ovl: remove privs in ovl_fallocate()
[platform/kernel/linux-starfive.git] / fs / overlayfs / file.c
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (C) 2017 Red Hat, Inc.
4  */
5
6 #include <linux/cred.h>
7 #include <linux/file.h>
8 #include <linux/mount.h>
9 #include <linux/xattr.h>
10 #include <linux/uio.h>
11 #include <linux/uaccess.h>
12 #include <linux/splice.h>
13 #include <linux/security.h>
14 #include <linux/mm.h>
15 #include <linux/fs.h>
16 #include "overlayfs.h"
17
18 struct ovl_aio_req {
19         struct kiocb iocb;
20         refcount_t ref;
21         struct kiocb *orig_iocb;
22         struct fd fd;
23 };
24
25 static struct kmem_cache *ovl_aio_request_cachep;
26
27 static char ovl_whatisit(struct inode *inode, struct inode *realinode)
28 {
29         if (realinode != ovl_inode_upper(inode))
30                 return 'l';
31         if (ovl_has_upperdata(inode))
32                 return 'u';
33         else
34                 return 'm';
35 }
36
37 /* No atime modificaton nor notify on underlying */
38 #define OVL_OPEN_FLAGS (O_NOATIME | FMODE_NONOTIFY)
39
40 static struct file *ovl_open_realfile(const struct file *file,
41                                       const struct path *realpath)
42 {
43         struct inode *realinode = d_inode(realpath->dentry);
44         struct inode *inode = file_inode(file);
45         struct user_namespace *real_mnt_userns;
46         struct file *realfile;
47         const struct cred *old_cred;
48         int flags = file->f_flags | OVL_OPEN_FLAGS;
49         int acc_mode = ACC_MODE(flags);
50         int err;
51
52         if (flags & O_APPEND)
53                 acc_mode |= MAY_APPEND;
54
55         old_cred = ovl_override_creds(inode->i_sb);
56         real_mnt_userns = mnt_user_ns(realpath->mnt);
57         err = inode_permission(real_mnt_userns, realinode, MAY_OPEN | acc_mode);
58         if (err) {
59                 realfile = ERR_PTR(err);
60         } else {
61                 if (!inode_owner_or_capable(real_mnt_userns, realinode))
62                         flags &= ~O_NOATIME;
63
64                 realfile = open_with_fake_path(&file->f_path, flags, realinode,
65                                                current_cred());
66         }
67         revert_creds(old_cred);
68
69         pr_debug("open(%p[%pD2/%c], 0%o) -> (%p, 0%o)\n",
70                  file, file, ovl_whatisit(inode, realinode), file->f_flags,
71                  realfile, IS_ERR(realfile) ? 0 : realfile->f_flags);
72
73         return realfile;
74 }
75
76 #define OVL_SETFL_MASK (O_APPEND | O_NONBLOCK | O_NDELAY | O_DIRECT)
77
78 static int ovl_change_flags(struct file *file, unsigned int flags)
79 {
80         struct inode *inode = file_inode(file);
81         int err;
82
83         flags &= OVL_SETFL_MASK;
84
85         if (((flags ^ file->f_flags) & O_APPEND) && IS_APPEND(inode))
86                 return -EPERM;
87
88         if ((flags & O_DIRECT) && !(file->f_mode & FMODE_CAN_ODIRECT))
89                 return -EINVAL;
90
91         if (file->f_op->check_flags) {
92                 err = file->f_op->check_flags(flags);
93                 if (err)
94                         return err;
95         }
96
97         spin_lock(&file->f_lock);
98         file->f_flags = (file->f_flags & ~OVL_SETFL_MASK) | flags;
99         spin_unlock(&file->f_lock);
100
101         return 0;
102 }
103
