forked from ~ljy/RK356X_SDK_RELEASE
blame | history | patch | commit | commitdiff
hc
2024-05-10 61598093bbdd283a7edc367d900f223070ead8d2 
 kernel/fs/overlayfs/namei.c
....@@ -1,10 +1,7 @@
1
+// SPDX-License-Identifier: GPL-2.0-only
12 /*
23  * Copyright (C) 2011 Novell Inc.
34  * Copyright (C) 2016 Red Hat, Inc.
4
- *
5
- * This program is free software; you can redistribute it and/or modify it
6
- * under the terms of the GNU General Public License version 2 as published by
7
- * the Free Software Foundation.
85  */
96 
107 #include <linux/fs.h>
....@@ -33,8 +30,9 @@
3330 {
3431 	int res;
3532 	char *buf;
33
+	struct ovl_fs *ofs = OVL_FS(d->sb);
3634 
37
-	buf = ovl_get_redirect_xattr(dentry, prelen + strlen(post));
35
+	buf = ovl_get_redirect_xattr(ofs, dentry, prelen + strlen(post));
3836 	if (IS_ERR_OR_NULL(buf))
3937 		return PTR_ERR(buf);
4038 
....@@ -87,33 +85,34 @@
8785  * Return -ENODATA for "origin unknown".
8886  * Return <0 for an invalid file handle.
8987  */
90
-int ovl_check_fh_len(struct ovl_fh *fh, int fh_len)
88
+int ovl_check_fb_len(struct ovl_fb *fb, int fb_len)
9189 {
92
-	if (fh_len < sizeof(struct ovl_fh) || fh_len < fh->len)
90
+	if (fb_len < sizeof(struct ovl_fb) || fb_len < fb->len)
9391 		return -EINVAL;
9492 
95
-	if (fh->magic != OVL_FH_MAGIC)
93
+	if (fb->magic != OVL_FH_MAGIC)
9694 		return -EINVAL;
9795 
9896 	/* Treat larger version and unknown flags as "origin unknown" */
99
-	if (fh->version > OVL_FH_VERSION || fh->flags & ~OVL_FH_FLAG_ALL)
97
+	if (fb->version > OVL_FH_VERSION || fb->flags & ~OVL_FH_FLAG_ALL)
10098 		return -ENODATA;
10199 
102100 	/* Treat endianness mismatch as "origin unknown" */
103
-	if (!(fh->flags & OVL_FH_FLAG_ANY_ENDIAN) &&
104
-	    (fh->flags & OVL_FH_FLAG_BIG_ENDIAN) != OVL_FH_FLAG_CPU_ENDIAN)
101
+	if (!(fb->flags & OVL_FH_FLAG_ANY_ENDIAN) &&
102
+	    (fb->flags & OVL_FH_FLAG_BIG_ENDIAN) != OVL_FH_FLAG_CPU_ENDIAN)
105103 		return -ENODATA;
106104 
107105 	return 0;
108106 }
109107 
110
-static struct ovl_fh *ovl_get_fh(struct dentry *dentry, const char *name)
108
+static struct ovl_fh *ovl_get_fh(struct ovl_fs *ofs, struct dentry *dentry,
109
+				 enum ovl_xattr ox)
111110 {
112111 	ssize_t res;
113112 	int err;
114113 	struct ovl_fh *fh = NULL;
115114 
116
-	res = ovl_vfs_getxattr(dentry, name, NULL, 0);
115
+	res = ovl_do_getxattr(ofs, dentry, ox, NULL, 0);
117116 	if (res < 0) {
118117 		if (res == -ENODATA || res == -EOPNOTSUPP)
119118 			return NULL;
....@@ -123,15 +122,15 @@
123122 	if (res == 0)
124123 		return NULL;
125124 
126
-	fh = kzalloc(res, GFP_KERNEL);
125
+	fh = kzalloc(res + OVL_FH_WIRE_OFFSET, GFP_KERNEL);
127126 	if (!fh)
128127 		return ERR_PTR(-ENOMEM);
129128 
130
-	res = ovl_vfs_getxattr(dentry, name, fh, res);
129
+	res = ovl_do_getxattr(ofs, dentry, ox, fh->buf, res);
131130 	if (res < 0)
132131 		goto fail;
133132 
134
-	err = ovl_check_fh_len(fh, res);
133
+	err = ovl_check_fb_len(&fh->fb, res);
135134 	if (err < 0) {
136135 		if (err == -ENODATA)
137136 			goto out;
....@@ -145,11 +144,10 @@
145144 	return NULL;
146145 
147146 fail:
148
-	pr_warn_ratelimited("overlayfs: failed to get origin (%zi)\n", res);
147
+	pr_warn_ratelimited("failed to get origin (%zi)\n", res);
149148 	goto out;
150149 invalid:
151
-	pr_warn_ratelimited("overlayfs: invalid origin (%*phN)\n",
152
-			    (int)res, fh);
150
+	pr_warn_ratelimited("invalid origin (%*phN)\n", (int)res, fh);
153151 	goto out;
154152 }
155153 
....@@ -163,12 +161,12 @@
163161 	 * Make sure that the stored uuid matches the uuid of the lower
164162 	 * layer where file handle will be decoded.
