3 * Copyright (C) 2011 Novell Inc.
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 as published by
7 * the Free Software Foundation.
10 #include <linux/module.h>
12 #include <linux/slab.h>
13 #include <linux/file.h>
14 #include <linux/splice.h>
15 #include <linux/xattr.h>
16 #include <linux/security.h>
17 #include <linux/uaccess.h>
18 #include <linux/sched/signal.h>
19 #include <linux/cred.h>
20 #include <linux/namei.h>
21 #include <linux/fdtable.h>
22 #include <linux/ratelimit.h>
23 #include <linux/exportfs.h>
24 #include "overlayfs.h"
26 #define OVL_COPY_UP_CHUNK_SIZE (1 << 20)
28 static bool __read_mostly ovl_check_copy_up
;
29 module_param_named(check_copy_up
, ovl_check_copy_up
, bool,
31 MODULE_PARM_DESC(ovl_check_copy_up
,
32 "Warn on copy-up when causing process also has a R/O fd open");
34 static int ovl_check_fd(const void *data
, struct file
*f
, unsigned int fd
)
36 const struct dentry
*dentry
= data
;
38 if (file_inode(f
) == d_inode(dentry
))
39 pr_warn_ratelimited("overlayfs: Warning: Copying up %pD, but open R/O on fd %u which will cease to be coherent [pid=%d %s]\n",
40 f
, fd
, current
->pid
, current
->comm
);
45 * Check the fds open by this process and warn if something like the following
46 * scenario is about to occur:
48 * fd1 = open("foo", O_RDONLY);
49 * fd2 = open("foo", O_RDWR);
51 static void ovl_do_check_copy_up(struct dentry
*dentry
)
53 if (ovl_check_copy_up
)
54 iterate_fd(current
->files
, 0, ovl_check_fd
, dentry
);
57 int ovl_copy_xattr(struct dentry
*old
, struct dentry
*new)
59 ssize_t list_size
, size
, value_size
= 0;
60 char *buf
, *name
, *value
= NULL
;
61 int uninitialized_var(error
);
64 if (!(old
->d_inode
->i_opflags
& IOP_XATTR
) ||
65 !(new->d_inode
->i_opflags
& IOP_XATTR
))
68 list_size
= vfs_listxattr(old
, NULL
, 0);
70 if (list_size
== -EOPNOTSUPP
)
75 buf
= kzalloc(list_size
, GFP_KERNEL
);
79 list_size
= vfs_listxattr(old
, buf
, list_size
);
85 for (name
= buf
; list_size
; name
+= slen
) {
86 slen
= strnlen(name
, list_size
) + 1;
88 /* underlying fs providing us with an broken xattr list? */
89 if (WARN_ON(slen
> list_size
)) {
95 if (ovl_is_private_xattr(name
))
98 size
= vfs_getxattr(old
, name
, value
, value_size
);
100 size
= vfs_getxattr(old
, name
, NULL
, 0);
107 if (size
> value_size
) {
110 new = krealloc(value
, size
, GFP_KERNEL
);
120 error
= security_inode_copy_up_xattr(name
);
121 if (error
< 0 && error
!= -EOPNOTSUPP
)
125 continue; /* Discard */
127 error
= vfs_setxattr(new, name
, value
, size
, 0);
137 static int ovl_copy_up_data(struct path
*old
, struct path
*new, loff_t len
)
139 struct file
*old_file
;
140 struct file
*new_file
;
148 old_file
= ovl_path_open(old
, O_LARGEFILE
| O_RDONLY
);
149 if (IS_ERR(old_file
))
150 return PTR_ERR(old_file
);
152 new_file
= ovl_path_open(new, O_LARGEFILE
| O_WRONLY
);
153 if (IS_ERR(new_file
)) {
154 error
= PTR_ERR(new_file
);
158 /* Try to use clone_file_range to clone up within the same fs */
159 error
= vfs_clone_file_range(old_file
, 0, new_file
, 0, len
);
162 /* Couldn't clone, so now we try to copy the data */
165 /* FIXME: copy up sparse files efficiently */
