dir.c

   1/*
   2  FUSE: Filesystem in Userspace
   3  Copyright (C) 2001-2008  Miklos Szeredi <miklos@szeredi.hu>
   4
   5  This program can be distributed under the terms of the GNU GPL.
   6  See the file COPYING.
   7*/
   8
   9#include "fuse_i.h"
  10
  11#include <linux/pagemap.h>
  12#include <linux/file.h>
  13#include <linux/fs_context.h>
  14#include <linux/moduleparam.h>
  15#include <linux/sched.h>
  16#include <linux/namei.h>
  17#include <linux/slab.h>
  18#include <linux/xattr.h>
  19#include <linux/iversion.h>
  20#include <linux/posix_acl.h>
  21#include <linux/security.h>
  22#include <linux/types.h>
  23#include <linux/kernel.h>
  24
  25static bool __read_mostly allow_sys_admin_access;
  26module_param(allow_sys_admin_access, bool, 0644);
  27MODULE_PARM_DESC(allow_sys_admin_access,
  28		 "Allow users with CAP_SYS_ADMIN in initial userns to bypass allow_other access check");
  29
  30struct dentry_bucket {
  31	struct rb_root tree;
  32	spinlock_t lock;
  33};
  34
  35#define FUSE_HASH_BITS	5
  36#define FUSE_HASH_SIZE	(1 << FUSE_HASH_BITS)
  37static struct dentry_bucket dentry_hash[FUSE_HASH_SIZE];
  38struct delayed_work dentry_tree_work;
  39
  40/* Minimum invalidation work queue frequency */
  41#define FUSE_DENTRY_INVAL_FREQ_MIN 5
  42
  43unsigned __read_mostly inval_wq;
  44static int inval_wq_set(const char *val, const struct kernel_param *kp)
  45{
  46	unsigned int num;
  47	unsigned int old = inval_wq;
  48	int ret;
  49
  50	if (!val)
  51		return -EINVAL;
  52
  53	ret = kstrtouint(val, 0, &num);
  54	if (ret)
  55		return ret;
  56
  57	if ((num < FUSE_DENTRY_INVAL_FREQ_MIN) && (num != 0))
  58		return -EINVAL;
  59
  60	/* This should prevent overflow in secs_to_jiffies() */
  61	if (num > USHRT_MAX)
  62		return -EINVAL;
  63
  64	*((unsigned int *)kp->arg) = num;
  65
  66	if (num && !old)
  67		schedule_delayed_work(&dentry_tree_work,
  68				      secs_to_jiffies(num));
  69	else if (!num && old)
  70		cancel_delayed_work_sync(&dentry_tree_work);
  71
  72	return 0;
  73}
  74static const struct kernel_param_ops inval_wq_ops = {
  75	.set = inval_wq_set,
  76	.get = param_get_uint,
  77};
  78module_param_cb(inval_wq, &inval_wq_ops, &inval_wq, 0644);
  79__MODULE_PARM_TYPE(inval_wq, "uint");
  80MODULE_PARM_DESC(inval_wq,
  81		 "Dentries invalidation work queue period in secs (>= "
  82		 __stringify(FUSE_DENTRY_INVAL_FREQ_MIN) ").");
  83
  84static inline struct dentry_bucket *get_dentry_bucket(struct dentry *dentry)
  85{
  86	int i = hash_ptr(dentry, FUSE_HASH_BITS);
  87
  88	return &dentry_hash[i];
  89}
  90
  91static void fuse_advise_use_readdirplus(struct inode *dir)
  92{
  93	struct fuse_inode *fi = get_fuse_inode(dir);
  94
  95	set_bit(FUSE_I_ADVISE_RDPLUS, &fi->state);
  96}
  97
  98struct fuse_dentry {
  99	u64 time;
 100	union {
 101		struct rcu_head rcu;
 102		struct rb_node node;
 103	};
 104	struct dentry *dentry;
 105};
 106
 107static void __fuse_dentry_tree_del_node(struct fuse_dentry *fd,
 108					struct dentry_bucket *bucket)
 109{
 110	if (!RB_EMPTY_NODE(&fd->node)) {
 111		rb_erase(&fd->node, &bucket->tree);
 112		RB_CLEAR_NODE(&fd->node);
 113	}
 114}
 115
 116static void fuse_dentry_tree_del_node(struct dentry *dentry)
 117{
 118	struct fuse_dentry *fd = dentry->d_fsdata;
 119	struct dentry_bucket *bucket = get_dentry_bucket(dentry);
 120
 121	spin_lock(&bucket->lock);
 122	__fuse_dentry_tree_del_node(fd, bucket);
 123	spin_unlock(&bucket->lock);
 124}
 125
 126static void fuse_dentry_tree_add_node(struct dentry *dentry)
 127{
 128	struct fuse_dentry *fd = dentry->d_fsdata;
 129	struct dentry_bucket *bucket;
 130	struct fuse_dentry *cur;
 131	struct rb_node **p, *parent = NULL;
 132
 133	if (!inval_wq)
 134		return;
 135
 136	bucket = get_dentry_bucket(dentry);
 137
 138	spin_lock(&bucket->lock);
 139
 140	__fuse_dentry_tree_del_node(fd, bucket);
 141
 142	p = &bucket->tree.rb_node;
 143	while (*p) {
 144		parent = *p;
 145		cur = rb_entry(*p, struct fuse_dentry, node);
 146		if (fd->time < cur->time)
 147			p = &(*p)->rb_left;
 148		else
 149			p = &(*p)->rb_right;
 150	}
 151	rb_link_node(&fd->node, parent, p);
 152	rb_insert_color(&fd->node, &bucket->tree);
 153	spin_unlock(&bucket->lock);
 154}
 155
 156/*
 157 * work queue which, when enabled, will periodically check for expired dentries
 158 * in the dentries tree.
 159 */
 160static void fuse_dentry_tree_work(struct work_struct *work)
 161{
 162	LIST_HEAD(dispose);
 163	struct fuse_dentry *fd;
 164	struct rb_node *node;
 165	int i;
 166
 167	for (i = 0; i < FUSE_HASH_SIZE; i++) {
 168		spin_lock(&dentry_hash[i].lock);
 169		node = rb_first(&dentry_hash[i].tree);
 170		while (node) {
 171			fd = rb_entry(node, struct fuse_dentry, node);
 172			if (!time_before64(fd->time, get_jiffies_64()))
 173				break;
 174
 175			rb_erase(&fd->node, &dentry_hash[i].tree);
 176			RB_CLEAR_NODE(&fd->node);
 177			spin_lock(&fd->dentry->d_lock);
 178			/* If dentry is still referenced, let next dput release it */
 179			fd->dentry->d_flags |= DCACHE_OP_DELETE;
 180			spin_unlock(&fd->dentry->d_lock);
 181			d_dispose_if_unused(fd->dentry, &dispose);
 182			if (need_resched()) {
 183				spin_unlock(&dentry_hash[i].lock);
 184				cond_resched();
 185				spin_lock(&dentry_hash[i].lock);
 186			}
 187			node = rb_first(&dentry_hash[i].tree);
 188		}
 189		spin_unlock(&dentry_hash[i].lock);
 190	}
 191	shrink_dentry_list(&dispose);
 192
 193	if (inval_wq)
 194		schedule_delayed_work(&dentry_tree_work,
 195				      secs_to_jiffies(inval_wq));
 196}
 197
 198void fuse_epoch_work(struct work_struct *work)
 199{
 200	struct fuse_conn *fc = container_of(work, struct fuse_conn,
 201					    epoch_work);
 202	struct fuse_mount *fm;
 203	struct inode *inode;
 204
 205	down_read(&fc->killsb);
 206
 207	inode = fuse_ilookup(fc, FUSE_ROOT_ID, &fm);
 208	if (inode) {
 209		iput(inode);
 210		/* Remove all possible active references to cached inodes */
 211		shrink_dcache_sb(fm->sb);
 212	} else
 213		pr_warn("Failed to get root inode");
 214
 215	up_read(&fc->killsb);
 216}
 217
 218void fuse_dentry_tree_init(void)
 219{
 220	int i;
 221
 222	for (i = 0; i < FUSE_HASH_SIZE; i++) {
 223		spin_lock_init(&dentry_hash[i].lock);
 224		dentry_hash[i].tree = RB_ROOT;
 225	}
 226	INIT_DELAYED_WORK(&dentry_tree_work, fuse_dentry_tree_work);
 227}
 228
 229void fuse_dentry_tree_cleanup(void)
 230{
 231	int i;
 232
 233	inval_wq = 0;
 234	cancel_delayed_work_sync(&dentry_tree_work);
 235
 236	for (i = 0; i < FUSE_HASH_SIZE; i++)
 237		WARN_ON_ONCE(!RB_EMPTY_ROOT(&dentry_hash[i].tree));
 238}
 239
 240static inline void __fuse_dentry_settime(struct dentry *dentry, u64 time)
 241{
 242	((struct fuse_dentry *) dentry->d_fsdata)->time = time;
 243}
 244
 245static inline u64 fuse_dentry_time(const struct dentry *entry)
 246{
 247	return ((struct fuse_dentry *) entry->d_fsdata)->time;
 248}
 249
 250static void fuse_dentry_settime(struct dentry *dentry, u64 time)
 251{
 252	struct fuse_conn *fc = get_fuse_conn_super(dentry->d_sb);
 253	bool delete = !time && fc->delete_stale;
 254	/*
 255	 * Mess with DCACHE_OP_DELETE because dput() will be faster without it.
 256	 * Don't care about races, either way it's just an optimization
 257	 */
 258	if ((!delete && (dentry->d_flags & DCACHE_OP_DELETE)) ||
 259	    (delete && !(dentry->d_flags & DCACHE_OP_DELETE))) {
 260		spin_lock(&dentry->d_lock);
 261		if (!delete)
 262			dentry->d_flags &= ~DCACHE_OP_DELETE;
 263		else
 264			dentry->d_flags |= DCACHE_OP_DELETE;
 265		spin_unlock(&dentry->d_lock);
 266	}
 267
 268	__fuse_dentry_settime(dentry, time);
 269	fuse_dentry_tree_add_node(dentry);
 270}
 271
 272/*
 273 * FUSE caches dentries and attributes with separate timeout.  The
 274 * time in jiffies until the dentry/attributes are valid is stored in
 275 * dentry->d_fsdata and fuse_inode->i_time respectively.
 276 */
 277
 278/*
 279 * Calculate the time in jiffies until a dentry/attributes are valid
 280 */
 281u64 fuse_time_to_jiffies(u64 sec, u32 nsec)
 282{
 283	if (sec || nsec) {
 284		struct timespec64 ts = {
 285			sec,
 286			min_t(u32, nsec, NSEC_PER_SEC - 1)
 287		};
 288
 289		return get_jiffies_64() + timespec64_to_jiffies(&ts);
 290	} else
 291		return 0;
 292}
 293
 294/*
 295 * Set dentry and possibly attribute timeouts from the lookup/mk*
 296 * replies
 297 */
 298void fuse_change_entry_timeout(struct dentry *entry, struct fuse_entry_out *o)
 299{
 300	fuse_dentry_settime(entry,
 301		fuse_time_to_jiffies(o->entry_valid, o->entry_valid_nsec));
 302}
 303
 304void fuse_invalidate_attr_mask(struct inode *inode, u32 mask)
 305{
 306	set_mask_bits(&get_fuse_inode(inode)->inval_mask, 0, mask);
 307}
 308
 309/*
 310 * Mark the attributes as stale, so that at the next call to
 311 * ->getattr() they will be fetched from userspace
 312 */
 313void fuse_invalidate_attr(struct inode *inode)
 314{
 315	fuse_invalidate_attr_mask(inode, STATX_BASIC_STATS);
 316}
 317
 318static void fuse_dir_changed(struct inode *dir)
 319{
 320	fuse_invalidate_attr(dir);
 321	inode_maybe_inc_iversion(dir, false);
 322}
 323
 324/*
 325 * Mark the attributes as stale due to an atime change.  Avoid the invalidate if
 326 * atime is not used.
