fs/fhandle.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 #include <linux/syscalls.h>
   3 #include <linux/slab.h>
   4 #include <linux/fs.h>
   5 #include <linux/file.h>
   6 #include <linux/mount.h>
   7 #include <linux/namei.h>
   8 #include <linux/exportfs.h>
   9 #include <linux/fs_struct.h>
  10 #include <linux/fsnotify.h>
  11 #include <linux/personality.h>
  12 #include <linux/uaccess.h>
  13 #include <linux/compat.h>
  14 #include "internal.h"
  15 #include "mount.h"
  16
  17 static long do_sys_name_to_handle(struct path *path,
  18                                   struct file_handle __user *ufh,
  19                                   int __user *mnt_id)
  20 {
  21         long retval;
  22         struct file_handle f_handle;
  23         int handle_dwords, handle_bytes;
  24         struct file_handle *handle = NULL;
  25
  26         /*
  27          * We need to make sure whether the file system
  28          * support decoding of the file handle
  29          */
  30         if (!path->dentry->d_sb->s_export_op ||
  31             !path->dentry->d_sb->s_export_op->fh_to_dentry)
  32                 return -EOPNOTSUPP;
  33
  34         if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle)))
  35                 return -EFAULT;
  36
  37         if (f_handle.handle_bytes > MAX_HANDLE_SZ)
  38                 return -EINVAL;
  39
  40         handle = kmalloc(sizeof(struct file_handle) + f_handle.handle_bytes,
  41                          GFP_KERNEL);
  42         if (!handle)
  43                 return -ENOMEM;
  44
  45         /* convert handle size to multiple of sizeof(u32) */
  46         handle_dwords = f_handle.handle_bytes >> 2;
  47
  48         /* we ask for a non connected handle */
  49         retval = exportfs_encode_fh(path->dentry,
  50                                     (struct fid *)handle->f_handle,
  51                                     &handle_dwords,  0);
  52         handle->handle_type = retval;
  53         /* convert handle size to bytes */
  54         handle_bytes = handle_dwords * sizeof(u32);
  55         handle->handle_bytes = handle_bytes;
  56         if ((handle->handle_bytes > f_handle.handle_bytes) ||
  57             (retval == FILEID_INVALID) || (retval == -ENOSPC)) {
  58                 /* As per old exportfs_encode_fh documentation
  59                  * we could return ENOSPC to indicate overflow
  60                  * But file system returned 255 always. So handle
  61                  * both the values
  62                  */
  63                 /*
  64                  * set the handle size to zero so we copy only
  65                  * non variable part of the file_handle
  66                  */
  67                 handle_bytes = 0;
  68                 retval = -EOVERFLOW;
  69         } else
  70                 retval = 0;
  71         /* copy the mount id */
  72         if (copy_to_user(mnt_id, &real_mount(path->mnt)->mnt_id,
  73                          sizeof(*mnt_id)) ||
  74             copy_to_user(ufh, handle,
  75                          sizeof(struct file_handle) + handle_bytes))
  76                 retval = -EFAULT;
  77         kfree(handle);
  78         return retval;
  79 }
  80
  81 /**
  82  * sys_name_to_handle_at: convert name to handle
  83  * @dfd: directory relative to which name is interpreted if not absolute
  84  * @name: name that should be converted to handle.
  85  * @handle: resulting file handle
  86  * @mnt_id: mount id of the file system containing the file
  87  * @flag: flag value to indicate whether to follow symlink or not
  88  *
  89  * @handle->handle_size indicate the space available to store the
  90  * variable part of the file handle in bytes. If there is not
  91  * enough space, the field is updated to return the minimum
  92  * value required.