167 size_t this_len
= OVL_COPY_UP_CHUNK_SIZE
;
173 if (signal_pending_state(TASK_KILLABLE
, current
)) {
178 bytes
= do_splice_direct(old_file
, &old_pos
,
180 this_len
, SPLICE_F_MOVE
);
185 WARN_ON(old_pos
!= new_pos
);
191 error
= vfs_fsync(new_file
, 0);
198 static int ovl_set_timestamps(struct dentry
*upperdentry
, struct kstat
*stat
)
200 struct iattr attr
= {
202 ATTR_ATIME
| ATTR_MTIME
| ATTR_ATIME_SET
| ATTR_MTIME_SET
,
203 .ia_atime
= stat
->atime
,
204 .ia_mtime
= stat
->mtime
,
207 return notify_change(upperdentry
, &attr
, NULL
);
210 int ovl_set_attr(struct dentry
*upperdentry
, struct kstat
*stat
)
214 if (!S_ISLNK(stat
->mode
)) {
215 struct iattr attr
= {
216 .ia_valid
= ATTR_MODE
,
217 .ia_mode
= stat
->mode
,
219 err
= notify_change(upperdentry
, &attr
, NULL
);
222 struct iattr attr
= {
223 .ia_valid
= ATTR_UID
| ATTR_GID
,
227 err
= notify_change(upperdentry
, &attr
, NULL
);
230 ovl_set_timestamps(upperdentry
, stat
);
235 struct ovl_fh
*ovl_encode_fh(struct dentry
*real
, bool is_upper
)
238 int fh_type
, fh_len
, dwords
;
240 int buflen
= MAX_HANDLE_SZ
;
241 uuid_t
*uuid
= &real
->d_sb
->s_uuid
;
243 buf
= kmalloc(buflen
, GFP_KERNEL
);
245 return ERR_PTR(-ENOMEM
);
248 * We encode a non-connectable file handle for non-dir, because we
249 * only need to find the lower inode number and we don't want to pay
250 * the price or reconnecting the dentry.
252 dwords
= buflen
>> 2;
253 fh_type
= exportfs_encode_fh(real
, buf
, &dwords
, 0);
254 buflen
= (dwords
<< 2);
257 if (WARN_ON(fh_type
< 0) ||
258 WARN_ON(buflen
> MAX_HANDLE_SZ
) ||
259 WARN_ON(fh_type
== FILEID_INVALID
))
262 BUILD_BUG_ON(MAX_HANDLE_SZ
+ offsetof(struct ovl_fh
, fid
) > 255);
263 fh_len
= offsetof(struct ovl_fh
, fid
) + buflen
;
264 fh
= kmalloc(fh_len
, GFP_KERNEL
);
266 fh
= ERR_PTR(-ENOMEM
);
270 fh
->version
= OVL_FH_VERSION
;
271 fh
->magic
= OVL_FH_MAGIC
;
273 fh
->flags
= OVL_FH_FLAG_CPU_ENDIAN
;
275 * When we will want to decode an overlay dentry from this handle
276 * and all layers are on the same fs, if we get a disconncted real
277 * dentry when we decode fid, the only way to tell if we should assign
278 * it to upperdentry or to lowerstack is by checking this flag.
281 fh
->flags
|= OVL_FH_FLAG_PATH_UPPER
;
284 memcpy(fh
->fid
, buf
, buflen
);
291 int ovl_set_origin(struct dentry
*dentry
, struct dentry
*lower
,
292 struct dentry
*upper
)
294 const struct ovl_fh
*fh
= NULL
;
298 * When lower layer doesn't support export operations store a 'null' fh,
299 * so we can use the overlay.origin xattr to distignuish between a copy
300 * up and a pure upper inode.
302 if (ovl_can_decode_fh(lower
->d_sb
)) {
303 fh
= ovl_encode_fh(lower
, false);
309 * Do not fail when upper doesn't support xattrs.
311 err
= ovl_check_setxattr(dentry
, upper
, OVL_XATTR_ORIGIN
, fh
,
312 fh
? fh
->len
: 0, 0);
318 /* Store file handle of @upper dir in @index dir entry */
319 static int ovl_set_upper_fh(struct dentry
*upper
, struct dentry
*index
)
321 const struct ovl_fh
*fh
;
324 fh
= ovl_encode_fh(upper
, true);
328 err
= ovl_do_setxattr(index
, OVL_XATTR_UPPER
, fh
, fh
->len
, 0);
335 * Create and install index entry.
