namespace.c

   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 *  linux/fs/namespace.c
   4 *
   5 * (C) Copyright Al Viro 2000, 2001
   6 *
   7 * Based on code from fs/super.c, copyright Linus Torvalds and others.
   8 * Heavily rewritten.
   9 */
  10
  11#include <linux/syscalls.h>
  12#include <linux/export.h>
  13#include <linux/capability.h>
  14#include <linux/mnt_namespace.h>
  15#include <linux/user_namespace.h>
  16#include <linux/namei.h>
  17#include <linux/security.h>
  18#include <linux/cred.h>
  19#include <linux/idr.h>
  20#include <linux/init.h>		/* init_rootfs */
  21#include <linux/fs_struct.h>	/* get_fs_root et.al. */
  22#include <linux/fsnotify.h>	/* fsnotify_vfsmount_delete */
  23#include <linux/file.h>
  24#include <linux/uaccess.h>
  25#include <linux/proc_ns.h>
  26#include <linux/magic.h>
  27#include <linux/memblock.h>
  28#include <linux/proc_fs.h>
  29#include <linux/task_work.h>
  30#include <linux/sched/task.h>
  31#include <uapi/linux/mount.h>
  32#include <linux/fs_context.h>
  33#include <linux/shmem_fs.h>
  34#include <linux/mnt_idmapping.h>
  35#include <linux/pidfs.h>
  36#include <linux/nstree.h>
  37
  38#include "pnode.h"
  39#include "internal.h"
  40
  41/* Maximum number of mounts in a mount namespace */
  42static unsigned int sysctl_mount_max __read_mostly = 100000;
  43
  44static unsigned int m_hash_mask __ro_after_init;
  45static unsigned int m_hash_shift __ro_after_init;
  46static unsigned int mp_hash_mask __ro_after_init;
  47static unsigned int mp_hash_shift __ro_after_init;
  48
  49static __initdata unsigned long mhash_entries;
  50static int __init set_mhash_entries(char *str)
  51{
  52	if (!str)
  53		return 0;
  54	mhash_entries = simple_strtoul(str, &str, 0);
  55	return 1;
  56}
  57__setup("mhash_entries=", set_mhash_entries);
  58
  59static __initdata unsigned long mphash_entries;
  60static int __init set_mphash_entries(char *str)
  61{
  62	if (!str)
  63		return 0;
  64	mphash_entries = simple_strtoul(str, &str, 0);
  65	return 1;
  66}
  67__setup("mphash_entries=", set_mphash_entries);
  68
  69static char * __initdata initramfs_options;
  70static int __init initramfs_options_setup(char *str)
  71{
  72	initramfs_options = str;
  73	return 1;
  74}
  75
  76__setup("initramfs_options=", initramfs_options_setup);
  77
  78static u64 event;
  79static DEFINE_XARRAY_FLAGS(mnt_id_xa, XA_FLAGS_ALLOC);
  80static DEFINE_IDA(mnt_group_ida);
  81
  82/* Don't allow confusion with old 32bit mount ID */
  83#define MNT_UNIQUE_ID_OFFSET (1ULL << 31)
  84static u64 mnt_id_ctr = MNT_UNIQUE_ID_OFFSET;
  85
  86static struct hlist_head *mount_hashtable __ro_after_init;
  87static struct hlist_head *mountpoint_hashtable __ro_after_init;
  88static struct kmem_cache *mnt_cache __ro_after_init;
  89static DECLARE_RWSEM(namespace_sem);
  90static HLIST_HEAD(unmounted);	/* protected by namespace_sem */
  91static LIST_HEAD(ex_mountpoints); /* protected by namespace_sem */
  92static struct mnt_namespace *emptied_ns; /* protected by namespace_sem */
  93
  94static inline void namespace_lock(void);
  95static void namespace_unlock(void);
  96DEFINE_LOCK_GUARD_0(namespace_excl, namespace_lock(), namespace_unlock())
  97DEFINE_LOCK_GUARD_0(namespace_shared, down_read(&namespace_sem),
  98				      up_read(&namespace_sem))
  99
 100DEFINE_FREE(mntput, struct vfsmount *, if (!IS_ERR(_T)) mntput(_T))
 101
 102#ifdef CONFIG_FSNOTIFY
 103LIST_HEAD(notify_list); /* protected by namespace_sem */
 104#endif
 105
 106enum mount_kattr_flags_t {
 107	MOUNT_KATTR_RECURSE		= (1 << 0),
 108	MOUNT_KATTR_IDMAP_REPLACE	= (1 << 1),
 109};
 110
 111struct mount_kattr {
 112	unsigned int attr_set;
 113	unsigned int attr_clr;
 114	unsigned int propagation;
 115	unsigned int lookup_flags;
 116	enum mount_kattr_flags_t kflags;
 117	struct user_namespace *mnt_userns;
 118	struct mnt_idmap *mnt_idmap;
 119};
 120
 121/* /sys/fs */
 122struct kobject *fs_kobj __ro_after_init;
 123EXPORT_SYMBOL_GPL(fs_kobj);
 124
 125/*
 126 * vfsmount lock may be taken for read to prevent changes to the
 127 * vfsmount hash, ie. during mountpoint lookups or walking back
 128 * up the tree.
 129 *
 130 * It should be taken for write in all cases where the vfsmount
 131 * tree or hash is modified or when a vfsmount structure is modified.
 132 */
 133__cacheline_aligned_in_smp DEFINE_SEQLOCK(mount_lock);
 134
 135static void mnt_ns_release(struct mnt_namespace *ns)
 136{
 137	/* keep alive for {list,stat}mount() */
 138	if (ns && refcount_dec_and_test(&ns->passive)) {
 139		fsnotify_mntns_delete(ns);
 140		put_user_ns(ns->user_ns);
 141		kfree(ns);
 142	}
 143}
 144DEFINE_FREE(mnt_ns_release, struct mnt_namespace *,
 145	    if (!IS_ERR(_T)) mnt_ns_release(_T))
 146
 147static void mnt_ns_release_rcu(struct rcu_head *rcu)
 148{
 149	mnt_ns_release(container_of(rcu, struct mnt_namespace, ns.ns_rcu));
 150}
 151
 152static void mnt_ns_tree_remove(struct mnt_namespace *ns)
 153{
 154	/* remove from global mount namespace list */
 155	if (ns_tree_active(ns))
 156		ns_tree_remove(ns);
 157
 158	call_rcu(&ns->ns.ns_rcu, mnt_ns_release_rcu);
 159}
 160
 161/*
 162 * Lookup a mount namespace by id and take a passive reference count. Taking a
 163 * passive reference means the mount namespace can be emptied if e.g., the last
 164 * task holding an active reference exits. To access the mounts of the
 165 * namespace the @namespace_sem must first be acquired. If the namespace has
 166 * already shut down before acquiring @namespace_sem, {list,stat}mount() will
 167 * see that the mount rbtree of the namespace is empty.
 168 *
 169 * Note the lookup is lockless protected by a sequence counter. We only
 170 * need to guard against false negatives as false positives aren't
 171 * possible. So if we didn't find a mount namespace and the sequence
 172 * counter has changed we need to retry. If the sequence counter is
 173 * still the same we know the search actually failed.
 174 */
 175static struct mnt_namespace *lookup_mnt_ns(u64 mnt_ns_id)
 176{
 177	struct mnt_namespace *mnt_ns;
 178	struct ns_common *ns;
 179
 180	guard(rcu)();
 181	ns = ns_tree_lookup_rcu(mnt_ns_id, CLONE_NEWNS);
 182	if (!ns)
 183		return NULL;
 184
 185	/*
 186	 * The last reference count is put with RCU delay so we can
 187	 * unconditonally acquire a reference here.
 188	 */
 189	mnt_ns = container_of(ns, struct mnt_namespace, ns);
 190	refcount_inc(&mnt_ns->passive);
 191	return mnt_ns;
 192}
 193
 194static inline void lock_mount_hash(void)
 195{
 196	write_seqlock(&mount_lock);
 197}
 198
 199static inline void unlock_mount_hash(void)
 200{
 201	write_sequnlock(&mount_lock);
 202}
 203
 204static inline struct hlist_head *m_hash(struct vfsmount *mnt, struct dentry *dentry)
 205{
 206	unsigned long tmp = ((unsigned long)mnt / L1_CACHE_BYTES);
 207	tmp += ((unsigned long)dentry / L1_CACHE_BYTES);
 208	tmp = tmp + (tmp >> m_hash_shift);
 209	return &mount_hashtable[tmp & m_hash_mask];
 210}
 211
 212static inline struct hlist_head *mp_hash(struct dentry *dentry)
 213{
 214	unsigned long tmp = ((unsigned long)dentry / L1_CACHE_BYTES);
 215	tmp = tmp + (tmp >> mp_hash_shift);
 216	return &mountpoint_hashtable[tmp & mp_hash_mask];
 217}
 218
 219static int mnt_alloc_id(struct mount *mnt)
 220{
 221	int res;
 222
 223	xa_lock(&mnt_id_xa);
 224	res = __xa_alloc(&mnt_id_xa, &mnt->mnt_id, mnt, xa_limit_31b, GFP_KERNEL);
 225	if (!res)
 226		mnt->mnt_id_unique = ++mnt_id_ctr;
 227	xa_unlock(&mnt_id_xa);
 228	return res;
 229}
 230
 231static void mnt_free_id(struct mount *mnt)
 232{
 233	xa_erase(&mnt_id_xa, mnt->mnt_id);
 234}
 235
 236/*
 237 * Allocate a new peer group ID
 238 */
 239static int mnt_alloc_group_id(struct mount *mnt)
 240{
 241	int res = ida_alloc_min(&mnt_group_ida, 1, GFP_KERNEL);
 242
 243	if (res < 0)
 244		return res;
 245	mnt->mnt_group_id = res;
 246	return 0;
 247}
 248
 249/*
 250 * Release a peer group ID
 251 */
 252void mnt_release_group_id(struct mount *mnt)
 253{
 254	ida_free(&mnt_group_ida, mnt->mnt_group_id);
 255	mnt->mnt_group_id = 0;
 256}
 257
 258/*
 259 * vfsmount lock must be held for read
 260 */
 261static inline void mnt_add_count(struct mount *mnt, int n)
 262{
 263#ifdef CONFIG_SMP
 264	this_cpu_add(mnt->mnt_pcp->mnt_count, n);
 265#else
 266	preempt_disable();
 267	mnt->mnt_count += n;
 268	preempt_enable();
 269#endif
 270}
 271
 272/*
 273 * vfsmount lock must be held for write
 274 */
 275int mnt_get_count(struct mount *mnt)
 276{
 277#ifdef CONFIG_SMP
 278	int count = 0;
 279	int cpu;
 280
 281	for_each_possible_cpu(cpu) {
 282		count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_count;
 283	}
 284
 285	return count;
 286#else
 287	return mnt->mnt_count;
 288#endif
 289}
 290
 291static struct mount *alloc_vfsmnt(const char *name)
 292{
 293	struct mount *mnt = kmem_cache_zalloc(mnt_cache, GFP_KERNEL);
 294	if (mnt) {
 295		int err;
 296
 297		err = mnt_alloc_id(mnt);
 298		if (err)
 299			goto out_free_cache;
 300
 301		if (name)
 302			mnt->mnt_devname = kstrdup_const(name,
 303							 GFP_KERNEL_ACCOUNT);
 304		else
 305			mnt->mnt_devname = "none";
 306		if (!mnt->mnt_devname)
 307			goto out_free_id;
 308
 309#ifdef CONFIG_SMP
 310		mnt->mnt_pcp = alloc_percpu(struct mnt_pcp);
 311		if (!mnt->mnt_pcp)
 312			goto out_free_devname;
 313
 314		this_cpu_add(mnt->mnt_pcp->mnt_count, 1);
 315#else
 316		mnt->mnt_count = 1;
 317		mnt->mnt_writers = 0;
 318#endif
 319
 320		INIT_HLIST_NODE(&mnt->mnt_hash);
 321		INIT_LIST_HEAD(&mnt->mnt_child);
 322		INIT_LIST_HEAD(&mnt->mnt_mounts);
 323		INIT_LIST_HEAD(&mnt->mnt_list);
 324		INIT_LIST_HEAD(&mnt->mnt_expire);
 325		INIT_LIST_HEAD(&mnt->mnt_share);
 326		INIT_HLIST_HEAD(&mnt->mnt_slave_list);
 327		INIT_HLIST_NODE(&mnt->mnt_slave);
 328		INIT_HLIST_NODE(&mnt->mnt_mp_list);
 329		INIT_HLIST_HEAD(&mnt->mnt_stuck_children);
 330		RB_CLEAR_NODE(&mnt->mnt_node);
 331		mnt->mnt.mnt_idmap = &nop_mnt_idmap;
 332	}
 333	return mnt;
 334
 335#ifdef CONFIG_SMP
 336out_free_devname:
 337	kfree_const(mnt->mnt_devname);
 338#endif
 339out_free_id:
 340	mnt_free_id(mnt);
 341out_free_cache:
 342	kmem_cache_free(mnt_cache, mnt);
 343	return NULL;
 344}
 345
 346/*
 347 * Most r/o checks on a fs are for operations that take
 348 * discrete amounts of time, like a write() or unlink().