165163 	 */
166
-	if (!uuid_equal(&fh->uuid, &mnt->mnt_sb->s_uuid))
164
+	if (!uuid_equal(&fh->fb.uuid, &mnt->mnt_sb->s_uuid))
167165 		return NULL;
168166 
169
-	bytes = (fh->len - offsetof(struct ovl_fh, fid));
170
-	real = exportfs_decode_fh(mnt, (struct fid *)fh->fid,
171
-				  bytes >> 2, (int)fh->type,
167
+	bytes = (fh->fb.len - offsetof(struct ovl_fb, fid));
168
+	real = exportfs_decode_fh(mnt, (struct fid *)fh->fb.fid,
169
+				  bytes >> 2, (int)fh->fb.type,
172170 				  connected ? ovl_acceptable : NULL, mnt);
173171 	if (IS_ERR(real)) {
174172 		/*
....@@ -178,7 +176,7 @@
178176 		 * index entries correctly.
179177 		 */
180178 		if (real == ERR_PTR(-ESTALE) &&
181
-		    !(fh->flags & OVL_FH_FLAG_PATH_UPPER))
179
+		    !(fh->fb.flags & OVL_FH_FLAG_PATH_UPPER))
182180 			real = NULL;
183181 		return real;
184182 	}
....@@ -191,21 +189,41 @@
191189 	return real;
192190 }
193191 
194
-static bool ovl_is_opaquedir(struct dentry *dentry)
192
+static bool ovl_is_opaquedir(struct super_block *sb, struct dentry *dentry)
195193 {
196
-	return ovl_check_dir_xattr(dentry, OVL_XATTR_OPAQUE);
194
+	return ovl_check_dir_xattr(sb, dentry, OVL_XATTR_OPAQUE);
195
+}
196
+
197
+static struct dentry *ovl_lookup_positive_unlocked(const char *name,
198
+						   struct dentry *base, int len,
199
+						   bool drop_negative)
200
+{
201
+	struct dentry *ret = lookup_one_len_unlocked(name, base, len);
202
+
203
+	if (!IS_ERR(ret) && d_flags_negative(smp_load_acquire(&ret->d_flags))) {
204
+		if (drop_negative && ret->d_lockref.count == 1) {
205
+			spin_lock(&ret->d_lock);
206
+			/* Recheck condition under lock */
207
+			if (d_is_negative(ret) && ret->d_lockref.count == 1)
208
+				__d_drop(ret);
209
+			spin_unlock(&ret->d_lock);
210
+		}
211
+		dput(ret);
212
+		ret = ERR_PTR(-ENOENT);
213
+	}
214
+	return ret;
197215 }
198216 
199217 static int ovl_lookup_single(struct dentry *base, struct ovl_lookup_data *d,
200218 			     const char *name, unsigned int namelen,
201219 			     size_t prelen, const char *post,
202
-			     struct dentry **ret)
220
+			     struct dentry **ret, bool drop_negative)
203221 {
204222 	struct dentry *this;
205223 	int err;
206224 	bool last_element = !post[0];
207225 
208
-	this = lookup_one_len_unlocked(name, base, namelen);
226
+	this = ovl_lookup_positive_unlocked(name, base, namelen, drop_negative);
209227 	if (IS_ERR(this)) {
210228 		err = PTR_ERR(this);
211229 		this = NULL;
....@@ -213,8 +231,6 @@
213231 			goto out;
214232 		goto out_err;
215233 	}
216
-	if (!this->d_inode)
217
-		goto put_and_out;
218234 
219235 	if (ovl_dentry_weird(this)) {
220236 		/* Don't support traversing automounts and other weirdness */
....@@ -238,7 +254,7 @@
238254 			d->stop = true;
239255 			goto put_and_out;
240256 		}
241
-		err = ovl_check_metacopy_xattr(this);
257
+		err = ovl_check_metacopy_xattr(OVL_FS(d->sb), this);
242258 		if (err < 0)
243259 			goto out_err;
244260 
....@@ -258,7 +274,7 @@
258274 		if (d->last)
259275 			goto out;
260276 
261
-		if (ovl_is_opaquedir(this)) {
277
+		if (ovl_is_opaquedir(d->sb, this)) {
262278 			d->stop = true;
263279 			if (last_element)
264280 				d->opaque = true;
....@@ -283,7 +299,7 @@
283299 }
284300 
285301 static int ovl_lookup_layer(struct dentry *base, struct ovl_lookup_data *d,
286
-			    struct dentry **ret)
302
+			    struct dentry **ret, bool drop_negative)
287303 {
288304 	/* Counting down from the end, since the prefix can change */
289305 	size_t rem = d->name.len - 1;
....@@ -292,7 +308,7 @@
292308 
293309 	if (d->name.name[0] != '/')