337 * Caller must hold i_mutex on indexdir.
339 static int ovl_create_index(struct dentry
*dentry
, struct dentry
*origin
,
340 struct dentry
*upper
)
342 struct dentry
*indexdir
= ovl_indexdir(dentry
->d_sb
);
343 struct inode
*dir
= d_inode(indexdir
);
344 struct dentry
*index
= NULL
;
345 struct dentry
*temp
= NULL
;
346 struct qstr name
= { };
350 * For now this is only used for creating index entry for directories,
351 * because non-dir are copied up directly to index and then hardlinked
354 * TODO: implement create index for non-dir, so we can call it when
355 * encoding file handle for non-dir in case index does not exist.
357 if (WARN_ON(!d_is_dir(dentry
)))
360 /* Directory not expected to be indexed before copy up */
361 if (WARN_ON(ovl_test_flag(OVL_INDEX
, d_inode(dentry
))))
364 err
= ovl_get_index_name(origin
, &name
);
368 temp
= ovl_lookup_temp(indexdir
);
372 err
= ovl_do_mkdir(dir
, temp
, S_IFDIR
, true);
376 err
= ovl_set_upper_fh(upper
, temp
);
380 index
= lookup_one_len(name
.name
, indexdir
, name
.len
);
382 err
= PTR_ERR(index
);
384 err
= ovl_do_rename(dir
, temp
, dir
, index
, 0);
402 ovl_cleanup(dir
, temp
);
406 struct ovl_copy_up_ctx
{
407 struct dentry
*parent
;
408 struct dentry
*dentry
;
409 struct path lowerpath
;
413 struct dentry
*destdir
;
414 struct qstr destname
;
415 struct dentry
*workdir
;
421 static int ovl_link_up(struct ovl_copy_up_ctx
*c
)
424 struct dentry
*upper
;
425 struct dentry
*upperdir
= ovl_dentry_upper(c
->parent
);
426 struct inode
*udir
= d_inode(upperdir
);
428 /* Mark parent "impure" because it may now contain non-pure upper */
429 err
= ovl_set_impure(c
->parent
, upperdir
);
433 err
= ovl_set_nlink_lower(c
->dentry
);
437 inode_lock_nested(udir
, I_MUTEX_PARENT
);
438 upper
= lookup_one_len(c
->dentry
->d_name
.name
, upperdir
,
439 c
->dentry
->d_name
.len
);
440 err
= PTR_ERR(upper
);
441 if (!IS_ERR(upper
)) {
442 err
= ovl_do_link(ovl_dentry_upper(c
->dentry
), udir
, upper
,
447 /* Restore timestamps on parent (best effort) */
448 ovl_set_timestamps(upperdir
, &c
->pstat
);
449 ovl_dentry_set_upper_alias(c
->dentry
);
456 err
= ovl_set_nlink_upper(c
->dentry
);
461 static int ovl_install_temp(struct ovl_copy_up_ctx
*c
, struct dentry
*temp
,
462 struct dentry
**newdentry
)
465 struct dentry
*upper
;
466 struct inode
*udir
= d_inode(c
->destdir
);
468 upper
= lookup_one_len(c
->destname
.name
, c
->destdir
, c
->destname
.len
);
470 return PTR_ERR(upper
);
473 err
= ovl_do_link(temp
, udir
, upper
, true);
475 err
= ovl_do_rename(d_inode(c
->workdir
), temp
, udir
, upper
, 0);
478 *newdentry
= dget(c
->tmpfile
? upper
: temp
);
484 static int ovl_get_tmpfile(struct ovl_copy_up_ctx
*c
, struct dentry
**tempp
)
488 const struct cred
*old_creds
= NULL
;
489 struct cred
*new_creds
= NULL
;
490 struct cattr cattr
= {
491 /* Can't properly set mode on creation because of the umask */
492 .mode
= c
->stat
.mode
& S_IFMT
,
493 .rdev
= c
->stat
.rdev
,
497 err
= security_inode_copy_up(c
->dentry
, &new_creds
);
502 old_creds
= override_creds(new_creds
);
505 temp
= ovl_do_tmpfile(c
->workdir
, c
->stat
.mode
);
509 temp
= ovl_lookup_temp(c
->workdir
);
513 err
= ovl_create_real(d_inode(c
->workdir
), temp
, &cattr
,
524 revert_creds(old_creds
);
535 static int ovl_copy_up_inode(struct ovl_copy_up_ctx
*c
, struct dentry
*temp
)
539 if (S_ISREG(c
->stat
.mode
)) {
540 struct path upperpath
;
542 ovl_path_upper(c
->dentry
, &upperpath
);
543 BUG_ON(upperpath
.dentry
!= NULL
);
544 upperpath
.dentry
= temp
;
546 err
= ovl_copy_up_data(&c
->lowerpath
, &upperpath
, c
->stat
.size
);
551 err
= ovl_copy_xattr(c
->lowerpath
.dentry
, temp
);
555 inode_lock(temp
->d_inode
);
556 err
= ovl_set_attr(temp
, &c
->stat
);
557 inode_unlock(temp
->d_inode
);
562 * Store identifier of lower inode in upper inode xattr to
563 * allow lookup of the copy up origin inode.