 349 * We must keep track of when those operations start
 350 * (for permission checks) and when they end, so that
 351 * we can determine when writes are able to occur to
 352 * a filesystem.
 353 */
 354/*
 355 * __mnt_is_readonly: check whether a mount is read-only
 356 * @mnt: the mount to check for its write status
 357 *
 358 * This shouldn't be used directly ouside of the VFS.
 359 * It does not guarantee that the filesystem will stay
 360 * r/w, just that it is right *now*.  This can not and
 361 * should not be used in place of IS_RDONLY(inode).
 362 * mnt_want/drop_write() will _keep_ the filesystem
 363 * r/w.
 364 */
 365bool __mnt_is_readonly(const struct vfsmount *mnt)
 366{
 367	return (mnt->mnt_flags & MNT_READONLY) || sb_rdonly(mnt->mnt_sb);
 368}
 369EXPORT_SYMBOL_GPL(__mnt_is_readonly);
 370
 371static inline void mnt_inc_writers(struct mount *mnt)
 372{
 373#ifdef CONFIG_SMP
 374	this_cpu_inc(mnt->mnt_pcp->mnt_writers);
 375#else
 376	mnt->mnt_writers++;
 377#endif
 378}
 379
 380static inline void mnt_dec_writers(struct mount *mnt)
 381{
 382#ifdef CONFIG_SMP
 383	this_cpu_dec(mnt->mnt_pcp->mnt_writers);
 384#else
 385	mnt->mnt_writers--;
 386#endif
 387}
 388
 389static unsigned int mnt_get_writers(struct mount *mnt)
 390{
 391#ifdef CONFIG_SMP
 392	unsigned int count = 0;
 393	int cpu;
 394
 395	for_each_possible_cpu(cpu) {
 396		count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_writers;
 397	}
 398
 399	return count;
 400#else
 401	return mnt->mnt_writers;
 402#endif
 403}
 404
 405static int mnt_is_readonly(const struct vfsmount *mnt)
 406{
 407	if (READ_ONCE(mnt->mnt_sb->s_readonly_remount))
 408		return 1;
 409	/*
 410	 * The barrier pairs with the barrier in sb_start_ro_state_change()
 411	 * making sure if we don't see s_readonly_remount set yet, we also will
 412	 * not see any superblock / mount flag changes done by remount.
 413	 * It also pairs with the barrier in sb_end_ro_state_change()
 414	 * assuring that if we see s_readonly_remount already cleared, we will
 415	 * see the values of superblock / mount flags updated by remount.
 416	 */
 417	smp_rmb();
 418	return __mnt_is_readonly(mnt);
 419}
 420
 421/*
 422 * Most r/o & frozen checks on a fs are for operations that take discrete
 423 * amounts of time, like a write() or unlink().  We must keep track of when
 424 * those operations start (for permission checks) and when they end, so that we
 425 * can determine when writes are able to occur to a filesystem.
 426 */
 427/**
 428 * mnt_get_write_access - get write access to a mount without freeze protection
 429 * @m: the mount on which to take a write
 430 *
 431 * This tells the low-level filesystem that a write is about to be performed to
 432 * it, and makes sure that writes are allowed (mnt it read-write) before
 433 * returning success. This operation does not protect against filesystem being
 434 * frozen. When the write operation is finished, mnt_put_write_access() must be
 435 * called. This is effectively a refcount.
 436 */
 437int mnt_get_write_access(struct vfsmount *m)
 438{
 439	struct mount *mnt = real_mount(m);
 440	int ret = 0;
 441
 442	preempt_disable();
 443	mnt_inc_writers(mnt);
 444	/*
 445	 * The store to mnt_inc_writers must be visible before we pass
 446	 * WRITE_HOLD loop below, so that the slowpath can see our
 447	 * incremented count after it has set WRITE_HOLD.
 448	 */
 449	smp_mb();
 450	might_lock(&mount_lock.lock);
 451	while (__test_write_hold(READ_ONCE(mnt->mnt_pprev_for_sb))) {
 452		if (!IS_ENABLED(CONFIG_PREEMPT_RT)) {
 453			cpu_relax();
 454		} else {
 455			/*
 456			 * This prevents priority inversion, if the task
 457			 * setting WRITE_HOLD got preempted on a remote
 458			 * CPU, and it prevents life lock if the task setting
 459			 * WRITE_HOLD has a lower priority and is bound to
 460			 * the same CPU as the task that is spinning here.
 461			 */
 462			preempt_enable();
 463			read_seqlock_excl(&mount_lock);
 464			read_sequnlock_excl(&mount_lock);
 465			preempt_disable();
 466		}
 467	}
 468	/*
 469	 * The barrier pairs with the barrier sb_start_ro_state_change() making
 470	 * sure that if we see WRITE_HOLD cleared, we will also see
 471	 * s_readonly_remount set (or even SB_RDONLY / MNT_READONLY flags) in
 472	 * mnt_is_readonly() and bail in case we are racing with remount
 473	 * read-only.
 474	 */
 475	smp_rmb();
 476	if (mnt_is_readonly(m)) {
 477		mnt_dec_writers(mnt);
 478		ret = -EROFS;
 479	}
 480	preempt_enable();
 481
 482	return ret;
 483}
 484EXPORT_SYMBOL_GPL(mnt_get_write_access);
 485
 486/**
 487 * mnt_want_write - get write access to a mount
 488 * @m: the mount on which to take a write
 489 *
 490 * This tells the low-level filesystem that a write is about to be performed to
 491 * it, and makes sure that writes are allowed (mount is read-write, filesystem
 492 * is not frozen) before returning success.  When the write operation is
 493 * finished, mnt_drop_write() must be called.  This is effectively a refcount.
 494 */
 495int mnt_want_write(struct vfsmount *m)
 496{
 497	int ret;
 498
 499	sb_start_write(m->mnt_sb);
 500	ret = mnt_get_write_access(m);
 501	if (ret)
 502		sb_end_write(m->mnt_sb);
 503	return ret;
 504}
 505EXPORT_SYMBOL_GPL(mnt_want_write);
 506
 507/**
 508 * mnt_get_write_access_file - get write access to a file's mount
 509 * @file: the file who's mount on which to take a write
 510 *
 511 * This is like mnt_get_write_access, but if @file is already open for write it
 512 * skips incrementing mnt_writers (since the open file already has a reference)
 513 * and instead only does the check for emergency r/o remounts.  This must be
 514 * paired with mnt_put_write_access_file.
 515 */
 516int mnt_get_write_access_file(struct file *file)
 517{
 518	if (file->f_mode & FMODE_WRITER) {
 519		/*
 520		 * Superblock may have become readonly while there are still
 521		 * writable fd's, e.g. due to a fs error with errors=remount-ro
 522		 */
 523		if (__mnt_is_readonly(file->f_path.mnt))
 524			return -EROFS;
 525		return 0;
 526	}
 527	return mnt_get_write_access(file->f_path.mnt);
 528}
 529
 530/**
 531 * mnt_want_write_file - get write access to a file's mount
 532 * @file: the file who's mount on which to take a write
 533 *
 534 * This is like mnt_want_write, but if the file is already open for writing it
 535 * skips incrementing mnt_writers (since the open file already has a reference)
 536 * and instead only does the freeze protection and the check for emergency r/o
 537 * remounts.  This must be paired with mnt_drop_write_file.
 538 */
 539int mnt_want_write_file(struct file *file)
 540{
 541	int ret;
 542
 543	sb_start_write(file_inode(file)->i_sb);
 544	ret = mnt_get_write_access_file(file);
 545	if (ret)
 546		sb_end_write(file_inode(file)->i_sb);
 547	return ret;
 548}
 549EXPORT_SYMBOL_GPL(mnt_want_write_file);
 550
 551/**
 552 * mnt_put_write_access - give up write access to a mount
 553 * @mnt: the mount on which to give up write access
 554 *
 555 * Tells the low-level filesystem that we are done
 556 * performing writes to it.  Must be matched with
 557 * mnt_get_write_access() call above.
 558 */
 559void mnt_put_write_access(struct vfsmount *mnt)
 560{
 561	preempt_disable();
 562	mnt_dec_writers(real_mount(mnt));
 563	preempt_enable();
 564}
 565EXPORT_SYMBOL_GPL(mnt_put_write_access);
 566
 567/**
 568 * mnt_drop_write - give up write access to a mount
 569 * @mnt: the mount on which to give up write access
 570 *
 571 * Tells the low-level filesystem that we are done performing writes to it and
 572 * also allows filesystem to be frozen again.  Must be matched with
 573 * mnt_want_write() call above.
 574 */
 575void mnt_drop_write(struct vfsmount *mnt)
 576{
 577	mnt_put_write_access(mnt);
 578	sb_end_write(mnt->mnt_sb);
 579}
 580EXPORT_SYMBOL_GPL(mnt_drop_write);
 581
 582void mnt_put_write_access_file(struct file *file)
 583{
 584	if (!(file->f_mode & FMODE_WRITER))
 585		mnt_put_write_access(file->f_path.mnt);
 586}
 587
 588void mnt_drop_write_file(struct file *file)
 589{
 590	mnt_put_write_access_file(file);
 591	sb_end_write(file_inode(file)->i_sb);
 592}
 593EXPORT_SYMBOL(mnt_drop_write_file);
 594
 595/**
 596 * mnt_hold_writers - prevent write access to the given mount
 597 * @mnt: mnt to prevent write access to
 598 *
 599 * Prevents write access to @mnt if there are no active writers for @mnt.
 600 * This function needs to be called and return successfully before changing
 601 * properties of @mnt that need to remain stable for callers with write access
 602 * to @mnt.
 603 *
 604 * After this functions has been called successfully callers must pair it with
 605 * a call to mnt_unhold_writers() in order to stop preventing write access to
 606 * @mnt.
 607 *
 608 * Context: This function expects to be in mount_locked_reader scope serializing
 609 *          setting WRITE_HOLD.
 610 * Return: On success 0 is returned.
 611 *	   On error, -EBUSY is returned.
 612 */
 613static inline int mnt_hold_writers(struct mount *mnt)
 614{
 615	set_write_hold(mnt);
 616	/*
 617	 * After storing WRITE_HOLD, we'll read the counters. This store
 618	 * should be visible before we do.
 619	 */
 620	smp_mb();
 621
 622	/*
 623	 * With writers on hold, if this value is zero, then there are
 624	 * definitely no active writers (although held writers may subsequently
 625	 * increment the count, they'll have to wait, and decrement it after
 626	 * seeing MNT_READONLY).
 627	 *
 628	 * It is OK to have counter incremented on one CPU and decremented on
 629	 * another: the sum will add up correctly. The danger would be when we
 630	 * sum up each counter, if we read a counter before it is incremented,
 631	 * but then read another CPU's count which it has been subsequently
 632	 * decremented from -- we would see more decrements than we should.
