1 /* $NetBSD: vfs_lookup.c,v 1.238 2024/12/07 02:27:38 riastradh Exp $ */
2
3 /*
4 * Copyright (c) 1982, 1986, 1989, 1993
5 * The Regents of the University of California. All rights reserved.
6 * (c) UNIX System Laboratories, Inc.
7 * All or some portions of this file are derived from material licensed
8 * to the University of California by American Telephone and Telegraph
9 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
10 * the permission of UNIX System Laboratories, Inc.
11 *
12 * Redistribution and use in source and binary forms, with or without
13 * modification, are permitted provided that the following conditions
14 * are met:
15 * 1. Redistributions of source code must retain the above copyright
16 * notice, this list of conditions and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 * notice, this list of conditions and the following disclaimer in the
19 * documentation and/or other materials provided with the distribution.
20 * 3. Neither the name of the University nor the names of its contributors
21 * may be used to endorse or promote products derived from this software
22 * without specific prior written permission.
23 *
24 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 * SUCH DAMAGE.
35 *
36 * @(#)vfs_lookup.c 8.10 (Berkeley) 5/27/95
37 */
38
39 #include <sys/cdefs.h>
40 __KERNEL_RCSID(0, "$NetBSD: vfs_lookup.c,v 1.238 2024/12/07 02:27:38 riastradh Exp $");
41
42 #ifdef _KERNEL_OPT
43 #include "opt_magiclinks.h"
44 #endif
45
46 #include <sys/param.h>
47 #include <sys/types.h>
48
49 #include <sys/dirent.h>
50 #include <sys/errno.h>
51 #include <sys/filedesc.h>
52 #include <sys/fstrans.h>
53 #include <sys/hash.h>
54 #include <sys/kauth.h>
55 #include <sys/kernel.h>
56 #include <sys/ktrace.h>
57 #include <sys/mount.h>
58 #include <sys/namei.h>
59 #include <sys/proc.h>
60 #include <sys/sdt.h>
61 #include <sys/syslimits.h>
62 #include <sys/syslog.h>
63 #include <sys/systm.h>
64 #include <sys/time.h>
65 #include <sys/vnode.h>
66 #include <sys/vnode_impl.h>
67
68 #ifndef MAGICLINKS
69 #define MAGICLINKS 0
70 #endif
71
72 int vfs_magiclinks = MAGICLINKS;
73
74 __CTASSERT(MAXNAMLEN == NAME_MAX);
75
76 /*
77 * Substitute replacement text for 'magic' strings in symlinks.
78 * Returns 0 if successful, and returns non-zero if an error
79 * occurs. (Currently, the only possible error is running out
80 * of temporary pathname space.)
81 *
82 * Looks for "@<string>" and "@<string>/", where <string> is a
83 * recognized 'magic' string. Replaces the "@<string>" with the
84 * appropriate replacement text. (Note that in some cases the
85 * replacement text may have zero length.)
86 *
87 * This would have been table driven, but the variance in
88 * replacement strings (and replacement string lengths) made
89 * that impractical.
90 */
91 #define VNL(x) \
92 (sizeof(x) - 1)
93
94 #define VO '{'
95 #define VC '}'
96
97 #define MATCH(str) \
98 ((termchar == '/' && i + VNL(str) == *len) || \
99 (i + VNL(str) < *len && \
100 cp[i + VNL(str)] == termchar)) && \
101 !strncmp((str), &cp[i], VNL(str))
102
103 #define SUBSTITUTE(m, s, sl) \
104 if ((newlen + (sl)) >= MAXPATHLEN) \
105 return 1; \
106 i += VNL(m); \
107 if (termchar != '/') \
108 i++; \
109 (void)memcpy(&tmp[newlen], (s), (sl)); \
110 newlen += (sl); \
111 change = 1; \
112 termchar = '/';
113
114 static int
symlink_magic(struct proc * p,char * cp,size_t * len)115 symlink_magic(struct proc *p, char *cp, size_t *len)
116 {
117 char *tmp;
118 size_t change, i, newlen, slen;
119 char termchar = '/';
120 char idtmp[11]; /* enough for 32 bit *unsigned* integer */
121
122
123 tmp = PNBUF_GET();
124 for (change = i = newlen = 0; i < *len; ) {
125 if (cp[i] != '@') {
126 tmp[newlen++] = cp[i++];
127 continue;
128 }
129
130 i++;
131
132 /* Check for @{var} syntax. */
133 if (cp[i] == VO) {
134 termchar = VC;
135 i++;
136 }
137
138 /*
139 * The following checks should be ordered according
140 * to frequency of use.
141 */
142 if (MATCH("machine_arch")) {
143 slen = strlen(PROC_MACHINE_ARCH(p));
144 SUBSTITUTE("machine_arch", PROC_MACHINE_ARCH(p), slen);
145 } else if (MATCH("machine")) {
146 slen = VNL(MACHINE);
147 SUBSTITUTE("machine", MACHINE, slen);
148 } else if (MATCH("hostname")) {
149 SUBSTITUTE("hostname", hostname, hostnamelen);
150 } else if (MATCH("osrelease")) {
151 slen = strlen(osrelease);
152 SUBSTITUTE("osrelease", osrelease, slen);
153 } else if (MATCH("emul")) {
154 slen = strlen(p->p_emul->e_name);
155 SUBSTITUTE("emul", p->p_emul->e_name, slen);
156 } else if (MATCH("kernel_ident")) {
157 slen = strlen(kernel_ident);
158 SUBSTITUTE("kernel_ident", kernel_ident, slen);
159 } else if (MATCH("domainname")) {
160 SUBSTITUTE("domainname", domainname, domainnamelen);
161 } else if (MATCH("ostype")) {
162 slen = strlen(ostype);
163 SUBSTITUTE("ostype", ostype, slen);
164 } else if (MATCH("uid")) {
165 slen = snprintf(idtmp, sizeof(idtmp), "%u",
166 kauth_cred_geteuid(kauth_cred_get()));
167 SUBSTITUTE("uid", idtmp, slen);
168 } else if (MATCH("ruid")) {
169 slen = snprintf(idtmp, sizeof(idtmp), "%u",
170 kauth_cred_getuid(kauth_cred_get()));
171 SUBSTITUTE("ruid", idtmp, slen);
172 } else if (MATCH("gid")) {
173 slen = snprintf(idtmp, sizeof(idtmp), "%u",
174 kauth_cred_getegid(kauth_cred_get()));
175 SUBSTITUTE("gid", idtmp, slen);
176 } else if (MATCH("rgid")) {
177 slen = snprintf(idtmp, sizeof(idtmp), "%u",
178 kauth_cred_getgid(kauth_cred_get()));
179 SUBSTITUTE("rgid", idtmp, slen);
180 } else {
181 tmp[newlen++] = '@';
182 if (termchar == VC)
183 tmp[newlen++] = VO;
184 }
185 }
186
187 if (change) {
188 (void)memcpy(cp, tmp, newlen);
189 *len = newlen;
190 }
191 PNBUF_PUT(tmp);
192
193 return 0;
194 }
195
196 #undef VNL
197 #undef VO
198 #undef VC
199 #undef MATCH
200 #undef SUBSTITUTE
201
202 ////////////////////////////////////////////////////////////
203
204 /*
205 * Determine the namei hash (for the namecache) for name.
206 * If *ep != NULL, hash from name to ep-1.
207 * If *ep == NULL, hash from name until the first NUL or '/', and
208 * return the location of this termination character in *ep.
209 *
210 * This function returns an equivalent hash to the MI hash32_strn().
211 * The latter isn't used because in the *ep == NULL case, determining
212 * the length of the string to the first NUL or `/' and then calling
213 * hash32_strn() involves unnecessary double-handling of the data.
214 */
215 uint32_t
namei_hash(const char * name,const char ** ep)216 namei_hash(const char *name, const char **ep)
217 {
218 uint32_t hash;
219
220 hash = HASH32_STR_INIT;
221 if (*ep != NULL) {
222 for (; name < *ep; name++)
223 hash = hash * 33 + *(const uint8_t *)name;
224 } else {
225 for (; *name != '\0' && *name != '/'; name++)
226 hash = hash * 33 + *(const uint8_t *)name;
227 *ep = name;
228 }
229 return (hash + (hash >> 5));
230 }
231
232 ////////////////////////////////////////////////////////////
233
234 /*
235 * Sealed abstraction for pathnames.
236 *
237 * System-call-layer level code that is going to call namei should
238 * first create a pathbuf and adjust all the bells and whistles on it
239 * as needed by context.
240 */
241
242 struct pathbuf {
243 char *pb_path;
244 char *pb_pathcopy;
245 unsigned pb_pathcopyuses;
246 };
247
248 static struct pathbuf *
pathbuf_create_raw(void)249 pathbuf_create_raw(void)
250 {
251 struct pathbuf *pb;
252
253 pb = kmem_alloc(sizeof(*pb), KM_SLEEP);
254 pb->pb_path = PNBUF_GET();
255 if (pb->pb_path == NULL) {
256 kmem_free(pb, sizeof(*pb));
257 return NULL;
258 }
259 pb->pb_pathcopy = NULL;
260 pb->pb_pathcopyuses = 0;
261 return pb;
262 }
263
264 void
pathbuf_destroy(struct pathbuf * pb)265 pathbuf_destroy(struct pathbuf *pb)
266 {
267
268 KASSERT(pb->pb_pathcopyuses == 0);
269 KASSERT(pb->pb_pathcopy == NULL);
270 PNBUF_PUT(pb->pb_path);
271 kmem_free(pb, sizeof(*pb));
272 }
273
274 struct pathbuf *
pathbuf_assimilate(char * pnbuf)275 pathbuf_assimilate(char *pnbuf)
276 {
277 struct pathbuf *pb;
278
279 pb = kmem_alloc(sizeof(*pb), KM_SLEEP);
280 pb->pb_path = pnbuf;
281 pb->pb_pathcopy = NULL;
282 pb->pb_pathcopyuses = 0;
283 return pb;
284 }
285
286 struct pathbuf *
pathbuf_create(const char * path)287 pathbuf_create(const char *path)
288 {
289 struct pathbuf *pb;
290 int error;
291
292 pb = pathbuf_create_raw();
293 if (pb == NULL) {
294 return NULL;
295 }
296 error = copystr(path, pb->pb_path, PATH_MAX, NULL);
297 if (error != 0) {
298 KASSERT(!"kernel path too long in pathbuf_create");
299 /* make sure it's null-terminated, just in case */
300 pb->pb_path[PATH_MAX-1] = '\0';
301 }
302 return pb;
303 }
304
305 int
pathbuf_copyin(const char * userpath,struct pathbuf ** ret)306 pathbuf_copyin(const char *userpath, struct pathbuf **ret)
307 {
308 struct pathbuf *pb;
309 int error;
310
311 pb = pathbuf_create_raw();
312 if (pb == NULL) {
313 return SET_ERROR(ENOMEM);
314 }
315 error = copyinstr(userpath, pb->pb_path, PATH_MAX, NULL);
316 if (error) {
317 pathbuf_destroy(pb);
318 return error;
319 }
320 *ret = pb;
321 return 0;
322 }
323
324 /*
325 * XXX should not exist:
326 * 1. whether a pointer is kernel or user should be statically checkable.