294310 		return ovl_lookup_single(base, d, d->name.name, d->name.len,
295
-					 0, "", ret);
311
+					 0, "", ret, drop_negative);
296312 
297313 	while (!IS_ERR_OR_NULL(base) && d_can_lookup(base)) {
298314 		const char *s = d->name.name + d->name.len - rem;
....@@ -305,7 +321,8 @@
305321 			return -EIO;
306322 
307323 		err = ovl_lookup_single(base, d, s, thislen,
308
-					d->name.len - rem, next, &base);
324
+					d->name.len - rem, next, &base,
325
+					drop_negative);
309326 		dput(dentry);
310327 		if (err)
311328 			return err;
....@@ -329,8 +346,16 @@
329346 	struct dentry *origin = NULL;
330347 	int i;
331348 
332
-	for (i = 0; i < ofs->numlower; i++) {
333
-		origin = ovl_decode_real_fh(fh, ofs->lower_layers[i].mnt,
349
+	for (i = 1; i < ofs->numlayer; i++) {
350
+		/*
351
+		 * If lower fs uuid is not unique among lower fs we cannot match
352
+		 * fh->uuid to layer.
353
+		 */
354
+		if (ofs->layers[i].fsid &&
355
+		    ofs->layers[i].fs->bad_uuid)
356
+			continue;
357
+
358
+		origin = ovl_decode_real_fh(fh, ofs->layers[i].mnt,
334359 					    connected);
335360 		if (origin)
336361 			break;
....@@ -342,7 +367,7 @@
342367 		return PTR_ERR(origin);
343368 
344369 	if (upperdentry && !ovl_is_whiteout(upperdentry) &&
345
-	    ((d_inode(origin)->i_mode ^ d_inode(upperdentry)->i_mode) & S_IFMT))
370
+	    inode_wrong_type(d_inode(upperdentry), d_inode(origin)->i_mode))
346371 		goto invalid;
347372 
348373 	if (!*stackp)
....@@ -353,13 +378,13 @@
353378 	}
354379 	**stackp = (struct ovl_path){
355380 		.dentry = origin,
356
-		.layer = &ofs->lower_layers[i]
381
+		.layer = &ofs->layers[i]
357382 	};
358383 
359384 	return 0;
360385 
361386 invalid:
362
-	pr_warn_ratelimited("overlayfs: invalid origin (%pd2, ftype=%x, origin ftype=%x).\n",
387
+	pr_warn_ratelimited("invalid origin (%pd2, ftype=%x, origin ftype=%x).\n",
363388 			    upperdentry, d_inode(upperdentry)->i_mode & S_IFMT,
364389 			    d_inode(origin)->i_mode & S_IFMT);
365390 	dput(origin);
....@@ -367,9 +392,9 @@
367392 }
368393 
369394 static int ovl_check_origin(struct ovl_fs *ofs, struct dentry *upperdentry,
370
-			    struct ovl_path **stackp, unsigned int *ctrp)
395
+			    struct ovl_path **stackp)
371396 {
372
-	struct ovl_fh *fh = ovl_get_fh(upperdentry, OVL_XATTR_ORIGIN);
397
+	struct ovl_fh *fh = ovl_get_fh(ofs, upperdentry, OVL_XATTR_ORIGIN);
373398 	int err;
374399 
375400 	if (IS_ERR_OR_NULL(fh))
....@@ -384,10 +409,6 @@
384409 		return err;
385410 	}
386411 
387
-	if (WARN_ON(*ctrp))
388
-		return -EIO;
389
-
390
-	*ctrp = 1;
391412 	return 0;
392413 }
393414 
....@@ -395,10 +416,10 @@
395416  * Verify that @fh matches the file handle stored in xattr @name.
396417  * Return 0 on match, -ESTALE on mismatch, < 0 on error.
397418  */
398
-static int ovl_verify_fh(struct dentry *dentry, const char *name,
399
-			 const struct ovl_fh *fh)
419
+static int ovl_verify_fh(struct ovl_fs *ofs, struct dentry *dentry,
420
+			 enum ovl_xattr ox, const struct ovl_fh *fh)
400421 {
401
-	struct ovl_fh *ofh = ovl_get_fh(dentry, name);
422
+	struct ovl_fh *ofh = ovl_get_fh(ofs, dentry, ox);
402423 	int err = 0;
403424 
404425 	if (!ofh)
....@@ -407,7 +428,7 @@
407428 	if (IS_ERR(ofh))
408429 		return PTR_ERR(ofh);
409430 
410
-	if (fh->len != ofh->len || memcmp(fh, ofh, fh->len))
431
+	if (fh->fb.len != ofh->fb.len || memcmp(&fh->fb, &ofh->fb, fh->fb.len))
411432 		err = -ESTALE;
412433 
413434 	kfree(ofh);
....@@ -422,8 +443,9 @@
422443  *
423444  * Return 0 on match, -ESTALE on mismatch, -ENODATA on no xattr, < 0 on error.