 633	 * WRITE_HOLD protects against this scenario, because
 634	 * mnt_want_write first increments count, then smp_mb, then spins on
 635	 * WRITE_HOLD, so it can't be decremented by another CPU while
 636	 * we're counting up here.
 637	 */
 638	if (mnt_get_writers(mnt) > 0)
 639		return -EBUSY;
 640
 641	return 0;
 642}
 643
 644/**
 645 * mnt_unhold_writers - stop preventing write access to the given mount
 646 * @mnt: mnt to stop preventing write access to
 647 *
 648 * Stop preventing write access to @mnt allowing callers to gain write access
 649 * to @mnt again.
 650 *
 651 * This function can only be called after a call to mnt_hold_writers().
 652 *
 653 * Context: This function expects to be in the same mount_locked_reader scope
 654 * as the matching mnt_hold_writers().
 655 */
 656static inline void mnt_unhold_writers(struct mount *mnt)
 657{
 658	if (!test_write_hold(mnt))
 659		return;
 660	/*
 661	 * MNT_READONLY must become visible before ~WRITE_HOLD, so writers
 662	 * that become unheld will see MNT_READONLY.
 663	 */
 664	smp_wmb();
 665	clear_write_hold(mnt);
 666}
 667
 668static inline void mnt_del_instance(struct mount *m)
 669{
 670	struct mount **p = m->mnt_pprev_for_sb;
 671	struct mount *next = m->mnt_next_for_sb;
 672
 673	if (next)
 674		next->mnt_pprev_for_sb = p;
 675	*p = next;
 676}
 677
 678static inline void mnt_add_instance(struct mount *m, struct super_block *s)
 679{
 680	struct mount *first = s->s_mounts;
 681
 682	if (first)
 683		first->mnt_pprev_for_sb = &m->mnt_next_for_sb;
 684	m->mnt_next_for_sb = first;
 685	m->mnt_pprev_for_sb = &s->s_mounts;
 686	s->s_mounts = m;
 687}
 688
 689static int mnt_make_readonly(struct mount *mnt)
 690{
 691	int ret;
 692
 693	ret = mnt_hold_writers(mnt);
 694	if (!ret)
 695		mnt->mnt.mnt_flags |= MNT_READONLY;
 696	mnt_unhold_writers(mnt);
 697	return ret;
 698}
 699
 700int sb_prepare_remount_readonly(struct super_block *sb)
 701{
 702	int err = 0;
 703
 704	/* Racy optimization.  Recheck the counter under WRITE_HOLD */
 705	if (atomic_long_read(&sb->s_remove_count))
 706		return -EBUSY;
 707
 708	guard(mount_locked_reader)();
 709
 710	for (struct mount *m = sb->s_mounts; m; m = m->mnt_next_for_sb) {
 711		if (!(m->mnt.mnt_flags & MNT_READONLY)) {
 712			err = mnt_hold_writers(m);
 713			if (err)
 714				break;
 715		}
 716	}
 717	if (!err && atomic_long_read(&sb->s_remove_count))
 718		err = -EBUSY;
 719
 720	if (!err)
 721		sb_start_ro_state_change(sb);
 722	for (struct mount *m = sb->s_mounts; m; m = m->mnt_next_for_sb) {
 723		if (test_write_hold(m))
 724			clear_write_hold(m);
 725	}
 726
 727	return err;
 728}
 729
 730static void free_vfsmnt(struct mount *mnt)
 731{
 732	mnt_idmap_put(mnt_idmap(&mnt->mnt));
 733	kfree_const(mnt->mnt_devname);
 734#ifdef CONFIG_SMP
 735	free_percpu(mnt->mnt_pcp);
 736#endif
 737	kmem_cache_free(mnt_cache, mnt);
 738}
 739
 740static void delayed_free_vfsmnt(struct rcu_head *head)
 741{
 742	free_vfsmnt(container_of(head, struct mount, mnt_rcu));
 743}
 744
 745/* call under rcu_read_lock */
 746int __legitimize_mnt(struct vfsmount *bastard, unsigned seq)
 747{
 748	struct mount *mnt;
 749	if (read_seqretry(&mount_lock, seq))
 750		return 1;
 751	if (bastard == NULL)
 752		return 0;
 753	mnt = real_mount(bastard);
 754	mnt_add_count(mnt, 1);
 755	smp_mb();		// see mntput_no_expire() and do_umount()
 756	if (likely(!read_seqretry(&mount_lock, seq)))
 757		return 0;
 758	lock_mount_hash();
 759	if (unlikely(bastard->mnt_flags & (MNT_SYNC_UMOUNT | MNT_DOOMED))) {
 760		mnt_add_count(mnt, -1);
 761		unlock_mount_hash();
 762		return 1;
 763	}
 764	unlock_mount_hash();
 765	/* caller will mntput() */
 766	return -1;
 767}
 768
 769/* call under rcu_read_lock */
 770static bool legitimize_mnt(struct vfsmount *bastard, unsigned seq)
 771{
 772	int res = __legitimize_mnt(bastard, seq);
 773	if (likely(!res))
 774		return true;
 775	if (unlikely(res < 0)) {
 776		rcu_read_unlock();
 777		mntput(bastard);
 778		rcu_read_lock();
 779	}
 780	return false;
 781}
 782
 783/**
 784 * __lookup_mnt - mount hash lookup
 785 * @mnt:	parent mount
 786 * @dentry:	dentry of mountpoint
 787 *
 788 * If @mnt has a child mount @c mounted on @dentry find and return it.
 789 * Caller must either hold the spinlock component of @mount_lock or
 790 * hold rcu_read_lock(), sample the seqcount component before the call
 791 * and recheck it afterwards.
 792 *
 793 * Return: The child of @mnt mounted on @dentry or %NULL.
 794 */
 795struct mount *__lookup_mnt(struct vfsmount *mnt, struct dentry *dentry)
 796{
 797	struct hlist_head *head = m_hash(mnt, dentry);
 798	struct mount *p;
 799
 800	hlist_for_each_entry_rcu(p, head, mnt_hash)
 801		if (&p->mnt_parent->mnt == mnt && p->mnt_mountpoint == dentry)
 802			return p;
 803	return NULL;
 804}
 805
 806/**
 807 * lookup_mnt - Return the child mount mounted at given location
 808 * @path:	location in the namespace
 809 *
 810 * Acquires and returns a new reference to mount at given location
 811 * or %NULL if nothing is mounted there.
 812 */
 813struct vfsmount *lookup_mnt(const struct path *path)
 814{
 815	struct mount *child_mnt;
 816	struct vfsmount *m;
 817	unsigned seq;
 818
 819	rcu_read_lock();
 820	do {
 821		seq = read_seqbegin(&mount_lock);
 822		child_mnt = __lookup_mnt(path->mnt, path->dentry);
 823		m = child_mnt ? &child_mnt->mnt : NULL;
 824	} while (!legitimize_mnt(m, seq));
 825	rcu_read_unlock();
 826	return m;
 827}
 828
 829/*
 830 * __is_local_mountpoint - Test to see if dentry is a mountpoint in the
 831 *                         current mount namespace.
 832 *
 833 * The common case is dentries are not mountpoints at all and that
 834 * test is handled inline.  For the slow case when we are actually
 835 * dealing with a mountpoint of some kind, walk through all of the
 836 * mounts in the current mount namespace and test to see if the dentry
 837 * is a mountpoint.
 838 *
 839 * The mount_hashtable is not usable in the context because we
 840 * need to identify all mounts that may be in the current mount
 841 * namespace not just a mount that happens to have some specified
 842 * parent mount.
 843 */
 844bool __is_local_mountpoint(const struct dentry *dentry)
 845{
 846	struct mnt_namespace *ns = current->nsproxy->mnt_ns;
 847	struct mount *mnt, *n;
 848
 849	guard(namespace_shared)();
 850
 851	rbtree_postorder_for_each_entry_safe(mnt, n, &ns->mounts, mnt_node)
 852		if (mnt->mnt_mountpoint == dentry)
 853			return true;
 854
 855	return false;
 856}
 857
 858struct pinned_mountpoint {
 859	struct hlist_node node;
 860	struct mountpoint *mp;
 861	struct mount *parent;
 862};
 863
 864static bool lookup_mountpoint(struct dentry *dentry, struct pinned_mountpoint *m)
 865{
 866	struct hlist_head *chain = mp_hash(dentry);
 867	struct mountpoint *mp;
 868
 869	hlist_for_each_entry(mp, chain, m_hash) {
 870		if (mp->m_dentry == dentry) {
 871			hlist_add_head(&m->node, &mp->m_list);
 872			m->mp = mp;
 873			return true;
 874		}
 875	}
 876	return false;
 877}
 878
 879static int get_mountpoint(struct dentry *dentry, struct pinned_mountpoint *m)
 880{
 881	struct mountpoint *mp __free(kfree) = NULL;
 882	bool found;
 883	int ret;
 884
 885	if (d_mountpoint(dentry)) {
 886		/* might be worth a WARN_ON() */
 887		if (d_unlinked(dentry))
 888			return -ENOENT;
 889mountpoint:
 890		read_seqlock_excl(&mount_lock);
 891		found = lookup_mountpoint(dentry, m);
 892		read_sequnlock_excl(&mount_lock);
 893		if (found)
 894			return 0;
 895	}
 896
 897	if (!mp)
 898		mp = kmalloc(sizeof(struct mountpoint), GFP_KERNEL);
 899	if (!mp)
 900		return -ENOMEM;
 901
 902	/* Exactly one processes may set d_mounted */
 903	ret = d_set_mounted(dentry);
 904
 905	/* Someone else set d_mounted? */
 906	if (ret == -EBUSY)
 907		goto mountpoint;
 908
 909	/* The dentry is not available as a mountpoint? */
 910	if (ret)
 911		return ret;
 912
 913	/* Add the new mountpoint to the hash table */
 914	read_seqlock_excl(&mount_lock);
 915	mp->m_dentry = dget(dentry);
 916	hlist_add_head(&mp->m_hash, mp_hash(dentry));
 917	INIT_HLIST_HEAD(&mp->m_list);
 918	hlist_add_head(&m->node, &mp->m_list);
 919	m->mp = no_free_ptr(mp);
 920	read_sequnlock_excl(&mount_lock);
 921	return 0;
 922}
 923
 924/*
 925 * vfsmount lock must be held.  Additionally, the caller is responsible
 926 * for serializing calls for given disposal list.