327 * 2. copyin should be handled by the upper part of the syscall layer,
328 * not in here.
329 */
330 int
pathbuf_maybe_copyin(const char * path,enum uio_seg seg,struct pathbuf ** ret)331 pathbuf_maybe_copyin(const char *path, enum uio_seg seg, struct pathbuf **ret)
332 {
333
334 if (seg == UIO_USERSPACE) {
335 return pathbuf_copyin(path, ret);
336 } else {
337 *ret = pathbuf_create(path);
338 if (*ret == NULL) {
339 return SET_ERROR(ENOMEM);
340 }
341 return 0;
342 }
343 }
344
345 /*
346 * Get a copy of the path buffer as it currently exists. If this is
347 * called after namei starts the results may be arbitrary.
348 */
349 void
pathbuf_copystring(const struct pathbuf * pb,char * buf,size_t maxlen)350 pathbuf_copystring(const struct pathbuf *pb, char *buf, size_t maxlen)
351 {
352
353 strlcpy(buf, pb->pb_path, maxlen);
354 }
355
356 /*
357 * These two functions allow access to a saved copy of the original
358 * path string. The first copy should be gotten before namei is
359 * called. Each copy that is gotten should be put back.
360 */
361
362 const char *
pathbuf_stringcopy_get(struct pathbuf * pb)363 pathbuf_stringcopy_get(struct pathbuf *pb)
364 {
365
366 if (pb->pb_pathcopyuses == 0) {
367 pb->pb_pathcopy = PNBUF_GET();
368 strcpy(pb->pb_pathcopy, pb->pb_path);
369 }
370 pb->pb_pathcopyuses++;
371 return pb->pb_pathcopy;
372 }
373
374 void
pathbuf_stringcopy_put(struct pathbuf * pb,const char * str)375 pathbuf_stringcopy_put(struct pathbuf *pb, const char *str)
376 {
377
378 KASSERT(str == pb->pb_pathcopy);
379 KASSERT(pb->pb_pathcopyuses > 0);
380 pb->pb_pathcopyuses--;
381 if (pb->pb_pathcopyuses == 0) {
382 PNBUF_PUT(pb->pb_pathcopy);
383 pb->pb_pathcopy = NULL;
384 }
385 }
386
387
388 ////////////////////////////////////////////////////////////
389
390 /*
391 * namei: convert a pathname into a pointer to a (maybe-locked) vnode,
392 * and maybe also its parent directory vnode, and assorted other guff.
393 * See namei(9) for the interface documentation.
394 *
395 *
396 * The FOLLOW flag is set when symbolic links are to be followed
397 * when they occur at the end of the name translation process.
398 * Symbolic links are always followed for all other pathname
399 * components other than the last.
400 *
401 * The segflg defines whether the name is to be copied from user
402 * space or kernel space.
403 *
404 * Overall outline of namei:
405 *
406 * copy in name
407 * get starting directory
408 * while (!done && !error) {
409 * call lookup to search path.
410 * if symbolic link, massage name in buffer and continue
411 * }
412 */
413
414 /*
415 * Search a pathname.
416 * This is a very central and rather complicated routine.
417 *
418 * The pathname is pointed to by ni_ptr and is of length ni_pathlen.
419 * The starting directory is passed in. The pathname is descended
420 * until done, or a symbolic link is encountered. The variable ni_more
421 * is clear if the path is completed; it is set to one if a symbolic
422 * link needing interpretation is encountered.
423 *
424 * The flag argument is LOOKUP, CREATE, RENAME, or DELETE depending on
425 * whether the name is to be looked up, created, renamed, or deleted.
426 * When CREATE, RENAME, or DELETE is specified, information usable in
427 * creating, renaming, or deleting a directory entry may be calculated.
428 * If flag has LOCKPARENT or'ed into it, the parent directory is returned
429 * locked. Otherwise the parent directory is not returned. If the target
430 * of the pathname exists and LOCKLEAF is or'ed into the flag the target
431 * is returned locked, otherwise it is returned unlocked. When creating
432 * or renaming and LOCKPARENT is specified, the target may not be ".".
433 * When deleting and LOCKPARENT is specified, the target may be ".".
434 *
435 * Overall outline of lookup:
436 *
437 * dirloop:
438 * identify next component of name at ndp->ni_ptr
439 * handle degenerate case where name is null string
440 * if .. and crossing mount points and on mounted filesys, find parent
441 * call VOP_LOOKUP routine for next component name
442 * directory vnode returned in ni_dvp, locked.
443 * component vnode returned in ni_vp (if it exists), locked.
444 * if result vnode is mounted on and crossing mount points,
445 * find mounted on vnode
446 * if more components of name, do next level at dirloop
447 * return the answer in ni_vp, locked if LOCKLEAF set
448 * if LOCKPARENT set, return locked parent in ni_dvp
449 */
450
451
452 /*
453 * Internal state for a namei operation.
454 *
455 * cnp is always equal to &ndp->ni_cnp.
456 */
457 struct namei_state {
458 struct nameidata *ndp;
459 struct componentname *cnp;
460
461 int docache; /* == 0 do not cache last component */
462 int rdonly; /* lookup read-only flag bit */
463 int slashes;
464
465 unsigned attempt_retry:1; /* true if error allows emul retry */
466 unsigned root_referenced:1; /* true if ndp->ni_rootdir and
467 ndp->ni_erootdir were referenced */
468 };
469
470
471 /*
472 * Initialize the namei working state.
473 */
474 static void
namei_init(struct namei_state * state,struct nameidata * ndp)475 namei_init(struct namei_state *state, struct nameidata *ndp)
476 {
477
478 state->ndp = ndp;
479 state->cnp = &ndp->ni_cnd;
480
481 state->docache = 0;
482 state->rdonly = 0;
483 state->slashes = 0;
484
485 state->root_referenced = 0;
486
487 KASSERTMSG((state->cnp->cn_cred != NULL), "namei: bad cred/proc");
488 KASSERTMSG(((state->cnp->cn_nameiop & (~OPMASK)) == 0),
489 "namei: nameiop contaminated with flags: %08"PRIx32,
490 state->cnp->cn_nameiop);
491 KASSERTMSG(((state->cnp->cn_flags & OPMASK) == 0),
492 "name: flags contaminated with nameiops: %08"PRIx32,
493 state->cnp->cn_flags);
494
495 /*
496 * The buffer for name translation shall be the one inside the
497 * pathbuf.
498 */
499 state->ndp->ni_pnbuf = state->ndp->ni_pathbuf->pb_path;
500 }
501
502 /*
503 * Clean up the working namei state, leaving things ready for return
504 * from namei.
505 */
506 static void
namei_cleanup(struct namei_state * state)507 namei_cleanup(struct namei_state *state)
508 {
509
510 KASSERT(state->cnp == &state->ndp->ni_cnd);
511
512 if (state->root_referenced) {
513 if (state->ndp->ni_rootdir != NULL)
514 vrele(state->ndp->ni_rootdir);
515 if (state->ndp->ni_erootdir != NULL)
516 vrele(state->ndp->ni_erootdir);
517 }
518 }
519
520 //////////////////////////////
521
522 /*
523 * Get the directory context.
524 * Initializes the rootdir and erootdir state and returns a reference
525 * to the starting dir.
526 */
527 static struct vnode *
namei_getstartdir(struct namei_state * state)528 namei_getstartdir(struct namei_state *state)
529 {
530 struct nameidata *ndp = state->ndp;
531 struct componentname *cnp = state->cnp;
532 struct cwdinfo *cwdi; /* pointer to cwd state */
533 struct lwp *self = curlwp; /* thread doing namei() */
534 struct vnode *rootdir, *erootdir, *curdir, *startdir;
535
536 if (state->root_referenced) {
537 if (state->ndp->ni_rootdir != NULL)
538 vrele(state->ndp->ni_rootdir);
539 if (state->ndp->ni_erootdir != NULL)
540 vrele(state->ndp->ni_erootdir);
541 state->root_referenced = 0;
542 }
543
544 cwdi = self->l_proc->p_cwdi;
545 rw_enter(&cwdi->cwdi_lock, RW_READER);
546
547 /* root dir */
548 if (cwdi->cwdi_rdir == NULL || (cnp->cn_flags & NOCHROOT)) {
549 rootdir = rootvnode;
550 } else {
551 rootdir = cwdi->cwdi_rdir;
552 }
553
554 /* emulation root dir, if any */
555 if ((cnp->cn_flags & TRYEMULROOT) == 0) {
556 /* if we don't want it, don't fetch it */
557 erootdir = NULL;
558 } else if (cnp->cn_flags & EMULROOTSET) {
559 /* explicitly set emulroot; "/../" doesn't override this */
560 erootdir = ndp->ni_erootdir;
561 } else if (!strncmp(ndp->ni_pnbuf, "/../", 4)) {
562 /* explicit reference to real rootdir */
563 erootdir = NULL;
564 } else {
565 /* may be null */
566 erootdir = cwdi->cwdi_edir;
567 }
568
569 /* current dir */
570 curdir = cwdi->cwdi_cdir;
571
572 if (ndp->ni_pnbuf[0] != '/') {
573 if (ndp->ni_atdir != NULL) {
574 startdir = ndp->ni_atdir;
575 } else {
576 startdir = curdir;
577 }
578 erootdir = NULL;
579 } else if (cnp->cn_flags & TRYEMULROOT && erootdir != NULL) {
580 startdir = erootdir;
581 } else {
582 startdir = rootdir;
583 erootdir = NULL;
584 }
585
586 state->ndp->ni_rootdir = rootdir;
587 state->ndp->ni_erootdir = erootdir;
588
589 /*
590 * Get a reference to the start dir so we can safely unlock cwdi.
591 *
592 * Must hold references to rootdir and erootdir while we're running.
593 * A multithreaded process may chroot during namei.
594 */
595 if (startdir != NULL)
596 vref(startdir);
597 if (state->ndp->ni_rootdir != NULL)
598 vref(state->ndp->ni_rootdir);
599 if (state->ndp->ni_erootdir != NULL)
600 vref(state->ndp->ni_erootdir);
601 state->root_referenced = 1;
602
603 rw_exit(&cwdi->cwdi_lock);
604 return startdir;
605 }
606
607 /*
608 * Get the directory context for the nfsd case, in parallel to
609 * getstartdir. Initializes the rootdir and erootdir state and
610 * returns a reference to the passed-in starting dir.