104 static int ovl_real_fdget_meta(const struct file *file, struct fd *real,
105                                bool allow_meta)
106 {
107         struct dentry *dentry = file_dentry(file);
108         struct path realpath;
109
110         real->flags = 0;
111         real->file = file->private_data;
112
113         if (allow_meta)
114                 ovl_path_real(dentry, &realpath);
115         else
116                 ovl_path_realdata(dentry, &realpath);
117
118         /* Has it been copied up since we'd opened it? */
119         if (unlikely(file_inode(real->file) != d_inode(realpath.dentry))) {
120                 real->flags = FDPUT_FPUT;
121                 real->file = ovl_open_realfile(file, &realpath);
122
123                 return PTR_ERR_OR_ZERO(real->file);
124         }
125
126         /* Did the flags change since open? */
127         if (unlikely((file->f_flags ^ real->file->f_flags) & ~OVL_OPEN_FLAGS))
128                 return ovl_change_flags(real->file, file->f_flags);
129
130         return 0;
131 }
132
133 static int ovl_real_fdget(const struct file *file, struct fd *real)
134 {
135         if (d_is_dir(file_dentry(file))) {
136                 real->flags = 0;
137                 real->file = ovl_dir_real_file(file, false);
138
139                 return PTR_ERR_OR_ZERO(real->file);
140         }
141
142         return ovl_real_fdget_meta(file, real, false);
143 }
144
145 static int ovl_open(struct inode *inode, struct file *file)
146 {
147         struct dentry *dentry = file_dentry(file);
148         struct file *realfile;
149         struct path realpath;
150         int err;
151
152         err = ovl_maybe_copy_up(dentry, file->f_flags);
153         if (err)
154                 return err;
155
156         /* No longer need these flags, so don't pass them on to underlying fs */
157         file->f_flags &= ~(O_CREAT | O_EXCL | O_NOCTTY | O_TRUNC);
158
159         ovl_path_realdata(dentry, &realpath);
160         realfile = ovl_open_realfile(file, &realpath);
161         if (IS_ERR(realfile))
162                 return PTR_ERR(realfile);
163
164         file->private_data = realfile;
165
166         return 0;
167 }
168
169 static int ovl_release(struct inode *inode, struct file *file)
170 {
171         fput(file->private_data);
172
173         return 0;
174 }
175
176 static loff_t ovl_llseek(struct file *file, loff_t offset, int whence)
177 {
178         struct inode *inode = file_inode(file);
179         struct fd real;
180         const struct cred *old_cred;
181         loff_t ret;
182
183         /*
184          * The two special cases below do not need to involve real fs,
185          * so we can optimizing concurrent callers.
186          */
187         if (offset == 0) {
188                 if (whence == SEEK_CUR)
189                         return file->f_pos;
190
191                 if (whence == SEEK_SET)
192                         return vfs_setpos(file, 0, 0);
193         }
194
195         ret = ovl_real_fdget(file, &real);
196         if (ret)
197                 return ret;
198
199         /*
200          * Overlay file f_pos is the master copy that is preserved
201          * through copy up and modified on read/write, but only real
202          * fs knows how to SEEK_HOLE/SEEK_DATA and real fs may impose
203          * limitations that are more strict than ->s_maxbytes for specific
204          * files, so we use the real file to perform seeks.