 927 */
 928static void maybe_free_mountpoint(struct mountpoint *mp, struct list_head *list)
 929{
 930	if (hlist_empty(&mp->m_list)) {
 931		struct dentry *dentry = mp->m_dentry;
 932		spin_lock(&dentry->d_lock);
 933		dentry->d_flags &= ~DCACHE_MOUNTED;
 934		spin_unlock(&dentry->d_lock);
 935		dput_to_list(dentry, list);
 936		hlist_del(&mp->m_hash);
 937		kfree(mp);
 938	}
 939}
 940
 941/*
 942 * locks: mount_lock [read_seqlock_excl], namespace_sem [excl]
 943 */
 944static void unpin_mountpoint(struct pinned_mountpoint *m)
 945{
 946	if (m->mp) {
 947		hlist_del(&m->node);
 948		maybe_free_mountpoint(m->mp, &ex_mountpoints);
 949	}
 950}
 951
 952static inline int check_mnt(const struct mount *mnt)
 953{
 954	return mnt->mnt_ns == current->nsproxy->mnt_ns;
 955}
 956
 957static inline bool check_anonymous_mnt(struct mount *mnt)
 958{
 959	u64 seq;
 960
 961	if (!is_anon_ns(mnt->mnt_ns))
 962		return false;
 963
 964	seq = mnt->mnt_ns->seq_origin;
 965	return !seq || (seq == current->nsproxy->mnt_ns->ns.ns_id);
 966}
 967
 968/*
 969 * vfsmount lock must be held for write
 970 */
 971static void touch_mnt_namespace(struct mnt_namespace *ns)
 972{
 973	if (ns) {
 974		ns->event = ++event;
 975		wake_up_interruptible(&ns->poll);
 976	}
 977}
 978
 979/*
 980 * vfsmount lock must be held for write
 981 */
 982static void __touch_mnt_namespace(struct mnt_namespace *ns)
 983{
 984	if (ns && ns->event != event) {
 985		ns->event = event;
 986		wake_up_interruptible(&ns->poll);
 987	}
 988}
 989
 990/*
 991 * locks: mount_lock[write_seqlock]
 992 */
 993static void __umount_mnt(struct mount *mnt, struct list_head *shrink_list)
 994{
 995	struct mountpoint *mp;
 996	struct mount *parent = mnt->mnt_parent;
 997	if (unlikely(parent->overmount == mnt))
 998		parent->overmount = NULL;
 999	mnt->mnt_parent = mnt;
1000	mnt->mnt_mountpoint = mnt->mnt.mnt_root;
1001	list_del_init(&mnt->mnt_child);
1002	hlist_del_init_rcu(&mnt->mnt_hash);
1003	hlist_del_init(&mnt->mnt_mp_list);
1004	mp = mnt->mnt_mp;
1005	mnt->mnt_mp = NULL;
1006	maybe_free_mountpoint(mp, shrink_list);
1007}
1008
1009/*
1010 * locks: mount_lock[write_seqlock], namespace_sem[excl] (for ex_mountpoints)
1011 */
1012static void umount_mnt(struct mount *mnt)
1013{
1014	__umount_mnt(mnt, &ex_mountpoints);
1015}
1016
1017/*
1018 * vfsmount lock must be held for write
1019 */
1020void mnt_set_mountpoint(struct mount *mnt,
1021			struct mountpoint *mp,
1022			struct mount *child_mnt)
1023{
1024	child_mnt->mnt_mountpoint = mp->m_dentry;
1025	child_mnt->mnt_parent = mnt;
1026	child_mnt->mnt_mp = mp;
1027	hlist_add_head(&child_mnt->mnt_mp_list, &mp->m_list);
1028}
1029
1030static void make_visible(struct mount *mnt)
1031{
1032	struct mount *parent = mnt->mnt_parent;
1033	if (unlikely(mnt->mnt_mountpoint == parent->mnt.mnt_root))
1034		parent->overmount = mnt;
1035	hlist_add_head_rcu(&mnt->mnt_hash,
1036			   m_hash(&parent->mnt, mnt->mnt_mountpoint));
1037	list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
1038}
1039
1040/**
1041 * attach_mnt - mount a mount, attach to @mount_hashtable and parent's
1042 *              list of child mounts
1043 * @parent:  the parent
1044 * @mnt:     the new mount
1045 * @mp:      the new mountpoint
1046 *
1047 * Mount @mnt at @mp on @parent. Then attach @mnt
1048 * to @parent's child mount list and to @mount_hashtable.
1049 *
1050 * Note, when make_visible() is called @mnt->mnt_parent already points
1051 * to the correct parent.
1052 *
1053 * Context: This function expects namespace_lock() and lock_mount_hash()
1054 *          to have been acquired in that order.
1055 */
1056static void attach_mnt(struct mount *mnt, struct mount *parent,
1057		       struct mountpoint *mp)
1058{
1059	mnt_set_mountpoint(parent, mp, mnt);
1060	make_visible(mnt);
1061}
1062
1063void mnt_change_mountpoint(struct mount *parent, struct mountpoint *mp, struct mount *mnt)
1064{
1065	struct mountpoint *old_mp = mnt->mnt_mp;
1066
1067	list_del_init(&mnt->mnt_child);
1068	hlist_del_init(&mnt->mnt_mp_list);
1069	hlist_del_init_rcu(&mnt->mnt_hash);
1070
1071	attach_mnt(mnt, parent, mp);
1072
1073	maybe_free_mountpoint(old_mp, &ex_mountpoints);
1074}
1075
1076static inline struct mount *node_to_mount(struct rb_node *node)
1077{
1078	return node ? rb_entry(node, struct mount, mnt_node) : NULL;
1079}
1080
1081static void mnt_add_to_ns(struct mnt_namespace *ns, struct mount *mnt)
1082{
1083	struct rb_node **link = &ns->mounts.rb_node;
1084	struct rb_node *parent = NULL;
1085	bool mnt_first_node = true, mnt_last_node = true;
1086
1087	WARN_ON(mnt_ns_attached(mnt));
1088	mnt->mnt_ns = ns;
1089	while (*link) {
1090		parent = *link;
1091		if (mnt->mnt_id_unique < node_to_mount(parent)->mnt_id_unique) {
1092			link = &parent->rb_left;
1093			mnt_last_node = false;
1094		} else {
1095			link = &parent->rb_right;
1096			mnt_first_node = false;
1097		}
1098	}
1099
1100	if (mnt_last_node)
1101		ns->mnt_last_node = &mnt->mnt_node;
1102	if (mnt_first_node)
1103		ns->mnt_first_node = &mnt->mnt_node;
1104	rb_link_node(&mnt->mnt_node, parent, link);
1105	rb_insert_color(&mnt->mnt_node, &ns->mounts);
1106
1107	mnt_notify_add(mnt);
1108}
1109
1110static struct mount *next_mnt(struct mount *p, struct mount *root)
1111{
1112	struct list_head *next = p->mnt_mounts.next;
1113	if (next == &p->mnt_mounts) {
1114		while (1) {
1115			if (p == root)
1116				return NULL;
1117			next = p->mnt_child.next;
1118			if (next != &p->mnt_parent->mnt_mounts)
1119				break;
1120			p = p->mnt_parent;
1121		}
1122	}
1123	return list_entry(next, struct mount, mnt_child);
1124}
1125
1126static struct mount *skip_mnt_tree(struct mount *p)
1127{
1128	struct list_head *prev = p->mnt_mounts.prev;
1129	while (prev != &p->mnt_mounts) {
1130		p = list_entry(prev, struct mount, mnt_child);
1131		prev = p->mnt_mounts.prev;
1132	}
1133	return p;
1134}
1135
1136/*
1137 * vfsmount lock must be held for write
1138 */
1139static void commit_tree(struct mount *mnt)
1140{
1141	struct mnt_namespace *n = mnt->mnt_parent->mnt_ns;
1142
1143	if (!mnt_ns_attached(mnt)) {
1144		for (struct mount *m = mnt; m; m = next_mnt(m, mnt))
1145			mnt_add_to_ns(n, m);
1146		n->nr_mounts += n->pending_mounts;
1147		n->pending_mounts = 0;
1148	}
1149
1150	make_visible(mnt);
1151	touch_mnt_namespace(n);
1152}
1153
1154static void setup_mnt(struct mount *m, struct dentry *root)
1155{
1156	struct super_block *s = root->d_sb;
1157
1158	atomic_inc(&s->s_active);
1159	m->mnt.mnt_sb = s;
1160	m->mnt.mnt_root = dget(root);
1161	m->mnt_mountpoint = m->mnt.mnt_root;
1162	m->mnt_parent = m;
1163
1164	guard(mount_locked_reader)();
1165	mnt_add_instance(m, s);
1166}
1167
1168/**
1169 * vfs_create_mount - Create a mount for a configured superblock
1170 * @fc: The configuration context with the superblock attached
1171 *
1172 * Create a mount to an already configured superblock.  If necessary, the
1173 * caller should invoke vfs_get_tree() before calling this.
1174 *
1175 * Note that this does not attach the mount to anything.
1176 */
1177struct vfsmount *vfs_create_mount(struct fs_context *fc)
1178{
1179	struct mount *mnt;
1180
1181	if (!fc->root)
1182		return ERR_PTR(-EINVAL);
1183
1184	mnt = alloc_vfsmnt(fc->source);
1185	if (!mnt)
1186		return ERR_PTR(-ENOMEM);
1187
1188	if (fc->sb_flags & SB_KERNMOUNT)
1189		mnt->mnt.mnt_flags = MNT_INTERNAL;
1190
1191	setup_mnt(mnt, fc->root);
1192
1193	return &mnt->mnt;
1194}
1195EXPORT_SYMBOL(vfs_create_mount);
1196
1197struct vfsmount *fc_mount(struct fs_context *fc)
1198{
1199	int err = vfs_get_tree(fc);
1200	if (!err) {
1201		up_write(&fc->root->d_sb->s_umount);
1202		return vfs_create_mount(fc);
1203	}
1204	return ERR_PTR(err);
1205}
1206EXPORT_SYMBOL(fc_mount);
1207
1208struct vfsmount *fc_mount_longterm(struct fs_context *fc)
1209{
1210	struct vfsmount *mnt = fc_mount(fc);
1211	if (!IS_ERR(mnt))
1212		real_mount(mnt)->mnt_ns = MNT_NS_INTERNAL;
1213	return mnt;
1214}
1215EXPORT_SYMBOL(fc_mount_longterm);
1216
1217struct vfsmount *vfs_kern_mount(struct file_system_type *type,
1218				int flags, const char *name,
1219				void *data)
1220{
1221	struct fs_context *fc;
1222	struct vfsmount *mnt;
1223	int ret = 0;
1224
1225	if (!type)
1226		return ERR_PTR(-EINVAL);
1227
1228	fc = fs_context_for_mount(type, flags);
1229	if (IS_ERR(fc))
1230		return ERR_CAST(fc);
1231
1232	if (name)
1233		ret = vfs_parse_fs_string(fc, "source", name);
1234	if (!ret)
1235		ret = parse_monolithic_mount_data(fc, data);
1236	if (!ret)
1237		mnt = fc_mount(fc);
1238	else
1239		mnt = ERR_PTR(ret);
1240
1241	put_fs_context(fc);
1242	return mnt;
1243}
1244EXPORT_SYMBOL_GPL(vfs_kern_mount);
1245
1246static struct mount *clone_mnt(struct mount *old, struct dentry *root,
1247					int flag)
1248{
1249	struct mount *mnt;
1250	int err;
1251
1252	mnt = alloc_vfsmnt(old->mnt_devname);
1253	if (!mnt)
1254		return ERR_PTR(-ENOMEM);
1255
1256	mnt->mnt.mnt_flags = READ_ONCE(old->mnt.mnt_flags) &
1257			     ~MNT_INTERNAL_FLAGS;
1258
1259	if (flag & (CL_SLAVE | CL_PRIVATE))
1260		mnt->mnt_group_id = 0; /* not a peer of original */
1261	else
1262		mnt->mnt_group_id = old->mnt_group_id;
1263
1264	if ((flag & CL_MAKE_SHARED) && !mnt->mnt_group_id) {
1265		err = mnt_alloc_group_id(mnt);
1266		if (err)
1267			goto out_free;
1268	}
1269
1270	if (mnt->mnt_group_id)
1271		set_mnt_shared(mnt);
1272
1273	mnt->mnt.mnt_idmap = mnt_idmap_get(mnt_idmap(&old->mnt));
1274
1275	setup_mnt(mnt, root);
1276
1277	if (flag & CL_PRIVATE)	// we are done with it
1278		return mnt;
1279
1280	if (peers(mnt, old))
1281		list_add(&mnt->mnt_share, &old->mnt_share);
1282
1283	if ((flag & CL_SLAVE) && old->mnt_group_id) {
1284		hlist_add_head(&mnt->mnt_slave, &old->mnt_slave_list);
1285		mnt->mnt_master = old;
1286	} else if (IS_MNT_SLAVE(old)) {
1287		hlist_add_behind(&mnt->mnt_slave, &old->mnt_slave);
1288		mnt->mnt_master = old->mnt_master;
1289	}
1290	return mnt;
1291
1292 out_free:
1293	mnt_free_id(mnt);
1294	free_vfsmnt(mnt);
1295	return ERR_PTR(err);
1296}
1297
1298static void cleanup_mnt(struct mount *mnt)
1299{
1300	struct hlist_node *p;
1301	struct mount *m;
1302	/*
1303	 * The warning here probably indicates that somebody messed
1304	 * up a mnt_want/drop_write() pair.  If this happens, the
1305	 * filesystem was probably unable to make r/w->r/o transitions.