  93  */
  94 SYSCALL_DEFINE5(name_to_handle_at, int, dfd, const char __user *, name,
  95                 struct file_handle __user *, handle, int __user *, mnt_id,
  96                 int, flag)
  97 {
  98         struct path path;
  99         int lookup_flags;
 100         int err;
 101
 102         if ((flag & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
 103                 return -EINVAL;
 104
 105         lookup_flags = (flag & AT_SYMLINK_FOLLOW) ? LOOKUP_FOLLOW : 0;
 106         if (flag & AT_EMPTY_PATH)
 107                 lookup_flags |= LOOKUP_EMPTY;
 108         err = user_path_at(dfd, name, lookup_flags, &path);
 109         if (!err) {
 110                 err = do_sys_name_to_handle(&path, handle, mnt_id);
 111                 path_put(&path);
 112         }
 113         return err;
 114 }
 115
 116 static struct vfsmount *get_vfsmount_from_fd(int fd)
 117 {
 118         struct vfsmount *mnt;
 119
 120         if (fd == AT_FDCWD) {
 121                 struct fs_struct *fs = current->fs;
 122                 spin_lock(&fs->lock);
 123                 mnt = mntget(fs->pwd.mnt);
 124                 spin_unlock(&fs->lock);
 125         } else {
 126                 struct fd f = fdget(fd);
 127                 if (!f.file)
 128                         return ERR_PTR(-EBADF);
 129                 mnt = mntget(f.file->f_path.mnt);
 130                 fdput(f);
 131         }
 132         return mnt;
 133 }
 134
 135 static int vfs_dentry_acceptable(void *context, struct dentry *dentry)
 136 {
 137         return 1;
 138 }
 139
 140 static int do_handle_to_path(int mountdirfd, struct file_handle *handle,
 141                              struct path *path)
 142 {
 143         int retval = 0;
 144         int handle_dwords;
 145
 146         path->mnt = get_vfsmount_from_fd(mountdirfd);
 147         if (IS_ERR(path->mnt)) {
 148                 retval = PTR_ERR(path->mnt);
 149                 goto out_err;
 150         }
 151         /* change the handle size to multiple of sizeof(u32) */
 152         handle_dwords = handle->handle_bytes >> 2;
 153         path->dentry = exportfs_decode_fh(path->mnt,
 154                                           (struct fid *)handle->f_handle,
 155                                           handle_dwords, handle->handle_type,
 156                                           vfs_dentry_acceptable, NULL);
 157         if (IS_ERR(path->dentry)) {
 158                 retval = PTR_ERR(path->dentry);
 159                 goto out_mnt;
 160         }
 161         return 0;
 162 out_mnt:
 163         mntput(path->mnt);
 164 out_err:
 165         return retval;
 166 }
 167
 168 static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
 169                    struct path *path)
 170 {
 171         int retval = 0;
 172         struct file_handle f_handle;
 173         struct file_handle *handle = NULL;
 174
 175         /*
 176          * With handle we don't look at the execute bit on the
 177          * the directory. Ideally we would like CAP_DAC_SEARCH.
 178          * But we don't have that
 179          */
 180         if (!capable(CAP_DAC_READ_SEARCH)) {
 181                 retval = -EPERM;
 182                 goto out_err;
 183         }
 184         if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle))) {
 185                 retval = -EFAULT;
 186                 goto out_err;
 187         }
 188         if ((f_handle.handle_bytes > MAX_HANDLE_SZ) ||
 189             (f_handle.handle_bytes == 0)) {
 190                 retval = -EINVAL;
 191                 goto out_err;
 192         }
 193         handle = kmalloc(sizeof(struct file_handle) + f_handle.handle_bytes,
 194                          GFP_KERNEL);
 195         if (!handle) {
 196                 retval = -ENOMEM;
 197                 goto out_err;
 198         }
 199         /* copy the full handle */
 200         *handle = f_handle;
 201         if (copy_from_user(&handle->f_handle,
 202                            &ufh->f_handle,
 203                            f_handle.handle_bytes)) {
 204                 retval = -EFAULT;
 205                 goto out_handle;
 206         }
 207
 208         retval = do_handle_to_path(mountdirfd, handle, path);
 209
 210 out_handle:
 211         kfree(handle);
 212 out_err:
 213         return retval;
 214 }
 215
 216 long do_handle_open(int mountdirfd,
 217                     struct file_handle __user *ufh, int open_flag)
 218 {
 219         long retval = 0;
 220         struct path path;
 221         struct file *file;
 222         int fd;
 223
 224         retval = handle_to_path(mountdirfd, ufh, &path);
 225         if (retval)
 226                 return retval;
 227
 228         fd = get_unused_fd_flags(open_flag);
 229         if (fd < 0) {
 230                 path_put(&path);
 231                 return fd;
 232         }
 233         file = file_open_root(path.dentry, path.mnt, "", open_flag, 0);
 234         if (IS_ERR(file)) {
 235                 put_unused_fd(fd);
 236                 retval =  PTR_ERR(file);
 237         } else {
 238                 retval = fd;
 239                 fsnotify_open(file);
 240                 fd_install(fd, file);
 241         }
 242         path_put(&path);
 243         return retval;
 244 }
 245
 246 /**
 247  * sys_open_by_handle_at: Open the file handle
 248  * @mountdirfd: directory file descriptor
 249  * @handle: file handle to be opened
 250  * @flag: open flags.
 251  *
 252  * @mountdirfd indicate the directory file descriptor
 253  * of the mount point. file handle is decoded relative
 254  * to the vfsmount pointed by the @mountdirfd. @flags
 255  * value is same as the open(2) flags.
 256  */
 257 SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd,
 258                 struct file_handle __user *, handle,
 259                 int, flags)
 260 {
 261         long ret;
 262
 263         if (force_o_largefile())
 264                 flags |= O_LARGEFILE;
 265
 266         ret = do_handle_open(mountdirfd, handle, flags);
 267         return ret;
 268 }
 269
 270 #ifdef CONFIG_COMPAT
 271 /*
 272  * Exactly like fs/open.c:sys_open_by_handle_at(), except that it
 273  * doesn't set the O_LARGEFILE flag.
 274  */
 275 COMPAT_SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd,
 276                              struct file_handle __user *, handle, int, flags)
 277 {
 278         return do_handle_open(mountdirfd, handle, flags);
 279 }
 280 #endif