611 */
612 static struct vnode *
namei_getstartdir_for_nfsd(struct namei_state * state)613 namei_getstartdir_for_nfsd(struct namei_state *state)
614 {
615
616 KASSERT(state->ndp->ni_atdir != NULL);
617
618 /* always use the real root, and never set an emulation root */
619 if (rootvnode == NULL) {
620 return NULL;
621 }
622 state->ndp->ni_rootdir = rootvnode;
623 state->ndp->ni_erootdir = NULL;
624
625 vref(state->ndp->ni_atdir);
626 KASSERT(! state->root_referenced);
627 vref(state->ndp->ni_rootdir);
628 state->root_referenced = 1;
629 return state->ndp->ni_atdir;
630 }
631
632
633 /*
634 * Ktrace the namei operation.
635 */
636 static void
namei_ktrace(struct namei_state * state)637 namei_ktrace(struct namei_state *state)
638 {
639 struct nameidata *ndp = state->ndp;
640 struct componentname *cnp = state->cnp;
641 struct lwp *self = curlwp; /* thread doing namei() */
642 const char *emul_path;
643
644 if (ktrpoint(KTR_NAMEI)) {
645 if (ndp->ni_erootdir != NULL) {
646 /*
647 * To make any sense, the trace entry need to have the
648 * text of the emulation path prepended.
649 * Usually we can get this from the current process,
650 * but when called from emul_find_interp() it is only
651 * in the exec_package - so we get it passed in ni_next
652 * (this is a hack).
653 */
654 if (cnp->cn_flags & EMULROOTSET)
655 emul_path = ndp->ni_next;
656 else
657 emul_path = self->l_proc->p_emul->e_path;
658 ktrnamei2(emul_path, strlen(emul_path),
659 ndp->ni_pnbuf, ndp->ni_pathlen);
660 } else
661 ktrnamei(ndp->ni_pnbuf, ndp->ni_pathlen);
662 }
663 }
664
665 /*
666 * Start up namei. Find the root dir and cwd, establish the starting
667 * directory for lookup, and lock it. Also calls ktrace when
668 * appropriate.
669 */
670 static int
namei_start(struct namei_state * state,int isnfsd,struct vnode ** startdir_ret)671 namei_start(struct namei_state *state, int isnfsd,
672 struct vnode **startdir_ret)
673 {
674 struct nameidata *ndp = state->ndp;
675 struct vnode *startdir;
676
677 /* length includes null terminator (was originally from copyinstr) */
678 ndp->ni_pathlen = strlen(ndp->ni_pnbuf) + 1;
679
680 /*
681 * POSIX.1 requirement: "" is not a valid file name.
682 */
683 if (ndp->ni_pathlen == 1) {
684 ndp->ni_erootdir = NULL;
685 return SET_ERROR(ENOENT);
686 }
687
688 ndp->ni_loopcnt = 0;
689
690 /* Get starting directory, set up root, and ktrace. */
691 if (isnfsd) {
692 startdir = namei_getstartdir_for_nfsd(state);
693 /* no ktrace */
694 } else {
695 startdir = namei_getstartdir(state);
696 namei_ktrace(state);
697 }
698
699 if (startdir == NULL) {
700 return SET_ERROR(ENOENT);
701 }
702
703 /* NDAT may feed us with a non directory namei_getstartdir */
704 if (startdir->v_type != VDIR) {
705 vrele(startdir);
706 return SET_ERROR(ENOTDIR);
707 }
708
709 *startdir_ret = startdir;
710 return 0;
711 }
712
713 /*
714 * Check for being at a symlink that we're going to follow.
715 */
716 static inline int
namei_atsymlink(struct namei_state * state,struct vnode * foundobj)717 namei_atsymlink(struct namei_state *state, struct vnode *foundobj)
718 {
719
720 return (foundobj->v_type == VLNK) &&
721 (state->cnp->cn_flags & (FOLLOW|REQUIREDIR));
722 }
723
724 /*
725 * Follow a symlink.
726 *
727 * Updates searchdir. inhibitmagic causes magic symlinks to not be
728 * interpreted; this is used by nfsd.
729 *
730 * Unlocks foundobj on success (ugh)
731 */
732 static inline int
namei_follow(struct namei_state * state,int inhibitmagic,struct vnode * searchdir,struct vnode * foundobj,struct vnode ** newsearchdir_ret)733 namei_follow(struct namei_state *state, int inhibitmagic,
734 struct vnode *searchdir, struct vnode *foundobj,
735 struct vnode **newsearchdir_ret)
736 {
737 struct nameidata *ndp = state->ndp;
738 struct componentname *cnp = state->cnp;
739
740 struct lwp *self = curlwp; /* thread doing namei() */
741 struct iovec aiov; /* uio for reading symbolic links */
742 struct uio auio;
743 char *cp; /* pointer into pathname argument */
744 size_t linklen;
745 int error;
746
747 if (ndp->ni_loopcnt++ >= MAXSYMLINKS) {
748 return SET_ERROR(ELOOP);
749 }
750
751 vn_lock(foundobj, LK_EXCLUSIVE | LK_RETRY);
752 if (foundobj->v_mount->mnt_flag & MNT_SYMPERM) {
753 error = VOP_ACCESS(foundobj, VEXEC, cnp->cn_cred);
754 if (error != 0) {
755 VOP_UNLOCK(foundobj);
756 return error;
757 }
758 }
759
760 /* FUTURE: fix this to not use a second buffer */
761 cp = PNBUF_GET();
762 aiov.iov_base = cp;
763 aiov.iov_len = MAXPATHLEN;
764 auio.uio_iov = &aiov;
765 auio.uio_iovcnt = 1;
766 auio.uio_offset = 0;
767 auio.uio_rw = UIO_READ;
768 auio.uio_resid = MAXPATHLEN;
769 UIO_SETUP_SYSSPACE(&auio);
770 error = VOP_READLINK(foundobj, &auio, cnp->cn_cred);
771 VOP_UNLOCK(foundobj);
772 if (error) {
773 PNBUF_PUT(cp);
774 return error;
775 }
776 linklen = MAXPATHLEN - auio.uio_resid;
777 if (linklen == 0) {
778 PNBUF_PUT(cp);
779 return SET_ERROR(ENOENT);
780 }
781
782 /*
783 * Do symlink substitution, if appropriate, and
784 * check length for potential overflow.
785 *
786 * Inhibit symlink substitution for nfsd.
787 * XXX: This is how it was before; is that a bug or a feature?
788 */
789 if ((!inhibitmagic && vfs_magiclinks &&
790 symlink_magic(self->l_proc, cp, &linklen)) ||
791 (linklen + ndp->ni_pathlen >= MAXPATHLEN)) {
792 PNBUF_PUT(cp);
793 return SET_ERROR(ENAMETOOLONG);
794 }
795 if (ndp->ni_pathlen > 1) {
796 /* includes a null-terminator */
797 memcpy(cp + linklen, ndp->ni_next, ndp->ni_pathlen);
798 } else {
799 cp[linklen] = '\0';
800 }
801 ndp->ni_pathlen += linklen;
802 memcpy(ndp->ni_pnbuf, cp, ndp->ni_pathlen);
803 PNBUF_PUT(cp);
804
805 /* we're now starting from the beginning of the buffer again */
806 cnp->cn_nameptr = ndp->ni_pnbuf;
807
808 /*
809 * Check if root directory should replace current directory.
810 */
811 if (ndp->ni_pnbuf[0] == '/') {
812 vrele(searchdir);
813 /* Keep absolute symbolic links inside emulation root */
814 searchdir = ndp->ni_erootdir;
815 if (searchdir == NULL ||
816 (ndp->ni_pnbuf[1] == '.'
817 && ndp->ni_pnbuf[2] == '.'
818 && ndp->ni_pnbuf[3] == '/')) {
819 ndp->ni_erootdir = NULL;
820 searchdir = ndp->ni_rootdir;
821 }
822 vref(searchdir);
823 while (cnp->cn_nameptr[0] == '/') {
824 cnp->cn_nameptr++;
825 ndp->ni_pathlen--;
826 }
827 }
828
829 *newsearchdir_ret = searchdir;
830 return 0;
831 }
832
833 //////////////////////////////
834
835 /*
836 * Inspect the leading path component and update the state accordingly.
837 */
838 static int
lookup_parsepath(struct namei_state * state,struct vnode * searchdir)839 lookup_parsepath(struct namei_state *state, struct vnode *searchdir)
840 {
841 const char *cp; /* pointer into pathname argument */
842 int error;
843 struct componentname *cnp = state->cnp;
844 struct nameidata *ndp = state->ndp;
845
846 KASSERT(cnp == &ndp->ni_cnd);
847
848 /*
849 * Search a new directory.
850 *
851 * The last component of the filename is left accessible via
852 * cnp->cn_nameptr for callers that need the name. Callers needing
853 * the name set the SAVENAME flag. When done, they assume
854 * responsibility for freeing the pathname buffer.
855 *
856 * At this point, our only vnode state is that the search dir
857 * is held.
858 */
859 error = VOP_PARSEPATH(searchdir, cnp->cn_nameptr, &cnp->cn_namelen);
860 if (error) {
861 return error;
862 }
863 cp = cnp->cn_nameptr + cnp->cn_namelen;
864 if (cnp->cn_namelen > KERNEL_NAME_MAX) {
865 return SET_ERROR(ENAMETOOLONG);
866 }
867 #ifdef NAMEI_DIAGNOSTIC
868 { char c = *cp;
869 *(char *)cp = '\0';
870 printf("{%s}: ", cnp->cn_nameptr);
871 *(char *)cp = c; }
872 #endif /* NAMEI_DIAGNOSTIC */
873 ndp->ni_pathlen -= cnp->cn_namelen;
874 ndp->ni_next = cp;
875 /*
876 * If this component is followed by a slash, then move the pointer to
877 * the next component forward, and remember that this component must be
878 * a directory.
879 */
880 if (*cp == '/') {
881 do {
882 cp++;
883 } while (*cp == '/');
884 state->slashes = cp - ndp->ni_next;
885 ndp->ni_pathlen -= state->slashes;
886 ndp->ni_next = cp;
887 cnp->cn_flags |= REQUIREDIR;
888 } else {
889 state->slashes = 0;
890 cnp->cn_flags &= ~REQUIREDIR;
891 }
892 /*
893 * We do special processing on the last component, whether or not it's
894 * a directory. Cache all intervening lookups, but not the final one.