1306	 * The locking used to deal with mnt_count decrement provides barriers,
1307	 * so mnt_get_writers() below is safe.
1308	 */
1309	WARN_ON(mnt_get_writers(mnt));
1310	if (unlikely(mnt->mnt_pins.first))
1311		mnt_pin_kill(mnt);
1312	hlist_for_each_entry_safe(m, p, &mnt->mnt_stuck_children, mnt_umount) {
1313		hlist_del(&m->mnt_umount);
1314		mntput(&m->mnt);
1315	}
1316	fsnotify_vfsmount_delete(&mnt->mnt);
1317	dput(mnt->mnt.mnt_root);
1318	deactivate_super(mnt->mnt.mnt_sb);
1319	mnt_free_id(mnt);
1320	call_rcu(&mnt->mnt_rcu, delayed_free_vfsmnt);
1321}
1322
1323static void __cleanup_mnt(struct rcu_head *head)
1324{
1325	cleanup_mnt(container_of(head, struct mount, mnt_rcu));
1326}
1327
1328static LLIST_HEAD(delayed_mntput_list);
1329static void delayed_mntput(struct work_struct *unused)
1330{
1331	struct llist_node *node = llist_del_all(&delayed_mntput_list);
1332	struct mount *m, *t;
1333
1334	llist_for_each_entry_safe(m, t, node, mnt_llist)
1335		cleanup_mnt(m);
1336}
1337static DECLARE_DELAYED_WORK(delayed_mntput_work, delayed_mntput);
1338
1339static void noinline mntput_no_expire_slowpath(struct mount *mnt)
1340{
1341	LIST_HEAD(list);
1342	int count;
1343
1344	VFS_BUG_ON(mnt->mnt_ns);
1345	lock_mount_hash();
1346	/*
1347	 * make sure that if __legitimize_mnt() has not seen us grab
1348	 * mount_lock, we'll see their refcount increment here.
1349	 */
1350	smp_mb();
1351	mnt_add_count(mnt, -1);
1352	count = mnt_get_count(mnt);
1353	if (count != 0) {
1354		WARN_ON(count < 0);
1355		rcu_read_unlock();
1356		unlock_mount_hash();
1357		return;
1358	}
1359	if (unlikely(mnt->mnt.mnt_flags & MNT_DOOMED)) {
1360		rcu_read_unlock();
1361		unlock_mount_hash();
1362		return;
1363	}
1364	mnt->mnt.mnt_flags |= MNT_DOOMED;
1365	rcu_read_unlock();
1366
1367	mnt_del_instance(mnt);
1368	if (unlikely(!list_empty(&mnt->mnt_expire)))
1369		list_del(&mnt->mnt_expire);
1370
1371	if (unlikely(!list_empty(&mnt->mnt_mounts))) {
1372		struct mount *p, *tmp;
1373		list_for_each_entry_safe(p, tmp, &mnt->mnt_mounts,  mnt_child) {
1374			__umount_mnt(p, &list);
1375			hlist_add_head(&p->mnt_umount, &mnt->mnt_stuck_children);
1376		}
1377	}
1378	unlock_mount_hash();
1379	shrink_dentry_list(&list);
1380
1381	if (likely(!(mnt->mnt.mnt_flags & MNT_INTERNAL))) {
1382		struct task_struct *task = current;
1383		if (likely(!(task->flags & PF_KTHREAD))) {
1384			init_task_work(&mnt->mnt_rcu, __cleanup_mnt);
1385			if (!task_work_add(task, &mnt->mnt_rcu, TWA_RESUME))
1386				return;
1387		}
1388		if (llist_add(&mnt->mnt_llist, &delayed_mntput_list))
1389			schedule_delayed_work(&delayed_mntput_work, 1);
1390		return;
1391	}
1392	cleanup_mnt(mnt);
1393}
1394
1395static void mntput_no_expire(struct mount *mnt)
1396{
1397	rcu_read_lock();
1398	if (likely(READ_ONCE(mnt->mnt_ns))) {
1399		/*
1400		 * Since we don't do lock_mount_hash() here,
1401		 * ->mnt_ns can change under us.  However, if it's
1402		 * non-NULL, then there's a reference that won't
1403		 * be dropped until after an RCU delay done after
1404		 * turning ->mnt_ns NULL.  So if we observe it
1405		 * non-NULL under rcu_read_lock(), the reference
1406		 * we are dropping is not the final one.
1407		 */
1408		mnt_add_count(mnt, -1);
1409		rcu_read_unlock();
1410		return;
1411	}
1412	mntput_no_expire_slowpath(mnt);
1413}
1414
1415void mntput(struct vfsmount *mnt)
1416{
1417	if (mnt) {
1418		struct mount *m = real_mount(mnt);
1419		/* avoid cacheline pingpong */
1420		if (unlikely(m->mnt_expiry_mark))
1421			WRITE_ONCE(m->mnt_expiry_mark, 0);
1422		mntput_no_expire(m);
1423	}
1424}
1425EXPORT_SYMBOL(mntput);
1426
1427struct vfsmount *mntget(struct vfsmount *mnt)
1428{
1429	if (mnt)
1430		mnt_add_count(real_mount(mnt), 1);
1431	return mnt;
1432}
1433EXPORT_SYMBOL(mntget);
1434
1435/*
1436 * Make a mount point inaccessible to new lookups.
1437 * Because there may still be current users, the caller MUST WAIT
1438 * for an RCU grace period before destroying the mount point.
1439 */
1440void mnt_make_shortterm(struct vfsmount *mnt)
1441{
1442	if (mnt)
1443		real_mount(mnt)->mnt_ns = NULL;
1444}
1445
1446/**
1447 * path_is_mountpoint() - Check if path is a mount in the current namespace.
1448 * @path: path to check
1449 *
1450 *  d_mountpoint() can only be used reliably to establish if a dentry is
1451 *  not mounted in any namespace and that common case is handled inline.
1452 *  d_mountpoint() isn't aware of the possibility there may be multiple
1453 *  mounts using a given dentry in a different namespace. This function
1454 *  checks if the passed in path is a mountpoint rather than the dentry
1455 *  alone.
1456 */
1457bool path_is_mountpoint(const struct path *path)
1458{
1459	unsigned seq;
1460	bool res;
1461
1462	if (!d_mountpoint(path->dentry))
1463		return false;
1464
1465	rcu_read_lock();
1466	do {
1467		seq = read_seqbegin(&mount_lock);
1468		res = __path_is_mountpoint(path);
1469	} while (read_seqretry(&mount_lock, seq));
1470	rcu_read_unlock();
1471
1472	return res;
1473}
1474EXPORT_SYMBOL(path_is_mountpoint);
1475
1476struct vfsmount *mnt_clone_internal(const struct path *path)
1477{
1478	struct mount *p;
1479	p = clone_mnt(real_mount(path->mnt), path->dentry, CL_PRIVATE);
1480	if (IS_ERR(p))
1481		return ERR_CAST(p);
1482	p->mnt.mnt_flags |= MNT_INTERNAL;
1483	return &p->mnt;
1484}
1485
1486/*
1487 * Returns the mount which either has the specified mnt_id, or has the next
1488 * smallest id afer the specified one.
1489 */
1490static struct mount *mnt_find_id_at(struct mnt_namespace *ns, u64 mnt_id)
1491{
1492	struct rb_node *node = ns->mounts.rb_node;
1493	struct mount *ret = NULL;
1494
1495	while (node) {
1496		struct mount *m = node_to_mount(node);
1497
1498		if (mnt_id <= m->mnt_id_unique) {
1499			ret = node_to_mount(node);
1500			if (mnt_id == m->mnt_id_unique)
1501				break;
1502			node = node->rb_left;
1503		} else {
1504			node = node->rb_right;
1505		}
1506	}
1507	return ret;
1508}
1509
1510/*
1511 * Returns the mount which either has the specified mnt_id, or has the next
1512 * greater id before the specified one.
1513 */
1514static struct mount *mnt_find_id_at_reverse(struct mnt_namespace *ns, u64 mnt_id)
1515{
1516	struct rb_node *node = ns->mounts.rb_node;
1517	struct mount *ret = NULL;
1518
1519	while (node) {
1520		struct mount *m = node_to_mount(node);
1521
1522		if (mnt_id >= m->mnt_id_unique) {
1523			ret = node_to_mount(node);
1524			if (mnt_id == m->mnt_id_unique)
1525				break;
1526			node = node->rb_right;
1527		} else {
1528			node = node->rb_left;
1529		}
1530	}
1531	return ret;
1532}
1533
1534#ifdef CONFIG_PROC_FS
1535
1536/* iterator; we want it to have access to namespace_sem, thus here... */
1537static void *m_start(struct seq_file *m, loff_t *pos)
1538{
1539	struct proc_mounts *p = m->private;
1540	struct mount *mnt;
1541
1542	down_read(&namespace_sem);
1543
1544	mnt = mnt_find_id_at(p->ns, *pos);
1545	if (mnt)
1546		*pos = mnt->mnt_id_unique;
1547	return mnt;
1548}
1549
1550static void *m_next(struct seq_file *m, void *v, loff_t *pos)
1551{
1552	struct mount *mnt = v;
1553	struct rb_node *node = rb_next(&mnt->mnt_node);
1554
1555	if (node) {
1556		struct mount *next = node_to_mount(node);
1557		*pos = next->mnt_id_unique;
1558		return next;
1559	}
1560
1561	/*
1562	 * No more mounts. Set pos past current mount's ID so that if
1563	 * iteration restarts, mnt_find_id_at() returns NULL.
1564	 */
1565	*pos = mnt->mnt_id_unique + 1;
1566	return NULL;
1567}
1568
1569static void m_stop(struct seq_file *m, void *v)
1570{
1571	up_read(&namespace_sem);
1572}
1573
1574static int m_show(struct seq_file *m, void *v)
1575{
1576	struct proc_mounts *p = m->private;
1577	struct mount *r = v;
1578	return p->show(m, &r->mnt);
1579}
1580
1581const struct seq_operations mounts_op = {
1582	.start	= m_start,
1583	.next	= m_next,
1584	.stop	= m_stop,
1585	.show	= m_show,
1586};
1587
1588#endif  /* CONFIG_PROC_FS */
1589
1590/**
1591 * may_umount_tree - check if a mount tree is busy
1592 * @m: root of mount tree
1593 *
1594 * This is called to check if a tree of mounts has any
1595 * open files, pwds, chroots or sub mounts that are
1596 * busy.
1597 */
1598int may_umount_tree(struct vfsmount *m)
1599{
1600	struct mount *mnt = real_mount(m);
1601	bool busy = false;
1602
1603	/* write lock needed for mnt_get_count */
1604	lock_mount_hash();
1605	for (struct mount *p = mnt; p; p = next_mnt(p, mnt)) {
1606		if (mnt_get_count(p) > (p == mnt ? 2 : 1)) {
1607			busy = true;
1608			break;
1609		}
1610	}
1611	unlock_mount_hash();
1612
1613	return !busy;
1614}
1615
1616EXPORT_SYMBOL(may_umount_tree);
1617
1618/**
1619 * may_umount - check if a mount point is busy
1620 * @mnt: root of mount
1621 *
1622 * This is called to check if a mount point has any
1623 * open files, pwds, chroots or sub mounts. If the
1624 * mount has sub mounts this will return busy
1625 * regardless of whether the sub mounts are busy.
1626 *
1627 * Doesn't take quota and stuff into account. IOW, in some cases it will
1628 * give false negatives. The main reason why it's here is that we need
1629 * a non-destructive way to look for easily umountable filesystems.