 327 */
 328void fuse_invalidate_atime(struct inode *inode)
 329{
 330	if (!IS_RDONLY(inode))
 331		fuse_invalidate_attr_mask(inode, STATX_ATIME);
 332}
 333
 334/*
 335 * Just mark the entry as stale, so that a next attempt to look it up
 336 * will result in a new lookup call to userspace
 337 *
 338 * This is called when a dentry is about to become negative and the
 339 * timeout is unknown (unlink, rmdir, rename and in some cases
 340 * lookup)
 341 */
 342void fuse_invalidate_entry_cache(struct dentry *entry)
 343{
 344	fuse_dentry_settime(entry, 0);
 345}
 346
 347/*
 348 * Same as fuse_invalidate_entry_cache(), but also try to remove the
 349 * dentry from the hash
 350 */
 351static void fuse_invalidate_entry(struct dentry *entry)
 352{
 353	d_invalidate(entry);
 354	fuse_invalidate_entry_cache(entry);
 355}
 356
 357static void fuse_lookup_init(struct fuse_conn *fc, struct fuse_args *args,
 358			     u64 nodeid, const struct qstr *name,
 359			     struct fuse_entry_out *outarg)
 360{
 361	memset(outarg, 0, sizeof(struct fuse_entry_out));
 362	args->opcode = FUSE_LOOKUP;
 363	args->nodeid = nodeid;
 364	args->in_numargs = 3;
 365	fuse_set_zero_arg0(args);
 366	args->in_args[1].size = name->len;
 367	args->in_args[1].value = name->name;
 368	args->in_args[2].size = 1;
 369	args->in_args[2].value = "";
 370	args->out_numargs = 1;
 371	args->out_args[0].size = sizeof(struct fuse_entry_out);
 372	args->out_args[0].value = outarg;
 373}
 374
 375/*
 376 * Check whether the dentry is still valid
 377 *
 378 * If the entry validity timeout has expired and the dentry is
 379 * positive, try to redo the lookup.  If the lookup results in a
 380 * different inode, then let the VFS invalidate the dentry and redo
 381 * the lookup once more.  If the lookup results in the same inode,
 382 * then refresh the attributes, timeouts and mark the dentry valid.
 383 */
 384static int fuse_dentry_revalidate(struct inode *dir, const struct qstr *name,
 385				  struct dentry *entry, unsigned int flags)
 386{
 387	struct inode *inode;
 388	struct fuse_mount *fm;
 389	struct fuse_conn *fc;
 390	struct fuse_inode *fi;
 391	int ret;
 392
 393	fc = get_fuse_conn_super(dir->i_sb);
 394	if (entry->d_time < atomic_read(&fc->epoch))
 395		goto invalid;
 396
 397	inode = d_inode_rcu(entry);
 398	if (inode && fuse_is_bad(inode))
 399		goto invalid;
 400	else if (time_before64(fuse_dentry_time(entry), get_jiffies_64()) ||
 401		 (flags & (LOOKUP_EXCL | LOOKUP_REVAL | LOOKUP_RENAME_TARGET))) {
 402		struct fuse_entry_out outarg;
 403		FUSE_ARGS(args);
 404		struct fuse_forget_link *forget;
 405		u64 attr_version;
 406
 407		/* For negative dentries, always do a fresh lookup */
 408		if (!inode)
 409			goto invalid;
 410
 411		ret = -ECHILD;
 412		if (flags & LOOKUP_RCU)
 413			goto out;
 414
 415		fm = get_fuse_mount(inode);
 416
 417		forget = fuse_alloc_forget();
 418		ret = -ENOMEM;
 419		if (!forget)
 420			goto out;
 421
 422		attr_version = fuse_get_attr_version(fm->fc);
 423
 424		fuse_lookup_init(fm->fc, &args, get_node_id(dir),
 425				 name, &outarg);
 426		ret = fuse_simple_request(fm, &args);
 427		/* Zero nodeid is same as -ENOENT */
 428		if (!ret && !outarg.nodeid)
 429			ret = -ENOENT;
 430		if (!ret) {
 431			fi = get_fuse_inode(inode);
 432			if (outarg.nodeid != get_node_id(inode) ||
 433			    (bool) IS_AUTOMOUNT(inode) != (bool) (outarg.attr.flags & FUSE_ATTR_SUBMOUNT)) {
 434				fuse_queue_forget(fm->fc, forget,
 435						  outarg.nodeid, 1);
 436				goto invalid;
 437			}
 438			spin_lock(&fi->lock);
 439			fi->nlookup++;
 440			spin_unlock(&fi->lock);
 441		}
 442		kfree(forget);
 443		if (ret == -ENOMEM || ret == -EINTR)
 444			goto out;
 445		if (ret || fuse_invalid_attr(&outarg.attr) ||
 446		    fuse_stale_inode(inode, outarg.generation, &outarg.attr))
 447			goto invalid;
 448
 449		forget_all_cached_acls(inode);
 450		fuse_change_attributes(inode, &outarg.attr, NULL,
 451				       ATTR_TIMEOUT(&outarg),
 452				       attr_version);
 453		fuse_change_entry_timeout(entry, &outarg);
 454	} else if (inode) {
 455		fi = get_fuse_inode(inode);
 456		if (flags & LOOKUP_RCU) {
 457			if (test_bit(FUSE_I_INIT_RDPLUS, &fi->state))
 458				return -ECHILD;
 459		} else if (test_and_clear_bit(FUSE_I_INIT_RDPLUS, &fi->state)) {
 460			fuse_advise_use_readdirplus(dir);
 461		}
 462	}
 463	ret = 1;
 464out:
 465	return ret;
 466
 467invalid:
 468	ret = 0;
 469	goto out;
 470}
 471
 472static int fuse_dentry_init(struct dentry *dentry)
 473{
 474	struct fuse_dentry *fd;
 475
 476	fd = kzalloc(sizeof(struct fuse_dentry),
 477			  GFP_KERNEL_ACCOUNT | __GFP_RECLAIMABLE);
 478	if (!fd)
 479		return -ENOMEM;
 480
 481	fd->dentry = dentry;
 482	RB_CLEAR_NODE(&fd->node);
 483	dentry->d_fsdata = fd;
 484
 485	return 0;
 486}
 487
 488static void fuse_dentry_release(struct dentry *dentry)
 489{
 490	struct fuse_dentry *fd = dentry->d_fsdata;
 491
 492	if (!RB_EMPTY_NODE(&fd->node))
 493		fuse_dentry_tree_del_node(dentry);
 494	kfree_rcu(fd, rcu);
 495}
 496
 497static int fuse_dentry_delete(const struct dentry *dentry)
 498{
 499	return time_before64(fuse_dentry_time(dentry), get_jiffies_64());
 500}
 501
 502/*
 503 * Create a fuse_mount object with a new superblock (with path->dentry
 504 * as the root), and return that mount so it can be auto-mounted on
 505 * @path.
 506 */
 507static struct vfsmount *fuse_dentry_automount(struct path *path)
 508{
 509	struct fs_context *fsc;
 510	struct vfsmount *mnt;
 511	struct fuse_inode *mp_fi = get_fuse_inode(d_inode(path->dentry));
 512
 513	fsc = fs_context_for_submount(path->mnt->mnt_sb->s_type, path->dentry);
 514	if (IS_ERR(fsc))
 515		return ERR_CAST(fsc);
 516
 517	/* Pass the FUSE inode of the mount for fuse_get_tree_submount() */
 518	fsc->fs_private = mp_fi;
 519
 520	/* Create the submount */
 521	mnt = fc_mount(fsc);
 522	put_fs_context(fsc);
 523	return mnt;
 524}
 525
 526const struct dentry_operations fuse_dentry_operations = {
 527	.d_revalidate	= fuse_dentry_revalidate,
 528	.d_delete	= fuse_dentry_delete,
 529	.d_init		= fuse_dentry_init,
 530	.d_release	= fuse_dentry_release,
 531	.d_automount	= fuse_dentry_automount,
 532};
 533
 534int fuse_valid_type(int m)
 535{
 536	return S_ISREG(m) || S_ISDIR(m) || S_ISLNK(m) || S_ISCHR(m) ||
 537		S_ISBLK(m) || S_ISFIFO(m) || S_ISSOCK(m);
 538}
 539
 540static bool fuse_valid_size(u64 size)
 541{
 542	return size <= LLONG_MAX;
 543}
 544
 545bool fuse_invalid_attr(struct fuse_attr *attr)
 546{
 547	return !fuse_valid_type(attr->mode) || !fuse_valid_size(attr->size);
 548}
 549
 550int fuse_lookup_name(struct super_block *sb, u64 nodeid, const struct qstr *name,
 551		     struct fuse_entry_out *outarg, struct inode **inode)
 552{
 553	struct fuse_mount *fm = get_fuse_mount_super(sb);
 554	FUSE_ARGS(args);
 555	struct fuse_forget_link *forget;
 556	u64 attr_version, evict_ctr;
 557	int err;
 558
 559	*inode = NULL;
 560	err = -ENAMETOOLONG;
 561	if (name->len > fm->fc->name_max)
 562		goto out;
 563
 564
 565	forget = fuse_alloc_forget();
 566	err = -ENOMEM;
 567	if (!forget)
 568		goto out;
 569
 570	attr_version = fuse_get_attr_version(fm->fc);
 571	evict_ctr = fuse_get_evict_ctr(fm->fc);
 572
 573	fuse_lookup_init(fm->fc, &args, nodeid, name, outarg);
 574	err = fuse_simple_request(fm, &args);
 575	/* Zero nodeid is same as -ENOENT, but with valid timeout */
 576	if (err || !outarg->nodeid)
 577		goto out_put_forget;
 578
 579	err = -EIO;
 580	if (fuse_invalid_attr(&outarg->attr))
 581		goto out_put_forget;
 582	if (outarg->nodeid == FUSE_ROOT_ID && outarg->generation != 0) {
 583		pr_warn_once("root generation should be zero\n");
 584		outarg->generation = 0;
 585	}
 586
 587	*inode = fuse_iget(sb, outarg->nodeid, outarg->generation,
 588			   &outarg->attr, ATTR_TIMEOUT(outarg),
 589			   attr_version, evict_ctr);
 590	err = -ENOMEM;
 591	if (!*inode) {
 592		fuse_queue_forget(fm->fc, forget, outarg->nodeid, 1);
 593		goto out;
 594	}
 595	err = 0;
 596
 597 out_put_forget:
 598	kfree(forget);
 599 out:
 600	return err;
 601}
 602
 603static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
 604				  unsigned int flags)
 605{
 606	struct fuse_entry_out outarg;
 607	struct fuse_conn *fc;
 608	struct inode *inode;
 609	struct dentry *newent;
 610	int err, epoch;
 611	bool outarg_valid = true;
 612	bool locked;
 613
 614	if (fuse_is_bad(dir))
 615		return ERR_PTR(-EIO);
 616
 617	fc = get_fuse_conn_super(dir->i_sb);
 618	epoch = atomic_read(&fc->epoch);
 619
 620	locked = fuse_lock_inode(dir);
 621	err = fuse_lookup_name(dir->i_sb, get_node_id(dir), &entry->d_name,
 622			       &outarg, &inode);
 623	fuse_unlock_inode(dir, locked);
 624	if (err == -ENOENT) {
 625		outarg_valid = false;
 626		err = 0;
 627	}
 628	if (err)
 629		goto out_err;
 630
 631	err = -EIO;
 632	if (inode && get_node_id(inode) == FUSE_ROOT_ID)
 633		goto out_iput;
 634
 635	newent = d_splice_alias(inode, entry);
 636	err = PTR_ERR(newent);
 637	if (IS_ERR(newent))
 638		goto out_err;
 639
 640	entry = newent ? newent : entry;
 641	entry->d_time = epoch;
 642	if (outarg_valid)
 643		fuse_change_entry_timeout(entry, &outarg);
 644	else
 645		fuse_invalidate_entry_cache(entry);
 646
 647	if (inode)
 648		fuse_advise_use_readdirplus(dir);
 649	return newent;
 650
 651 out_iput:
 652	iput(inode);
 653 out_err:
 654	return ERR_PTR(err);
 655}
 656
 657static int get_security_context(struct dentry *entry, umode_t mode,
 658				struct fuse_in_arg *ext)
 659{
 660	struct fuse_secctx *fctx;
 661	struct fuse_secctx_header *header;
 662	struct lsm_context lsmctx = { };
 663	void *ptr;
 664	u32 total_len = sizeof(*header);
 665	int err, nr_ctx = 0;
 666	const char *name = NULL;
 667	size_t namesize;
 668
 669	err = security_dentry_init_security(entry, mode, &entry->d_name,
 670					    &name, &lsmctx);
 671
 672	/* If no LSM is supporting this security hook ignore error */
 673	if (err && err != -EOPNOTSUPP)
 674		goto out_err;
 675
 676	if (lsmctx.len) {
 677		nr_ctx = 1;
 678		namesize = strlen(name) + 1;
 679		err = -EIO;
 680		if (WARN_ON(namesize > XATTR_NAME_MAX + 1 ||
 681		    lsmctx.len > S32_MAX))
 682			goto out_err;
 683		total_len += FUSE_REC_ALIGN(sizeof(*fctx) + namesize +
 684					    lsmctx.len);
 685	}
 686
 687	err = -ENOMEM;
 688	header = ptr = kzalloc(total_len, GFP_KERNEL);
 689	if (!ptr)
 690		goto out_err;
 691
 692	header->nr_secctx = nr_ctx;
 693	header->size = total_len;
 694	ptr += sizeof(*header);
 695	if (nr_ctx) {
 696		fctx = ptr;
 697		fctx->size = lsmctx.len;
 698		ptr += sizeof(*fctx);
 699
 700		strscpy(ptr, name, namesize);
 701		ptr += namesize;
 702
 703		memcpy(ptr, lsmctx.context, lsmctx.len);
 704	}
 705	ext->size = total_len;
 706	ext->value = header;
 707	err = 0;
 708out_err:
 709	if (nr_ctx)
 710		security_release_secctx(&lsmctx);
 711	return err;
 712}
 713
 714static void *extend_arg(struct fuse_in_arg *buf, u32 bytes)
 715{
 716	void *p;
 717	u32 newlen = buf->size + bytes;
 718
 719	p = krealloc(buf->value, newlen, GFP_KERNEL);
 720	if (!p) {
 721		kfree(buf->value);
 722		buf->size = 0;
 723		buf->value = NULL;
 724		return NULL;
 725	}
 726
 727	memset(p + buf->size, 0, bytes);
 728	buf->value = p;
 729	buf->size = newlen;
 730
 731	return p + newlen - bytes;
 732}
 733
 734static u32 fuse_ext_size(size_t size)
 735{
 736	return FUSE_REC_ALIGN(sizeof(struct fuse_ext_header) + size);
 737}
 738
 739/*
 740 * This adds just a single supplementary group that matches the parent's group.