895 */
896 if (*cp == '\0') {
897 if (state->docache)
898 cnp->cn_flags |= MAKEENTRY;
899 else
900 cnp->cn_flags &= ~MAKEENTRY;
901 cnp->cn_flags |= ISLASTCN;
902 } else {
903 cnp->cn_flags |= MAKEENTRY;
904 cnp->cn_flags &= ~ISLASTCN;
905 }
906 if (cnp->cn_namelen == 2 &&
907 cnp->cn_nameptr[1] == '.' && cnp->cn_nameptr[0] == '.')
908 cnp->cn_flags |= ISDOTDOT;
909 else
910 cnp->cn_flags &= ~ISDOTDOT;
911
912 return 0;
913 }
914
915 /*
916 * Take care of crossing a mounted-on vnode. On error, foundobj_ret will be
917 * vrele'd, but searchdir is left alone.
918 */
919 static int
lookup_crossmount(struct namei_state * state,struct vnode ** searchdir_ret,struct vnode ** foundobj_ret,bool * searchdir_locked)920 lookup_crossmount(struct namei_state *state,
921 struct vnode **searchdir_ret,
922 struct vnode **foundobj_ret,
923 bool *searchdir_locked)
924 {
925 struct componentname *cnp = state->cnp;
926 struct vnode *foundobj, *vp;
927 struct vnode *searchdir;
928 struct mount *mp;
929 int error, lktype;
930
931 searchdir = *searchdir_ret;
932 foundobj = *foundobj_ret;
933 error = 0;
934
935 KASSERT((cnp->cn_flags & NOCROSSMOUNT) == 0);
936
937 /* First, unlock searchdir (oof). */
938 if (*searchdir_locked) {
939 KASSERT(searchdir != NULL);
940 lktype = VOP_ISLOCKED(searchdir);
941 VOP_UNLOCK(searchdir);
942 *searchdir_locked = false;
943 } else {
944 lktype = LK_NONE;
945 }
946
947 /*
948 * Do an unlocked check to see if the vnode has been mounted on; if
949 * so find the root of the mounted file system.
950 */
951 while (foundobj->v_type == VDIR &&
952 (mp = foundobj->v_mountedhere) != NULL &&
953 (cnp->cn_flags & NOCROSSMOUNT) == 0) {
954 /*
955 * Try the namecache first. If that doesn't work, do
956 * it the hard way.
957 */
958 if (cache_lookup_mount(foundobj, &vp)) {
959 vrele(foundobj);
960 foundobj = vp;
961 } else {
962 /* First get the vnodes mount stable. */
963 while ((mp = foundobj->v_mountedhere) != NULL) {
964 fstrans_start(mp);
965 if (fstrans_held(mp) &&
966 mp == foundobj->v_mountedhere) {
967 break;
968 }
969 fstrans_done(mp);
970 }
971 if (mp == NULL) {
972 break;
973 }
974
975 /*
976 * Now get a reference on the root vnode.
977 * XXX Future - maybe allow only VDIR here.
978 */
979 error = VFS_ROOT(mp, LK_NONE, &vp);
980
981 /*
982 * If successful, enter it into the cache while
983 * holding the mount busy (competing with unmount).
984 */
985 if (error == 0) {
986 cache_enter_mount(foundobj, vp);
987 }
988
989 /*
990 * Finally, drop references to foundobj & mountpoint.
991 */
992 vrele(foundobj);
993 fstrans_done(mp);
994 if (error) {
995 foundobj = NULL;
996 break;
997 }
998 foundobj = vp;
999 }
1000
1001 /*
1002 * Avoid locking vnodes from two filesystems because
1003 * it's prone to deadlock, e.g. when using puffs.
1004 * Also, it isn't a good idea to propagate slowness of
1005 * a filesystem up to the root directory. For now,
1006 * only handle the common case, where foundobj is
1007 * VDIR.
1008 *
1009 * In this case set searchdir to null to avoid using
1010 * it again. It is not correct to set searchdir ==
1011 * foundobj here as that will confuse the caller.
1012 * (See PR 40740.)
1013 */
1014 if (searchdir == NULL) {
1015 /* already been here once; do nothing further */
1016 } else if (foundobj->v_type == VDIR) {
1017 vrele(searchdir);
1018 *searchdir_ret = searchdir = NULL;
1019 lktype = LK_NONE;
1020 }
1021 }
1022
1023 /* If searchdir is still around, re-lock it. */
1024 if (error == 0 && lktype != LK_NONE) {
1025 vn_lock(searchdir, lktype | LK_RETRY);
1026 *searchdir_locked = true;
1027 }
1028 *foundobj_ret = foundobj;
1029 return error;
1030 }
1031
1032 /*
1033 * Determine the desired locking mode for the directory of a lookup.
1034 */
1035 static int
lookup_lktype(struct vnode * searchdir,struct componentname * cnp)1036 lookup_lktype(struct vnode *searchdir, struct componentname *cnp)
1037 {
1038
1039 /*
1040 * If the file system supports VOP_LOOKUP() with a shared lock, and
1041 * we are not making any modifications (nameiop LOOKUP) or this is
1042 * not the last component then get a shared lock. Where we can't do
1043 * fast-forwarded lookups (for example with layered file systems)
1044 * then this is the fallback for reducing lock contention.
1045 */
1046 if ((searchdir->v_mount->mnt_iflag & IMNT_SHRLOOKUP) != 0 &&
1047 (cnp->cn_nameiop == LOOKUP || (cnp->cn_flags & ISLASTCN) == 0)) {
1048 return LK_SHARED;
1049 } else {
1050 return LK_EXCLUSIVE;
1051 }
1052 }
1053
1054 /*
1055 * Call VOP_LOOKUP for a single lookup; return a new search directory
1056 * (used when crossing mountpoints up or searching union mounts down) and
1057 * the found object, which for create operations may be NULL on success.
1058 *
1059 * Note that the new search directory may be null, which means the
1060 * searchdir was unlocked and released. This happens in the common case
1061 * when crossing a mount point downwards, in order to avoid coupling
1062 * locks between different file system volumes. Importantly, this can
1063 * happen even if the call fails. (XXX: this is gross and should be
1064 * tidied somehow.)
1065 */
1066 static int
lookup_once(struct namei_state * state,struct vnode * searchdir,struct vnode ** newsearchdir_ret,struct vnode ** foundobj_ret,bool * newsearchdir_locked_ret)1067 lookup_once(struct namei_state *state,
1068 struct vnode *searchdir,
1069 struct vnode **newsearchdir_ret,
1070 struct vnode **foundobj_ret,
1071 bool *newsearchdir_locked_ret)
1072 {
1073 struct vnode *tmpvn; /* scratch vnode */
1074 struct vnode *foundobj; /* result */
1075 struct lwp *l = curlwp;
1076 bool searchdir_locked = false;
1077 int error, lktype;
1078
1079 struct componentname *cnp = state->cnp;
1080 struct nameidata *ndp = state->ndp;
1081
1082 KASSERT(cnp == &ndp->ni_cnd);
1083 *newsearchdir_ret = searchdir;
1084
1085 /*
1086 * Handle "..": two special cases.
1087 * 1. If at root directory (e.g. after chroot)
1088 * or at absolute root directory
1089 * then ignore it so can't get out.
1090 * 1a. If at the root of the emulation filesystem go to the real
1091 * root. So "/../<path>" is always absolute.
1092 * 1b. If we have somehow gotten out of a jail, warn
1093 * and also ignore it so we can't get farther out.
1094 * 2. If this vnode is the root of a mounted
1095 * filesystem, then replace it with the
1096 * vnode which was mounted on so we take the
1097 * .. in the other file system.
1098 */
1099 if (cnp->cn_flags & ISDOTDOT) {
1100 struct proc *p = l->l_proc;
1101
1102 for (;;) {
1103 if (searchdir == ndp->ni_rootdir ||
1104 searchdir == rootvnode) {
1105 foundobj = searchdir;
1106 vref(foundobj);
1107 *foundobj_ret = foundobj;
1108 if (cnp->cn_flags & LOCKPARENT) {
1109 lktype = lookup_lktype(searchdir, cnp);
1110 vn_lock(searchdir, lktype | LK_RETRY);
1111 searchdir_locked = true;
1112 }
1113 error = 0;
1114 goto done;
1115 }
1116 if (ndp->ni_rootdir != rootvnode) {
1117 int retval;
1118
1119 retval = vn_isunder(searchdir, ndp->ni_rootdir,
1120 l);
1121 if (!retval) {
1122 /* Oops! We got out of jail! */
1123 log(LOG_WARNING,
1124 "chrooted pid %d uid %d (%s) "
1125 "detected outside of its chroot\n",
1126 p->p_pid,
1127 kauth_cred_geteuid(l->l_cred),
1128 p->p_comm);
1129 /* Put us at the jail root. */
1130 vrele(searchdir);
1131 searchdir = NULL;
1132 foundobj = ndp->ni_rootdir;
1133 vref(foundobj);
1134 vref(foundobj);
1135 *newsearchdir_ret = foundobj;
1136 *foundobj_ret = foundobj;
1137 error = 0;
1138 goto done;
1139 }
1140 }
1141 if ((searchdir->v_vflag & VV_ROOT) == 0 ||
1142 (cnp->cn_flags & NOCROSSMOUNT))
1143 break;
1144 tmpvn = searchdir;
1145 searchdir = searchdir->v_mount->mnt_vnodecovered;
1146 vref(searchdir);
1147 vrele(tmpvn);
1148 *newsearchdir_ret = searchdir;
1149 }
1150 }
1151
1152 lktype = lookup_lktype(searchdir, cnp);
1153
1154 /*
1155 * We now have a segment name to search for, and a directory to search.
1156 * Our vnode state here is that "searchdir" is held.
1157 */
1158 unionlookup:
1159 foundobj = NULL;
1160 if (!searchdir_locked) {
1161 vn_lock(searchdir, lktype | LK_RETRY);
1162 searchdir_locked = true;
1163 }
1164 error = VOP_LOOKUP(searchdir, &foundobj, cnp);
1165
1166 if (error != 0) {
1167 KASSERTMSG((foundobj == NULL),
1168 "leaf `%s' should be empty but is %p",
1169 cnp->cn_nameptr, foundobj);
1170 #ifdef NAMEI_DIAGNOSTIC
1171 printf("not found\n");
1172 #endif /* NAMEI_DIAGNOSTIC */
1173
1174 /*
1175 * If ENOLCK, the file system needs us to retry the lookup
1176 * with an exclusive lock. It's likely nothing was found in
1177 * cache and/or modifications need to be made.
