Line data Source code
1 : /* SPDX-License-Identifier: GPL-2.0 */
2 : #include <linux/syscalls.h>
3 : #include <linux/export.h>
4 : #include <linux/uaccess.h>
5 : #include <linux/fs_struct.h>
6 : #include <linux/fs.h>
7 : #include <linux/slab.h>
8 : #include <linux/prefetch.h>
9 : #include "mount.h"
10 : #include "internal.h"
11 :
12 : struct prepend_buffer {
13 : char *buf;
14 : int len;
15 : };
16 : #define DECLARE_BUFFER(__name, __buf, __len) \
17 : struct prepend_buffer __name = {.buf = __buf + __len, .len = __len}
18 :
19 : static char *extract_string(struct prepend_buffer *p)
20 : {
21 791012898 : if (likely(p->len >= 0))
22 790329193 : return p->buf;
23 : return ERR_PTR(-ENAMETOOLONG);
24 : }
25 :
26 : static bool prepend_char(struct prepend_buffer *p, unsigned char c)
27 : {
28 3626633236 : if (likely(p->len > 0)) {
29 5237661010 : p->len--;
30 5237661010 : *--p->buf = c;
31 4461017072 : return true;
32 : }
33 67 : p->len = -1;
34 67 : return false;
35 : }
36 :
37 : /*
38 : * The source of the prepend data can be an optimistic load
39 : * of a dentry name and length. And because we don't hold any
40 : * locks, the length and the pointer to the name may not be
41 : * in sync if a concurrent rename happens, and the kernel
42 : * copy might fault as a result.
43 : *
44 : * The end result will correct itself when we check the
45 : * rename sequence count, but we need to be able to handle
46 : * the fault gracefully.
47 : */
48 3625836409 : static bool prepend_copy(void *dst, const void *src, int len)
49 : {
50 3625836409 : if (unlikely(copy_from_kernel_nofault(dst, src, len))) {
51 0 : memset(dst, 'x', len);
52 0 : return false;
53 : }
54 : return true;
55 : }
56 :
57 3626409961 : static bool prepend(struct prepend_buffer *p, const char *str, int namelen)
58 : {
59 : // Already overflowed?
60 3626409961 : if (p->len < 0)
61 : return false;
62 :
63 : // Will overflow?
64 3626409961 : if (p->len < namelen) {
65 : // Fill as much as possible from the end of the name
66 683673 : str += namelen - p->len;
67 683673 : p->buf -= p->len;
68 683673 : prepend_copy(p->buf, str, p->len);
69 683658 : p->len = -1;
70 683658 : return false;
71 : }
72 :
73 : // Fits fully
74 3625726288 : p->len -= namelen;
75 3625726288 : p->buf -= namelen;
76 3625726288 : return prepend_copy(p->buf, str, namelen);
77 : }
78 :
79 : /**
80 : * prepend_name - prepend a pathname in front of current buffer pointer
81 : * @p: prepend buffer which contains buffer pointer and allocated length
82 : * @name: name string and length qstr structure
83 : *
84 : * With RCU path tracing, it may race with d_move(). Use READ_ONCE() to
85 : * make sure that either the old or the new name pointer and length are
86 : * fetched. However, there may be mismatch between length and pointer.
87 : * But since the length cannot be trusted, we need to copy the name very
88 : * carefully when doing the prepend_copy(). It also prepends "/" at
89 : * the beginning of the name. The sequence number check at the caller will
90 : * retry it again when a d_move() does happen. So any garbage in the buffer
91 : * due to mismatched pointer and length will be discarded.
92 : *
93 : * Load acquire is needed to make sure that we see the new name data even
94 : * if we might get the length wrong.