 741 */
 742static int get_create_supp_group(struct mnt_idmap *idmap,
 743				 struct inode *dir,
 744				 struct fuse_in_arg *ext)
 745{
 746	struct fuse_conn *fc = get_fuse_conn(dir);
 747	struct fuse_ext_header *xh;
 748	struct fuse_supp_groups *sg;
 749	kgid_t kgid = dir->i_gid;
 750	vfsgid_t vfsgid = make_vfsgid(idmap, fc->user_ns, kgid);
 751	gid_t parent_gid = from_kgid(fc->user_ns, kgid);
 752
 753	u32 sg_len = fuse_ext_size(sizeof(*sg) + sizeof(sg->groups[0]));
 754
 755	if (parent_gid == (gid_t) -1 || vfsgid_eq_kgid(vfsgid, current_fsgid()) ||
 756	    !vfsgid_in_group_p(vfsgid))
 757		return 0;
 758
 759	xh = extend_arg(ext, sg_len);
 760	if (!xh)
 761		return -ENOMEM;
 762
 763	xh->size = sg_len;
 764	xh->type = FUSE_EXT_GROUPS;
 765
 766	sg = (struct fuse_supp_groups *) &xh[1];
 767	sg->nr_groups = 1;
 768	sg->groups[0] = parent_gid;
 769
 770	return 0;
 771}
 772
 773static int get_create_ext(struct mnt_idmap *idmap,
 774			  struct fuse_args *args,
 775			  struct inode *dir, struct dentry *dentry,
 776			  umode_t mode)
 777{
 778	struct fuse_conn *fc = get_fuse_conn_super(dentry->d_sb);
 779	struct fuse_in_arg ext = { .size = 0, .value = NULL };
 780	int err = 0;
 781
 782	if (fc->init_security)
 783		err = get_security_context(dentry, mode, &ext);
 784	if (!err && fc->create_supp_group)
 785		err = get_create_supp_group(idmap, dir, &ext);
 786
 787	if (!err && ext.size) {
 788		WARN_ON(args->in_numargs >= ARRAY_SIZE(args->in_args));
 789		args->is_ext = true;
 790		args->ext_idx = args->in_numargs++;
 791		args->in_args[args->ext_idx] = ext;
 792	} else {
 793		kfree(ext.value);
 794	}
 795
 796	return err;
 797}
 798
 799static void free_ext_value(struct fuse_args *args)
 800{
 801	if (args->is_ext)
 802		kfree(args->in_args[args->ext_idx].value);
 803}
 804
 805/*
 806 * Atomic create+open operation
 807 *
 808 * If the filesystem doesn't support this, then fall back to separate
 809 * 'mknod' + 'open' requests.
 810 */
 811static int fuse_create_open(struct mnt_idmap *idmap, struct inode *dir,
 812			    struct dentry *entry, struct file *file,
 813			    unsigned int flags, umode_t mode, u32 opcode)
 814{
 815	struct inode *inode;
 816	struct fuse_mount *fm = get_fuse_mount(dir);
 817	FUSE_ARGS(args);
 818	struct fuse_forget_link *forget;
 819	struct fuse_create_in inarg;
 820	struct fuse_open_out *outopenp;
 821	struct fuse_entry_out outentry;
 822	struct fuse_inode *fi;
 823	struct fuse_file *ff;
 824	int epoch, err;
 825	bool trunc = flags & O_TRUNC;
 826
 827	/* Userspace expects S_IFREG in create mode */
 828	BUG_ON((mode & S_IFMT) != S_IFREG);
 829
 830	epoch = atomic_read(&fm->fc->epoch);
 831	forget = fuse_alloc_forget();
 832	err = -ENOMEM;
 833	if (!forget)
 834		goto out_err;
 835
 836	err = -ENOMEM;
 837	ff = fuse_file_alloc(fm, true);
 838	if (!ff)
 839		goto out_put_forget_req;
 840
 841	if (!fm->fc->dont_mask)
 842		mode &= ~current_umask();
 843
 844	flags &= ~O_NOCTTY;
 845	memset(&inarg, 0, sizeof(inarg));
 846	memset(&outentry, 0, sizeof(outentry));
 847	inarg.flags = flags;
 848	inarg.mode = mode;
 849	inarg.umask = current_umask();
 850
 851	if (fm->fc->handle_killpriv_v2 && trunc &&
 852	    !(flags & O_EXCL) && !capable(CAP_FSETID)) {
 853		inarg.open_flags |= FUSE_OPEN_KILL_SUIDGID;
 854	}
 855
 856	args.opcode = opcode;
 857	args.nodeid = get_node_id(dir);
 858	args.in_numargs = 2;
 859	args.in_args[0].size = sizeof(inarg);
 860	args.in_args[0].value = &inarg;
 861	args.in_args[1].size = entry->d_name.len + 1;
 862	args.in_args[1].value = entry->d_name.name;
 863	args.out_numargs = 2;
 864	args.out_args[0].size = sizeof(outentry);
 865	args.out_args[0].value = &outentry;
 866	/* Store outarg for fuse_finish_open() */
 867	outopenp = &ff->args->open_outarg;
 868	args.out_args[1].size = sizeof(*outopenp);
 869	args.out_args[1].value = outopenp;
 870
 871	err = get_create_ext(idmap, &args, dir, entry, mode);
 872	if (err)
 873		goto out_free_ff;
 874
 875	err = fuse_simple_idmap_request(idmap, fm, &args);
 876	free_ext_value(&args);
 877	if (err)
 878		goto out_free_ff;
 879
 880	err = -EIO;
 881	if (!S_ISREG(outentry.attr.mode) || invalid_nodeid(outentry.nodeid) ||
 882	    fuse_invalid_attr(&outentry.attr))
 883		goto out_free_ff;
 884
 885	ff->fh = outopenp->fh;
 886	ff->nodeid = outentry.nodeid;
 887	ff->open_flags = outopenp->open_flags;
 888	inode = fuse_iget(dir->i_sb, outentry.nodeid, outentry.generation,
 889			  &outentry.attr, ATTR_TIMEOUT(&outentry), 0, 0);
 890	if (!inode) {
 891		flags &= ~(O_CREAT | O_EXCL | O_TRUNC);
 892		fuse_sync_release(NULL, ff, flags);
 893		fuse_queue_forget(fm->fc, forget, outentry.nodeid, 1);
 894		err = -ENOMEM;
 895		goto out_err;
 896	}
 897	kfree(forget);
 898	d_instantiate(entry, inode);
 899	entry->d_time = epoch;
 900	fuse_change_entry_timeout(entry, &outentry);
 901	fuse_dir_changed(dir);
 902	err = generic_file_open(inode, file);
 903	if (!err) {
 904		file->private_data = ff;
 905		err = finish_open(file, entry, fuse_finish_open);
 906	}
 907	if (err) {
 908		fi = get_fuse_inode(inode);
 909		fuse_sync_release(fi, ff, flags);
 910	} else {
 911		if (fm->fc->atomic_o_trunc && trunc)
 912			truncate_pagecache(inode, 0);
 913		else if (!(ff->open_flags & FOPEN_KEEP_CACHE))
 914			invalidate_inode_pages2(inode->i_mapping);
 915	}
 916	return err;
 917
 918out_free_ff:
 919	fuse_file_free(ff);
 920out_put_forget_req:
 921	kfree(forget);
 922out_err:
 923	return err;
 924}
 925
 926static int fuse_mknod(struct mnt_idmap *, struct inode *, struct dentry *,
 927		      umode_t, dev_t);
 928static int fuse_atomic_open(struct inode *dir, struct dentry *entry,
 929			    struct file *file, unsigned flags,
 930			    umode_t mode)
 931{
 932	int err;
 933	struct mnt_idmap *idmap = file_mnt_idmap(file);
 934	struct fuse_conn *fc = get_fuse_conn(dir);
 935
 936	if (fuse_is_bad(dir))
 937		return -EIO;
 938
 939	if (d_in_lookup(entry)) {
 940		struct dentry *res = fuse_lookup(dir, entry, 0);
 941		if (res || d_really_is_positive(entry))
 942			return finish_no_open(file, res);
 943	}
 944
 945	if (!(flags & O_CREAT))
 946		return finish_no_open(file, NULL);
 947
 948	/* Only creates */
 949	file->f_mode |= FMODE_CREATED;
 950
 951	if (fc->no_create)
 952		goto mknod;
 953
 954	err = fuse_create_open(idmap, dir, entry, file, flags, mode, FUSE_CREATE);
 955	if (err == -ENOSYS) {
 956		fc->no_create = 1;
 957		goto mknod;
 958	} else if (err == -EEXIST)
 959		fuse_invalidate_entry(entry);
 960	return err;
 961
 962mknod:
 963	err = fuse_mknod(idmap, dir, entry, mode, 0);
 964	if (err)
 965		return err;
 966	return finish_no_open(file, NULL);
 967}
 968
 969/*
 970 * Code shared between mknod, mkdir, symlink and link
 971 */
 972static struct dentry *create_new_entry(struct mnt_idmap *idmap, struct fuse_mount *fm,
 973				       struct fuse_args *args, struct inode *dir,
 974				       struct dentry *entry, umode_t mode)
 975{
 976	struct fuse_entry_out outarg;
 977	struct inode *inode;
 978	struct dentry *d;
 979	struct fuse_forget_link *forget;
 980	int epoch, err;
 981
 982	if (fuse_is_bad(dir))
 983		return ERR_PTR(-EIO);
 984
 985	epoch = atomic_read(&fm->fc->epoch);
 986
 987	forget = fuse_alloc_forget();
 988	if (!forget)
 989		return ERR_PTR(-ENOMEM);
 990
 991	memset(&outarg, 0, sizeof(outarg));
 992	args->nodeid = get_node_id(dir);
 993	args->out_numargs = 1;
 994	args->out_args[0].size = sizeof(outarg);
 995	args->out_args[0].value = &outarg;
 996
 997	if (args->opcode != FUSE_LINK) {
 998		err = get_create_ext(idmap, args, dir, entry, mode);
 999		if (err)
1000			goto out_put_forget_req;
1001	}
1002
1003	err = fuse_simple_idmap_request(idmap, fm, args);
1004	free_ext_value(args);
1005	if (err)
1006		goto out_put_forget_req;
1007
1008	err = -EIO;
1009	if (invalid_nodeid(outarg.nodeid) || fuse_invalid_attr(&outarg.attr))
1010		goto out_put_forget_req;
1011
1012	if ((outarg.attr.mode ^ mode) & S_IFMT)
1013		goto out_put_forget_req;
1014
1015	inode = fuse_iget(dir->i_sb, outarg.nodeid, outarg.generation,
1016			  &outarg.attr, ATTR_TIMEOUT(&outarg), 0, 0);
1017	if (!inode) {
1018		fuse_queue_forget(fm->fc, forget, outarg.nodeid, 1);
1019		return ERR_PTR(-ENOMEM);
1020	}
1021	kfree(forget);
1022
1023	d_drop(entry);
1024	d = d_splice_alias(inode, entry);
1025	if (IS_ERR(d))
1026		return d;
1027
1028	if (d) {
1029		d->d_time = epoch;
1030		fuse_change_entry_timeout(d, &outarg);
1031	} else {
1032		entry->d_time = epoch;
1033		fuse_change_entry_timeout(entry, &outarg);
1034	}
1035	fuse_dir_changed(dir);
1036	return d;
1037
1038 out_put_forget_req:
1039	if (err == -EEXIST)
1040		fuse_invalidate_entry(entry);
1041	kfree(forget);
1042	return ERR_PTR(err);
1043}
1044
1045static int create_new_nondir(struct mnt_idmap *idmap, struct fuse_mount *fm,
1046			     struct fuse_args *args, struct inode *dir,
1047			     struct dentry *entry, umode_t mode)
1048{
1049	/*
1050	 * Note that when creating anything other than a directory we
1051	 * can be sure create_new_entry() will NOT return an alternate
1052	 * dentry as d_splice_alias() only returns an alternate dentry
1053	 * for directories.  So we don't need to check for that case
1054	 * when passing back the result.