424445  */
425
-int ovl_verify_set_fh(struct dentry *dentry, const char *name,
426
-		      struct dentry *real, bool is_upper, bool set)
446
+int ovl_verify_set_fh(struct ovl_fs *ofs, struct dentry *dentry,
447
+		      enum ovl_xattr ox, struct dentry *real, bool is_upper,
448
+		      bool set)
427449 {
428450 	struct inode *inode;
429451 	struct ovl_fh *fh;
....@@ -436,9 +458,9 @@
436458 		goto fail;
437459 	}
438460 
439
-	err = ovl_verify_fh(dentry, name, fh);
461
+	err = ovl_verify_fh(ofs, dentry, ox, fh);
440462 	if (set && err == -ENODATA)
441
-		err = ovl_do_setxattr(dentry, name, fh, fh->len, 0);
463
+		err = ovl_do_setxattr(ofs, dentry, ox, fh->buf, fh->fb.len);
442464 	if (err)
443465 		goto fail;
444466 
....@@ -448,7 +470,7 @@
448470 
449471 fail:
450472 	inode = d_inode(real);
451
-	pr_warn_ratelimited("overlayfs: failed to verify %s (%pd2, ino=%lu, err=%i)\n",
473
+	pr_warn_ratelimited("failed to verify %s (%pd2, ino=%lu, err=%i)\n",
452474 			    is_upper ? "upper" : "origin", real,
453475 			    inode ? inode->i_ino : 0, err);
454476 	goto out;
....@@ -463,30 +485,24 @@
463485 	if (!d_is_dir(index))
464486 		return dget(index);
465487 
466
-	fh = ovl_get_fh(index, OVL_XATTR_UPPER);
488
+	fh = ovl_get_fh(ofs, index, OVL_XATTR_UPPER);
467489 	if (IS_ERR_OR_NULL(fh))
468490 		return ERR_CAST(fh);
469491 
470
-	upper = ovl_decode_real_fh(fh, ofs->upper_mnt, true);
492
+	upper = ovl_decode_real_fh(fh, ovl_upper_mnt(ofs), true);
471493 	kfree(fh);
472494 
473495 	if (IS_ERR_OR_NULL(upper))
474496 		return upper ?: ERR_PTR(-ESTALE);
475497 
476498 	if (!d_is_dir(upper)) {
477
-		pr_warn_ratelimited("overlayfs: invalid index upper (%pd2, upper=%pd2).\n",
499
+		pr_warn_ratelimited("invalid index upper (%pd2, upper=%pd2).\n",
478500 				    index, upper);
479501 		dput(upper);
480502 		return ERR_PTR(-EIO);
481503 	}
482504 
483505 	return upper;
484
-}
485
-
486
-/* Is this a leftover from create/whiteout of directory index entry? */
487
-static bool ovl_is_temp_index(struct dentry *index)
488
-{
489
-	return index->d_name.name[0] == '#';
490506 }
491507 
492508 /*
....@@ -506,26 +522,21 @@
506522 	if (!d_inode(index))
507523 		return 0;
508524 
509
-	/* Cleanup leftover from index create/cleanup attempt */
510
-	err = -ESTALE;
511
-	if (ovl_is_temp_index(index))
512
-		goto fail;
513
-
514525 	err = -EINVAL;
515
-	if (index->d_name.len < sizeof(struct ovl_fh)*2)
526
+	if (index->d_name.len < sizeof(struct ovl_fb)*2)
516527 		goto fail;
517528 
518529 	err = -ENOMEM;
519530 	len = index->d_name.len / 2;
520
-	fh = kzalloc(len, GFP_KERNEL);
531
+	fh = kzalloc(len + OVL_FH_WIRE_OFFSET, GFP_KERNEL);
521532 	if (!fh)
522533 		goto fail;
523534 
524535 	err = -EINVAL;
525
-	if (hex2bin((u8 *)fh, index->d_name.name, len))
536
+	if (hex2bin(fh->buf, index->d_name.name, len))
526537 		goto fail;
527538 
528
-	err = ovl_check_fh_len(fh, len);
539
+	err = ovl_check_fb_len(&fh->fb, len);
529540 	if (err)
530541 		goto fail;
531542 
....@@ -567,7 +578,7 @@
567578 		goto fail;
568579 	}
569580 
570
-	err = ovl_verify_fh(upper, OVL_XATTR_ORIGIN, fh);
581
+	err = ovl_verify_fh(ofs, upper, OVL_XATTR_ORIGIN, fh);
571582 	dput(upper);
572583 	if (err)
573584 		goto fail;
....@@ -578,7 +589,7 @@
578589 		if (err)
579590 			goto fail;
580591 
581
-		if (ovl_get_nlink(origin.dentry, index, 0) == 0)
592