95 : */
96 3626561710 : static bool prepend_name(struct prepend_buffer *p, const struct qstr *name)
97 : {
98 3626561710 : const char *dname = smp_load_acquire(&name->name); /* ^^^ */
99 3626765502 : u32 dlen = READ_ONCE(name->len);
100 :
101 3626765502 : return prepend(p, dname, dlen) && prepend_char(p, '/');
102 : }
103 :
104 1527396520 : static int __prepend_path(const struct dentry *dentry, const struct mount *mnt,
105 : const struct path *root, struct prepend_buffer *p)
106 : {
107 6794807813 : while (dentry != root->dentry || &mnt->mnt != root->mnt) {
108 5275968151 : const struct dentry *parent = READ_ONCE(dentry->d_parent);
109 :
110 5275968151 : if (dentry == mnt->mnt.mnt_root) {
111 1732284551 : struct mount *m = READ_ONCE(mnt->mnt_parent);
112 1732284551 : struct mnt_namespace *mnt_ns;
113 :
114 1732284551 : if (likely(mnt != m)) {
115 1724651864 : dentry = READ_ONCE(mnt->mnt_mountpoint);
116 1724651864 : mnt = m;
117 1724651864 : continue;
118 : }
119 : /* Global root */
120 7632687 : mnt_ns = READ_ONCE(mnt->mnt_ns);
121 : /* open-coded is_mounted() to use local mnt_ns */
122 15265374 : if (!IS_ERR_OR_NULL(mnt_ns) && !is_anon_ns(mnt_ns))
123 : return 1; // absolute root
124 : else
125 0 : return 2; // detached or not attached yet
126 : }
127 :
128 3543683600 : if (unlikely(dentry == parent))
129 : /* Escaped? */
130 : return 3;
131 :
132 3543683600 : prefetch(parent);
133 3543188890 : if (!prepend_name(p, &dentry->d_name))
134 : break;
135 : dentry = parent;
136 : }
137 : return 0;
138 : }
139 :
140 : /**
141 : * prepend_path - Prepend path string to a buffer
142 : * @path: the dentry/vfsmount to report
143 : * @root: root vfsmnt/dentry
144 : * @p: prepend buffer which contains buffer pointer and allocated length
145 : *
146 : * The function will first try to write out the pathname without taking any
147 : * lock other than the RCU read lock to make sure that dentries won't go away.
148 : * It only checks the sequence number of the global rename_lock as any change
149 : * in the dentry's d_seq will be preceded by changes in the rename_lock
150 : * sequence number. If the sequence number had been changed, it will restart
151 : * the whole pathname back-tracing sequence again by taking the rename_lock.
152 : * In this case, there is no need to take the RCU read lock as the recursive
153 : * parent pointer references will keep the dentry chain alive as long as no
154 : * rename operation is performed.
155 : */
156 1527517211 : static int prepend_path(const struct path *path,
157 : const struct path *root,
158 : struct prepend_buffer *p)
159 : {
160 1527517211 : unsigned seq, m_seq = 0;
161 1527517211 : struct prepend_buffer b;
162 1527517211 : int error;
163 :
164 1527517211 : rcu_read_lock();
165 1527502669 : restart_mnt:
166 1527502669 : read_seqbegin_or_lock(&mount_lock, &m_seq);
167 1526951571 : seq = 0;
168 1526951571 : rcu_read_lock();
169 1527490411 : restart:
170 1527490411 : b = *p;
171 1527490411 : read_seqbegin_or_lock(&rename_lock, &seq);
172 1527387051 : error = __prepend_path(path->dentry, real_mount(path->mnt), root, &b);
173 1527050966 : if (!(seq & 1))
174 1526713513 : rcu_read_unlock();
175 1527112979 : if (need_seqretry(&rename_lock, seq)) {
176 254296 : seq = 1;
177 254296 : goto restart;
178 : }
179 1526758221 : done_seqretry(&rename_lock, seq);
180 :
181 1526758221 : if (!(m_seq & 1))
182 1526765976 : rcu_read_unlock();
183 1526554379 : if (need_seqretry(&mount_lock, m_seq)) {
184 5800 : m_seq = 1;
185 5800 : goto restart_mnt;
186 : }
187 1526547384 : done_seqretry(&mount_lock, m_seq);
188 :
189 1526547384 : if (unlikely(error == 3))
190 0 : b = *p;
191 :
192 1526547384 : if (b.len == p->len)
193 15257247 : prepend_char(&b, '/');
194 :
195 1526547384 : *p = b;
196 1526547384 : return error;
197 : }
198 :
199 : /**
200 : * __d_path - return the path of a dentry
201 : * @path: the dentry/vfsmount to report
202 : * @root: root vfsmnt/dentry
203 : * @buf: buffer to return value in
204 : * @buflen: buffer length
205 : *
206 : * Convert a dentry into an ASCII path name.
207 : *
208 : * Returns a pointer into the buffer or an error code if the
209 : * path was too long.
210 : *
211 : * "buflen" should be positive.
212 : *
213 : * If the path is not reachable from the supplied root, return %NULL.
