kernel/fork: always deny write access to current MM exe_file
[linux-2.6-microblaze.git] / fs / ecryptfs / inode.c
index 7169ea8..16d50df 100644 (file)
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
-/**
+/*
  * eCryptfs: Linux filesystem encryption layer
  *
  * Copyright (C) 1997-2004 Erez Zadok
 #include <asm/unaligned.h>
 #include "ecryptfs_kernel.h"
 
-static struct dentry *lock_parent(struct dentry *dentry)
+static int lock_parent(struct dentry *dentry,
+                      struct dentry **lower_dentry,
+                      struct inode **lower_dir)
 {
-       struct dentry *dir;
+       struct dentry *lower_dir_dentry;
 
-       dir = dget_parent(dentry);
-       inode_lock_nested(d_inode(dir), I_MUTEX_PARENT);
-       return dir;
-}
+       lower_dir_dentry = ecryptfs_dentry_to_lower(dentry->d_parent);
+       *lower_dir = d_inode(lower_dir_dentry);
+       *lower_dentry = ecryptfs_dentry_to_lower(dentry);
 
-static void unlock_dir(struct dentry *dir)
-{
-       inode_unlock(d_inode(dir));
-       dput(dir);
+       inode_lock_nested(*lower_dir, I_MUTEX_PARENT);
+       return (*lower_dentry)->d_parent == lower_dir_dentry ? 0 : -EINVAL;
 }
 
 static int ecryptfs_inode_test(struct inode *inode, void *lower_inode)
@@ -128,32 +127,29 @@ static int ecryptfs_interpose(struct dentry *lower_dentry,
 static int ecryptfs_do_unlink(struct inode *dir, struct dentry *dentry,
                              struct inode *inode)
 {
-       struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
-       struct dentry *lower_dir_dentry;
-       struct inode *lower_dir_inode;
+       struct dentry *lower_dentry;
+       struct inode *lower_dir;
        int rc;
 
-       lower_dir_dentry = ecryptfs_dentry_to_lower(dentry->d_parent);
-       lower_dir_inode = d_inode(lower_dir_dentry);
-       inode_lock_nested(lower_dir_inode, I_MUTEX_PARENT);
+       rc = lock_parent(dentry, &lower_dentry, &lower_dir);
        dget(lower_dentry);     // don't even try to make the lower negative
-       if (lower_dentry->d_parent != lower_dir_dentry)
-               rc = -EINVAL;
-       else if (d_unhashed(lower_dentry))
-               rc = -EINVAL;
-       else
-               rc = vfs_unlink(&init_user_ns, lower_dir_inode, lower_dentry,
-                               NULL);
+       if (!rc) {
+               if (d_unhashed(lower_dentry))
+                       rc = -EINVAL;
+               else
+                       rc = vfs_unlink(&init_user_ns, lower_dir, lower_dentry,
+                                       NULL);
+       }
        if (rc) {
                printk(KERN_ERR "Error in vfs_unlink; rc = [%d]\n", rc);
                goto out_unlock;
        }
-       fsstack_copy_attr_times(dir, lower_dir_inode);
+       fsstack_copy_attr_times(dir, lower_dir);
        set_nlink(inode, ecryptfs_inode_to_lower(inode)->i_nlink);
        inode->i_ctime = dir->i_ctime;
 out_unlock:
        dput(lower_dentry);
-       inode_unlock(lower_dir_inode);
+       inode_unlock(lower_dir);
        if (!rc)
                d_drop(dentry);
        return rc;
@@ -177,13 +173,13 @@ ecryptfs_do_create(struct inode *directory_inode,
 {
        int rc;
        struct dentry *lower_dentry;
-       struct dentry *lower_dir_dentry;
+       struct inode *lower_dir;
        struct inode *inode;
 
-       lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
-       lower_dir_dentry = lock_parent(lower_dentry);
-       rc = vfs_create(&init_user_ns, d_inode(lower_dir_dentry), lower_dentry,
-                       mode, true);
+       rc = lock_parent(ecryptfs_dentry, &lower_dentry, &lower_dir);
+       if (!rc)
+               rc = vfs_create(&init_user_ns, lower_dir,
+                               lower_dentry, mode, true);
        if (rc) {
                printk(KERN_ERR "%s: Failure to create dentry in lower fs; "
                       "rc = [%d]\n", __func__, rc);
@@ -193,18 +189,17 @@ ecryptfs_do_create(struct inode *directory_inode,
        inode = __ecryptfs_get_inode(d_inode(lower_dentry),
                                     directory_inode->i_sb);
        if (IS_ERR(inode)) {
-               vfs_unlink(&init_user_ns, d_inode(lower_dir_dentry),
-                          lower_dentry, NULL);
+               vfs_unlink(&init_user_ns, lower_dir, lower_dentry, NULL);
                goto out_lock;
        }
-       fsstack_copy_attr_times(directory_inode, d_inode(lower_dir_dentry));
-       fsstack_copy_inode_size(directory_inode, d_inode(lower_dir_dentry));
+       fsstack_copy_attr_times(directory_inode, lower_dir);
+       fsstack_copy_inode_size(directory_inode, lower_dir);
 out_lock:
-       unlock_dir(lower_dir_dentry);
+       inode_unlock(lower_dir);
        return inode;
 }
 