+		if (ovl_get_nlink(ofs, origin.dentry, index, 0) == 0)
582593 			goto orphan;
583594 	}
584595 
....@@ -588,12 +599,12 @@
588599 	return err;
589600 
590601 fail:
591
-	pr_warn_ratelimited("overlayfs: failed to verify index (%pd2, ftype=%x, err=%i)\n",
602
+	pr_warn_ratelimited("failed to verify index (%pd2, ftype=%x, err=%i)\n",
592603 			    index, d_inode(index)->i_mode & S_IFMT, err);
593604 	goto out;
594605 
595606 orphan:
596
-	pr_warn_ratelimited("overlayfs: orphan index entry (%pd2, ftype=%x, nlink=%u)\n",
607
+	pr_warn_ratelimited("orphan index entry (%pd2, ftype=%x, nlink=%u)\n",
597608 			    index, d_inode(index)->i_mode & S_IFMT,
598609 			    d_inode(index)->i_nlink);
599610 	err = -ENOENT;
....@@ -604,11 +615,11 @@
604615 {
605616 	char *n, *s;
606617 
607
-	n = kcalloc(fh->len, 2, GFP_KERNEL);
618
+	n = kcalloc(fh->fb.len, 2, GFP_KERNEL);
608619 	if (!n)
609620 		return -ENOMEM;
610621 
611
-	s  = bin2hex(n, fh, fh->len);
622
+	s  = bin2hex(n, fh->buf, fh->fb.len);
612623 	*name = (struct qstr) QSTR_INIT(n, s - n);
613624 
614625 	return 0;
....@@ -656,7 +667,7 @@
656667 	if (err)
657668 		return ERR_PTR(err);
658669 
659
-	index = lookup_one_len_unlocked(name.name, ofs->indexdir, name.len);
670
+	index = lookup_positive_unlocked(name.name, ofs->indexdir, name.len);
660671 	kfree(name.name);
661672 	if (IS_ERR(index)) {
662673 		if (PTR_ERR(index) == -ENOENT)
....@@ -664,9 +675,7 @@
664675 		return index;
665676 	}
666677 
667
-	if (d_is_negative(index))
668
-		err = 0;
669
-	else if (ovl_is_whiteout(index))
678
+	if (ovl_is_whiteout(index))
670679 		err = -ESTALE;
671680 	else if (ovl_dentry_weird(index))
672681 		err = -EIO;
....@@ -690,14 +699,14 @@
690699 	if (err)
691700 		return ERR_PTR(err);
692701 
693
-	index = lookup_one_len_unlocked(name.name, ofs->indexdir, name.len);
702
+	index = lookup_positive_unlocked(name.name, ofs->indexdir, name.len);
694703 	if (IS_ERR(index)) {
695704 		err = PTR_ERR(index);
696705 		if (err == -ENOENT) {
697706 			index = NULL;
698707 			goto out;
699708 		}
700
-		pr_warn_ratelimited("overlayfs: failed inode index lookup (ino=%lu, key=%.*s, err=%i);\n"
709
+		pr_warn_ratelimited("failed inode index lookup (ino=%lu, key=%.*s, err=%i);\n"
701710 				    "overlayfs: mount with '-o index=off' to disable inodes index.\n",
702711 				    d_inode(origin)->i_ino, name.len, name.name,
703712 				    err);
....@@ -705,9 +714,7 @@
705714 	}
706715 
707716 	inode = d_inode(index);
708
-	if (d_is_negative(index)) {
709
-		goto out_dput;
710
-	} else if (ovl_is_whiteout(index) && !verify) {
717
+	if (ovl_is_whiteout(index) && !verify) {
711718 		/*
712719 		 * When index lookup is called with !verify for decoding an
713720 		 * overlay file handle, a whiteout index implies that decode
....@@ -718,7 +725,7 @@
718725 		index = ERR_PTR(-ESTALE);
719726 		goto out;
720727 	} else if (ovl_dentry_weird(index) || ovl_is_whiteout(index) ||
721
-		   ((inode->i_mode ^ d_inode(origin)->i_mode) & S_IFMT)) {
728
+		   inode_wrong_type(inode, d_inode(origin)->i_mode)) {
722729 		/*
723730 		 * Index should always be of the same file type as origin
724731 		 * except for the case of a whiteout index. A whiteout
....@@ -726,22 +733,22 @@
726733 		 * unlinked, which means that finding a lower origin on lookup
727734 		 * whose index is a whiteout should be treated as an error.