1055	 */
1056	WARN_ON_ONCE(S_ISDIR(mode));
1057
1058	return PTR_ERR(create_new_entry(idmap, fm, args, dir, entry, mode));
1059}
1060
1061static int fuse_mknod(struct mnt_idmap *idmap, struct inode *dir,
1062		      struct dentry *entry, umode_t mode, dev_t rdev)
1063{
1064	struct fuse_mknod_in inarg;
1065	struct fuse_mount *fm = get_fuse_mount(dir);
1066	FUSE_ARGS(args);
1067
1068	if (!fm->fc->dont_mask)
1069		mode &= ~current_umask();
1070
1071	memset(&inarg, 0, sizeof(inarg));
1072	inarg.mode = mode;
1073	inarg.rdev = new_encode_dev(rdev);
1074	inarg.umask = current_umask();
1075	args.opcode = FUSE_MKNOD;
1076	args.in_numargs = 2;
1077	args.in_args[0].size = sizeof(inarg);
1078	args.in_args[0].value = &inarg;
1079	args.in_args[1].size = entry->d_name.len + 1;
1080	args.in_args[1].value = entry->d_name.name;
1081	return create_new_nondir(idmap, fm, &args, dir, entry, mode);
1082}
1083
1084static int fuse_create(struct mnt_idmap *idmap, struct inode *dir,
1085		       struct dentry *entry, umode_t mode, bool excl)
1086{
1087	return fuse_mknod(idmap, dir, entry, mode, 0);
1088}
1089
1090static int fuse_tmpfile(struct mnt_idmap *idmap, struct inode *dir,
1091			struct file *file, umode_t mode)
1092{
1093	struct fuse_conn *fc = get_fuse_conn(dir);
1094	int err;
1095
1096	if (fc->no_tmpfile)
1097		return -EOPNOTSUPP;
1098
1099	err = fuse_create_open(idmap, dir, file->f_path.dentry, file,
1100			       file->f_flags, mode, FUSE_TMPFILE);
1101	if (err == -ENOSYS) {
1102		fc->no_tmpfile = 1;
1103		err = -EOPNOTSUPP;
1104	}
1105	return err;
1106}
1107
1108static struct dentry *fuse_mkdir(struct mnt_idmap *idmap, struct inode *dir,
1109				 struct dentry *entry, umode_t mode)
1110{
1111	struct fuse_mkdir_in inarg;
1112	struct fuse_mount *fm = get_fuse_mount(dir);
1113	FUSE_ARGS(args);
1114
1115	if (!fm->fc->dont_mask)
1116		mode &= ~current_umask();
1117
1118	memset(&inarg, 0, sizeof(inarg));
1119	inarg.mode = mode;
1120	inarg.umask = current_umask();
1121	args.opcode = FUSE_MKDIR;
1122	args.in_numargs = 2;
1123	args.in_args[0].size = sizeof(inarg);
1124	args.in_args[0].value = &inarg;
1125	args.in_args[1].size = entry->d_name.len + 1;
1126	args.in_args[1].value = entry->d_name.name;
1127	return create_new_entry(idmap, fm, &args, dir, entry, S_IFDIR);
1128}
1129
1130static int fuse_symlink(struct mnt_idmap *idmap, struct inode *dir,
1131			struct dentry *entry, const char *link)
1132{
1133	struct fuse_mount *fm = get_fuse_mount(dir);
1134	unsigned len = strlen(link) + 1;
1135	FUSE_ARGS(args);
1136
1137	args.opcode = FUSE_SYMLINK;
1138	args.in_numargs = 3;
1139	fuse_set_zero_arg0(&args);
1140	args.in_args[1].size = entry->d_name.len + 1;
1141	args.in_args[1].value = entry->d_name.name;
1142	args.in_args[2].size = len;
1143	args.in_args[2].value = link;
1144	return create_new_nondir(idmap, fm, &args, dir, entry, S_IFLNK);
1145}
1146
1147void fuse_flush_time_update(struct inode *inode)
1148{
1149	int err = sync_inode_metadata(inode, 1);
1150
1151	mapping_set_error(inode->i_mapping, err);
1152}
1153
1154static void fuse_update_ctime_in_cache(struct inode *inode)
1155{
1156	if (!IS_NOCMTIME(inode)) {
1157		inode_set_ctime_current(inode);
1158		mark_inode_dirty_sync(inode);
1159		fuse_flush_time_update(inode);
1160	}
1161}
1162
1163void fuse_update_ctime(struct inode *inode)
1164{
1165	fuse_invalidate_attr_mask(inode, STATX_CTIME);
1166	fuse_update_ctime_in_cache(inode);
1167}
1168
1169static void fuse_entry_unlinked(struct dentry *entry)
1170{
1171	struct inode *inode = d_inode(entry);
1172	struct fuse_conn *fc = get_fuse_conn(inode);
1173	struct fuse_inode *fi = get_fuse_inode(inode);
1174
1175	spin_lock(&fi->lock);
1176	fi->attr_version = atomic64_inc_return(&fc->attr_version);
1177	/*
1178	 * If i_nlink == 0 then unlink doesn't make sense, yet this can
1179	 * happen if userspace filesystem is careless.  It would be
1180	 * difficult to enforce correct nlink usage so just ignore this
1181	 * condition here
1182	 */
1183	if (S_ISDIR(inode->i_mode))
1184		clear_nlink(inode);
1185	else if (inode->i_nlink > 0)
1186		drop_nlink(inode);
1187	spin_unlock(&fi->lock);
1188	fuse_invalidate_entry_cache(entry);
1189	fuse_update_ctime(inode);
1190}
1191
1192static int fuse_unlink(struct inode *dir, struct dentry *entry)
1193{
1194	int err;
1195	struct fuse_mount *fm = get_fuse_mount(dir);
1196	FUSE_ARGS(args);
1197
1198	if (fuse_is_bad(dir))
1199		return -EIO;
1200
1201	args.opcode = FUSE_UNLINK;
1202	args.nodeid = get_node_id(dir);
1203	args.in_numargs = 2;
1204	fuse_set_zero_arg0(&args);
1205	args.in_args[1].size = entry->d_name.len + 1;
1206	args.in_args[1].value = entry->d_name.name;
1207	err = fuse_simple_request(fm, &args);
1208	if (!err) {
1209		fuse_dir_changed(dir);
1210		fuse_entry_unlinked(entry);
1211	} else if (err == -EINTR || err == -ENOENT)
1212		fuse_invalidate_entry(entry);
1213	return err;
1214}
1215
1216static int fuse_rmdir(struct inode *dir, struct dentry *entry)
1217{
1218	int err;
1219	struct fuse_mount *fm = get_fuse_mount(dir);
1220	FUSE_ARGS(args);
1221
1222	if (fuse_is_bad(dir))
1223		return -EIO;
1224
1225	args.opcode = FUSE_RMDIR;
1226	args.nodeid = get_node_id(dir);
1227	args.in_numargs = 2;
1228	fuse_set_zero_arg0(&args);
1229	args.in_args[1].size = entry->d_name.len + 1;
1230	args.in_args[1].value = entry->d_name.name;
1231	err = fuse_simple_request(fm, &args);
1232	if (!err) {
1233		fuse_dir_changed(dir);
1234		fuse_entry_unlinked(entry);
1235	} else if (err == -EINTR || err == -ENOENT)
1236		fuse_invalidate_entry(entry);
1237	return err;
1238}
1239
1240static int fuse_rename_common(struct mnt_idmap *idmap, struct inode *olddir, struct dentry *oldent,
1241			      struct inode *newdir, struct dentry *newent,
1242			      unsigned int flags, int opcode, size_t argsize)
1243{
1244	int err;
1245	struct fuse_rename2_in inarg;
1246	struct fuse_mount *fm = get_fuse_mount(olddir);
1247	FUSE_ARGS(args);
1248
1249	memset(&inarg, 0, argsize);
1250	inarg.newdir = get_node_id(newdir);
1251	inarg.flags = flags;
1252	args.opcode = opcode;
1253	args.nodeid = get_node_id(olddir);
1254	args.in_numargs = 3;
1255	args.in_args[0].size = argsize;
1256	args.in_args[0].value = &inarg;
1257	args.in_args[1].size = oldent->d_name.len + 1;
1258	args.in_args[1].value = oldent->d_name.name;
1259	args.in_args[2].size = newent->d_name.len + 1;
1260	args.in_args[2].value = newent->d_name.name;
1261	err = fuse_simple_idmap_request(idmap, fm, &args);
1262	if (!err) {
1263		/* ctime changes */
1264		fuse_update_ctime(d_inode(oldent));
1265
1266		if (flags & RENAME_EXCHANGE)
1267			fuse_update_ctime(d_inode(newent));
1268
1269		fuse_dir_changed(olddir);
1270		if (olddir != newdir)
1271			fuse_dir_changed(newdir);
1272
1273		/* newent will end up negative */
1274		if (!(flags & RENAME_EXCHANGE) && d_really_is_positive(newent))
1275			fuse_entry_unlinked(newent);
1276	} else if (err == -EINTR || err == -ENOENT) {
1277		/* If request was interrupted, DEITY only knows if the
1278		   rename actually took place.  If the invalidation
1279		   fails (e.g. some process has CWD under the renamed
1280		   directory), then there can be inconsistency between
1281		   the dcache and the real filesystem.  Tough luck. */
1282		fuse_invalidate_entry(oldent);
1283		if (d_really_is_positive(newent))
1284			fuse_invalidate_entry(newent);
1285	}
1286
1287	return err;
1288}
1289
1290static int fuse_rename2(struct mnt_idmap *idmap, struct inode *olddir,
1291			struct dentry *oldent, struct inode *newdir,
1292			struct dentry *newent, unsigned int flags)
1293{
1294	struct fuse_conn *fc = get_fuse_conn(olddir);
1295	int err;
1296
1297	if (fuse_is_bad(olddir))
1298		return -EIO;
1299
1300	if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT))
1301		return -EINVAL;
1302
1303	if (flags) {
1304		if (fc->no_rename2 || fc->minor < 23)
1305			return -EINVAL;
1306
1307		err = fuse_rename_common((flags & RENAME_WHITEOUT) ? idmap : &invalid_mnt_idmap,
1308					 olddir, oldent, newdir, newent, flags,
1309					 FUSE_RENAME2,
1310					 sizeof(struct fuse_rename2_in));
1311		if (err == -ENOSYS) {
1312			fc->no_rename2 = 1;
1313			err = -EINVAL;
1314		}
1315	} else {
1316		err = fuse_rename_common(&invalid_mnt_idmap, olddir, oldent, newdir, newent, 0,
1317					 FUSE_RENAME,
1318					 sizeof(struct fuse_rename_in));
1319	}
1320
1321	return err;
1322}
1323
1324static int fuse_link(struct dentry *entry, struct inode *newdir,
1325		     struct dentry *newent)
1326{
1327	int err;
1328	struct fuse_link_in inarg;
1329	struct inode *inode = d_inode(entry);
1330	struct fuse_mount *fm = get_fuse_mount(inode);
1331	FUSE_ARGS(args);