1178 */
1179 if (error == ENOLCK) {
1180 KASSERT(VOP_ISLOCKED(searchdir) == LK_SHARED);
1181 KASSERT(searchdir_locked);
1182 if (vn_lock(searchdir, LK_UPGRADE | LK_NOWAIT)) {
1183 VOP_UNLOCK(searchdir);
1184 searchdir_locked = false;
1185 }
1186 lktype = LK_EXCLUSIVE;
1187 goto unionlookup;
1188 }
1189
1190 if ((error == ENOENT) &&
1191 (searchdir->v_vflag & VV_ROOT) &&
1192 (searchdir->v_mount->mnt_flag & MNT_UNION)) {
1193 tmpvn = searchdir;
1194 searchdir = searchdir->v_mount->mnt_vnodecovered;
1195 vref(searchdir);
1196 vput(tmpvn);
1197 searchdir_locked = false;
1198 *newsearchdir_ret = searchdir;
1199 goto unionlookup;
1200 }
1201
1202 if (error != EJUSTRETURN)
1203 goto done;
1204
1205 /*
1206 * If this was not the last component, or there were trailing
1207 * slashes, and we are not going to create a directory,
1208 * then the name must exist.
1209 */
1210 if ((cnp->cn_flags & (REQUIREDIR | CREATEDIR)) == REQUIREDIR) {
1211 error = SET_ERROR(ENOENT);
1212 goto done;
1213 }
1214
1215 /*
1216 * If creating and at end of pathname, then can consider
1217 * allowing file to be created.
1218 */
1219 if (state->rdonly) {
1220 error = SET_ERROR(EROFS);
1221 goto done;
1222 }
1223
1224 /*
1225 * We return success and a NULL foundobj to indicate
1226 * that the entry doesn't currently exist, leaving a
1227 * pointer to the (normally, locked) directory vnode
1228 * as searchdir.
1229 */
1230 *foundobj_ret = NULL;
1231 error = 0;
1232 goto done;
1233 }
1234 #ifdef NAMEI_DIAGNOSTIC
1235 printf("found\n");
1236 #endif /* NAMEI_DIAGNOSTIC */
1237
1238 /* Unlock, unless the caller needs the parent locked. */
1239 if (searchdir != NULL) {
1240 KASSERT(searchdir_locked);
1241 if ((cnp->cn_flags & (ISLASTCN | LOCKPARENT)) !=
1242 (ISLASTCN | LOCKPARENT)) {
1243 VOP_UNLOCK(searchdir);
1244 searchdir_locked = false;
1245 }
1246 } else {
1247 KASSERT(!searchdir_locked);
1248 }
1249
1250 *foundobj_ret = foundobj;
1251 error = 0;
1252 done:
1253 *newsearchdir_locked_ret = searchdir_locked;
1254 return error;
1255 }
1256
1257 /*
1258 * Parse out the first path name component that we need to to consider.
1259 *
1260 * While doing this, attempt to use the name cache to fast-forward through
1261 * as many "easy" to find components of the path as possible.
1262 *
1263 * We use the namecache's node locks to form a chain, and avoid as many
1264 * vnode references and locks as possible. In the ideal case, only the
1265 * final vnode will have its reference count adjusted and lock taken.
1266 */
1267 static int
lookup_fastforward(struct namei_state * state,struct vnode ** searchdir_ret,struct vnode ** foundobj_ret)1268 lookup_fastforward(struct namei_state *state, struct vnode **searchdir_ret,
1269 struct vnode **foundobj_ret)
1270 {
1271 struct componentname *cnp = state->cnp;
1272 struct nameidata *ndp = state->ndp;
1273 krwlock_t *plock;
1274 struct vnode *foundobj, *searchdir;
1275 int error, error2;
1276 size_t oldpathlen;
1277 const char *oldnameptr;
1278 bool terminal;
1279
1280 /*
1281 * Eat as many path name components as possible before giving up and
1282 * letting lookup_once() handle it. Remember the starting point in
1283 * case we can't get vnode references and need to roll back.
1284 */
1285 plock = NULL;
1286 searchdir = *searchdir_ret;
1287 oldnameptr = cnp->cn_nameptr;
1288 oldpathlen = ndp->ni_pathlen;
1289 terminal = false;
1290 for (;;) {
1291 foundobj = NULL;
1292
1293 /*
1294 * Get the next component name. There should be no slashes
1295 * here, and we shouldn't have looped around if we were
1296 * done.
1297 */
1298 KASSERT(cnp->cn_nameptr[0] != '/');
1299 KASSERT(cnp->cn_nameptr[0] != '\0');
1300 if ((error = lookup_parsepath(state, searchdir)) != 0) {
1301 break;
1302 }
1303
1304 /*
1305 * Can't deal with DOTDOT lookups if NOCROSSMOUNT or the
1306 * lookup is chrooted.
1307 */
1308 if ((cnp->cn_flags & ISDOTDOT) != 0) {
1309 if ((searchdir->v_vflag & VV_ROOT) != 0 &&
1310 (cnp->cn_flags & NOCROSSMOUNT)) {
1311 error = SET_ERROR(EOPNOTSUPP);
1312 break;
1313 }
1314 if (ndp->ni_rootdir != rootvnode) {
1315 error = SET_ERROR(EOPNOTSUPP);
1316 break;
1317 }
1318 }
1319
1320 /*
1321 * Can't deal with last component when modifying; this needs
1322 * searchdir locked and VOP_LOOKUP() called (which can and
1323 * does modify state, despite the name). NB: this case means
1324 * terminal is never set true when LOCKPARENT.
1325 */
1326 if ((cnp->cn_flags & ISLASTCN) != 0) {
1327 if (cnp->cn_nameiop != LOOKUP ||
1328 (cnp->cn_flags & LOCKPARENT) != 0) {
1329 error = SET_ERROR(EOPNOTSUPP);
1330 break;
1331 }
1332 }
1333
1334 /*
1335 * Good, now look for it in cache. cache_lookup_linked()
1336 * will fail if there's nothing there, or if there's no
1337 * ownership info for the directory, or if the user doesn't
1338 * have permission to look up files in this directory.
1339 */
1340 if (!cache_lookup_linked(searchdir, cnp->cn_nameptr,
1341 cnp->cn_namelen, &foundobj, &plock, cnp->cn_cred)) {
1342 error = SET_ERROR(EOPNOTSUPP);
1343 break;
1344 }
1345 KASSERT(plock != NULL);
1346 KASSERT(rw_lock_held(plock));
1347
1348 /*
1349 * Scored a hit. Negative is good too (ENOENT). If there's
1350 * a '-o union' mount here, punt and let lookup_once() deal
1351 * with it.
1352 */
1353 if (foundobj == NULL) {
1354 if ((searchdir->v_vflag & VV_ROOT) != 0 &&
1355 (searchdir->v_mount->mnt_flag & MNT_UNION) != 0) {
1356 error = SET_ERROR(EOPNOTSUPP);
1357 } else {
1358 error = SET_ERROR(ENOENT);
1359 terminal = ((cnp->cn_flags & ISLASTCN) != 0);
1360 }
1361 break;
1362 }
1363
1364 /*
1365 * Stop and get a hold on the vnode if we've encountered
1366 * something other than a dirctory.
1367 */
1368 if (foundobj->v_type != VDIR) {
1369 error = vcache_tryvget(foundobj);
1370 if (error != 0) {
1371 foundobj = NULL;
1372 error = SET_ERROR(EOPNOTSUPP);
1373 } else {
1374 terminal = (foundobj->v_type != VLNK &&
1375 (cnp->cn_flags & ISLASTCN) != 0);
1376 }
1377 break;
1378 }
1379
1380 /*
1381 * Try to cross mountpoints, bearing in mind that they can
1382 * be stacked. If at any point we can't go further, stop
1383 * and try to get a reference on the vnode. If we are able
1384 * to get a ref then lookup_crossmount() will take care of
1385 * it, otherwise we'll fall through to lookup_once().
1386 */
1387 if (foundobj->v_mountedhere != NULL) {
1388 while (foundobj->v_mountedhere != NULL &&
1389 (cnp->cn_flags & NOCROSSMOUNT) == 0 &&
1390 cache_cross_mount(&foundobj, &plock)) {
1391 KASSERT(foundobj != NULL);
1392 KASSERT(foundobj->v_type == VDIR);
1393 }
1394 if (foundobj->v_mountedhere != NULL) {
1395 error = vcache_tryvget(foundobj);
1396 if (error != 0) {
1397 foundobj = NULL;
1398 error = SET_ERROR(EOPNOTSUPP);
1399 }
1400 break;
1401 } else {
1402 searchdir = NULL;
1403 }
1404 }
1405
1406 /*
1407 * Time to stop if we found the last component & traversed
1408 * all mounts.
1409 */
1410 if ((cnp->cn_flags & ISLASTCN) != 0) {
1411 error = vcache_tryvget(foundobj);
1412 if (error != 0) {
1413 foundobj = NULL;
1414 error = SET_ERROR(EOPNOTSUPP);
1415 } else {
1416 terminal = (foundobj->v_type != VLNK);
1417 }
1418 break;
1419 }
1420
1421 /*
1422 * Otherwise, we're still in business. Set the found VDIR
1423 * vnode as the search dir for the next component and
1424 * continue on to it.
1425 */
1426 cnp->cn_nameptr = ndp->ni_next;
1427 searchdir = foundobj;
1428 }
1429
1430 if (terminal) {
1431 /*
1432 * If we exited the loop above having successfully located
1433 * the last component with a zero error code, and it's not a
1434 * symbolic link, then the parent directory is not needed.
1435 * Release reference to the starting parent and make the
1436 * terminal parent disappear into thin air.
1437 */
1438 KASSERT(plock != NULL);
1439 rw_exit(plock);
1440 vrele(*searchdir_ret);
1441 *searchdir_ret = NULL;
1442 } else if (searchdir != *searchdir_ret) {
1443 /*
1444 * Otherwise we need to return the parent. If we ended up
1445 * with a new search dir, ref it before dropping the
1446 * namecache's lock. The lock prevents both searchdir and
1447 * foundobj from disappearing. If we can't ref the new
1448 * searchdir, we have a bit of a problem. Roll back the
1449 * fastforward to the beginning and let lookup_once() take
1450 * care of it.
1451 */
1452 if (searchdir == NULL) {
1453 /*
1454 * It's possible for searchdir to be NULL in the
1455 * case of a root vnode being reclaimed while
1456 * trying to cross a mount.