565 * Don't set origin when we are breaking the association with a lower
569 err
= ovl_set_origin(c
->dentry
, c
->lowerpath
.dentry
, temp
);
577 static int ovl_copy_up_locked(struct ovl_copy_up_ctx
*c
)
579 struct inode
*udir
= c
->destdir
->d_inode
;
581 struct dentry
*newdentry
= NULL
;
582 struct dentry
*temp
= NULL
;
585 err
= ovl_get_tmpfile(c
, &temp
);
589 err
= ovl_copy_up_inode(c
, temp
);
593 if (S_ISDIR(c
->stat
.mode
) && c
->indexed
) {
594 err
= ovl_create_index(c
->dentry
, c
->lowerpath
.dentry
, temp
);
600 inode_lock_nested(udir
, I_MUTEX_PARENT
);
601 err
= ovl_install_temp(c
, temp
, &newdentry
);
604 err
= ovl_install_temp(c
, temp
, &newdentry
);
609 inode
= d_inode(c
->dentry
);
610 ovl_inode_update(inode
, newdentry
);
611 if (S_ISDIR(inode
->i_mode
))
612 ovl_set_flag(OVL_WHITEOUTS
, inode
);
620 ovl_cleanup(d_inode(c
->workdir
), temp
);
625 * Copy up a single dentry
627 * All renames start with copy up of source if necessary. The actual
628 * rename will only proceed once the copy up was successful. Copy up uses
629 * upper parent i_mutex for exclusion. Since rename can change d_parent it
630 * is possible that the copy up will lock the old parent. At that point
631 * the file will have already been copied up anyway.
633 static int ovl_do_copy_up(struct ovl_copy_up_ctx
*c
)
636 struct ovl_fs
*ofs
= c
->dentry
->d_sb
->s_fs_info
;
637 bool to_index
= false;
640 * Indexed non-dir is copied up directly to the index entry and then
641 * hardlinked to upper dir. Indexed dir is copied up to indexdir,
642 * then index entry is created and then copied up dir installed.
643 * Copying dir up to indexdir instead of workdir simplifies locking.