1630 */
1631int may_umount(struct vfsmount *mnt)
1632{
1633	int ret = 1;
1634	down_read(&namespace_sem);
1635	lock_mount_hash();
1636	if (propagate_mount_busy(real_mount(mnt), 2))
1637		ret = 0;
1638	unlock_mount_hash();
1639	up_read(&namespace_sem);
1640	return ret;
1641}
1642
1643EXPORT_SYMBOL(may_umount);
1644
1645#ifdef CONFIG_FSNOTIFY
1646static void mnt_notify(struct mount *p)
1647{
1648	if (!p->prev_ns && p->mnt_ns) {
1649		fsnotify_mnt_attach(p->mnt_ns, &p->mnt);
1650	} else if (p->prev_ns && !p->mnt_ns) {
1651		fsnotify_mnt_detach(p->prev_ns, &p->mnt);
1652	} else if (p->prev_ns == p->mnt_ns) {
1653		fsnotify_mnt_move(p->mnt_ns, &p->mnt);
1654	} else {
1655		fsnotify_mnt_detach(p->prev_ns, &p->mnt);
1656		fsnotify_mnt_attach(p->mnt_ns, &p->mnt);
1657	}
1658	p->prev_ns = p->mnt_ns;
1659}
1660
1661static void notify_mnt_list(void)
1662{
1663	struct mount *m, *tmp;
1664	/*
1665	 * Notify about mounts that were added/reparented/detached/remain
1666	 * connected after unmount.
1667	 */
1668	list_for_each_entry_safe(m, tmp, &notify_list, to_notify) {
1669		mnt_notify(m);
1670		list_del_init(&m->to_notify);
1671	}
1672}
1673
1674static bool need_notify_mnt_list(void)
1675{
1676	return !list_empty(&notify_list);
1677}
1678#else
1679static void notify_mnt_list(void)
1680{
1681}
1682
1683static bool need_notify_mnt_list(void)
1684{
1685	return false;
1686}
1687#endif
1688
1689static void free_mnt_ns(struct mnt_namespace *);
1690static void namespace_unlock(void)
1691{
1692	struct hlist_head head;
1693	struct hlist_node *p;
1694	struct mount *m;
1695	struct mnt_namespace *ns = emptied_ns;
1696	LIST_HEAD(list);
1697
1698	hlist_move_list(&unmounted, &head);
1699	list_splice_init(&ex_mountpoints, &list);
1700	emptied_ns = NULL;
1701
1702	if (need_notify_mnt_list()) {
1703		/*
1704		 * No point blocking out concurrent readers while notifications
1705		 * are sent. This will also allow statmount()/listmount() to run
1706		 * concurrently.
1707		 */
1708		downgrade_write(&namespace_sem);
1709		notify_mnt_list();
1710		up_read(&namespace_sem);
1711	} else {
1712		up_write(&namespace_sem);
1713	}
1714	if (unlikely(ns)) {
1715		/* Make sure we notice when we leak mounts. */
1716		VFS_WARN_ON_ONCE(!mnt_ns_empty(ns));
1717		free_mnt_ns(ns);
1718	}
1719
1720	shrink_dentry_list(&list);
1721
1722	if (likely(hlist_empty(&head)))
1723		return;
1724
1725	synchronize_rcu_expedited();
1726
1727	hlist_for_each_entry_safe(m, p, &head, mnt_umount) {
1728		hlist_del(&m->mnt_umount);
1729		mntput(&m->mnt);
1730	}
1731}
1732
1733static inline void namespace_lock(void)
1734{
1735	down_write(&namespace_sem);
1736}
1737
1738enum umount_tree_flags {
1739	UMOUNT_SYNC = 1,
1740	UMOUNT_PROPAGATE = 2,
1741	UMOUNT_CONNECTED = 4,
1742};
1743
1744static bool disconnect_mount(struct mount *mnt, enum umount_tree_flags how)
1745{
1746	/* Leaving mounts connected is only valid for lazy umounts */
1747	if (how & UMOUNT_SYNC)
1748		return true;
1749
1750	/* A mount without a parent has nothing to be connected to */
1751	if (!mnt_has_parent(mnt))
1752		return true;
1753
1754	/* Because the reference counting rules change when mounts are
1755	 * unmounted and connected, umounted mounts may not be
1756	 * connected to mounted mounts.
1757	 */
1758	if (!(mnt->mnt_parent->mnt.mnt_flags & MNT_UMOUNT))
1759		return true;
1760
1761	/* Has it been requested that the mount remain connected? */
1762	if (how & UMOUNT_CONNECTED)
1763		return false;
1764
1765	/* Is the mount locked such that it needs to remain connected? */
1766	if (IS_MNT_LOCKED(mnt))
1767		return false;
1768
1769	/* By default disconnect the mount */
1770	return true;
1771}
1772
1773/*
1774 * mount_lock must be held
1775 * namespace_sem must be held for write
1776 */
1777static void umount_tree(struct mount *mnt, enum umount_tree_flags how)
1778{
1779	LIST_HEAD(tmp_list);
1780	struct mount *p;
1781
1782	if (how & UMOUNT_PROPAGATE)
1783		propagate_mount_unlock(mnt);
1784
1785	/* Gather the mounts to umount */
1786	for (p = mnt; p; p = next_mnt(p, mnt)) {
1787		p->mnt.mnt_flags |= MNT_UMOUNT;
1788		if (mnt_ns_attached(p))
1789			move_from_ns(p);
1790		list_add_tail(&p->mnt_list, &tmp_list);
1791	}
1792
1793	/* Hide the mounts from mnt_mounts */
1794	list_for_each_entry(p, &tmp_list, mnt_list) {
1795		list_del_init(&p->mnt_child);
1796	}
1797
1798	/* Add propagated mounts to the tmp_list */
1799	if (how & UMOUNT_PROPAGATE)
1800		propagate_umount(&tmp_list);
1801
1802	bulk_make_private(&tmp_list);
1803
1804	while (!list_empty(&tmp_list)) {
1805		struct mnt_namespace *ns;
1806		bool disconnect;
1807		p = list_first_entry(&tmp_list, struct mount, mnt_list);
1808		list_del_init(&p->mnt_expire);
1809		list_del_init(&p->mnt_list);
1810		ns = p->mnt_ns;
1811		if (ns) {
1812			ns->nr_mounts--;
1813			__touch_mnt_namespace(ns);
1814		}
1815		p->mnt_ns = NULL;
1816		if (how & UMOUNT_SYNC)
1817			p->mnt.mnt_flags |= MNT_SYNC_UMOUNT;
1818
1819		disconnect = disconnect_mount(p, how);
1820		if (mnt_has_parent(p)) {
1821			if (!disconnect) {
1822				/* Don't forget about p */
1823				list_add_tail(&p->mnt_child, &p->mnt_parent->mnt_mounts);
1824			} else {
1825				umount_mnt(p);
1826			}
1827		}
1828		if (disconnect)
1829			hlist_add_head(&p->mnt_umount, &unmounted);
1830
1831		/*
1832		 * At this point p->mnt_ns is NULL, notification will be queued
1833		 * only if
1834		 *
1835		 *  - p->prev_ns is non-NULL *and*
1836		 *  - p->prev_ns->n_fsnotify_marks is non-NULL
1837		 *
1838		 * This will preclude queuing the mount if this is a cleanup
1839		 * after a failed copy_tree() or destruction of an anonymous
1840		 * namespace, etc.
1841		 */
1842		mnt_notify_add(p);
1843	}
1844}
1845
1846static void shrink_submounts(struct mount *mnt);
1847
1848static int do_umount_root(struct super_block *sb)
1849{
1850	int ret = 0;
1851
1852	down_write(&sb->s_umount);
1853	if (!sb_rdonly(sb)) {
1854		struct fs_context *fc;
1855
1856		fc = fs_context_for_reconfigure(sb->s_root, SB_RDONLY,
1857						SB_RDONLY);
1858		if (IS_ERR(fc)) {
1859			ret = PTR_ERR(fc);
1860		} else {
1861			ret = parse_monolithic_mount_data(fc, NULL);
1862			if (!ret)
1863				ret = reconfigure_super(fc);
1864			put_fs_context(fc);
1865		}
1866	}
1867	up_write(&sb->s_umount);
1868	return ret;
1869}
1870
1871static int do_umount(struct mount *mnt, int flags)
1872{
1873	struct super_block *sb = mnt->mnt.mnt_sb;
1874	int retval;
1875
1876	retval = security_sb_umount(&mnt->mnt, flags);
1877	if (retval)
1878		return retval;
1879
1880	/*
1881	 * Allow userspace to request a mountpoint be expired rather than
1882	 * unmounting unconditionally. Unmount only happens if:
1883	 *  (1) the mark is already set (the mark is cleared by mntput())
1884	 *  (2) the usage count == 1 [parent vfsmount] + 1 [sys_umount]
1885	 */
1886	if (flags & MNT_EXPIRE) {
1887		if (&mnt->mnt == current->fs->root.mnt ||
1888		    flags & (MNT_FORCE | MNT_DETACH))
1889			return -EINVAL;
1890
1891		/*
1892		 * probably don't strictly need the lock here if we examined
1893		 * all race cases, but it's a slowpath.
1894		 */
1895		lock_mount_hash();
1896		if (!list_empty(&mnt->mnt_mounts) || mnt_get_count(mnt) != 2) {
1897			unlock_mount_hash();
1898			return -EBUSY;
1899		}
1900		unlock_mount_hash();
1901
1902		if (!xchg(&mnt->mnt_expiry_mark, 1))
1903			return -EAGAIN;
1904	}
1905
1906	/*
1907	 * If we may have to abort operations to get out of this
1908	 * mount, and they will themselves hold resources we must
1909	 * allow the fs to do things. In the Unix tradition of
1910	 * 'Gee thats tricky lets do it in userspace' the umount_begin
1911	 * might fail to complete on the first run through as other tasks
1912	 * must return, and the like. Thats for the mount program to worry
1913	 * about for the moment.
1914	 */
1915
1916	if (flags & MNT_FORCE && sb->s_op->umount_begin) {
1917		sb->s_op->umount_begin(sb);
1918	}
1919
1920	/*
1921	 * No sense to grab the lock for this test, but test itself looks
1922	 * somewhat bogus. Suggestions for better replacement?
1923	 * Ho-hum... In principle, we might treat that as umount + switch
1924	 * to rootfs. GC would eventually take care of the old vfsmount.
1925	 * Actually it makes sense, especially if rootfs would contain a
1926	 * /reboot - static binary that would close all descriptors and
1927	 * call reboot(9). Then init(8) could umount root and exec /reboot.
1928	 */
1929	if (&mnt->mnt == current->fs->root.mnt && !(flags & MNT_DETACH)) {
1930		/*
1931		 * Special case for "unmounting" root ...
1932		 * we just try to remount it readonly.
1933		 */
1934		if (!ns_capable(sb->s_user_ns, CAP_SYS_ADMIN))
1935			return -EPERM;
1936		return do_umount_root(sb);
1937	}
1938
1939	namespace_lock();
1940	lock_mount_hash();
1941
1942	/* Repeat the earlier racy checks, now that we are holding the locks */
1943	retval = -EINVAL;
1944	if (!check_mnt(mnt))
1945		goto out;
1946
1947	if (mnt->mnt.mnt_flags & MNT_LOCKED)
1948		goto out;
1949
1950	if (!mnt_has_parent(mnt)) /* not the absolute root */
1951		goto out;
1952
1953	event++;
1954	if (flags & MNT_DETACH) {
1955		umount_tree(mnt, UMOUNT_PROPAGATE);
1956		retval = 0;
1957	} else {
1958		smp_mb(); // paired with __legitimize_mnt()
1959		shrink_submounts(mnt);
1960		retval = -EBUSY;
1961		if (!propagate_mount_busy(mnt, 2)) {
1962			umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC);
1963			retval = 0;
1964		}
1965	}
1966out:
1967	unlock_mount_hash();
1968	namespace_unlock();
1969	return retval;
1970}
1971
1972/*
1973 * __detach_mounts - lazily unmount all mounts on the specified dentry
1974 *
1975 * During unlink, rmdir, and d_drop it is possible to loose the path
1976 * to an existing mountpoint, and wind up leaking the mount.
1977 * detach_mounts allows lazily unmounting those mounts instead of
1978 * leaking them.
1979 *
1980 * The caller may hold dentry->d_inode->i_rwsem.