205          */
206         ovl_inode_lock(inode);
207         real.file->f_pos = file->f_pos;
208
209         old_cred = ovl_override_creds(inode->i_sb);
210         ret = vfs_llseek(real.file, offset, whence);
211         revert_creds(old_cred);
212
213         file->f_pos = real.file->f_pos;
214         ovl_inode_unlock(inode);
215
216         fdput(real);
217
218         return ret;
219 }
220
221 static void ovl_file_accessed(struct file *file)
222 {
223         struct inode *inode, *upperinode;
224
225         if (file->f_flags & O_NOATIME)
226                 return;
227
228         inode = file_inode(file);
229         upperinode = ovl_inode_upper(inode);
230
231         if (!upperinode)
232                 return;
233
234         if ((!timespec64_equal(&inode->i_mtime, &upperinode->i_mtime) ||
235              !timespec64_equal(&inode->i_ctime, &upperinode->i_ctime))) {
236                 inode->i_mtime = upperinode->i_mtime;
237                 inode->i_ctime = upperinode->i_ctime;
238         }
239
240         touch_atime(&file->f_path);
241 }
242
243 static rwf_t ovl_iocb_to_rwf(int ifl)
244 {
245         rwf_t flags = 0;
246
247         if (ifl & IOCB_NOWAIT)
248                 flags |= RWF_NOWAIT;
249         if (ifl & IOCB_HIPRI)
250                 flags |= RWF_HIPRI;
251         if (ifl & IOCB_DSYNC)
252                 flags |= RWF_DSYNC;
253         if (ifl & IOCB_SYNC)
254                 flags |= RWF_SYNC;
255
256         return flags;
257 }
258
259 static inline void ovl_aio_put(struct ovl_aio_req *aio_req)
260 {
261         if (refcount_dec_and_test(&aio_req->ref)) {
262                 fdput(aio_req->fd);
263                 kmem_cache_free(ovl_aio_request_cachep, aio_req);
264         }
265 }
266
267 static void ovl_aio_cleanup_handler(struct ovl_aio_req *aio_req)
268 {
269         struct kiocb *iocb = &aio_req->iocb;
270         struct kiocb *orig_iocb = aio_req->orig_iocb;
271
272         if (iocb->ki_flags & IOCB_WRITE) {
273                 struct inode *inode = file_inode(orig_iocb->ki_filp);
274
275                 /* Actually acquired in ovl_write_iter() */
276                 __sb_writers_acquired(file_inode(iocb->ki_filp)->i_sb,
277                                       SB_FREEZE_WRITE);
278                 file_end_write(iocb->ki_filp);
279                 ovl_copyattr(inode);
280         }
281
282         orig_iocb->ki_pos = iocb->ki_pos;
283         ovl_aio_put(aio_req);
284 }
285
286 static void ovl_aio_rw_complete(struct kiocb *iocb, long res)
287 {
288         struct ovl_aio_req *aio_req = container_of(iocb,
289                                                    struct ovl_aio_req, iocb);
290         struct kiocb *orig_iocb = aio_req->orig_iocb;
291
292         ovl_aio_cleanup_handler(aio_req);
293         orig_iocb->ki_complete(orig_iocb, res);
294 }
295
296 static ssize_t ovl_read_iter(struct kiocb *iocb, struct iov_iter *iter)
297 {
298         struct file *file = iocb->ki_filp;
299         struct fd real;
300         const struct cred *old_cred;
301         ssize_t ret;
302
303         if (!iov_iter_count(iter))
304                 return 0;
305
306         ret = ovl_real_fdget(file, &real);
307         if (ret)
308                 return ret;
309
310         ret = -EINVAL;
311         if (iocb->ki_flags & IOCB_DIRECT &&
312             !(real.file->f_mode & FMODE_CAN_ODIRECT))
313                 goto out_fdput;
314
315         old_cred = ovl_override_creds(file_inode(file)->i_sb);
316         if (is_sync_kiocb(iocb)) {
317                 ret = vfs_iter_read(real.file, iter, &iocb->ki_pos,
318                                     ovl_iocb_to_rwf(iocb->ki_flags));
319         } else {
320                 struct ovl_aio_req *aio_req;
321
322                 ret = -ENOMEM;
323                 aio_req = kmem_cache_zalloc(ovl_aio_request_cachep, GFP_KERNEL);