645 if (ovl_need_index(c
->dentry
)) {
647 if (S_ISDIR(c
->stat
.mode
))
648 c
->workdir
= ovl_indexdir(c
->dentry
->d_sb
);
653 if (S_ISDIR(c
->stat
.mode
) || c
->stat
.nlink
== 1 || to_index
)
657 c
->destdir
= ovl_indexdir(c
->dentry
->d_sb
);
658 err
= ovl_get_index_name(c
->lowerpath
.dentry
, &c
->destname
);
661 } else if (WARN_ON(!c
->parent
)) {
662 /* Disconnected dentry must be copied up to index dir */
666 * Mark parent "impure" because it may now contain non-pure
669 err
= ovl_set_impure(c
->parent
, c
->destdir
);
674 /* Should we copyup with O_TMPFILE or with workdir? */
675 if (S_ISREG(c
->stat
.mode
) && ofs
->tmpfile
) {
677 err
= ovl_copy_up_locked(c
);
679 err
= ovl_lock_rename_workdir(c
->workdir
, c
->destdir
);
681 err
= ovl_copy_up_locked(c
);
682 unlock_rename(c
->workdir
, c
->destdir
);
691 ovl_set_flag(OVL_INDEX
, d_inode(c
->dentry
));
694 /* Initialize nlink for copy up of disconnected dentry */
695 err
= ovl_set_nlink_upper(c
->dentry
);
697 struct inode
*udir
= d_inode(c
->destdir
);
699 /* Restore timestamps on parent (best effort) */
701 ovl_set_timestamps(c
->destdir
, &c
->pstat
);
704 ovl_dentry_set_upper_alias(c
->dentry
);
709 kfree(c
->destname
.name
);
713 static int ovl_copy_up_one(struct dentry
*parent
, struct dentry
*dentry
,
717 DEFINE_DELAYED_CALL(done
);
718 struct path parentpath
;
719 struct ovl_copy_up_ctx ctx
= {
722 .workdir
= ovl_workdir(dentry
),
725 if (WARN_ON(!ctx
.workdir
))
728 ovl_path_lower(dentry
, &ctx
.lowerpath
);
729 err
= vfs_getattr(&ctx
.lowerpath
, &ctx
.stat
,
730 STATX_BASIC_STATS
, AT_STATX_SYNC_AS_STAT
);
735 ovl_path_upper(parent
, &parentpath
);
736 ctx
.destdir
= parentpath
.dentry
;
737 ctx
.destname
= dentry
->d_name
;
739 err
= vfs_getattr(&parentpath
, &ctx
.pstat
,
740 STATX_ATIME
| STATX_MTIME
,
741 AT_STATX_SYNC_AS_STAT
);
746 /* maybe truncate regular file. this has no effect on dirs */
750 if (S_ISLNK(ctx
.stat
.mode
)) {
751 ctx
.link
= vfs_get_link(ctx
.lowerpath
.dentry
, &done
);
752 if (IS_ERR(ctx
.link
))
753 return PTR_ERR(ctx
.link
);
755 ovl_do_check_copy_up(ctx
.lowerpath
.dentry
);
757 err
= ovl_copy_up_start(dentry
);
758 /* err < 0: interrupted, err > 0: raced with another copy-up */
763 if (!ovl_dentry_upper(dentry
))
764 err
= ovl_do_copy_up(&ctx
);
765 if (!err
&& parent
&& !ovl_dentry_has_upper_alias(dentry
))
766 err
= ovl_link_up(&ctx
);
767 ovl_copy_up_end(dentry
);
769 do_delayed_call(&done
);
774 int ovl_copy_up_flags(struct dentry
*dentry
, int flags
)
777 const struct cred
*old_cred
= ovl_override_creds(dentry
->d_sb
);
778 bool disconnected
= (dentry
->d_flags
& DCACHE_DISCONNECTED
);
781 * With NFS export, copy up can get called for a disconnected non-dir.
782 * In this case, we will copy up lower inode to index dir without
783 * linking it to upper dir.
785 if (WARN_ON(disconnected
&& d_is_dir(dentry
)))
790 struct dentry
*parent
= NULL
;
793 * Check if copy-up has happened as well as for upper alias (in
794 * case of hard links) is there.
796 * Both checks are lockless:
797 * - false negatives: will recheck under oi->lock
799 * + ovl_dentry_upper() uses memory barriers to ensure the
800 * upper dentry is up-to-date
801 * + ovl_dentry_has_upper_alias() relies on locking of
802 * upper parent i_rwsem to prevent reordering copy-up
805 if (ovl_dentry_upper(dentry
) &&
806 (ovl_dentry_has_upper_alias(dentry
) || disconnected
))
810 /* find the topmost dentry not yet copied up */
811 for (; !disconnected
;) {
812 parent
= dget_parent(next
);
814 if (ovl_dentry_upper(parent
))
821 err
= ovl_copy_up_one(parent
, next
, flags
);
826 revert_creds(old_cred
);
831 int ovl_copy_up(struct dentry
*dentry
)
833 return ovl_copy_up_flags(dentry
, 0);