214 : */
215 695154067 : char *__d_path(const struct path *path,
216 : const struct path *root,
217 : char *buf, int buflen)
218 : {
219 695154067 : DECLARE_BUFFER(b, buf, buflen);
220 :
221 695154067 : prepend_char(&b, 0);
222 695154067 : if (unlikely(prepend_path(path, root, &b) > 0))
223 : return NULL;
224 687030863 : return extract_string(&b);
225 : }
226 :
227 0 : char *d_absolute_path(const struct path *path,
228 : char *buf, int buflen)
229 : {
230 0 : struct path root = {};
231 0 : DECLARE_BUFFER(b, buf, buflen);
232 :
233 0 : prepend_char(&b, 0);
234 0 : if (unlikely(prepend_path(path, &root, &b) > 1))
235 : return ERR_PTR(-EINVAL);
236 0 : return extract_string(&b);
237 : }
238 :
239 55666073 : static void get_fs_root_rcu(struct fs_struct *fs, struct path *root)
240 : {
241 55666073 : unsigned seq;
242 :
243 55666073 : do {
244 55666073 : seq = read_seqcount_begin(&fs->seq);
245 55668828 : *root = fs->root;
246 55668828 : } while (read_seqcount_retry(&fs->seq, seq));
247 55666061 : }
248 :
249 : /**
250 : * d_path - return the path of a dentry
251 : * @path: path to report
252 : * @buf: buffer to return value in
253 : * @buflen: buffer length
254 : *
255 : * Convert a dentry into an ASCII path name. If the entry has been deleted
256 : * the string " (deleted)" is appended. Note that this is ambiguous.
257 : *
258 : * Returns a pointer into the buffer or an error code if the path was
259 : * too long. Note: Callers should use the returned pointer, not the passed
260 : * in buffer, to use the name! The implementation often starts at an offset
261 : * into the buffer, and may leave 0 bytes at the start.
262 : *
263 : * "buflen" should be positive.
264 : */
265 55663677 : char *d_path(const struct path *path, char *buf, int buflen)
266 : {
267 55663677 : DECLARE_BUFFER(b, buf, buflen);
268 55663677 : struct path root;
269 :
270 : /*
271 : * We have various synthetic filesystems that never get mounted. On
272 : * these filesystems dentries are never used for lookup purposes, and
273 : * thus don't need to be hashed. They also don't need a name until a
274 : * user wants to identify the object in /proc/pid/fd/. The little hack
275 : * below allows us to generate a name for these objects on demand:
276 : *
277 : * Some pseudo inodes are mountable. When they are mounted
278 : * path->dentry == path->mnt->mnt_root. In that case don't call d_dname
279 : * and instead have d_path return the mounted path.
280 : */
281 55663677 : if (path->dentry->d_op && path->dentry->d_op->d_dname &&
282 182 : (!IS_ROOT(path->dentry) || path->dentry != path->mnt->mnt_root))
283 182 : return path->dentry->d_op->d_dname(path->dentry, buf, buflen);
284 :
285 55663495 : rcu_read_lock();
286 55664721 : get_fs_root_rcu(current->fs, &root);
287 111333688 : if (unlikely(d_unlinked(path->dentry)))
288 0 : prepend(&b, " (deleted)", 11);
289 : else
290 55666844 : prepend_char(&b, 0);
291 55666844 : prepend_path(path, &root, &b);
292 55668056 : rcu_read_unlock();
293 :
294 55668786 : return extract_string(&b);
295 : }
296 : EXPORT_SYMBOL(d_path);
297 :
298 : /*
299 : * Helper function for dentry_operations.d_dname() members
300 : */
301 0 : char *dynamic_dname(char *buffer, int buflen, const char *fmt, ...)
302 : {
303 0 : va_list args;
304 0 : char temp[64];
305 0 : int sz;
306 :
307 0 : va_start(args, fmt);
308 0 : sz = vsnprintf(temp, sizeof(temp), fmt, args) + 1;
309 0 : va_end(args);
310 :
311 0 : if (sz > sizeof(temp) || sz > buflen)
312 : return ERR_PTR(-ENAMETOOLONG);
313 :
314 0 : buffer += buflen - sz;
315 0 : return memcpy(buffer, temp, sz);
316 : }
317 :
318 182 : char *simple_dname(struct dentry *dentry, char *buffer, int buflen)
319 : {
320 182 : DECLARE_BUFFER(b, buffer, buflen);
321 : /* these dentries are never renamed, so d_lock is not needed */
322 182 : prepend(&b, " (deleted)", 11);
323 182 : prepend(&b, dentry->d_name.name, dentry->d_name.len);
324 182 : prepend_char(&b, '/');
325 182 : return extract_string(&b);
326 : }
327 :
328 : /*
329 : * Write full pathname from the root of the filesystem into the buffer.