1457 */
1458 error2 = SET_ERROR(EOPNOTSUPP);
1459 } else {
1460 error2 = vcache_tryvget(searchdir);
1461 }
1462 KASSERT(plock != NULL);
1463 rw_exit(plock);
1464 if (__predict_true(error2 == 0)) {
1465 /* Returning new searchdir, and maybe new foundobj. */
1466 vrele(*searchdir_ret);
1467 *searchdir_ret = searchdir;
1468 } else {
1469 /* Returning nothing. */
1470 if (foundobj != NULL) {
1471 vrele(foundobj);
1472 foundobj = NULL;
1473 }
1474 cnp->cn_nameptr = oldnameptr;
1475 ndp->ni_pathlen = oldpathlen;
1476 error = lookup_parsepath(state, *searchdir_ret);
1477 if (error == 0) {
1478 error = SET_ERROR(EOPNOTSUPP);
1479 }
1480 }
1481 } else if (plock != NULL) {
1482 /* Drop any namecache lock still held. */
1483 rw_exit(plock);
1484 }
1485
1486 KASSERT(error == 0 ? foundobj != NULL : foundobj == NULL);
1487 *foundobj_ret = foundobj;
1488 return error;
1489 }
1490
1491 //////////////////////////////
1492
1493 /*
1494 * Do a complete path search from a single root directory.
1495 * (This is called up to twice if TRYEMULROOT is in effect.)
1496 */
1497 static int
namei_oneroot(struct namei_state * state,int neverfollow,int inhibitmagic,int isnfsd)1498 namei_oneroot(struct namei_state *state,
1499 int neverfollow, int inhibitmagic, int isnfsd)
1500 {
1501 struct nameidata *ndp = state->ndp;
1502 struct componentname *cnp = state->cnp;
1503 struct vnode *searchdir, *foundobj;
1504 bool searchdir_locked = false;
1505 int error;
1506
1507 error = namei_start(state, isnfsd, &searchdir);
1508 if (error) {
1509 ndp->ni_dvp = NULL;
1510 ndp->ni_vp = NULL;
1511 return error;
1512 }
1513 KASSERT(searchdir->v_type == VDIR);
1514
1515 /*
1516 * Setup: break out flag bits into variables.
1517 */
1518 state->docache = (cnp->cn_flags & NOCACHE) ^ NOCACHE;
1519 if (cnp->cn_nameiop == DELETE)
1520 state->docache = 0;
1521 state->rdonly = cnp->cn_flags & RDONLY;
1522
1523 /*
1524 * Keep going until we run out of path components.
1525 */
1526 cnp->cn_nameptr = ndp->ni_pnbuf;
1527
1528 /* drop leading slashes (already used them to choose startdir) */
1529 while (cnp->cn_nameptr[0] == '/') {
1530 cnp->cn_nameptr++;
1531 ndp->ni_pathlen--;
1532 }
1533 /* was it just "/"? */
1534 if (cnp->cn_nameptr[0] == '\0') {
1535 foundobj = searchdir;
1536 searchdir = NULL;
1537 cnp->cn_flags |= ISLASTCN;
1538
1539 /* bleh */
1540 goto skiploop;
1541 }
1542
1543 for (;;) {
1544 KASSERT(searchdir != NULL);
1545 KASSERT(!searchdir_locked);
1546
1547 /*
1548 * Parse out the first path name component that we need to
1549 * to consider. While doing this, attempt to use the name
1550 * cache to fast-forward through as many "easy" to find
1551 * components of the path as possible.
1552 */
1553 error = lookup_fastforward(state, &searchdir, &foundobj);
1554
1555 /*
1556 * If we didn't get a good answer from the namecache, then
1557 * go directly to the file system.
1558 */
1559 if (error == EOPNOTSUPP) {
1560 error = lookup_once(state, searchdir, &searchdir,
1561 &foundobj, &searchdir_locked);
1562 }
1563
1564 /*
1565 * If the vnode we found is mounted on, then cross the mount
1566 * and get the root vnode in foundobj. If this encounters
1567 * an error, it will dispose of foundobj, but searchdir is
1568 * untouched.
1569 */
1570 if (error == 0 && foundobj != NULL &&
1571 foundobj->v_type == VDIR &&
1572 foundobj->v_mountedhere != NULL &&
1573 (cnp->cn_flags & NOCROSSMOUNT) == 0) {
1574 error = lookup_crossmount(state, &searchdir,
1575 &foundobj, &searchdir_locked);
1576 }
1577
1578 if (error) {
1579 if (searchdir != NULL) {
1580 if (searchdir_locked) {
1581 searchdir_locked = false;
1582 vput(searchdir);
1583 } else {
1584 vrele(searchdir);
1585 }
1586 }
1587 ndp->ni_dvp = NULL;
1588 ndp->ni_vp = NULL;
1589 /*
1590 * Note that if we're doing TRYEMULROOT we can
1591 * retry with the normal root. Where this is
1592 * currently set matches previous practice,
1593 * but the previous practice didn't make much
1594 * sense and somebody should sit down and
1595 * figure out which cases should cause retry
1596 * and which shouldn't. XXX.
1597 */
1598 state->attempt_retry = 1;
1599 return error;
1600 }
1601
1602 if (foundobj == NULL) {
1603 /*
1604 * Success with no object returned means we're
1605 * creating something and it isn't already
1606 * there. Break out of the main loop now so
1607 * the code below doesn't have to test for
1608 * foundobj == NULL.
1609 */
1610 /* lookup_once can't have dropped the searchdir */
1611 KASSERT(searchdir != NULL ||
1612 (cnp->cn_flags & ISLASTCN) != 0);
1613 break;
1614 }
1615
1616 /*
1617 * Check for symbolic link. If we've reached one,
1618 * follow it, unless we aren't supposed to. Back up
1619 * over any slashes that we skipped, as we will need
1620 * them again.
1621 */
1622 if (namei_atsymlink(state, foundobj)) {
1623 /* Don't need searchdir locked any more. */
1624 if (searchdir_locked) {
1625 searchdir_locked = false;
1626 VOP_UNLOCK(searchdir);
1627 }
1628 ndp->ni_pathlen += state->slashes;
1629 ndp->ni_next -= state->slashes;
1630 if (neverfollow) {
1631 error = SET_ERROR(EINVAL);
1632 } else if (searchdir == NULL) {
1633 /*
1634 * dholland 20160410: lookup_once only
1635 * drops searchdir if it crossed a
1636 * mount point. Therefore, if we get
1637 * here it means we crossed a mount
1638 * point to a mounted filesystem whose
1639 * root vnode is a symlink. In theory
1640 * we could continue at this point by
1641 * using the pre-crossing searchdir
1642 * (e.g. just take out an extra
1643 * reference on it before calling
1644 * lookup_once so we still have it),
1645 * but this will make an ugly mess and
1646 * it should never happen in practice
1647 * as only badly broken filesystems
1648 * have non-directory root vnodes. (I
1649 * have seen this sort of thing with
1650 * NFS occasionally but even then it
1651 * means something's badly wrong.)
1652 */
1653 error = SET_ERROR(ENOTDIR);
1654 } else {
1655 /*
1656 * dholland 20110410: if we're at a
1657 * union mount it might make sense to
1658 * use the top of the union stack here
1659 * rather than the layer we found the
1660 * symlink in. (FUTURE)
1661 */
1662 error = namei_follow(state, inhibitmagic,
1663 searchdir, foundobj,
1664 &searchdir);
1665 }
1666 if (error) {
1667 KASSERT(searchdir != foundobj);
1668 if (searchdir != NULL) {
1669 vrele(searchdir);
1670 }
1671 vrele(foundobj);
1672 ndp->ni_dvp = NULL;
1673 ndp->ni_vp = NULL;
1674 return error;
1675 }
1676 vrele(foundobj);
1677 foundobj = NULL;
1678
1679 /*
1680 * If we followed a symlink to `/' and there
1681 * are no more components after the symlink,
1682 * we're done with the loop and what we found
1683 * is the searchdir.
1684 */
1685 if (cnp->cn_nameptr[0] == '\0') {
1686 KASSERT(searchdir != NULL);
1687 foundobj = searchdir;
1688 searchdir = NULL;
1689 cnp->cn_flags |= ISLASTCN;
1690 break;
1691 }
1692
1693 continue;
1694 }
1695
1696 /*
1697 * Not a symbolic link.
1698 *
1699 * Check for directory, if the component was
1700 * followed by a series of slashes.
1701 */
1702 if ((foundobj->v_type != VDIR) &&
1703 (cnp->cn_flags & REQUIREDIR)) {
1704 KASSERT(foundobj != searchdir);
1705 if (searchdir) {
1706 if (searchdir_locked) {
1707 searchdir_locked = false;
1708 vput(searchdir);
1709 } else {
1710 vrele(searchdir);
1711 }
1712 } else {
1713 KASSERT(!searchdir_locked);
1714 }
1715 vrele(foundobj);
1716 ndp->ni_dvp = NULL;
1717 ndp->ni_vp = NULL;
1718 state->attempt_retry = 1;
1719 return SET_ERROR(ENOTDIR);
1720 }
1721
1722 /*
1723 * Stop if we've reached the last component.
1724 */
1725 if (cnp->cn_flags & ISLASTCN) {
1726 break;
1727 }
1728
1729 /*
1730 * Continue with the next component.
1731 */
1732 cnp->cn_nameptr = ndp->ni_next;
1733 if (searchdir != NULL) {
1734 if (searchdir_locked) {
1735 searchdir_locked = false;
1736 vput(searchdir);
1737 } else {
1738 vrele(searchdir);
1739 }
1740 }
1741 searchdir = foundobj;
1742 foundobj = NULL;
1743 }
1744
1745 KASSERT((cnp->cn_flags & LOCKPARENT) == 0 || searchdir == NULL ||
1746 VOP_ISLOCKED(searchdir) == LK_EXCLUSIVE);
1747
1748 skiploop:
1749 if (foundobj != NULL) {
1750 if (foundobj == ndp->ni_erootdir) {
1751 /*
1752 * We are about to return the emulation root.
1753 * This isn't a good idea because code might
1754 * repeatedly lookup ".." until the file
1755 * matches that returned for "/" and loop
1756 * forever. So convert it to the real root.
1757 */
1758 if (searchdir != NULL) {
1759 if (searchdir_locked) {
1760 vput(searchdir);
1761 searchdir_locked = false;
1762 } else {
1763 vrele(searchdir);
1764 }
1765 searchdir = NULL;
1766 }
1767 vrele(foundobj);
1768 foundobj = ndp->ni_rootdir;
1769 vref(foundobj);
1770 }
1771
1772 /*
1773 * If the caller requested the parent node (i.e. it's
1774 * a CREATE, DELETE, or RENAME), and we don't have one
1775 * (because this is the root directory, or we crossed
1776 * a mount point), then we must fail.
1777 *
1778 * 20210604 dholland when NONEXCLHACK is set (open
1779 * with O_CREAT but not O_EXCL) skip this logic. Since
1780 * we have a foundobj, open will not be creating, so
1781 * it doesn't actually need or use the searchdir, so
1782 * it's ok to return it even if it's on a different
1783 * volume, and it's also ok to return NULL; by setting
1784 * NONEXCLHACK the open code promises to cope with
1785 * those cases correctly. (That is, it should do what
1786 * it would do anyway, that is, just release the
1787 * searchdir, except not crash if it's null.) This is
1788 * needed because otherwise opening mountpoints with
1789 * O_CREAT but not O_EXCL fails... which is a silly
1790 * thing to do but ought to work. (This whole issue
1791 * came to light because 3rd party code wanted to open
1792 * certain procfs nodes with O_CREAT for some 3rd
1793 * party reason, and it failed.)