1332
1333	if (fm->fc->no_link)
1334		goto out;
1335
1336	memset(&inarg, 0, sizeof(inarg));
1337	inarg.oldnodeid = get_node_id(inode);
1338	args.opcode = FUSE_LINK;
1339	args.in_numargs = 2;
1340	args.in_args[0].size = sizeof(inarg);
1341	args.in_args[0].value = &inarg;
1342	args.in_args[1].size = newent->d_name.len + 1;
1343	args.in_args[1].value = newent->d_name.name;
1344	err = create_new_nondir(&invalid_mnt_idmap, fm, &args, newdir, newent, inode->i_mode);
1345	if (!err)
1346		fuse_update_ctime_in_cache(inode);
1347	else if (err == -EINTR)
1348		fuse_invalidate_attr(inode);
1349
1350	if (err == -ENOSYS)
1351		fm->fc->no_link = 1;
1352out:
1353	if (fm->fc->no_link)
1354		return -EPERM;
1355
1356	return err;
1357}
1358
1359static void fuse_fillattr(struct mnt_idmap *idmap, struct inode *inode,
1360			  struct fuse_attr *attr, struct kstat *stat)
1361{
1362	unsigned int blkbits;
1363	struct fuse_conn *fc = get_fuse_conn(inode);
1364	vfsuid_t vfsuid = make_vfsuid(idmap, fc->user_ns,
1365				      make_kuid(fc->user_ns, attr->uid));
1366	vfsgid_t vfsgid = make_vfsgid(idmap, fc->user_ns,
1367				      make_kgid(fc->user_ns, attr->gid));
1368
1369	stat->dev = inode->i_sb->s_dev;
1370	stat->ino = attr->ino;
1371	stat->mode = (inode->i_mode & S_IFMT) | (attr->mode & 07777);
1372	stat->nlink = attr->nlink;
1373	stat->uid = vfsuid_into_kuid(vfsuid);
1374	stat->gid = vfsgid_into_kgid(vfsgid);
1375	stat->rdev = inode->i_rdev;
1376	stat->atime.tv_sec = attr->atime;
1377	stat->atime.tv_nsec = attr->atimensec;
1378	stat->mtime.tv_sec = attr->mtime;
1379	stat->mtime.tv_nsec = attr->mtimensec;
1380	stat->ctime.tv_sec = attr->ctime;
1381	stat->ctime.tv_nsec = attr->ctimensec;
1382	stat->size = attr->size;
1383	stat->blocks = attr->blocks;
1384
1385	if (attr->blksize != 0)
1386		blkbits = ilog2(attr->blksize);
1387	else
1388		blkbits = inode->i_sb->s_blocksize_bits;
1389
1390	stat->blksize = 1 << blkbits;
1391}
1392
1393static void fuse_statx_to_attr(struct fuse_statx *sx, struct fuse_attr *attr)
1394{
1395	memset(attr, 0, sizeof(*attr));
1396	attr->ino = sx->ino;
1397	attr->size = sx->size;
1398	attr->blocks = sx->blocks;
1399	attr->atime = sx->atime.tv_sec;
1400	attr->mtime = sx->mtime.tv_sec;
1401	attr->ctime = sx->ctime.tv_sec;
1402	attr->atimensec = sx->atime.tv_nsec;
1403	attr->mtimensec = sx->mtime.tv_nsec;
1404	attr->ctimensec = sx->ctime.tv_nsec;
1405	attr->mode = sx->mode;
1406	attr->nlink = sx->nlink;
1407	attr->uid = sx->uid;
1408	attr->gid = sx->gid;
1409	attr->rdev = new_encode_dev(MKDEV(sx->rdev_major, sx->rdev_minor));
1410	attr->blksize = sx->blksize;
1411}
1412
1413static int fuse_do_statx(struct mnt_idmap *idmap, struct inode *inode,
1414			 struct file *file, struct kstat *stat)
1415{
1416	int err;
1417	struct fuse_attr attr;
1418	struct fuse_statx *sx;
1419	struct fuse_statx_in inarg;
1420	struct fuse_statx_out outarg;
1421	struct fuse_mount *fm = get_fuse_mount(inode);
1422	u64 attr_version = fuse_get_attr_version(fm->fc);
1423	FUSE_ARGS(args);
1424
1425	memset(&inarg, 0, sizeof(inarg));
1426	memset(&outarg, 0, sizeof(outarg));
1427	/* Directories have separate file-handle space */
1428	if (file && S_ISREG(inode->i_mode)) {
1429		struct fuse_file *ff = file->private_data;
1430
1431		inarg.getattr_flags |= FUSE_GETATTR_FH;
1432		inarg.fh = ff->fh;
1433	}
1434	/* For now leave sync hints as the default, request all stats. */
1435	inarg.sx_flags = 0;
1436	inarg.sx_mask = STATX_BASIC_STATS | STATX_BTIME;
1437	args.opcode = FUSE_STATX;
1438	args.nodeid = get_node_id(inode);
1439	args.in_numargs = 1;
1440	args.in_args[0].size = sizeof(inarg);
1441	args.in_args[0].value = &inarg;
1442	args.out_numargs = 1;
1443	args.out_args[0].size = sizeof(outarg);
1444	args.out_args[0].value = &outarg;
1445	err = fuse_simple_request(fm, &args);
1446	if (err)
1447		return err;
1448
1449	sx = &outarg.stat;
1450	if (((sx->mask & STATX_SIZE) && !fuse_valid_size(sx->size)) ||
1451	    ((sx->mask & STATX_TYPE) && (!fuse_valid_type(sx->mode) ||
1452					 inode_wrong_type(inode, sx->mode)))) {
1453		fuse_make_bad(inode);
1454		return -EIO;
1455	}
1456
1457	fuse_statx_to_attr(&outarg.stat, &attr);
1458	if ((sx->mask & STATX_BASIC_STATS) == STATX_BASIC_STATS) {
1459		fuse_change_attributes(inode, &attr, &outarg.stat,
1460				       ATTR_TIMEOUT(&outarg), attr_version);
1461	}
1462
1463	if (stat) {
1464		stat->result_mask = sx->mask & (STATX_BASIC_STATS | STATX_BTIME);
1465		stat->btime.tv_sec = sx->btime.tv_sec;
1466		stat->btime.tv_nsec = min_t(u32, sx->btime.tv_nsec, NSEC_PER_SEC - 1);
1467		fuse_fillattr(idmap, inode, &attr, stat);
1468		stat->result_mask |= STATX_TYPE;
1469	}
1470
1471	return 0;
1472}
1473
1474static int fuse_do_getattr(struct mnt_idmap *idmap, struct inode *inode,
1475			   struct kstat *stat, struct file *file)
1476{
1477	int err;
1478	struct fuse_getattr_in inarg;
1479	struct fuse_attr_out outarg;
1480	struct fuse_mount *fm = get_fuse_mount(inode);
1481	FUSE_ARGS(args);
1482	u64 attr_version;
1483
1484	attr_version = fuse_get_attr_version(fm->fc);
1485
1486	memset(&inarg, 0, sizeof(inarg));
1487	memset(&outarg, 0, sizeof(outarg));
1488	/* Directories have separate file-handle space */
1489	if (file && S_ISREG(inode->i_mode)) {
1490		struct fuse_file *ff = file->private_data;
1491
1492		inarg.getattr_flags |= FUSE_GETATTR_FH;
1493		inarg.fh = ff->fh;
1494	}
1495	args.opcode = FUSE_GETATTR;
1496	args.nodeid = get_node_id(inode);
1497	args.in_numargs = 1;
1498	args.in_args[0].size = sizeof(inarg);
1499	args.in_args[0].value = &inarg;
1500	args.out_numargs = 1;
1501	args.out_args[0].size = sizeof(outarg);
1502	args.out_args[0].value = &outarg;
1503	err = fuse_simple_request(fm, &args);
1504	if (!err) {
1505		if (fuse_invalid_attr(&outarg.attr) ||
1506		    inode_wrong_type(inode, outarg.attr.mode)) {
1507			fuse_make_bad(inode);
1508			err = -EIO;
1509		} else {
1510			fuse_change_attributes(inode, &outarg.attr, NULL,
1511					       ATTR_TIMEOUT(&outarg),
1512					       attr_version);
1513			if (stat)
1514				fuse_fillattr(idmap, inode, &outarg.attr, stat);
1515		}
1516	}
1517	return err;
1518}
1519
1520static int fuse_update_get_attr(struct mnt_idmap *idmap, struct inode *inode,
1521				struct file *file, struct kstat *stat,
1522				u32 request_mask, unsigned int flags)
1523{
1524	struct fuse_inode *fi = get_fuse_inode(inode);
1525	struct fuse_conn *fc = get_fuse_conn(inode);
1526	int err = 0;
1527	bool sync;
1528	u32 inval_mask = READ_ONCE(fi->inval_mask);
1529	u32 cache_mask = fuse_get_cache_mask(inode);
1530
1531
1532	/* FUSE only supports basic stats and possibly btime */
1533	request_mask &= STATX_BASIC_STATS | STATX_BTIME;
1534retry:
1535	if (fc->no_statx)
1536		request_mask &= STATX_BASIC_STATS;
1537
1538	if (!request_mask)
1539		sync = false;
1540	else if (flags & AT_STATX_FORCE_SYNC)
1541		sync = true;
1542	else if (flags & AT_STATX_DONT_SYNC)
1543		sync = false;
1544	else if (request_mask & inval_mask & ~cache_mask)
1545		sync = true;
1546	else
1547		sync = time_before64(fi->i_time, get_jiffies_64());
1548
1549	if (sync) {
1550		forget_all_cached_acls(inode);
1551		/* Try statx if BTIME is requested */
1552		if (!fc->no_statx && (request_mask & ~STATX_BASIC_STATS)) {
1553			err = fuse_do_statx(idmap, inode, file, stat);
1554			if (err == -ENOSYS) {
1555				fc->no_statx = 1;
1556				err = 0;
1557				goto retry;
1558			}
1559		} else {
1560			err = fuse_do_getattr(idmap, inode, stat, file);
1561		}
1562	} else if (stat) {
1563		generic_fillattr(idmap, request_mask, inode, stat);
1564		stat->mode = fi->orig_i_mode;
1565		stat->ino = fi->orig_ino;
1566		stat->blksize = 1 << fi->cached_i_blkbits;
1567		if (test_bit(FUSE_I_BTIME, &fi->state)) {
1568			stat->btime = fi->i_btime;
1569			stat->result_mask |= STATX_BTIME;
1570		}
1571	}
1572
1573	return err;
1574}
1575
1576int fuse_update_attributes(struct inode *inode, struct file *file, u32 mask)
1577{
1578	return fuse_update_get_attr(&nop_mnt_idmap, inode, file, NULL, mask, 0);
1579}
1580
1581int fuse_reverse_inval_entry(struct fuse_conn *fc, u64 parent_nodeid,
1582			     u64 child_nodeid, struct qstr *name, u32 flags)
1583{
1584	int err = -ENOTDIR;
1585	struct inode *parent;
1586	struct dentry *dir = NULL;
1587	struct dentry *entry = NULL;
1588
1589	parent = fuse_ilookup(fc, parent_nodeid, NULL);
1590	if (!parent)
1591		return -ENOENT;
1592
1593	if (!S_ISDIR(parent->i_mode))
1594		goto put_parent;
1595
1596	err = -ENOENT;
1597	dir = d_find_alias(parent);
1598	if (!dir)
1599		goto put_parent;
1600	while (!entry) {
1601		struct dentry *child = try_lookup_noperm(name, dir);
1602		if (!child || IS_ERR(child))