728735 		 */
729
-		pr_warn_ratelimited("overlayfs: bad index found (index=%pd2, ftype=%x, origin ftype=%x).\n",
736
+		pr_warn_ratelimited("bad index found (index=%pd2, ftype=%x, origin ftype=%x).\n",
730737 				    index, d_inode(index)->i_mode & S_IFMT,
731738 				    d_inode(origin)->i_mode & S_IFMT);
732739 		goto fail;
733740 	} else if (is_dir && verify) {
734741 		if (!upper) {
735
-			pr_warn_ratelimited("overlayfs: suspected uncovered redirected dir found (origin=%pd2, index=%pd2).\n",
742
+			pr_warn_ratelimited("suspected uncovered redirected dir found (origin=%pd2, index=%pd2).\n",
736743 					    origin, index);
737744 			goto fail;
738745 		}
739746 
740747 		/* Verify that dir index 'upper' xattr points to upper dir */
741
-		err = ovl_verify_upper(index, upper, false);
748
+		err = ovl_verify_upper(ofs, index, upper, false);
742749 		if (err) {
743750 			if (err == -ESTALE) {
744
-				pr_warn_ratelimited("overlayfs: suspected multiply redirected dir found (upper=%pd2, origin=%pd2, index=%pd2).\n",
751
+				pr_warn_ratelimited("suspected multiply redirected dir found (upper=%pd2, origin=%pd2, index=%pd2).\n",
745752 						    upper, origin, index);
746753 			}
747754 			goto fail;
....@@ -787,12 +794,12 @@
787794 }
788795 
789796 /* Fix missing 'origin' xattr */
790
-static int ovl_fix_origin(struct dentry *dentry, struct dentry *lower,
791
-			  struct dentry *upper)
797
+static int ovl_fix_origin(struct ovl_fs *ofs, struct dentry *dentry,
798
+			  struct dentry *lower, struct dentry *upper)
792799 {
793800 	int err;
794801 
795
-	if (ovl_check_origin_xattr(upper))
802
+	if (ovl_check_origin_xattr(ofs, upper))
796803 		return 0;
797804 
798805 	err = ovl_want_write(dentry);
....@@ -826,7 +833,7 @@
826833 	struct dentry *this;
827834 	unsigned int i;
828835 	int err;
829
-	bool metacopy = false;
836
+	bool uppermetacopy = false;
830837 	struct ovl_lookup_data d = {
831838 		.sb = dentry->d_sb,
832839 		.name = dentry->d_name,
....@@ -844,18 +851,16 @@
844851 	old_cred = ovl_override_creds(dentry->d_sb);
845852 	upperdir = ovl_dentry_upper(dentry->d_parent);
846853 	if (upperdir) {
847
-		err = ovl_lookup_layer(upperdir, &d, &upperdentry);
854
+		err = ovl_lookup_layer(upperdir, &d, &upperdentry, true);
848855 		if (err)
849856 			goto out;
850857 
851
-		if (upperdentry && unlikely(ovl_dentry_remote(upperdentry))) {
858
+		if (upperdentry && upperdentry->d_flags & DCACHE_OP_REAL) {
852859 			dput(upperdentry);
853860 			err = -EREMOTE;
854861 			goto out;
855862 		}
856863 		if (upperdentry && !d.is_dir) {
857
-			unsigned int origin_ctr = 0;
858
-
859864 			/*
860865 			 * Lookup copy up origin by decoding origin file handle.
861866 			 * We may get a disconnected dentry, which is fine,
....@@ -866,13 +871,12 @@
866871 			 * number - it's the same as if we held a reference
867872 			 * to a dentry in lower layer that was moved under us.
868873 			 */
869
-			err = ovl_check_origin(ofs, upperdentry, &origin_path,
870
-					       &origin_ctr);
874
+			err = ovl_check_origin(ofs, upperdentry, &origin_path);
871875 			if (err)
872876 				goto out_put_upper;
873877 
874878 			if (d.metacopy)
875
-				metacopy = true;
879
+				uppermetacopy = true;
876880 		}
877881 
878882 		if (d.redirect) {
....@@ -888,7 +892,7 @@
888892 
889893 	if (!d.stop && poe->numlower) {
890894 		err = -ENOMEM;
891
-		stack = kcalloc(ofs->numlower, sizeof(struct ovl_path),
895
+		stack = kcalloc(ofs->numlayer - 1, sizeof(struct ovl_path),
892896 				GFP_KERNEL);
893897 		if (!stack)
894898 			goto out_put_upper;
....@@ -902,19 +906,26 @@
902906 		else
903907 			d.last = lower.layer->idx == roe->numlower;
904908 
905
-		err = ovl_lookup_layer(lower.dentry, &d, &this);
909
+		err = ovl_lookup_layer(lower.dentry, &d, &this, false);
906910 		if (err)
907911 			goto out_put;
908912 
909913 		if (!this)
910914 			continue;
911915 
916
+		if ((uppermetacopy || d.metacopy) && !ofs->config.metacopy) {
917
+			dput(this);
918
+			err = -EPERM;
919
+			pr_warn_ratelimited("refusing to follow metacopy origin for (%pd2)\n", dentry);
920
+			goto out_put;
921
+		}
922
+
912923 		/*
913924 		 * If no origin fh is stored in upper of a merge dir, store fh
914925 		 * of lower dir and set upper parent "impure".