330 : */
331 47786820 : static char *__dentry_path(const struct dentry *d, struct prepend_buffer *p)
332 : {
333 47786820 : const struct dentry *dentry;
334 47786820 : struct prepend_buffer b;
335 47786820 : int seq = 0;
336 :
337 47786820 : rcu_read_lock();
338 47805409 : restart:
339 47805409 : dentry = d;
340 47805409 : b = *p;
341 47805409 : read_seqbegin_or_lock(&rename_lock, &seq);
342 132661654 : while (!IS_ROOT(dentry)) {
343 84903985 : const struct dentry *parent = dentry->d_parent;
344 :
345 84903985 : prefetch(parent);
346 84712090 : if (!prepend_name(&b, &dentry->d_name))
347 : break;
348 : dentry = parent;
349 : }
350 48279003 : if (!(seq & 1))
351 48275671 : rcu_read_unlock();
352 48317427 : if (need_seqretry(&rename_lock, seq)) {
353 241 : seq = 1;
354 241 : goto restart;
355 : }
356 48313067 : done_seqretry(&rename_lock, seq);
357 48313067 : if (b.len == p->len)
358 20649556 : prepend_char(&b, '/');
359 48313067 : return extract_string(&b);
360 : }
361 :
362 0 : char *dentry_path_raw(const struct dentry *dentry, char *buf, int buflen)
363 : {
364 0 : DECLARE_BUFFER(b, buf, buflen);
365 :
366 0 : prepend_char(&b, 0);
367 0 : return __dentry_path(dentry, &b);
368 : }
369 : EXPORT_SYMBOL(dentry_path_raw);
370 :
371 47656007 : char *dentry_path(const struct dentry *dentry, char *buf, int buflen)
372 : {
373 47656007 : DECLARE_BUFFER(b, buf, buflen);
374 :
375 95312014 : if (unlikely(d_unlinked(dentry)))
376 0 : prepend(&b, "//deleted", 10);
377 : else
378 47656007 : prepend_char(&b, 0);
379 47656007 : return __dentry_path(dentry, &b);
380 : }
381 :
382 776592949 : static void get_fs_root_and_pwd_rcu(struct fs_struct *fs, struct path *root,
383 : struct path *pwd)
384 : {
385 776592949 : unsigned seq;
386 :
387 776592949 : do {
388 776592949 : seq = read_seqcount_begin(&fs->seq);
389 776650714 : *root = fs->root;
390 776650714 : *pwd = fs->pwd;
391 776650714 : } while (read_seqcount_retry(&fs->seq, seq));
392 776698154 : }
393 :
394 : /*
395 : * NOTE! The user-level library version returns a
396 : * character pointer. The kernel system call just
397 : * returns the length of the buffer filled (which
398 : * includes the ending '\0' character), or a negative
399 : * error value. So libc would do something like
400 : *
401 : * char *getcwd(char * buf, size_t size)
402 : * {
403 : * int retval;
404 : *
405 : * retval = sys_getcwd(buf, size);
406 : * if (retval >= 0)
407 : * return buf;
408 : * errno = -retval;
409 : * return NULL;
410 : * }
411 : */
412 1553327954 : SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)
413 : {
414 776512081 : int error;
415 776512081 : struct path pwd, root;
416 776512081 : char *page = __getname();
417 :
418 776816315 : if (!page)
419 : return -ENOMEM;
420 :
421 776816315 : rcu_read_lock();
422 776851614 : get_fs_root_and_pwd_rcu(current->fs, &root, &pwd);
423 :
424 1553287876 : if (unlikely(d_unlinked(pwd.dentry))) {
425 0 : rcu_read_unlock();
426 0 : error = -ENOENT;
427 : } else {
428 776643938 : unsigned len;
429 776643938 : DECLARE_BUFFER(b, page, PATH_MAX);
430 :
431 776643938 : prepend_char(&b, 0);
432 776643938 : if (unlikely(prepend_path(&pwd, &root, &b) > 0))
433 0 : prepend(&b, "(unreachable)", 13);
434 776474786 : rcu_read_unlock();
435 :
436 776474949 : len = PATH_MAX - b.len;
437 776474949 : if (unlikely(len > PATH_MAX))
438 : error = -ENAMETOOLONG;
439 776474949 : else if (unlikely(len > size))
440 : error = -ERANGE;
441 1552782744 : else if (copy_to_user(buf, b.buf, len))
442 : error = -EFAULT;
443 : else
444 776307795 : error = len;
445 : }
446 776307795 : __putname(page);
447 776302218 : return error;
448 : }
|