324                 if (!aio_req)
325                         goto out;
326
327                 aio_req->fd = real;
328                 real.flags = 0;
329                 aio_req->orig_iocb = iocb;
330                 kiocb_clone(&aio_req->iocb, iocb, real.file);
331                 aio_req->iocb.ki_complete = ovl_aio_rw_complete;
332                 refcount_set(&aio_req->ref, 2);
333                 ret = vfs_iocb_iter_read(real.file, &aio_req->iocb, iter);
334                 ovl_aio_put(aio_req);
335                 if (ret != -EIOCBQUEUED)
336                         ovl_aio_cleanup_handler(aio_req);
337         }
338 out:
339         revert_creds(old_cred);
340         ovl_file_accessed(file);
341 out_fdput:
342         fdput(real);
343
344         return ret;
345 }
346
347 static ssize_t ovl_write_iter(struct kiocb *iocb, struct iov_iter *iter)
348 {
349         struct file *file = iocb->ki_filp;
350         struct inode *inode = file_inode(file);
351         struct fd real;
352         const struct cred *old_cred;
353         ssize_t ret;
354         int ifl = iocb->ki_flags;
355
356         if (!iov_iter_count(iter))
357                 return 0;
358
359         inode_lock(inode);
360         /* Update mode */
361         ovl_copyattr(inode);
362         ret = file_remove_privs(file);
363         if (ret)
364                 goto out_unlock;
365
366         ret = ovl_real_fdget(file, &real);
367         if (ret)
368                 goto out_unlock;
369
370         ret = -EINVAL;
371         if (iocb->ki_flags & IOCB_DIRECT &&
372             !(real.file->f_mode & FMODE_CAN_ODIRECT))
373                 goto out_fdput;
374
375         if (!ovl_should_sync(OVL_FS(inode->i_sb)))
376                 ifl &= ~(IOCB_DSYNC | IOCB_SYNC);
377
378         old_cred = ovl_override_creds(file_inode(file)->i_sb);
379         if (is_sync_kiocb(iocb)) {
380                 file_start_write(real.file);
381                 ret = vfs_iter_write(real.file, iter, &iocb->ki_pos,
382                                      ovl_iocb_to_rwf(ifl));
383                 file_end_write(real.file);
384                 /* Update size */
385                 ovl_copyattr(inode);
386         } else {
387                 struct ovl_aio_req *aio_req;
388
389                 ret = -ENOMEM;
390                 aio_req = kmem_cache_zalloc(ovl_aio_request_cachep, GFP_KERNEL);
391                 if (!aio_req)
392                         goto out;
393
394                 file_start_write(real.file);
395                 /* Pacify lockdep, same trick as done in aio_write() */
396                 __sb_writers_release(file_inode(real.file)->i_sb,
397                                      SB_FREEZE_WRITE);
398                 aio_req->fd = real;
399                 real.flags = 0;
400                 aio_req->orig_iocb = iocb;
401                 kiocb_clone(&aio_req->iocb, iocb, real.file);
402                 aio_req->iocb.ki_flags = ifl;
403                 aio_req->iocb.ki_complete = ovl_aio_rw_complete;
404                 refcount_set(&aio_req->ref, 2);
405                 ret = vfs_iocb_iter_write(real.file, &aio_req->iocb, iter);
406                 ovl_aio_put(aio_req);
407                 if (ret != -EIOCBQUEUED)
408                         ovl_aio_cleanup_handler(aio_req);
409         }
410 out:
411         revert_creds(old_cred);
412 out_fdput:
413         fdput(real);
414
415 out_unlock:
416         inode_unlock(inode);
417
418         return ret;
419 }
420
421 /*
422  * Calling iter_file_splice_write() directly from overlay's f_op may deadlock
423  * due to lock order inversion between pipe->mutex in iter_file_splice_write()
424  * and file_start_write(real.file) in ovl_write_iter().
425  *
426  * So do everything ovl_write_iter() does and call iter_file_splice_write() on
427  * the real file.