915926 		 */
916927 		if (upperdentry && !ctr && !ofs->noxattr && d.is_dir) {
917
-			err = ovl_fix_origin(dentry, this, upperdentry);
928
+			err = ovl_fix_origin(ofs, dentry, this, upperdentry);
918929 			if (err) {
919930 				dput(this);
920931 				goto out_put;
....@@ -933,7 +944,7 @@
933944 		if (upperdentry && !ctr &&
934945 		    ((d.is_dir && ovl_verify_lower(dentry->d_sb)) ||
935946 		     (!d.is_dir && ofs->config.index && origin_path))) {
936
-			err = ovl_verify_origin(upperdentry, this, false);
947
+			err = ovl_verify_origin(ofs, upperdentry, this, false);
937948 			if (err) {
938949 				dput(this);
939950 				if (d.is_dir)
....@@ -943,20 +954,20 @@
943954 			origin = this;
944955 		}
945956 
946
-		if (d.metacopy)
947
-			metacopy = true;
948
-		/*
949
-		 * Do not store intermediate metacopy dentries in chain,
950
-		 * except top most lower metacopy dentry
951
-		 */
952957 		if (d.metacopy && ctr) {
958
+			/*
959
+			 * Do not store intermediate metacopy dentries in
960
+			 * lower chain, except top most lower metacopy dentry.
961
+			 * Continue the loop so that if there is an absolute
962
+			 * redirect on this dentry, poe can be reset to roe.
963
+			 */
953964 			dput(this);
954
-			continue;
965
+			this = NULL;
966
+		} else {
967
+			stack[ctr].dentry = this;
968
+			stack[ctr].layer = lower.layer;
969
+			ctr++;
955970 		}
956
-
957
-		stack[ctr].dentry = this;
958
-		stack[ctr].layer = lower.layer;
959
-		ctr++;
960971 
961972 		/*
962973 		 * Following redirects can have security consequences: it's like
....@@ -970,7 +981,7 @@
970981 		 */
971982 		err = -EPERM;
972983 		if (d.redirect && !ofs->config.redirect_follow) {
973
-			pr_warn_ratelimited("overlayfs: refusing to follow redirect for (%pd2)\n",
984
+			pr_warn_ratelimited("refusing to follow redirect for (%pd2)\n",
974985 					    dentry);
975986 			goto out_put;
976987 		}
....@@ -985,22 +996,17 @@
985996 		}
986997 	}
987998 
988
-	if (metacopy) {
989
-		/*
990
-		 * Found a metacopy dentry but did not find corresponding
991
-		 * data dentry
992
-		 */
993
-		if (d.metacopy) {
994
-			err = -EIO;
995
-			goto out_put;
996
-		}
997
-
998
-		err = -EPERM;
999
-		if (!ofs->config.metacopy) {
1000
-			pr_warn_ratelimited("overlay: refusing to follow metacopy origin for (%pd2)\n",
1001
-					    dentry);
1002
-			goto out_put;
1003
-		}
999
+	/*
1000
+	 * For regular non-metacopy upper dentries, there is no lower
1001
+	 * path based lookup, hence ctr will be zero. If a dentry is found
1002
+	 * using ORIGIN xattr on upper, install it in stack.
1003
+	 *
1004
+	 * For metacopy dentry, path based lookup will find lower dentries.
1005
+	 * Just make sure a corresponding data dentry has been found.
1006
+	 */
1007
+	if (d.metacopy || (uppermetacopy && !ctr)) {
1008
+		err = -EIO;
1009
+		goto out_put;
10041010 	} else if (!d.is_dir && upperdentry && !ctr && origin_path) {
10051011 		if (WARN_ON(stack != NULL)) {
10061012 			err = -EIO;
....@@ -1008,25 +1014,30 @@
10081014 		}
10091015 		stack = origin_path;
10101016 		ctr = 1;
1017
+		origin = origin_path->dentry;
10111018 		origin_path = NULL;
10121019 	}
10131020 
10141021 	/*
1015
-	 * Lookup index by lower inode and verify it matches upper inode.