1794 *
1795 * Note that NONEXCLHACK is properly a different
1796 * nameiop (it is partway between LOOKUP and CREATE)
1797 * but it was stuffed in as a flag instead to make the
1798 * resulting patch less invasive for pullup. Blah.
1799 */
1800 if (cnp->cn_nameiop != LOOKUP &&
1801 (searchdir == NULL ||
1802 searchdir->v_mount != foundobj->v_mount) &&
1803 (cnp->cn_flags & NONEXCLHACK) == 0) {
1804 if (searchdir) {
1805 if (searchdir_locked) {
1806 vput(searchdir);
1807 searchdir_locked = false;
1808 } else {
1809 vrele(searchdir);
1810 }
1811 searchdir = NULL;
1812 }
1813 vrele(foundobj);
1814 foundobj = NULL;
1815 ndp->ni_dvp = NULL;
1816 ndp->ni_vp = NULL;
1817 state->attempt_retry = 1;
1818
1819 switch (cnp->cn_nameiop) {
1820 case CREATE:
1821 return SET_ERROR(EEXIST);
1822 case DELETE:
1823 case RENAME:
1824 return SET_ERROR(EBUSY);
1825 default:
1826 break;
1827 }
1828 panic("Invalid nameiop\n");
1829 }
1830
1831 /*
1832 * Disallow directory write attempts on read-only lookups.
1833 * Prefers EEXIST over EROFS for the CREATE case.
1834 */
1835 if (state->rdonly &&
1836 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) {
1837 if (searchdir) {
1838 if (searchdir_locked) {
1839 vput(searchdir);
1840 searchdir_locked = false;
1841 } else {
1842 vrele(searchdir);
1843 }
1844 searchdir = NULL;
1845 }
1846 vrele(foundobj);
1847 foundobj = NULL;
1848 ndp->ni_dvp = NULL;
1849 ndp->ni_vp = NULL;
1850 state->attempt_retry = 1;
1851 return SET_ERROR(EROFS);
1852 }
1853
1854 /* Lock the leaf node if requested. */
1855 if ((cnp->cn_flags & (LOCKLEAF | LOCKPARENT)) == LOCKPARENT &&
1856 searchdir == foundobj) {
1857 /*
1858 * Note: if LOCKPARENT but not LOCKLEAF is
1859 * set, and searchdir == foundobj, this code
1860 * necessarily unlocks the parent as well as
1861 * the leaf. That is, just because you specify
1862 * LOCKPARENT doesn't mean you necessarily get
1863 * a locked parent vnode. The code in
1864 * vfs_syscalls.c, and possibly elsewhere,
1865 * that uses this combination "knows" this, so
1866 * it can't be safely changed. Feh. XXX
1867 */
1868 KASSERT(searchdir_locked);
1869 VOP_UNLOCK(searchdir);
1870 searchdir_locked = false;
1871 } else if ((cnp->cn_flags & LOCKLEAF) != 0 &&
1872 (searchdir != foundobj ||
1873 (cnp->cn_flags & LOCKPARENT) == 0)) {
1874 const int lktype = (cnp->cn_flags & LOCKSHARED) != 0 ?
1875 LK_SHARED : LK_EXCLUSIVE;
1876 vn_lock(foundobj, lktype | LK_RETRY);
1877 }
1878 }
1879
1880 /*
1881 * Done.
1882 */
1883
1884 /*
1885 * If LOCKPARENT is not set, the parent directory isn't returned.
1886 */
1887 if ((cnp->cn_flags & LOCKPARENT) == 0 && searchdir != NULL) {
1888 vrele(searchdir);
1889 searchdir = NULL;
1890 }
1891
1892 ndp->ni_dvp = searchdir;
1893 ndp->ni_vp = foundobj;
1894 return 0;
1895 }
1896
1897 /*
1898 * Do namei; wrapper layer that handles TRYEMULROOT.
1899 */
1900 static int
namei_tryemulroot(struct namei_state * state,int neverfollow,int inhibitmagic,int isnfsd)1901 namei_tryemulroot(struct namei_state *state,
1902 int neverfollow, int inhibitmagic, int isnfsd)
1903 {
1904 int error;
1905
1906 struct nameidata *ndp = state->ndp;
1907 struct componentname *cnp = state->cnp;
1908 const char *savepath = NULL;
1909
1910 KASSERT(cnp == &ndp->ni_cnd);
1911
1912 if (cnp->cn_flags & TRYEMULROOT) {
1913 savepath = pathbuf_stringcopy_get(ndp->ni_pathbuf);
1914 }
1915
1916 emul_retry:
1917 state->attempt_retry = 0;
1918
1919 error = namei_oneroot(state, neverfollow, inhibitmagic, isnfsd);
1920 if (error) {
1921 /*
1922 * Once namei has started up, the existence of ni_erootdir
1923 * tells us whether we're working from an emulation root.
1924 * The TRYEMULROOT flag isn't necessarily authoritative.
1925 */
1926 if (ndp->ni_erootdir != NULL && state->attempt_retry) {
1927 /* Retry the whole thing using the normal root */
1928 cnp->cn_flags &= ~TRYEMULROOT;
1929 state->attempt_retry = 0;
1930
1931 /* kinda gross */
1932 strcpy(ndp->ni_pathbuf->pb_path, savepath);
1933 pathbuf_stringcopy_put(ndp->ni_pathbuf, savepath);
1934 savepath = NULL;
1935
1936 goto emul_retry;
1937 }
1938 }
1939 if (savepath != NULL) {
1940 pathbuf_stringcopy_put(ndp->ni_pathbuf, savepath);
1941 }
1942 return error;
1943 }
1944
1945 /*
1946 * External interface.
1947 */
1948 int
namei(struct nameidata * ndp)1949 namei(struct nameidata *ndp)
1950 {
1951 struct namei_state state;
1952 int error;
1953
1954 namei_init(&state, ndp);
1955 error = namei_tryemulroot(&state,
1956 0/*!neverfollow*/, 0/*!inhibitmagic*/, 0/*isnfsd*/);
1957 namei_cleanup(&state);
1958
1959 if (error) {
1960 /* make sure no stray refs leak out */
1961 KASSERT(ndp->ni_dvp == NULL);
1962 KASSERT(ndp->ni_vp == NULL);
1963 }
1964
1965 return error;
1966 }
1967
1968 ////////////////////////////////////////////////////////////
1969
1970 /*
1971 * External interface used by nfsd. This is basically different from
1972 * namei only in that it has the ability to pass in the "current
1973 * directory", and uses an extra flag "neverfollow" for which there's
1974 * no physical flag defined in namei.h. (There used to be a cut&paste
1975 * copy of about half of namei in nfsd to allow these minor
1976 * adjustments to exist.)
1977 *
1978 * XXX: the namei interface should be adjusted so nfsd can just use
1979 * ordinary namei().
1980 */
1981 int
lookup_for_nfsd(struct nameidata * ndp,struct vnode * forcecwd,int neverfollow)1982 lookup_for_nfsd(struct nameidata *ndp, struct vnode *forcecwd, int neverfollow)
1983 {
1984 struct namei_state state;
1985 int error;
1986
1987 KASSERT(ndp->ni_atdir == NULL);
1988 ndp->ni_atdir = forcecwd;
1989
1990 namei_init(&state, ndp);
1991 error = namei_tryemulroot(&state,
1992 neverfollow, 1/*inhibitmagic*/, 1/*isnfsd*/);
1993 namei_cleanup(&state);
1994
1995 if (error) {
1996 /* make sure no stray refs leak out */
1997 KASSERT(ndp->ni_dvp == NULL);
1998 KASSERT(ndp->ni_vp == NULL);
1999 }
2000
2001 return error;
2002 }
2003
2004 /*
2005 * A second external interface used by nfsd. This turns out to be a
2006 * single lookup used by the WebNFS code (ha!) to get "index.html" or
2007 * equivalent when asked for a directory. It should eventually evolve
2008 * into some kind of namei_once() call; for the time being it's kind
2009 * of a mess. XXX.
2010 *
2011 * dholland 20110109: I don't think it works, and I don't think it
2012 * worked before I started hacking and slashing either, and I doubt
2013 * anyone will ever notice.
2014 */
2015
2016 /*
2017 * Internals. This calls lookup_once() after setting up the assorted
2018 * pieces of state the way they ought to be.
2019 */
2020 static int
do_lookup_for_nfsd_index(struct namei_state * state)2021 do_lookup_for_nfsd_index(struct namei_state *state)
2022 {
2023 int error;
2024
2025 struct componentname *cnp = state->cnp;
2026 struct nameidata *ndp = state->ndp;
2027 struct vnode *startdir;
2028 struct vnode *foundobj;
2029 bool startdir_locked;
2030 const char *cp; /* pointer into pathname argument */
2031
2032 KASSERT(cnp == &ndp->ni_cnd);
2033
2034 startdir = state->ndp->ni_atdir;
2035
2036 cnp->cn_nameptr = ndp->ni_pnbuf;
2037 state->docache = 1;
2038 state->rdonly = cnp->cn_flags & RDONLY;
2039 ndp->ni_dvp = NULL;
2040
2041 error = VOP_PARSEPATH(startdir, cnp->cn_nameptr, &cnp->cn_namelen);
2042 if (error) {
2043 return error;
2044 }
2045
2046 cp = cnp->cn_nameptr + cnp->cn_namelen;
2047 KASSERT(cnp->cn_namelen <= KERNEL_NAME_MAX);
2048 ndp->ni_pathlen -= cnp->cn_namelen;
2049 ndp->ni_next = cp;
2050 state->slashes = 0;
2051 cnp->cn_flags &= ~REQUIREDIR;
2052 cnp->cn_flags |= MAKEENTRY|ISLASTCN;
2053
2054 if (cnp->cn_namelen == 2 &&
2055 cnp->cn_nameptr[1] == '.' && cnp->cn_nameptr[0] == '.')
2056 cnp->cn_flags |= ISDOTDOT;
2057 else
2058 cnp->cn_flags &= ~ISDOTDOT;
2059
2060 /*
2061 * Because lookup_once can change the startdir, we need our
2062 * own reference to it to avoid consuming the caller's.