1981 */
1982void __detach_mounts(struct dentry *dentry)
1983{
1984	struct pinned_mountpoint mp = {};
1985	struct mount *mnt;
1986
1987	guard(namespace_excl)();
1988	guard(mount_writer)();
1989
1990	if (!lookup_mountpoint(dentry, &mp))
1991		return;
1992
1993	event++;
1994	while (mp.node.next) {
1995		mnt = hlist_entry(mp.node.next, struct mount, mnt_mp_list);
1996		if (mnt->mnt.mnt_flags & MNT_UMOUNT) {
1997			umount_mnt(mnt);
1998			hlist_add_head(&mnt->mnt_umount, &unmounted);
1999		}
2000		else umount_tree(mnt, UMOUNT_CONNECTED);
2001	}
2002	unpin_mountpoint(&mp);
2003}
2004
2005/*
2006 * Is the caller allowed to modify his namespace?
2007 */
2008bool may_mount(void)
2009{
2010	return ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN);
2011}
2012
2013static void warn_mandlock(void)
2014{
2015	pr_warn_once("=======================================================\n"
2016		     "WARNING: The mand mount option has been deprecated and\n"
2017		     "         and is ignored by this kernel. Remove the mand\n"
2018		     "         option from the mount to silence this warning.\n"
2019		     "=======================================================\n");
2020}
2021
2022static int can_umount(const struct path *path, int flags)
2023{
2024	struct mount *mnt = real_mount(path->mnt);
2025	struct super_block *sb = path->dentry->d_sb;
2026
2027	if (!may_mount())
2028		return -EPERM;
2029	if (!path_mounted(path))
2030		return -EINVAL;
2031	if (!check_mnt(mnt))
2032		return -EINVAL;
2033	if (mnt->mnt.mnt_flags & MNT_LOCKED) /* Check optimistically */
2034		return -EINVAL;
2035	if (flags & MNT_FORCE && !ns_capable(sb->s_user_ns, CAP_SYS_ADMIN))
2036		return -EPERM;
2037	return 0;
2038}
2039
2040// caller is responsible for flags being sane
2041int path_umount(const struct path *path, int flags)
2042{
2043	struct mount *mnt = real_mount(path->mnt);
2044	int ret;
2045
2046	ret = can_umount(path, flags);
2047	if (!ret)
2048		ret = do_umount(mnt, flags);
2049
2050	/* we mustn't call path_put() as that would clear mnt_expiry_mark */
2051	dput(path->dentry);
2052	mntput_no_expire(mnt);
2053	return ret;
2054}
2055
2056static int ksys_umount(char __user *name, int flags)
2057{
2058	int lookup_flags = LOOKUP_MOUNTPOINT;
2059	struct path path;
2060	int ret;
2061
2062	// basic validity checks done first
2063	if (flags & ~(MNT_FORCE | MNT_DETACH | MNT_EXPIRE | UMOUNT_NOFOLLOW))
2064		return -EINVAL;
2065
2066	if (!(flags & UMOUNT_NOFOLLOW))
2067		lookup_flags |= LOOKUP_FOLLOW;
2068	ret = user_path_at(AT_FDCWD, name, lookup_flags, &path);
2069	if (ret)
2070		return ret;
2071	return path_umount(&path, flags);
2072}
2073
2074SYSCALL_DEFINE2(umount, char __user *, name, int, flags)
2075{
2076	return ksys_umount(name, flags);
2077}
2078
2079#ifdef __ARCH_WANT_SYS_OLDUMOUNT
2080
2081/*
2082 *	The 2.0 compatible umount. No flags.
2083 */
2084SYSCALL_DEFINE1(oldumount, char __user *, name)
2085{
2086	return ksys_umount(name, 0);
2087}
2088
2089#endif
2090
2091static bool is_mnt_ns_file(struct dentry *dentry)
2092{
2093	struct ns_common *ns;
2094
2095	/* Is this a proxy for a mount namespace? */
2096	if (dentry->d_op != &ns_dentry_operations)
2097		return false;
2098
2099	ns = d_inode(dentry)->i_private;
2100
2101	return ns->ops == &mntns_operations;
2102}
2103
2104struct ns_common *from_mnt_ns(struct mnt_namespace *mnt)
2105{
2106	return &mnt->ns;
2107}
2108
2109struct mnt_namespace *get_sequential_mnt_ns(struct mnt_namespace *mntns, bool previous)
2110{
2111	struct ns_common *ns;
2112
2113	guard(rcu)();
2114
2115	for (;;) {
2116		ns = ns_tree_adjoined_rcu(mntns, previous);
2117		if (IS_ERR(ns))
2118			return ERR_CAST(ns);
2119
2120		mntns = to_mnt_ns(ns);
2121
2122		/*
2123		 * The last passive reference count is put with RCU
2124		 * delay so accessing the mount namespace is not just
2125		 * safe but all relevant members are still valid.
2126		 */
2127		if (!ns_capable_noaudit(mntns->user_ns, CAP_SYS_ADMIN))
2128			continue;
2129
2130		/*
2131		 * We need an active reference count as we're persisting
2132		 * the mount namespace and it might already be on its
2133		 * deathbed.
2134		 */
2135		if (!ns_ref_get(mntns))
2136			continue;
2137
2138		return mntns;
2139	}
2140}
2141
2142struct mnt_namespace *mnt_ns_from_dentry(struct dentry *dentry)
2143{
2144	if (!is_mnt_ns_file(dentry))
2145		return NULL;
2146
2147	return to_mnt_ns(get_proc_ns(dentry->d_inode));
2148}
2149
2150static bool mnt_ns_loop(struct dentry *dentry)
2151{
2152	/* Could bind mounting the mount namespace inode cause a
2153	 * mount namespace loop?
2154	 */
2155	struct mnt_namespace *mnt_ns = mnt_ns_from_dentry(dentry);
2156
2157	if (!mnt_ns)
2158		return false;
2159
2160	return current->nsproxy->mnt_ns->ns.ns_id >= mnt_ns->ns.ns_id;
2161}
2162
2163struct mount *copy_tree(struct mount *src_root, struct dentry *dentry,
2164					int flag)
2165{
2166	struct mount *res, *src_parent, *src_root_child, *src_mnt,
2167		*dst_parent, *dst_mnt;
2168
2169	if (!(flag & CL_COPY_UNBINDABLE) && IS_MNT_UNBINDABLE(src_root))
2170		return ERR_PTR(-EINVAL);
2171
2172	if (!(flag & CL_COPY_MNT_NS_FILE) && is_mnt_ns_file(dentry))
2173		return ERR_PTR(-EINVAL);
2174
2175	res = dst_mnt = clone_mnt(src_root, dentry, flag);
2176	if (IS_ERR(dst_mnt))
2177		return dst_mnt;
2178
2179	src_parent = src_root;
2180
2181	list_for_each_entry(src_root_child, &src_root->mnt_mounts, mnt_child) {
2182		if (!is_subdir(src_root_child->mnt_mountpoint, dentry))
2183			continue;
2184
2185		for (src_mnt = src_root_child; src_mnt;
2186		    src_mnt = next_mnt(src_mnt, src_root_child)) {
2187			if (!(flag & CL_COPY_UNBINDABLE) &&
2188			    IS_MNT_UNBINDABLE(src_mnt)) {
2189				if (src_mnt->mnt.mnt_flags & MNT_LOCKED) {
2190					/* Both unbindable and locked. */
2191					dst_mnt = ERR_PTR(-EPERM);
2192					goto out;
2193				} else {
2194					src_mnt = skip_mnt_tree(src_mnt);
2195					continue;
2196				}
2197			}
2198			if (!(flag & CL_COPY_MNT_NS_FILE) &&
2199			    is_mnt_ns_file(src_mnt->mnt.mnt_root)) {
2200				src_mnt = skip_mnt_tree(src_mnt);
2201				continue;
2202			}
2203			while (src_parent != src_mnt->mnt_parent) {
2204				src_parent = src_parent->mnt_parent;
2205				dst_mnt = dst_mnt->mnt_parent;
2206			}
2207
2208			src_parent = src_mnt;
2209			dst_parent = dst_mnt;
2210			dst_mnt = clone_mnt(src_mnt, src_mnt->mnt.mnt_root, flag);
2211			if (IS_ERR(dst_mnt))
2212				goto out;
2213			lock_mount_hash();
2214			if (src_mnt->mnt.mnt_flags & MNT_LOCKED)
2215				dst_mnt->mnt.mnt_flags |= MNT_LOCKED;
2216			if (unlikely(flag & CL_EXPIRE)) {
2217				/* stick the duplicate mount on the same expiry
2218				 * list as the original if that was on one */
2219				if (!list_empty(&src_mnt->mnt_expire))
2220					list_add(&dst_mnt->mnt_expire,
2221						 &src_mnt->mnt_expire);
2222			}
2223			attach_mnt(dst_mnt, dst_parent, src_parent->mnt_mp);
2224			unlock_mount_hash();
2225		}
2226	}
2227	return res;
2228
2229out:
2230	if (res) {
2231		lock_mount_hash();
2232		umount_tree(res, UMOUNT_SYNC);
2233		unlock_mount_hash();
2234	}
2235	return dst_mnt;
2236}
2237
2238static inline bool extend_array(struct path **res, struct path **to_free,
2239				unsigned n, unsigned *count, unsigned new_count)
2240{
2241	struct path *p;
2242
2243	if (likely(n < *count))
2244		return true;
2245	p = kmalloc_array(new_count, sizeof(struct path), GFP_KERNEL);
2246	if (p && *count)
2247		memcpy(p, *res, *count * sizeof(struct path));
2248	*count = new_count;
2249	kfree(*to_free);
2250	*to_free = *res = p;
2251	return p;
2252}
2253
2254const struct path *collect_paths(const struct path *path,
2255			      struct path *prealloc, unsigned count)
2256{
2257	struct mount *root = real_mount(path->mnt);
2258	struct mount *child;
2259	struct path *res = prealloc, *to_free = NULL;
2260	unsigned n = 0;
2261
2262	guard(namespace_shared)();
2263
2264	if (!check_mnt(root))
2265		return ERR_PTR(-EINVAL);
2266	if (!extend_array(&res, &to_free, 0, &count, 32))
2267		return ERR_PTR(-ENOMEM);
2268	res[n++] = *path;
2269	list_for_each_entry(child, &root->mnt_mounts, mnt_child) {
2270		if (!is_subdir(child->mnt_mountpoint, path->dentry))
2271			continue;
2272		for (struct mount *m = child; m; m = next_mnt(m, child)) {
2273			if (!extend_array(&res, &to_free, n, &count, 2 * count))
2274				return ERR_PTR(-ENOMEM);
2275			res[n].mnt = &m->mnt;
2276			res[n].dentry = m->mnt.mnt_root;
2277			n++;
2278		}
2279	}
2280	if (!extend_array(&res, &to_free, n, &count, count + 1))
2281		return ERR_PTR(-ENOMEM);
2282	memset(res + n, 0, (count - n) * sizeof(struct path));
2283	for (struct path *p = res; p->mnt; p++)
2284		path_get(p);
2285	return res;
2286}
2287
2288void drop_collected_paths(const struct path *paths, const struct path *prealloc)
2289{
2290	for (const struct path *p = paths; p->mnt; p++)
2291		path_put(p);
2292	if (paths != prealloc)
2293		kfree(paths);
2294}
2295
2296static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *, bool);
2297
2298void dissolve_on_fput(struct vfsmount *mnt)
2299{
2300	struct mount *m = real_mount(mnt);
2301
2302	/*
2303	 * m used to be the root of anon namespace; if it still is one,
2304	 * we need to dissolve the mount tree and free that namespace.
2305	 * Let's try to avoid taking namespace_sem if we can determine
2306	 * that there's nothing to do without it - rcu_read_lock() is
2307	 * enough to make anon_ns_root() memory-safe and once m has
2308	 * left its namespace, it's no longer our concern, since it will
2309	 * never become a root of anon ns again.