428  */
429 static ssize_t ovl_splice_write(struct pipe_inode_info *pipe, struct file *out,
430                                 loff_t *ppos, size_t len, unsigned int flags)
431 {
432         struct fd real;
433         const struct cred *old_cred;
434         struct inode *inode = file_inode(out);
435         ssize_t ret;
436
437         inode_lock(inode);
438         /* Update mode */
439         ovl_copyattr(inode);
440         ret = file_remove_privs(out);
441         if (ret)
442                 goto out_unlock;
443
444         ret = ovl_real_fdget(out, &real);
445         if (ret)
446                 goto out_unlock;
447
448         old_cred = ovl_override_creds(inode->i_sb);
449         file_start_write(real.file);
450
451         ret = iter_file_splice_write(pipe, real.file, ppos, len, flags);
452
453         file_end_write(real.file);
454         /* Update size */
455         ovl_copyattr(inode);
456         revert_creds(old_cred);
457         fdput(real);
458
459 out_unlock:
460         inode_unlock(inode);
461
462         return ret;
463 }
464
465 static int ovl_fsync(struct file *file, loff_t start, loff_t end, int datasync)
466 {
467         struct fd real;
468         const struct cred *old_cred;
469         int ret;
470
471         ret = ovl_sync_status(OVL_FS(file_inode(file)->i_sb));
472         if (ret <= 0)
473                 return ret;
474
475         ret = ovl_real_fdget_meta(file, &real, !datasync);
476         if (ret)
477                 return ret;
478
479         /* Don't sync lower file for fear of receiving EROFS error */
480         if (file_inode(real.file) == ovl_inode_upper(file_inode(file))) {
481                 old_cred = ovl_override_creds(file_inode(file)->i_sb);
482                 ret = vfs_fsync_range(real.file, start, end, datasync);
483                 revert_creds(old_cred);
484         }
485
486         fdput(real);
487
488         return ret;
489 }
490
491 static int ovl_mmap(struct file *file, struct vm_area_struct *vma)
492 {
493         struct file *realfile = file->private_data;
494         const struct cred *old_cred;
495         int ret;
496
497         if (!realfile->f_op->mmap)
498                 return -ENODEV;
499
500         if (WARN_ON(file != vma->vm_file))
501                 return -EIO;
502
503         vma_set_file(vma, realfile);
504
505         old_cred = ovl_override_creds(file_inode(file)->i_sb);
506         ret = call_mmap(vma->vm_file, vma);
507         revert_creds(old_cred);
508         ovl_file_accessed(file);
509
510         return ret;
511 }
512
513 static long ovl_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
514 {
515         struct inode *inode = file_inode(file);
516         struct fd real;
517         const struct cred *old_cred;
518         int ret;
519
520         inode_lock(inode);
521         /* Update mode */
522         ovl_copyattr(inode);
523         ret = file_remove_privs(file);
524         if (ret)
525                 goto out_unlock;
526
527         ret = ovl_real_fdget(file, &real);
528         if (ret)
529                 goto out_unlock;
530
531         old_cred = ovl_override_creds(file_inode(file)->i_sb);
532         ret = vfs_fallocate(real.file, mode, offset, len);
533         revert_creds(old_cred);
534
535         /* Update size */
536         ovl_copyattr(inode);
537
538         fdput(real);
539
540 out_unlock:
541         inode_unlock(inode);
542
543         return ret;
544 }
545
546 static int ovl_fadvise(struct file *file, loff_t offset, loff_t len, int advice)
547 {
548         struct fd real;
549         const struct cred *old_cred;
550         int ret;
551
552         ret = ovl_real_fdget(file, &real);
553         if (ret)
554                 return ret;
555
556         old_cred = ovl_override_creds(file_inode(file)->i_sb);
557         ret = vfs_fadvise(real.file, offset, len, advice);
558         revert_creds(old_cred);
559
560         fdput(real);
561
562         return ret;
563 }
564
565 enum ovl_copyop {
566         OVL_COPY,
567         OVL_CLONE,
568         OVL_DEDUPE,
569 };
570
571 static loff_t ovl_copyfile(struct file *file_in, loff_t pos_in,
572                             struct file *file_out, loff_t pos_out,
573                             loff_t len, unsigned int flags, enum ovl_copyop op)
574 {
575         struct inode *inode_out = file_inode(file_out);
576         struct fd real_in, real_out;
577         const struct cred *old_cred;
578         loff_t ret;
579
580         inode_lock(inode_out);
581         if (op != OVL_DEDUPE) {
582                 /* Update mode */
583                 ovl_copyattr(inode_out);
584                 ret = file_remove_privs(file_out);