1603			goto put_parent;
1604		entry = start_removing_dentry(dir, child);
1605		dput(child);
1606		if (IS_ERR(entry))
1607			goto put_parent;
1608		if (!d_same_name(entry, dir, name)) {
1609			end_removing(entry);
1610			entry = NULL;
1611		}
1612	}
1613
1614	fuse_dir_changed(parent);
1615	if (!(flags & FUSE_EXPIRE_ONLY))
1616		d_invalidate(entry);
1617	fuse_invalidate_entry_cache(entry);
1618
1619	if (child_nodeid != 0) {
1620		inode_lock(d_inode(entry));
1621		if (get_node_id(d_inode(entry)) != child_nodeid) {
1622			err = -ENOENT;
1623			goto badentry;
1624		}
1625		if (d_mountpoint(entry)) {
1626			err = -EBUSY;
1627			goto badentry;
1628		}
1629		if (d_is_dir(entry)) {
1630			shrink_dcache_parent(entry);
1631			if (!simple_empty(entry)) {
1632				err = -ENOTEMPTY;
1633				goto badentry;
1634			}
1635			d_inode(entry)->i_flags |= S_DEAD;
1636		}
1637		dont_mount(entry);
1638		clear_nlink(d_inode(entry));
1639		err = 0;
1640 badentry:
1641		inode_unlock(d_inode(entry));
1642		if (!err)
1643			d_delete(entry);
1644	} else {
1645		err = 0;
1646	}
1647
1648	end_removing(entry);
1649 put_parent:
1650	dput(dir);
1651	iput(parent);
1652	return err;
1653}
1654
1655static inline bool fuse_permissible_uidgid(struct fuse_conn *fc)
1656{
1657	const struct cred *cred = current_cred();
1658
1659	return (uid_eq(cred->euid, fc->user_id) &&
1660		uid_eq(cred->suid, fc->user_id) &&
1661		uid_eq(cred->uid,  fc->user_id) &&
1662		gid_eq(cred->egid, fc->group_id) &&
1663		gid_eq(cred->sgid, fc->group_id) &&
1664		gid_eq(cred->gid,  fc->group_id));
1665}
1666
1667/*
1668 * Calling into a user-controlled filesystem gives the filesystem
1669 * daemon ptrace-like capabilities over the current process.  This
1670 * means, that the filesystem daemon is able to record the exact
1671 * filesystem operations performed, and can also control the behavior
1672 * of the requester process in otherwise impossible ways.  For example
1673 * it can delay the operation for arbitrary length of time allowing
1674 * DoS against the requester.
1675 *
1676 * For this reason only those processes can call into the filesystem,
1677 * for which the owner of the mount has ptrace privilege.  This
1678 * excludes processes started by other users, suid or sgid processes.
1679 */
1680bool fuse_allow_current_process(struct fuse_conn *fc)
1681{
1682	bool allow;
1683
1684	if (fc->allow_other)
1685		allow = current_in_userns(fc->user_ns);
1686	else
1687		allow = fuse_permissible_uidgid(fc);
1688
1689	if (!allow && allow_sys_admin_access && capable(CAP_SYS_ADMIN))
1690		allow = true;
1691
1692	return allow;
1693}
1694
1695static int fuse_access(struct inode *inode, int mask)
1696{
1697	struct fuse_mount *fm = get_fuse_mount(inode);
1698	FUSE_ARGS(args);
1699	struct fuse_access_in inarg;
1700	int err;
1701
1702	BUG_ON(mask & MAY_NOT_BLOCK);
1703
1704	/*
1705	 * We should not send FUSE_ACCESS to the userspace
1706	 * when idmapped mounts are enabled as for this case
1707	 * we have fc->default_permissions = 1 and access
1708	 * permission checks are done on the kernel side.
1709	 */
1710	WARN_ON_ONCE(!(fm->sb->s_iflags & SB_I_NOIDMAP));
1711
1712	if (fm->fc->no_access)
1713		return 0;
1714
1715	memset(&inarg, 0, sizeof(inarg));
1716	inarg.mask = mask & (MAY_READ | MAY_WRITE | MAY_EXEC);
1717	args.opcode = FUSE_ACCESS;
1718	args.nodeid = get_node_id(inode);
1719	args.in_numargs = 1;
1720	args.in_args[0].size = sizeof(inarg);
1721	args.in_args[0].value = &inarg;
1722	err = fuse_simple_request(fm, &args);
1723	if (err == -ENOSYS) {
1724		fm->fc->no_access = 1;
1725		err = 0;
1726	}
1727	return err;
1728}
1729
1730static int fuse_perm_getattr(struct inode *inode, int mask)
1731{
1732	if (mask & MAY_NOT_BLOCK)
1733		return -ECHILD;
1734
1735	forget_all_cached_acls(inode);
1736	return fuse_do_getattr(&nop_mnt_idmap, inode, NULL, NULL);
1737}
1738
1739/*
1740 * Check permission.  The two basic access models of FUSE are:
1741 *
1742 * 1) Local access checking ('default_permissions' mount option) based
1743 * on file mode.  This is the plain old disk filesystem permission
1744 * model.
1745 *
1746 * 2) "Remote" access checking, where server is responsible for
1747 * checking permission in each inode operation.  An exception to this
1748 * is if ->permission() was invoked from sys_access() in which case an
1749 * access request is sent.  Execute permission is still checked
1750 * locally based on file mode.
1751 */
1752static int fuse_permission(struct mnt_idmap *idmap,
1753			   struct inode *inode, int mask)
1754{
1755	struct fuse_conn *fc = get_fuse_conn(inode);
1756	bool refreshed = false;
1757	int err = 0;
1758
1759	if (fuse_is_bad(inode))
1760		return -EIO;
1761
1762	if (!fuse_allow_current_process(fc))
1763		return -EACCES;
1764
1765	/*
1766	 * If attributes are needed, refresh them before proceeding
1767	 */
1768	if (fc->default_permissions ||
1769	    ((mask & MAY_EXEC) && S_ISREG(inode->i_mode))) {
1770		struct fuse_inode *fi = get_fuse_inode(inode);
1771		u32 perm_mask = STATX_MODE | STATX_UID | STATX_GID;
1772
1773		if (perm_mask & READ_ONCE(fi->inval_mask) ||
1774		    time_before64(fi->i_time, get_jiffies_64())) {
1775			refreshed = true;
1776
1777			err = fuse_perm_getattr(inode, mask);
1778			if (err)
1779				return err;
1780		}
1781	}
1782
1783	if (fc->default_permissions) {
1784		err = generic_permission(idmap, inode, mask);
1785
1786		/* If permission is denied, try to refresh file
1787		   attributes.  This is also needed, because the root
1788		   node will at first have no permissions */
1789		if (err == -EACCES && !refreshed) {
1790			err = fuse_perm_getattr(inode, mask);
1791			if (!err)
1792				err = generic_permission(idmap,
1793							 inode, mask);
1794		}
1795
1796		/* Note: the opposite of the above test does not
1797		   exist.  So if permissions are revoked this won't be
1798		   noticed immediately, only after the attribute
1799		   timeout has expired */
1800	} else if (mask & (MAY_ACCESS | MAY_CHDIR)) {
1801		err = fuse_access(inode, mask);
1802	} else if ((mask & MAY_EXEC) && S_ISREG(inode->i_mode)) {
1803		if (!(inode->i_mode & S_IXUGO)) {
1804			if (refreshed)
1805				return -EACCES;
1806
1807			err = fuse_perm_getattr(inode, mask);
1808			if (!err && !(inode->i_mode & S_IXUGO))
1809				return -EACCES;
1810		}
1811	}
1812	return err;
1813}
1814
1815static int fuse_readlink_folio(struct inode *inode, struct folio *folio)
1816{
1817	struct fuse_mount *fm = get_fuse_mount(inode);
1818	struct fuse_folio_desc desc = { .length = folio_size(folio) - 1 };
1819	struct fuse_args_pages ap = {
1820		.num_folios = 1,
1821		.folios = &folio,
1822		.descs = &desc,
1823	};
1824	char *link;
1825	ssize_t res;
1826
1827	ap.args.opcode = FUSE_READLINK;
1828	ap.args.nodeid = get_node_id(inode);
1829	ap.args.out_pages = true;
1830	ap.args.out_argvar = true;
1831	ap.args.page_zeroing = true;
1832	ap.args.out_numargs = 1;
1833	ap.args.out_args[0].size = desc.length;
1834	res = fuse_simple_request(fm, &ap.args);
1835
1836	fuse_invalidate_atime(inode);
1837
1838	if (res < 0)
1839		return res;
1840
1841	if (WARN_ON(res >= PAGE_SIZE))
1842		return -EIO;
1843
1844	link = folio_address(folio);
1845	link[res] = '\0';
1846
1847	return 0;
1848}
1849
1850static const char *fuse_get_link(struct dentry *dentry, struct inode *inode,
1851				 struct delayed_call *callback)
1852{
1853	struct fuse_conn *fc = get_fuse_conn(inode);
1854	struct folio *folio;
1855	int err;
1856
1857	err = -EIO;
1858	if (fuse_is_bad(inode))
1859		goto out_err;
1860
1861	if (fc->cache_symlinks)
1862		return page_get_link_raw(dentry, inode, callback);
1863
1864	err = -ECHILD;
1865	if (!dentry)
1866		goto out_err;
1867
1868	folio = folio_alloc(GFP_KERNEL, 0);
1869	err = -ENOMEM;
1870	if (!folio)
1871		goto out_err;
1872
1873	err = fuse_readlink_folio(inode, folio);
1874	if (err) {
1875		folio_put(folio);
1876		goto out_err;
1877	}
1878
1879	set_delayed_call(callback, page_put_link, folio);
1880
1881	return folio_address(folio);
1882
1883out_err:
1884	return ERR_PTR(err);
1885}
1886
1887static int fuse_dir_open(struct inode *inode, struct file *file)
1888{
1889	struct fuse_mount *fm = get_fuse_mount(inode);
1890	int err;
1891
1892	if (fuse_is_bad(inode))
1893		return -EIO;
1894
1895	err = generic_file_open(inode, file);
1896	if (err)
1897		return err;
1898
1899	err = fuse_do_open(fm, get_node_id(inode), file, true);
1900	if (!err) {
1901		struct fuse_file *ff = file->private_data;
1902
1903		/*
1904		 * Keep handling FOPEN_STREAM and FOPEN_NONSEEKABLE for
1905		 * directories for backward compatibility, though it's unlikely
1906		 * to be useful.