-/**
+/*
  * ecryptfs_initialize_file
  *
  * Cause the file to be changed from a basic empty file to an ecryptfs
@@ -247,10 +242,8 @@ out:
        return rc;
 }
 
-/**
+/*
  * ecryptfs_create
- * @dir: The inode of the directory in which to create the file.
- * @dentry: The eCryptfs dentry
  * @mode: The mode of the new file.
  *
  * Creates a new file.
@@ -318,7 +311,7 @@ static int ecryptfs_i_size_read(struct dentry *dentry, struct inode *inode)
        return 0;
 }
 
-/**
+/*
  * ecryptfs_lookup_interpose - Dentry interposition for a lookup
  */
 static struct dentry *ecryptfs_lookup_interpose(struct dentry *dentry,
@@ -431,32 +424,28 @@ static int ecryptfs_link(struct dentry *old_dentry, struct inode *dir,
 {
        struct dentry *lower_old_dentry;
        struct dentry *lower_new_dentry;
-       struct dentry *lower_dir_dentry;
+       struct inode *lower_dir;
        u64 file_size_save;
        int rc;
 
        file_size_save = i_size_read(d_inode(old_dentry));
        lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
-       lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);
-       dget(lower_old_dentry);
-       dget(lower_new_dentry);
-       lower_dir_dentry = lock_parent(lower_new_dentry);
-       rc = vfs_link(lower_old_dentry, &init_user_ns,
-                     d_inode(lower_dir_dentry), lower_new_dentry, NULL);
+       rc = lock_parent(new_dentry, &lower_new_dentry, &lower_dir);
+       if (!rc)
+               rc = vfs_link(lower_old_dentry, &init_user_ns, lower_dir,
+                             lower_new_dentry, NULL);
        if (rc || d_really_is_negative(lower_new_dentry))
                goto out_lock;
        rc = ecryptfs_interpose(lower_new_dentry, new_dentry, dir->i_sb);
        if (rc)
                goto out_lock;
-       fsstack_copy_attr_times(dir, d_inode(lower_dir_dentry));
-       fsstack_copy_inode_size(dir, d_inode(lower_dir_dentry));
+       fsstack_copy_attr_times(dir, lower_dir);
+       fsstack_copy_inode_size(dir, lower_dir);
        set_nlink(d_inode(old_dentry),
                  ecryptfs_inode_to_lower(d_inode(old_dentry))->i_nlink);
        i_size_write(d_inode(new_dentry), file_size_save);
 out_lock:
-       unlock_dir(lower_dir_dentry);
-       dput(lower_new_dentry);
-       dput(lower_old_dentry);
+       inode_unlock(lower_dir);
        return rc;
 }
 
@@ -471,14 +460,14 @@ static int ecryptfs_symlink(struct user_namespace *mnt_userns,
 {
        int rc;
        struct dentry *lower_dentry;
-       struct dentry *lower_dir_dentry;
+       struct inode *lower_dir;
        char *encoded_symname;
        size_t encoded_symlen;
        struct ecryptfs_mount_crypt_stat *mount_crypt_stat = NULL;
 
-       lower_dentry = ecryptfs_dentry_to_lower(dentry);
-       dget(lower_dentry);
-       lower_dir_dentry = lock_parent(lower_dentry);
+       rc = lock_parent(dentry, &lower_dentry, &lower_dir);
+       if (rc)
+               goto out_lock;
        mount_crypt_stat = &ecryptfs_superblock_to_private(
                dir->i_sb)->mount_crypt_stat;
        rc = ecryptfs_encrypt_and_encode_filename(&encoded_symname,
@@ -487,7 +476,7 @@ static int ecryptfs_symlink(struct user_namespace *mnt_userns,
                                                  strlen(symname));
        if (rc)
                goto out_lock;
-       rc = vfs_symlink(&init_user_ns, d_inode(lower_dir_dentry), lower_dentry,
+       rc = vfs_symlink(&init_user_ns, lower_dir, lower_dentry,
                         encoded_symname);
        kfree(encoded_symname);
        if (rc || d_really_is_negative(lower_dentry))
@@ -495,11 +484,10 @@ static int ecryptfs_symlink(struct user_namespace *mnt_userns,
        rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb);
        if (rc)
                goto out_lock;
-       fsstack_copy_attr_times(dir, d_inode(lower_dir_dentry));
-       fsstack_copy_inode_size(dir, d_inode(lower_dir_dentry));
+       fsstack_copy_attr_times(dir, lower_dir);
+       fsstack_copy_inode_size(dir, lower_dir);
 out_lock:
-       unlock_dir(lower_dir_dentry);
-       dput(lower_dentry);
+       inode_unlock(lower_dir);
        if (d_really_is_negative(dentry))
                d_drop(dentry);
        return rc;
@@ -510,22 +498,22 @@ static int ecryptfs_mkdir(struct user_namespace *mnt_userns, struct inode *dir,
 {
        int rc;
        struct dentry *lower_dentry;
-       struct dentry *lower_dir_dentry;
+       struct inode *lower_dir;
 