585                 if (ret)
586                         goto out_unlock;
587         }
588
589         ret = ovl_real_fdget(file_out, &real_out);
590         if (ret)
591                 goto out_unlock;
592
593         ret = ovl_real_fdget(file_in, &real_in);
594         if (ret) {
595                 fdput(real_out);
596                 goto out_unlock;
597         }
598
599         old_cred = ovl_override_creds(file_inode(file_out)->i_sb);
600         switch (op) {
601         case OVL_COPY:
602                 ret = vfs_copy_file_range(real_in.file, pos_in,
603                                           real_out.file, pos_out, len, flags);
604                 break;
605
606         case OVL_CLONE:
607                 ret = vfs_clone_file_range(real_in.file, pos_in,
608                                            real_out.file, pos_out, len, flags);
609                 break;
610
611         case OVL_DEDUPE:
612                 ret = vfs_dedupe_file_range_one(real_in.file, pos_in,
613                                                 real_out.file, pos_out, len,
614                                                 flags);
615                 break;
616         }
617         revert_creds(old_cred);
618
619         /* Update size */
620         ovl_copyattr(inode_out);
621
622         fdput(real_in);
623         fdput(real_out);
624
625 out_unlock:
626         inode_unlock(inode_out);
627
628         return ret;
629 }
630
631 static ssize_t ovl_copy_file_range(struct file *file_in, loff_t pos_in,
632                                    struct file *file_out, loff_t pos_out,
633                                    size_t len, unsigned int flags)
634 {
635         return ovl_copyfile(file_in, pos_in, file_out, pos_out, len, flags,
636                             OVL_COPY);
637 }
638
639 static loff_t ovl_remap_file_range(struct file *file_in, loff_t pos_in,
640                                    struct file *file_out, loff_t pos_out,
641                                    loff_t len, unsigned int remap_flags)
642 {
643         enum ovl_copyop op;
644
645         if (remap_flags & ~(REMAP_FILE_DEDUP | REMAP_FILE_ADVISORY))
646                 return -EINVAL;
647
648         if (remap_flags & REMAP_FILE_DEDUP)
649                 op = OVL_DEDUPE;
650         else
651                 op = OVL_CLONE;
652
653         /*
654          * Don't copy up because of a dedupe request, this wouldn't make sense
655          * most of the time (data would be duplicated instead of deduplicated).
656          */
657         if (op == OVL_DEDUPE &&
658             (!ovl_inode_upper(file_inode(file_in)) ||
659              !ovl_inode_upper(file_inode(file_out))))
660                 return -EPERM;
661
662         return ovl_copyfile(file_in, pos_in, file_out, pos_out, len,
663                             remap_flags, op);
664 }
665
666 static int ovl_flush(struct file *file, fl_owner_t id)
667 {
668         struct fd real;
669         const struct cred *old_cred;
670         int err;
671
672         err = ovl_real_fdget(file, &real);
673         if (err)
674                 return err;
675
676         if (real.file->f_op->flush) {
677                 old_cred = ovl_override_creds(file_inode(file)->i_sb);
678                 err = real.file->f_op->flush(real.file, id);
679                 revert_creds(old_cred);
680         }
681         fdput(real);
682
683         return err;
684 }
685
686 const struct file_operations ovl_file_operations = {
687         .open           = ovl_open,
688         .release        = ovl_release,
689         .llseek         = ovl_llseek,
690         .read_iter      = ovl_read_iter,
691         .write_iter     = ovl_write_iter,
692         .fsync          = ovl_fsync,
693         .mmap           = ovl_mmap,
694         .fallocate      = ovl_fallocate,
695         .fadvise        = ovl_fadvise,
696         .flush          = ovl_flush,
697         .splice_read    = generic_file_splice_read,
698         .splice_write   = ovl_splice_write,
699
700         .copy_file_range        = ovl_copy_file_range,
701         .remap_file_range       = ovl_remap_file_range,
702 };
703
704 int __init ovl_aio_request_cache_init(void)
705 {
706         ovl_aio_request_cachep = kmem_cache_create("ovl_aio_req",
707                                                    sizeof(struct ovl_aio_req),
708                                                    0, SLAB_HWCACHE_ALIGN, NULL);
709         if (!ovl_aio_request_cachep)
710                 return -ENOMEM;
711
712         return 0;
713 }
714
715 void ovl_aio_request_cache_destroy(void)
716 {
717         kmem_cache_destroy(ovl_aio_request_cachep);
718 }