1907		 */
1908		if (ff->open_flags & (FOPEN_STREAM | FOPEN_NONSEEKABLE))
1909			nonseekable_open(inode, file);
1910		if (!(ff->open_flags & FOPEN_KEEP_CACHE))
1911			invalidate_inode_pages2(inode->i_mapping);
1912	}
1913
1914	return err;
1915}
1916
1917static int fuse_dir_release(struct inode *inode, struct file *file)
1918{
1919	fuse_release_common(file, true);
1920
1921	return 0;
1922}
1923
1924static int fuse_dir_fsync(struct file *file, loff_t start, loff_t end,
1925			  int datasync)
1926{
1927	struct inode *inode = file->f_mapping->host;
1928	struct fuse_conn *fc = get_fuse_conn(inode);
1929	int err;
1930
1931	if (fuse_is_bad(inode))
1932		return -EIO;
1933
1934	if (fc->no_fsyncdir)
1935		return 0;
1936
1937	inode_lock(inode);
1938	err = fuse_fsync_common(file, start, end, datasync, FUSE_FSYNCDIR);
1939	if (err == -ENOSYS) {
1940		fc->no_fsyncdir = 1;
1941		err = 0;
1942	}
1943	inode_unlock(inode);
1944
1945	return err;
1946}
1947
1948static long fuse_dir_ioctl(struct file *file, unsigned int cmd,
1949			    unsigned long arg)
1950{
1951	struct fuse_conn *fc = get_fuse_conn(file->f_mapping->host);
1952
1953	/* FUSE_IOCTL_DIR only supported for API version >= 7.18 */
1954	if (fc->minor < 18)
1955		return -ENOTTY;
1956
1957	return fuse_ioctl_common(file, cmd, arg, FUSE_IOCTL_DIR);
1958}
1959
1960static long fuse_dir_compat_ioctl(struct file *file, unsigned int cmd,
1961				   unsigned long arg)
1962{
1963	struct fuse_conn *fc = get_fuse_conn(file->f_mapping->host);
1964
1965	if (fc->minor < 18)
1966		return -ENOTTY;
1967
1968	return fuse_ioctl_common(file, cmd, arg,
1969				 FUSE_IOCTL_COMPAT | FUSE_IOCTL_DIR);
1970}
1971
1972static bool update_mtime(unsigned ivalid, bool trust_local_mtime)
1973{
1974	/* Always update if mtime is explicitly set  */
1975	if (ivalid & ATTR_MTIME_SET)
1976		return true;
1977
1978	/* Or if kernel i_mtime is the official one */
1979	if (trust_local_mtime)
1980		return true;
1981
1982	/* If it's an open(O_TRUNC) or an ftruncate(), don't update */
1983	if ((ivalid & ATTR_SIZE) && (ivalid & (ATTR_OPEN | ATTR_FILE)))
1984		return false;
1985
1986	/* In all other cases update */
1987	return true;
1988}
1989
1990static void iattr_to_fattr(struct mnt_idmap *idmap, struct fuse_conn *fc,
1991			   struct iattr *iattr, struct fuse_setattr_in *arg,
1992			   bool trust_local_cmtime)
1993{
1994	unsigned ivalid = iattr->ia_valid;
1995
1996	if (ivalid & ATTR_MODE)
1997		arg->valid |= FATTR_MODE,   arg->mode = iattr->ia_mode;
1998
1999	if (ivalid & ATTR_UID) {
2000		kuid_t fsuid = from_vfsuid(idmap, fc->user_ns, iattr->ia_vfsuid);
2001
2002		arg->valid |= FATTR_UID;
2003		arg->uid = from_kuid(fc->user_ns, fsuid);
2004	}
2005
2006	if (ivalid & ATTR_GID) {
2007		kgid_t fsgid = from_vfsgid(idmap, fc->user_ns, iattr->ia_vfsgid);
2008
2009		arg->valid |= FATTR_GID;
2010		arg->gid = from_kgid(fc->user_ns, fsgid);
2011	}
2012
2013	if (ivalid & ATTR_SIZE)
2014		arg->valid |= FATTR_SIZE,   arg->size = iattr->ia_size;
2015	if (ivalid & ATTR_ATIME) {
2016		arg->valid |= FATTR_ATIME;
2017		arg->atime = iattr->ia_atime.tv_sec;
2018		arg->atimensec = iattr->ia_atime.tv_nsec;
2019		if (!(ivalid & ATTR_ATIME_SET))
2020			arg->valid |= FATTR_ATIME_NOW;
2021	}
2022	if ((ivalid & ATTR_MTIME) && update_mtime(ivalid, trust_local_cmtime)) {
2023		arg->valid |= FATTR_MTIME;
2024		arg->mtime = iattr->ia_mtime.tv_sec;
2025		arg->mtimensec = iattr->ia_mtime.tv_nsec;
2026		if (!(ivalid & ATTR_MTIME_SET) && !trust_local_cmtime)
2027			arg->valid |= FATTR_MTIME_NOW;
2028	}
2029	if ((ivalid & ATTR_CTIME) && trust_local_cmtime) {
2030		arg->valid |= FATTR_CTIME;
2031		arg->ctime = iattr->ia_ctime.tv_sec;
2032		arg->ctimensec = iattr->ia_ctime.tv_nsec;
2033	}
2034}
2035
2036/*
2037 * Prevent concurrent writepages on inode
2038 *
2039 * This is done by adding a negative bias to the inode write counter
2040 * and waiting for all pending writes to finish.
2041 */
2042void fuse_set_nowrite(struct inode *inode)
2043{
2044	struct fuse_inode *fi = get_fuse_inode(inode);
2045
2046	BUG_ON(!inode_is_locked(inode));
2047
2048	spin_lock(&fi->lock);
2049	BUG_ON(fi->writectr < 0);
2050	fi->writectr += FUSE_NOWRITE;
2051	spin_unlock(&fi->lock);
2052	wait_event(fi->page_waitq, fi->writectr == FUSE_NOWRITE);
2053}
2054
2055/*
2056 * Allow writepages on inode
2057 *
2058 * Remove the bias from the writecounter and send any queued
2059 * writepages.
2060 */
2061static void __fuse_release_nowrite(struct inode *inode)
2062{
2063	struct fuse_inode *fi = get_fuse_inode(inode);
2064
2065	BUG_ON(fi->writectr != FUSE_NOWRITE);
2066	fi->writectr = 0;
2067	fuse_flush_writepages(inode);
2068}
2069
2070void fuse_release_nowrite(struct inode *inode)
2071{
2072	struct fuse_inode *fi = get_fuse_inode(inode);
2073
2074	spin_lock(&fi->lock);
2075	__fuse_release_nowrite(inode);
2076	spin_unlock(&fi->lock);
2077}
2078
2079static void fuse_setattr_fill(struct fuse_conn *fc, struct fuse_args *args,
2080			      struct inode *inode,
2081			      struct fuse_setattr_in *inarg_p,
2082			      struct fuse_attr_out *outarg_p)
2083{
2084	args->opcode = FUSE_SETATTR;
2085	args->nodeid = get_node_id(inode);
2086	args->in_numargs = 1;
2087	args->in_args[0].size = sizeof(*inarg_p);
2088	args->in_args[0].value = inarg_p;
2089	args->out_numargs = 1;
2090	args->out_args[0].size = sizeof(*outarg_p);
2091	args->out_args[0].value = outarg_p;
2092}
2093
2094/*
2095 * Flush inode->i_mtime to the server
2096 */
2097int fuse_flush_times(struct inode *inode, struct fuse_file *ff)
2098{
2099	struct fuse_mount *fm = get_fuse_mount(inode);
2100	FUSE_ARGS(args);
2101	struct fuse_setattr_in inarg;
2102	struct fuse_attr_out outarg;
2103
2104	memset(&inarg, 0, sizeof(inarg));
2105	memset(&outarg, 0, sizeof(outarg));
2106
2107	inarg.valid = FATTR_MTIME;
2108	inarg.mtime = inode_get_mtime_sec(inode);
2109	inarg.mtimensec = inode_get_mtime_nsec(inode);
2110	if (fm->fc->minor >= 23) {
2111		inarg.valid |= FATTR_CTIME;
2112		inarg.ctime = inode_get_ctime_sec(inode);
2113		inarg.ctimensec = inode_get_ctime_nsec(inode);
2114	}
2115	if (ff) {
2116		inarg.valid |= FATTR_FH;
2117		inarg.fh = ff->fh;
2118	}
2119	fuse_setattr_fill(fm->fc, &args, inode, &inarg, &outarg);
2120
2121	return fuse_simple_request(fm, &args);
2122}
2123
2124/*
2125 * Set attributes, and at the same time refresh them.
2126 *
2127 * Truncation is slightly complicated, because the 'truncate' request
2128 * may fail, in which case we don't want to touch the mapping.
2129 * vmtruncate() doesn't allow for this case, so do the rlimit checking
2130 * and the actual truncation by hand.
2131 */
2132int fuse_do_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
2133		    struct iattr *attr, struct file *file)
2134{
2135	struct inode *inode = d_inode(dentry);
2136	struct fuse_mount *fm = get_fuse_mount(inode);
2137	struct fuse_conn *fc = fm->fc;
2138	struct fuse_inode *fi = get_fuse_inode(inode);
2139	struct address_space *mapping = inode->i_mapping;
2140	FUSE_ARGS(args);
2141	struct fuse_setattr_in inarg;
2142	struct fuse_attr_out outarg;
2143	bool is_truncate = false;
2144	bool is_wb = fc->writeback_cache && S_ISREG(inode->i_mode);
2145	loff_t oldsize;
2146	int err;
2147	bool trust_local_cmtime = is_wb;
2148	bool fault_blocked = false;
2149	u64 attr_version;
2150
2151	if (!fc->default_permissions)
2152		attr->ia_valid |= ATTR_FORCE;
2153
2154	err = setattr_prepare(idmap, dentry, attr);
2155	if (err)
2156		return err;
2157
2158	if (attr->ia_valid & ATTR_SIZE) {
2159		if (WARN_ON(!S_ISREG(inode->i_mode)))
2160			return -EIO;
2161		is_truncate = true;
2162	}
2163
2164	if (FUSE_IS_DAX(inode) && is_truncate) {
2165		filemap_invalidate_lock(mapping);
2166		fault_blocked = true;
2167		err = fuse_dax_break_layouts(inode, 0, -1);
2168		if (err) {
2169			filemap_invalidate_unlock(mapping);
2170			return err;
2171		}
2172	}
2173
2174	if (attr->ia_valid & ATTR_OPEN) {
2175		/* This is coming from open(..., ... | O_TRUNC); */
2176		WARN_ON(!(attr->ia_valid & ATTR_SIZE));
2177		WARN_ON(attr->ia_size != 0);
2178		if (fc->atomic_o_trunc) {
2179			/*
2180			 * No need to send request to userspace, since actual
2181			 * truncation has already been done by OPEN.  But still
2182			 * need to truncate page cache.