2063 */
2064 vref(startdir);
2065 error = lookup_once(state, startdir, &startdir, &foundobj,
2066 &startdir_locked);
2067
2068 KASSERT((cnp->cn_flags & LOCKPARENT) == 0);
2069 if (startdir_locked) {
2070 VOP_UNLOCK(startdir);
2071 startdir_locked = false;
2072 }
2073
2074 /*
2075 * If the vnode we found is mounted on, then cross the mount and get
2076 * the root vnode in foundobj. If this encounters an error, it will
2077 * dispose of foundobj, but searchdir is untouched.
2078 */
2079 if (error == 0 && foundobj != NULL &&
2080 foundobj->v_type == VDIR &&
2081 foundobj->v_mountedhere != NULL &&
2082 (cnp->cn_flags & NOCROSSMOUNT) == 0) {
2083 error = lookup_crossmount(state, &startdir, &foundobj,
2084 &startdir_locked);
2085 }
2086
2087 /* Now toss startdir and see if we have an error. */
2088 if (startdir != NULL)
2089 vrele(startdir);
2090 if (error)
2091 foundobj = NULL;
2092 else if (foundobj != NULL && (cnp->cn_flags & LOCKLEAF) != 0)
2093 vn_lock(foundobj, LK_EXCLUSIVE | LK_RETRY);
2094
2095 ndp->ni_vp = foundobj;
2096 return error;
2097 }
2098
2099 /*
2100 * External interface. The partitioning between this function and the
2101 * above isn't very clear - the above function exists mostly so code
2102 * that uses "state->" can be shuffled around without having to change
2103 * it to "state.".
2104 */
2105 int
lookup_for_nfsd_index(struct nameidata * ndp,struct vnode * startdir)2106 lookup_for_nfsd_index(struct nameidata *ndp, struct vnode *startdir)
2107 {
2108 struct namei_state state;
2109 int error;
2110
2111 KASSERT(ndp->ni_atdir == NULL);
2112 ndp->ni_atdir = startdir;
2113
2114 /*
2115 * Note: the name sent in here (is not|should not be) allowed
2116 * to contain a slash.
2117 */
2118 if (strlen(ndp->ni_pathbuf->pb_path) > KERNEL_NAME_MAX) {
2119 return SET_ERROR(ENAMETOOLONG);
2120 }
2121 if (strchr(ndp->ni_pathbuf->pb_path, '/')) {
2122 return SET_ERROR(EINVAL);
2123 }
2124
2125 ndp->ni_pathlen = strlen(ndp->ni_pathbuf->pb_path) + 1;
2126 ndp->ni_pnbuf = NULL;
2127 ndp->ni_cnd.cn_nameptr = NULL;
2128
2129 namei_init(&state, ndp);
2130 error = do_lookup_for_nfsd_index(&state);
2131 namei_cleanup(&state);
2132
2133 return error;
2134 }
2135
2136 ////////////////////////////////////////////////////////////
2137
2138 /*
2139 * Reacquire a path name component.
2140 * dvp is locked on entry and exit.
2141 * *vpp is locked on exit unless it's NULL.
2142 */
2143 int
relookup(struct vnode * dvp,struct vnode ** vpp,struct componentname * cnp,int dummy)2144 relookup(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp,
2145 int dummy)
2146 {
2147 int rdonly; /* lookup read-only flag bit */
2148 int error = 0;
2149 #ifdef DEBUG
2150 size_t newlen; /* DEBUG: check name len */
2151 const char *cp; /* DEBUG: check name ptr */
2152 #endif /* DEBUG */
2153
2154 (void)dummy;
2155
2156 /*
2157 * Setup: break out flag bits into variables.
2158 */
2159 rdonly = cnp->cn_flags & RDONLY;
2160
2161 /*
2162 * Search a new directory.
2163 *
2164 * The cn_hash value is for use by vfs_cache.
2165 * The last component of the filename is left accessible via
2166 * cnp->cn_nameptr for callers that need the name. Callers needing
2167 * the name set the SAVENAME flag. When done, they assume
2168 * responsibility for freeing the pathname buffer.
2169 */
2170 #ifdef DEBUG
2171 #if 0
2172 cp = NULL;
2173 newhash = namei_hash(cnp->cn_nameptr, &cp);
2174 if ((uint32_t)newhash != (uint32_t)cnp->cn_hash)
2175 panic("relookup: bad hash");
2176 #endif
2177 error = VOP_PARSEPATH(dvp, cnp->cn_nameptr, &newlen);
2178 if (error) {
2179 panic("relookup: parsepath failed with error %d", error);
2180 }
2181 if (cnp->cn_namelen != newlen)
2182 panic("relookup: bad len");
2183 cp = cnp->cn_nameptr + cnp->cn_namelen;
2184 while (*cp == '/')
2185 cp++;
2186 if (*cp != 0)
2187 panic("relookup: not last component");
2188 #endif /* DEBUG */
2189
2190 /*
2191 * Check for degenerate name (e.g. / or "")
2192 * which is a way of talking about a directory,
2193 * e.g. like "/." or ".".
2194 */
2195 if (cnp->cn_nameptr[0] == '\0')
2196 panic("relookup: null name");
2197
2198 if (cnp->cn_flags & ISDOTDOT)
2199 panic("relookup: lookup on dot-dot");
2200
2201 /*
2202 * We now have a segment name to search for, and a directory to search.
2203 */
2204 *vpp = NULL;
2205 error = VOP_LOOKUP(dvp, vpp, cnp);
2206 if ((error) != 0) {
2207 KASSERTMSG((*vpp == NULL),
2208 "leaf `%s' should be empty but is %p",
2209 cnp->cn_nameptr, *vpp);
2210 if (error != EJUSTRETURN)
2211 goto bad;
2212 }
2213
2214 /*
2215 * Check for symbolic link
2216 */
2217 KASSERTMSG((*vpp == NULL || (*vpp)->v_type != VLNK ||
2218 (cnp->cn_flags & FOLLOW) == 0),
2219 "relookup: symlink found");
2220
2221 /*
2222 * Check for read-only lookups.
2223 */
2224 if (rdonly && cnp->cn_nameiop != LOOKUP) {
2225 error = SET_ERROR(EROFS);
2226 if (*vpp) {
2227 vrele(*vpp);
2228 }
2229 goto bad;
2230 }
2231 /*
2232 * Lock result.
2233 */
2234 if (*vpp && *vpp != dvp) {
2235 error = vn_lock(*vpp, LK_EXCLUSIVE);
2236 if (error != 0) {
2237 vrele(*vpp);
2238 goto bad;
2239 }
2240 }
2241 return 0;
2242
2243 bad:
2244 *vpp = NULL;
2245 return error;
2246 }
2247
2248 /*
2249 * namei_simple - simple forms of namei.
2250 *
2251 * These are wrappers to allow the simple case callers of namei to be
2252 * left alone while everything else changes under them.
2253 */
2254
2255 /* Flags */
2256 struct namei_simple_flags_type {
2257 int dummy;
2258 };
2259 static const struct namei_simple_flags_type ns_nn, ns_nt, ns_fn, ns_ft;
2260 const namei_simple_flags_t NSM_NOFOLLOW_NOEMULROOT = &ns_nn;
2261 const namei_simple_flags_t NSM_NOFOLLOW_TRYEMULROOT = &ns_nt;
2262 const namei_simple_flags_t NSM_FOLLOW_NOEMULROOT = &ns_fn;
2263 const namei_simple_flags_t NSM_FOLLOW_TRYEMULROOT = &ns_ft;
2264
2265 static int
namei_simple_convert_flags(namei_simple_flags_t sflags)2266 namei_simple_convert_flags(namei_simple_flags_t sflags)
2267 {
2268
2269 if (sflags == NSM_NOFOLLOW_NOEMULROOT)
2270 return NOFOLLOW | 0;
2271 if (sflags == NSM_NOFOLLOW_TRYEMULROOT)
2272 return NOFOLLOW | TRYEMULROOT;
2273 if (sflags == NSM_FOLLOW_NOEMULROOT)
2274 return FOLLOW | 0;
2275 if (sflags == NSM_FOLLOW_TRYEMULROOT)
2276 return FOLLOW | TRYEMULROOT;
2277 panic("namei_simple_convert_flags: bogus sflags\n");
2278 return 0;
2279 }
2280
2281 int
namei_simple_kernel(const char * path,namei_simple_flags_t sflags,struct vnode ** vp_ret)2282 namei_simple_kernel(const char *path, namei_simple_flags_t sflags,
2283 struct vnode **vp_ret)
2284 {
2285
2286 return nameiat_simple_kernel(NULL, path, sflags, vp_ret);
2287 }
2288
2289 int
nameiat_simple(struct vnode * dvp,struct pathbuf * pb,namei_simple_flags_t sflags,struct vnode ** vp_ret)2290 nameiat_simple(struct vnode *dvp, struct pathbuf *pb,
2291 namei_simple_flags_t sflags, struct vnode **vp_ret)
2292 {
2293 struct nameidata nd;
2294 int error;
2295
2296 NDINIT(&nd, LOOKUP, namei_simple_convert_flags(sflags), pb);
2297
2298 if (dvp != NULL)
2299 NDAT(&nd, dvp);
2300
2301 error = namei(&nd);
2302 if (error != 0)
2303 return error;
2304
2305 *vp_ret = nd.ni_vp;
2306 return 0;
2307 }
2308
2309 int
nameiat_simple_kernel(struct vnode * dvp,const char * path,namei_simple_flags_t sflags,struct vnode ** vp_ret)2310 nameiat_simple_kernel(struct vnode *dvp, const char *path,
2311 namei_simple_flags_t sflags, struct vnode **vp_ret)
2312 {
2313 struct pathbuf *pb;
2314 int error;
2315
2316 pb = pathbuf_create(path);
2317 if (pb == NULL)
2318 return SET_ERROR(ENOMEM);
2319
2320 error = nameiat_simple(dvp, pb, sflags, vp_ret);
2321
2322 pathbuf_destroy(pb);
2323 return error;
2324 }
2325
2326 int
namei_simple_user(const char * path,namei_simple_flags_t sflags,struct vnode ** vp_ret)2327 namei_simple_user(const char *path, namei_simple_flags_t sflags,
2328 struct vnode **vp_ret)
2329 {
2330
2331 return nameiat_simple_user(NULL, path, sflags, vp_ret);
2332 }
2333
2334 int
nameiat_simple_user(struct vnode * dvp,const char * path,namei_simple_flags_t sflags,struct vnode ** vp_ret)2335 nameiat_simple_user(struct vnode *dvp, const char *path,
2336 namei_simple_flags_t sflags, struct vnode **vp_ret)
2337 {
2338 struct pathbuf *pb;
2339 int error;
2340
2341 error = pathbuf_copyin(path, &pb);
2342 if (error)
2343 return error;
2344
2345 error = nameiat_simple(dvp, pb, sflags, vp_ret);
2346
2347 pathbuf_destroy(pb);
2348 return error;
2349 }
2350