovl_inode *oi = foo; 2073 2074 inode_init_once(&oi->vfs_inode); 2075} 2076 2077static int __init ovl_init(void) 2078{ 2079 int err; 2080 2081 ovl_inode_cachep = kmem_cache_create("ovl_inode", 2082 sizeof(struct ovl_inode), 0, 2083 (SLAB_RECLAIM_ACCOUNT| 2084 SLAB_MEM_SPREAD|SLAB_ACCOUNT), 2085 ovl_inode_init_once); 2086 if (ovl_inode_cachep == NULL) 2087 return -ENOMEM; 2088 2089 err = ovl_aio_request_cache_init(); 2090 if (!err) { 2091 err = register_filesystem(&ovl_fs_type); 2092 if (!err) 2093 return 0; 2094 2095 ovl_aio_request_cache_destroy(); 2096 } 2097 kmem_cache_destroy(ovl_inode_cachep); 2098 2099 return err; 2100} 2101 2102static void __exit ovl_exit(void) 2103{ 2104 unregister_filesystem(&ovl_fs_type); 2105 2106 /* 2107 * Make sure all delayed rcu free inodes are flushed before we 2108 * destroy cache. 2109 */ 2110 rcu_barrier(); 2111 kmem_cache_destroy(ovl_inode_cachep); 2112 ovl_aio_request_cache_destroy(); 2113} 2114 2115module_init(ovl_init); 2116module_exit(ovl_exit); 2117