1016
-	 * We only trust dir index if we verified that lower dir matches
1017
-	 * origin, otherwise dir index entries may be inconsistent and we
1018
-	 * ignore them.
1022
+	 * Always lookup index if there is no-upperdentry.
10191023 	 *
1020
-	 * For non-dir upper metacopy dentry, we already set "origin" if we
1021
-	 * verified that lower matched upper origin. If upper origin was
1022
-	 * not present (because lower layer did not support fh encode/decode),
1023
-	 * or indexing is not enabled, do not set "origin" and skip looking up
1024
-	 * index. This case should be handled in same way as a non-dir upper
1025
-	 * without ORIGIN is handled.
1024
+	 * For the case of upperdentry, we have set origin by now if it
1025
+	 * needed to be set. There are basically three cases.
10261026 	 *
1027
-	 * Always lookup index of non-dir non-metacopy and non-upper.
1027
+	 * For directories, lookup index by lower inode and verify it matches
1028
+	 * upper inode. We only trust dir index if we verified that lower dir
1029
+	 * matches origin, otherwise dir index entries may be inconsistent
1030
+	 * and we ignore them.
1031
+	 *
1032
+	 * For regular upper, we already set origin if upper had ORIGIN
1033
+	 * xattr. There is no verification though as there is no path
1034
+	 * based dentry lookup in lower in this case.
1035
+	 *
1036
+	 * For metacopy upper, we set a verified origin already if index
1037
+	 * is enabled and if upper had an ORIGIN xattr.
1038
+	 *
10281039 	 */
1029
-	if (ctr && (!upperdentry || (!d.is_dir && !metacopy)))
1040
+	if (!upperdentry && ctr)
10301041 		origin = stack[0].dentry;
10311042 
10321043 	if (origin && ovl_indexdir(dentry->d_sb) &&
....@@ -1054,12 +1065,16 @@
10541065 		ovl_dentry_set_upper_alias(dentry);
10551066 	else if (index) {
10561067 		upperdentry = dget(index);
1057
-		upperredirect = ovl_get_redirect_xattr(upperdentry, 0);
1068
+		upperredirect = ovl_get_redirect_xattr(ofs, upperdentry, 0);
10581069 		if (IS_ERR(upperredirect)) {
10591070 			err = PTR_ERR(upperredirect);
10601071 			upperredirect = NULL;
10611072 			goto out_free_oe;
10621073 		}
1074
+		err = ovl_check_metacopy_xattr(ofs, upperdentry);
1075
+		if (err < 0)
1076
+			goto out_free_oe;
1077
+		uppermetacopy = err;
10631078 	}
10641079 
10651080 	if (upperdentry || ctr) {
....@@ -1077,9 +1092,13 @@
10771092 		err = PTR_ERR(inode);
10781093 		if (IS_ERR(inode))
10791094 			goto out_free_oe;
1095
+		if (upperdentry && !uppermetacopy)
1096
+			ovl_set_flag(OVL_UPPERDATA, inode);
10801097 	}
10811098 
1082
-	ovl_revert_creds(old_cred);
1099
+	ovl_dentry_init_reval(dentry, upperdentry);
1100
+
1101
+	ovl_revert_creds(dentry->d_sb, old_cred);
10831102 	if (origin_path) {
10841103 		dput(origin_path->dentry);
10851104 		kfree(origin_path);
....@@ -1106,7 +1125,7 @@
11061125 	kfree(upperredirect);
11071126 out:
11081127 	kfree(d.redirect);
1109
-	ovl_revert_creds(old_cred);
1128
+	ovl_revert_creds(dentry->d_sb, old_cred);
11101129 	return ERR_PTR(err);
11111130 }
11121131 
....@@ -1136,7 +1155,7 @@
11361155 		struct dentry *this;
11371156 		struct dentry *lowerdir = poe->lowerstack[i].dentry;
11381157 
1139
-		this = lookup_one_len_unlocked(name->name, lowerdir,
1158
+		this = lookup_positive_unlocked(name->name, lowerdir,
11401159 					       name->len);
11411160 		if (IS_ERR(this)) {
11421161 			switch (PTR_ERR(this)) {
....@@ -1153,14 +1172,12 @@
11531172 				break;
11541173 			}
11551174 		} else {
1156
-			if (this->d_inode) {
1157
-				positive = !ovl_is_whiteout(this);
1158
-				done = true;
1159
-			}
1175
+			positive = !ovl_is_whiteout(this);
1176
+			done = true;
11601177 			dput(this);
11611178 		}
11621179 	}
1163
-	ovl_revert_creds(old_cred);
1180
+	ovl_revert_creds(dentry->d_sb, old_cred);
11641181 
11651182 	return positive;
11661183 }