2183			 */
2184			i_size_write(inode, 0);
2185			truncate_pagecache(inode, 0);
2186			goto out;
2187		}
2188		file = NULL;
2189	}
2190
2191	/* Flush dirty data/metadata before non-truncate SETATTR */
2192	if (is_wb &&
2193	    attr->ia_valid &
2194			(ATTR_MODE | ATTR_UID | ATTR_GID | ATTR_MTIME_SET |
2195			 ATTR_TIMES_SET)) {
2196		err = write_inode_now(inode, true);
2197		if (err)
2198			return err;
2199
2200		fuse_set_nowrite(inode);
2201		fuse_release_nowrite(inode);
2202	}
2203
2204	if (is_truncate) {
2205		fuse_set_nowrite(inode);
2206		set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
2207		if (trust_local_cmtime && attr->ia_size != inode->i_size)
2208			attr->ia_valid |= ATTR_MTIME | ATTR_CTIME;
2209	}
2210
2211	memset(&inarg, 0, sizeof(inarg));
2212	memset(&outarg, 0, sizeof(outarg));
2213	iattr_to_fattr(idmap, fc, attr, &inarg, trust_local_cmtime);
2214	if (file) {
2215		struct fuse_file *ff = file->private_data;
2216		inarg.valid |= FATTR_FH;
2217		inarg.fh = ff->fh;
2218	}
2219
2220	/* Kill suid/sgid for non-directory chown unconditionally */
2221	if (fc->handle_killpriv_v2 && !S_ISDIR(inode->i_mode) &&
2222	    attr->ia_valid & (ATTR_UID | ATTR_GID))
2223		inarg.valid |= FATTR_KILL_SUIDGID;
2224
2225	if (attr->ia_valid & ATTR_SIZE) {
2226		/* For mandatory locking in truncate */
2227		inarg.valid |= FATTR_LOCKOWNER;
2228		inarg.lock_owner = fuse_lock_owner_id(fc, current->files);
2229
2230		/* Kill suid/sgid for truncate only if no CAP_FSETID */
2231		if (fc->handle_killpriv_v2 && !capable(CAP_FSETID))
2232			inarg.valid |= FATTR_KILL_SUIDGID;
2233	}
2234
2235	attr_version = fuse_get_attr_version(fm->fc);
2236	fuse_setattr_fill(fc, &args, inode, &inarg, &outarg);
2237	err = fuse_simple_request(fm, &args);
2238	if (err) {
2239		if (err == -EINTR)
2240			fuse_invalidate_attr(inode);
2241		goto error;
2242	}
2243
2244	if (fuse_invalid_attr(&outarg.attr) ||
2245	    inode_wrong_type(inode, outarg.attr.mode)) {
2246		fuse_make_bad(inode);
2247		err = -EIO;
2248		goto error;
2249	}
2250
2251	spin_lock(&fi->lock);
2252	/* the kernel maintains i_mtime locally */
2253	if (trust_local_cmtime) {
2254		if (attr->ia_valid & ATTR_MTIME)
2255			inode_set_mtime_to_ts(inode, attr->ia_mtime);
2256		if (attr->ia_valid & ATTR_CTIME)
2257			inode_set_ctime_to_ts(inode, attr->ia_ctime);
2258		/* FIXME: clear I_DIRTY_SYNC? */
2259	}
2260
2261	if (fi->attr_version > attr_version) {
2262		/*
2263		 * Apply attributes, for example for fsnotify_change(), but set
2264		 * attribute timeout to zero.
2265		 */
2266		outarg.attr_valid = outarg.attr_valid_nsec = 0;
2267	}
2268
2269	fuse_change_attributes_common(inode, &outarg.attr, NULL,
2270				      ATTR_TIMEOUT(&outarg),
2271				      fuse_get_cache_mask(inode), 0);
2272	oldsize = inode->i_size;
2273	/* see the comment in fuse_change_attributes() */
2274	if (!is_wb || is_truncate)
2275		i_size_write(inode, outarg.attr.size);
2276
2277	if (is_truncate) {
2278		/* NOTE: this may release/reacquire fi->lock */
2279		__fuse_release_nowrite(inode);
2280	}
2281	spin_unlock(&fi->lock);
2282
2283	/*
2284	 * Only call invalidate_inode_pages2() after removing
2285	 * FUSE_NOWRITE, otherwise fuse_launder_folio() would deadlock.
2286	 */
2287	if ((is_truncate || !is_wb) &&
2288	    S_ISREG(inode->i_mode) && oldsize != outarg.attr.size) {
2289		truncate_pagecache(inode, outarg.attr.size);
2290		invalidate_inode_pages2(mapping);
2291	}
2292
2293	clear_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
2294out:
2295	if (fault_blocked)
2296		filemap_invalidate_unlock(mapping);
2297
2298	return 0;
2299
2300error:
2301	if (is_truncate)
2302		fuse_release_nowrite(inode);
2303
2304	clear_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
2305
2306	if (fault_blocked)
2307		filemap_invalidate_unlock(mapping);
2308	return err;
2309}
2310
2311static int fuse_setattr(struct mnt_idmap *idmap, struct dentry *entry,
2312			struct iattr *attr)
2313{
2314	struct inode *inode = d_inode(entry);
2315	struct fuse_conn *fc = get_fuse_conn(inode);
2316	struct file *file = (attr->ia_valid & ATTR_FILE) ? attr->ia_file : NULL;
2317	int ret;
2318
2319	if (fuse_is_bad(inode))
2320		return -EIO;
2321
2322	if (!fuse_allow_current_process(get_fuse_conn(inode)))
2323		return -EACCES;
2324
2325	if (attr->ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID)) {
2326		attr->ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID |
2327				    ATTR_MODE);
2328
2329		/*
2330		 * The only sane way to reliably kill suid/sgid is to do it in
2331		 * the userspace filesystem
2332		 *
2333		 * This should be done on write(), truncate() and chown().
2334		 */
2335		if (!fc->handle_killpriv && !fc->handle_killpriv_v2) {
2336			/*
2337			 * ia_mode calculation may have used stale i_mode.
2338			 * Refresh and recalculate.
2339			 */
2340			ret = fuse_do_getattr(idmap, inode, NULL, file);
2341			if (ret)
2342				return ret;
2343
2344			attr->ia_mode = inode->i_mode;
2345			if (inode->i_mode & S_ISUID) {
2346				attr->ia_valid |= ATTR_MODE;
2347				attr->ia_mode &= ~S_ISUID;
2348			}
2349			if ((inode->i_mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
2350				attr->ia_valid |= ATTR_MODE;
2351				attr->ia_mode &= ~S_ISGID;
2352			}
2353		}
2354	}
2355	if (!attr->ia_valid)
2356		return 0;
2357
2358	ret = fuse_do_setattr(idmap, entry, attr, file);
2359	if (!ret) {
2360		/*
2361		 * If filesystem supports acls it may have updated acl xattrs in
2362		 * the filesystem, so forget cached acls for the inode.
2363		 */
2364		if (fc->posix_acl)
2365			forget_all_cached_acls(inode);
2366
2367		/* Directory mode changed, may need to revalidate access */
2368		if (d_is_dir(entry) && (attr->ia_valid & ATTR_MODE))
2369			fuse_invalidate_entry_cache(entry);
2370	}
2371	return ret;
2372}
2373
2374static int fuse_getattr(struct mnt_idmap *idmap,
2375			const struct path *path, struct kstat *stat,
2376			u32 request_mask, unsigned int flags)
2377{
2378	struct inode *inode = d_inode(path->dentry);
2379	struct fuse_conn *fc = get_fuse_conn(inode);
2380
2381	if (fuse_is_bad(inode))
2382		return -EIO;
2383
2384	if (!fuse_allow_current_process(fc)) {
2385		if (!request_mask) {
2386			/*
2387			 * If user explicitly requested *nothing* then don't
2388			 * error out, but return st_dev only.
2389			 */
2390			stat->result_mask = 0;
2391			stat->dev = inode->i_sb->s_dev;
2392			return 0;
2393		}
2394		return -EACCES;
2395	}
2396
2397	return fuse_update_get_attr(idmap, inode, NULL, stat, request_mask, flags);
2398}
2399
2400static const struct inode_operations fuse_dir_inode_operations = {
2401	.lookup		= fuse_lookup,
2402	.mkdir		= fuse_mkdir,
2403	.symlink	= fuse_symlink,
2404	.unlink		= fuse_unlink,
2405	.rmdir		= fuse_rmdir,
2406	.rename		= fuse_rename2,
2407	.link		= fuse_link,
2408	.setattr	= fuse_setattr,
2409	.create		= fuse_create,
2410	.atomic_open	= fuse_atomic_open,
2411	.tmpfile	= fuse_tmpfile,
2412	.mknod		= fuse_mknod,
2413	.permission	= fuse_permission,
2414	.getattr	= fuse_getattr,
2415	.listxattr	= fuse_listxattr,
2416	.get_inode_acl	= fuse_get_inode_acl,
2417	.get_acl	= fuse_get_acl,
2418	.set_acl	= fuse_set_acl,
2419	.fileattr_get	= fuse_fileattr_get,
2420	.fileattr_set	= fuse_fileattr_set,
2421};
2422
2423static const struct file_operations fuse_dir_operations = {
2424	.llseek		= generic_file_llseek,
2425	.read		= generic_read_dir,
2426	.iterate_shared	= fuse_readdir,
2427	.open		= fuse_dir_open,
2428	.release	= fuse_dir_release,
2429	.fsync		= fuse_dir_fsync,
2430	.unlocked_ioctl	= fuse_dir_ioctl,
2431	.compat_ioctl	= fuse_dir_compat_ioctl,
2432	.setlease	= simple_nosetlease,
2433};
2434
2435static const struct inode_operations fuse_common_inode_operations = {
2436	.setattr	= fuse_setattr,
2437	.permission	= fuse_permission,
2438	.getattr	= fuse_getattr,
2439	.listxattr	= fuse_listxattr,
2440	.get_inode_acl	= fuse_get_inode_acl,
2441	.get_acl	= fuse_get_acl,
2442	.set_acl	= fuse_set_acl,
2443	.fileattr_get	= fuse_fileattr_get,
2444	.fileattr_set	= fuse_fileattr_set,
2445};
2446
2447static const struct inode_operations fuse_symlink_inode_operations = {
2448	.setattr	= fuse_setattr,
2449	.get_link	= fuse_get_link,
2450	.getattr	= fuse_getattr,
2451	.listxattr	= fuse_listxattr,
2452};
2453
2454void fuse_init_common(struct inode *inode)
2455{
2456	inode->i_op = &fuse_common_inode_operations;
2457}
2458
2459void fuse_init_dir(struct inode *inode)
2460{
2461	struct fuse_inode *fi = get_fuse_inode(inode);
2462
2463	inode->i_op = &fuse_dir_inode_operations;
2464	inode->i_fop = &fuse_dir_operations;
2465
2466	spin_lock_init(&fi->rdc.lock);
2467	fi->rdc.cached = false;
2468	fi->rdc.size = 0;
2469	fi->rdc.pos = 0;
2470	fi->rdc.version = 0;
2471}
2472
2473static int fuse_symlink_read_folio(struct file *null, struct folio *folio)
2474{
2475	int err = fuse_readlink_folio(folio->mapping->host, folio);
2476
2477	if (!err)
2478		folio_mark_uptodate(folio);
2479
2480	folio_unlock(folio);
2481
2482	return err;
2483}
2484
2485static const struct address_space_operations fuse_symlink_aops = {
2486	.read_folio	= fuse_symlink_read_folio,
2487};
2488
2489void fuse_init_symlink(struct inode *inode)
2490{
2491	inode->i_op = &fuse_symlink_inode_operations;
2492	inode->i_data.a_ops = &fuse_symlink_aops;
2493	inode_nohighmem(inode);
2494}