-       lower_dentry = ecryptfs_dentry_to_lower(dentry);
-       lower_dir_dentry = lock_parent(lower_dentry);
-       rc = vfs_mkdir(&init_user_ns, d_inode(lower_dir_dentry), lower_dentry,
-                      mode);
+       rc = lock_parent(dentry, &lower_dentry, &lower_dir);
+       if (!rc)
+               rc = vfs_mkdir(&init_user_ns, lower_dir,
+                              lower_dentry, mode);
        if (rc || d_really_is_negative(lower_dentry))
                goto out;
        rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb);
        if (rc)
                goto out;
-       fsstack_copy_attr_times(dir, d_inode(lower_dir_dentry));
-       fsstack_copy_inode_size(dir, d_inode(lower_dir_dentry));
-       set_nlink(dir, d_inode(lower_dir_dentry)->i_nlink);
+       fsstack_copy_attr_times(dir, lower_dir);
+       fsstack_copy_inode_size(dir, lower_dir);
+       set_nlink(dir, lower_dir->i_nlink);
 out:
-       unlock_dir(lower_dir_dentry);
+       inode_unlock(lower_dir);
        if (d_really_is_negative(dentry))
                d_drop(dentry);
        return rc;
@@ -534,29 +522,24 @@ out:
 static int ecryptfs_rmdir(struct inode *dir, struct dentry *dentry)
 {
        struct dentry *lower_dentry;
-       struct dentry *lower_dir_dentry;
-       struct inode *lower_dir_inode;
+       struct inode *lower_dir;
        int rc;
 
-       lower_dentry = ecryptfs_dentry_to_lower(dentry);
-       lower_dir_dentry = ecryptfs_dentry_to_lower(dentry->d_parent);
-       lower_dir_inode = d_inode(lower_dir_dentry);
-
-       inode_lock_nested(lower_dir_inode, I_MUTEX_PARENT);
+       rc = lock_parent(dentry, &lower_dentry, &lower_dir);
        dget(lower_dentry);     // don't even try to make the lower negative
-       if (lower_dentry->d_parent != lower_dir_dentry)
-               rc = -EINVAL;
-       else if (d_unhashed(lower_dentry))
-               rc = -EINVAL;
-       else
-               rc = vfs_rmdir(&init_user_ns, lower_dir_inode, lower_dentry);
+       if (!rc) {
+               if (d_unhashed(lower_dentry))
+                       rc = -EINVAL;
+               else
+                       rc = vfs_rmdir(&init_user_ns, lower_dir, lower_dentry);
+       }
        if (!rc) {
                clear_nlink(d_inode(dentry));
-               fsstack_copy_attr_times(dir, lower_dir_inode);
-               set_nlink(dir, lower_dir_inode->i_nlink);
+               fsstack_copy_attr_times(dir, lower_dir);
+               set_nlink(dir, lower_dir->i_nlink);
        }
        dput(lower_dentry);
-       inode_unlock(lower_dir_inode);
+       inode_unlock(lower_dir);
        if (!rc)
                d_drop(dentry);
        return rc;
@@ -568,21 +551,21 @@ ecryptfs_mknod(struct user_namespace *mnt_userns, struct inode *dir,
 {
        int rc;
        struct dentry *lower_dentry;
-       struct dentry *lower_dir_dentry;
+       struct inode *lower_dir;
 
-       lower_dentry = ecryptfs_dentry_to_lower(dentry);
-       lower_dir_dentry = lock_parent(lower_dentry);
-       rc = vfs_mknod(&init_user_ns, d_inode(lower_dir_dentry), lower_dentry,
-                      mode, dev);
+       rc = lock_parent(dentry, &lower_dentry, &lower_dir);
+       if (!rc)
+               rc = vfs_mknod(&init_user_ns, lower_dir,
+                              lower_dentry, mode, dev);
        if (rc || d_really_is_negative(lower_dentry))
                goto out;
        rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb);
        if (rc)
                goto out;
-       fsstack_copy_attr_times(dir, d_inode(lower_dir_dentry));
-       fsstack_copy_inode_size(dir, d_inode(lower_dir_dentry));
+       fsstack_copy_attr_times(dir, lower_dir);
+       fsstack_copy_inode_size(dir, lower_dir);
 out:
-       unlock_dir(lower_dir_dentry);
+       inode_unlock(lower_dir);
        if (d_really_is_negative(dentry))
                d_drop(dentry);
        return rc;
@@ -888,6 +871,7 @@ ecryptfs_permission(struct user_namespace *mnt_userns, struct inode *inode,
 
 /**
  * ecryptfs_setattr
+ * @mnt_userns: user namespace of the target mount
  * @dentry: dentry handle to the inode to modify
  * @ia: Structure with flags of what to change and values
  *