2310	 */
2311
2312	scoped_guard(rcu) {
2313		if (!anon_ns_root(m))
2314			return;
2315	}
2316
2317	scoped_guard(namespace_excl) {
2318		if (!anon_ns_root(m))
2319			return;
2320
2321		emptied_ns = m->mnt_ns;
2322		lock_mount_hash();
2323		umount_tree(m, UMOUNT_CONNECTED);
2324		unlock_mount_hash();
2325	}
2326}
2327
2328/* locks: namespace_shared && pinned(mnt) || mount_locked_reader */
2329static bool __has_locked_children(struct mount *mnt, struct dentry *dentry)
2330{
2331	struct mount *child;
2332
2333	list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
2334		if (!is_subdir(child->mnt_mountpoint, dentry))
2335			continue;
2336
2337		if (child->mnt.mnt_flags & MNT_LOCKED)
2338			return true;
2339	}
2340	return false;
2341}
2342
2343bool has_locked_children(struct mount *mnt, struct dentry *dentry)
2344{
2345	guard(mount_locked_reader)();
2346	return __has_locked_children(mnt, dentry);
2347}
2348
2349/*
2350 * Check that there aren't references to earlier/same mount namespaces in the
2351 * specified subtree.  Such references can act as pins for mount namespaces
2352 * that aren't checked by the mount-cycle checking code, thereby allowing
2353 * cycles to be made.
2354 *
2355 * locks: mount_locked_reader || namespace_shared && pinned(subtree)
2356 */
2357static bool check_for_nsfs_mounts(struct mount *subtree)
2358{
2359	for (struct mount *p = subtree; p; p = next_mnt(p, subtree))
2360		if (mnt_ns_loop(p->mnt.mnt_root))
2361			return false;
2362	return true;
2363}
2364
2365/**
2366 * clone_private_mount - create a private clone of a path
2367 * @path: path to clone
2368 *
2369 * This creates a new vfsmount, which will be the clone of @path.  The new mount
2370 * will not be attached anywhere in the namespace and will be private (i.e.
2371 * changes to the originating mount won't be propagated into this).
2372 *
2373 * This assumes caller has called or done the equivalent of may_mount().
2374 *
2375 * Release with mntput().
2376 */
2377struct vfsmount *clone_private_mount(const struct path *path)
2378{
2379	struct mount *old_mnt = real_mount(path->mnt);
2380	struct mount *new_mnt;
2381
2382	guard(namespace_shared)();
2383
2384	if (IS_MNT_UNBINDABLE(old_mnt))
2385		return ERR_PTR(-EINVAL);
2386
2387	/*
2388	 * Make sure the source mount is acceptable.
2389	 * Anything mounted in our mount namespace is allowed.
2390	 * Otherwise, it must be the root of an anonymous mount
2391	 * namespace, and we need to make sure no namespace
2392	 * loops get created.
2393	 */
2394	if (!check_mnt(old_mnt)) {
2395		if (!anon_ns_root(old_mnt))
2396			return ERR_PTR(-EINVAL);
2397
2398		if (!check_for_nsfs_mounts(old_mnt))
2399			return ERR_PTR(-EINVAL);
2400	}
2401
2402	if (!ns_capable(old_mnt->mnt_ns->user_ns, CAP_SYS_ADMIN))
2403		return ERR_PTR(-EPERM);
2404
2405	if (__has_locked_children(old_mnt, path->dentry))
2406		return ERR_PTR(-EINVAL);
2407
2408	new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE);
2409	if (IS_ERR(new_mnt))
2410		return ERR_PTR(-EINVAL);
2411
2412	/* Longterm mount to be removed by kern_unmount*() */
2413	new_mnt->mnt_ns = MNT_NS_INTERNAL;
2414	return &new_mnt->mnt;
2415}
2416EXPORT_SYMBOL_GPL(clone_private_mount);
2417
2418static void lock_mnt_tree(struct mount *mnt)
2419{
2420	struct mount *p;
2421
2422	for (p = mnt; p; p = next_mnt(p, mnt)) {
2423		int flags = p->mnt.mnt_flags;
2424		/* Don't allow unprivileged users to change mount flags */
2425		flags |= MNT_LOCK_ATIME;
2426
2427		if (flags & MNT_READONLY)
2428			flags |= MNT_LOCK_READONLY;
2429
2430		if (flags & MNT_NODEV)
2431			flags |= MNT_LOCK_NODEV;
2432
2433		if (flags & MNT_NOSUID)
2434			flags |= MNT_LOCK_NOSUID;
2435
2436		if (flags & MNT_NOEXEC)
2437			flags |= MNT_LOCK_NOEXEC;
2438		/* Don't allow unprivileged users to reveal what is under a mount */
2439		if (list_empty(&p->mnt_expire) && p != mnt)
2440			flags |= MNT_LOCKED;
2441		p->mnt.mnt_flags = flags;
2442	}
2443}
2444
2445static void cleanup_group_ids(struct mount *mnt, struct mount *end)
2446{
2447	struct mount *p;
2448
2449	for (p = mnt; p != end; p = next_mnt(p, mnt)) {
2450		if (p->mnt_group_id && !IS_MNT_SHARED(p))
2451			mnt_release_group_id(p);
2452	}
2453}
2454
2455static int invent_group_ids(struct mount *mnt, bool recurse)
2456{
2457	struct mount *p;
2458
2459	for (p = mnt; p; p = recurse ? next_mnt(p, mnt) : NULL) {
2460		if (!p->mnt_group_id) {
2461			int err = mnt_alloc_group_id(p);
2462			if (err) {
2463				cleanup_group_ids(mnt, p);
2464				return err;
2465			}
2466		}
2467	}
2468
2469	return 0;
2470}
2471
2472int count_mounts(struct mnt_namespace *ns, struct mount *mnt)
2473{
2474	unsigned int max = READ_ONCE(sysctl_mount_max);
2475	unsigned int mounts = 0;
2476	struct mount *p;
2477
2478	if (ns->nr_mounts >= max)
2479		return -ENOSPC;
2480	max -= ns->nr_mounts;
2481	if (ns->pending_mounts >= max)
2482		return -ENOSPC;
2483	max -= ns->pending_mounts;
2484
2485	for (p = mnt; p; p = next_mnt(p, mnt))
2486		mounts++;
2487
2488	if (mounts > max)
2489		return -ENOSPC;
2490
2491	ns->pending_mounts += mounts;
2492	return 0;
2493}
2494
2495enum mnt_tree_flags_t {
2496	MNT_TREE_BENEATH = BIT(0),
2497	MNT_TREE_PROPAGATION = BIT(1),
2498};
2499
2500/**
2501 * attach_recursive_mnt - attach a source mount tree
2502 * @source_mnt: mount tree to be attached
2503 * @dest:	the context for mounting at the place where the tree should go
2504 *
2505 *  NOTE: in the table below explains the semantics when a source mount
2506 *  of a given type is attached to a destination mount of a given type.
2507 * ---------------------------------------------------------------------------
2508 * |         BIND MOUNT OPERATION                                            |
2509 * |**************************************************************************
2510 * | source-->| shared        |       private  |       slave    | unbindable |
2511 * | dest     |               |                |                |            |
2512 * |   |      |               |                |                |            |
2513 * |   v      |               |                |                |            |
2514 * |**************************************************************************
2515 * |  shared  | shared (++)   |     shared (+) |     shared(+++)|  invalid   |
2516 * |          |               |                |                |            |
2517 * |non-shared| shared (+)    |      private   |      slave (*) |  invalid   |
2518 * ***************************************************************************
2519 * A bind operation clones the source mount and mounts the clone on the
2520 * destination mount.
2521 *
2522 * (++)  the cloned mount is propagated to all the mounts in the propagation
2523 * 	 tree of the destination mount and the cloned mount is added to
2524 * 	 the peer group of the source mount.
2525 * (+)   the cloned mount is created under the destination mount and is marked
2526 *       as shared. The cloned mount is added to the peer group of the source
2527 *       mount.
2528 * (+++) the mount is propagated to all the mounts in the propagation tree
2529 *       of the destination mount and the cloned mount is made slave
2530 *       of the same master as that of the source mount. The cloned mount
2531 *       is marked as 'shared and slave'.
2532 * (*)   the cloned mount is made a slave of the same master as that of the
2533 * 	 source mount.
2534 *
2535 * ---------------------------------------------------------------------------
2536 * |         		MOVE MOUNT OPERATION                                 |
2537 * |**************************************************************************
2538 * | source-->| shared        |       private  |       slave    | unbindable |
2539 * | dest     |               |                |                |            |
2540 * |   |      |               |                |                |            |
2541 * |   v      |               |                |                |            |
2542 * |**************************************************************************
2543 * |  shared  | shared (+)    |     shared (+) |    shared(+++) |  invalid   |
2544 * |          |               |                |                |            |
2545 * |non-shared| shared (+*)   |      private   |    slave (*)   | unbindable |
2546 * ***************************************************************************
2547 *
2548 * (+)  the mount is moved to the destination. And is then propagated to
2549 * 	all the mounts in the propagation tree of the destination mount.
2550 * (+*)  the mount is moved to the destination.
2551 * (+++)  the mount is moved to the destination and is then propagated to
2552 * 	all the mounts belonging to the destination mount's propagation tree.
2553 * 	the mount is marked as 'shared and slave'.
2554 * (*)	the mount continues to be a slave at the new location.
2555 *
2556 * if the source mount is a tree, the operations explained above is
2557 * applied to each mount in the tree.
2558 * Must be called without spinlocks held, since this function can sleep
2559 * in allocations.
2560 *
2561 * Context: The function expects namespace_lock() to be held.
2562 * Return: If @source_mnt was successfully attached 0 is returned.
2563 *         Otherwise a negative error code is returned.
2564 */
2565static int attach_recursive_mnt(struct mount *source_mnt,
2566				const struct pinned_mountpoint *dest)
2567{
2568	struct user_namespace *user_ns = current->nsproxy->mnt_ns->user_ns;
2569	struct mount *dest_mnt = dest->parent;
2570	struct mountpoint *dest_mp = dest->mp;
2571	HLIST_HEAD(tree_list);
2572	struct mnt_namespace *ns = dest_mnt->mnt_ns;
2573	struct pinned_mountpoint root = {};
2574	struct mountpoint *shorter = NULL;
2575	struct mount *child, *p;
2576	struct mount *top;
2577	struct hlist_node *n;
2578	int err = 0;
2579	bool moving = mnt_has_parent(source_mnt);
2580
2581	/*
2582	 * Preallocate a mountpoint in case the new mounts need to be
2583	 * mounted beneath mounts on the same mountpoint.
2584	 */
2585	for (top = source_mnt; unlikely(top->overmount); top = top->overmount) {
2586		if (!shorter && is_mnt_ns_file(top->mnt.mnt_root))
2587			shorter = top->mnt_mp;
2588	}
2589	err = get_mountpoint(top->mnt.mnt_root, &root);
2590	if (err)
2591		return err;
2592
2593	/* Is there space to add these mounts to the mount namespace? */
2594	if (!moving) {
2595		err = count_mounts(ns, source_mnt);
2596		if (err)
2597			goto out;
2598	}
2599
2600	if (IS_MNT_SHARED(dest_mnt)) {
2601		err = invent_group_ids(source_mnt, true);
2602		if (err)
2603			goto out;
2604		err = propagate_mnt(dest_mnt, dest_mp, source_mnt, &tree_list);
2605	}
2606	lock_mount_hash();
2607	if (err)
2608		goto out_cleanup_ids;
2609
2610	if (IS_MNT_SHARED(dest_mnt)) {
2611		for (p = source_mnt; p; p = next_mnt(p, source_mnt))
2612			set_mnt_shared(p);
2613	}
2614
2615	if (moving) {
2616		umount_mnt(source_mnt);
2617		mnt_notify_add(source_mnt);
2618		/* if the mount is moved, it should no longer be expired
2619		 * automatically */
2620		list_del_init(&source_mnt->mnt_expire);
2621	} else {
2622		if (source_mnt->mnt_ns) {
2623			/* move from anon - the caller will destroy */
2624			emptied_ns = source_mnt->mnt_ns;
2625			for (p = source_mnt; p; p = next_mnt(p, source_mnt))
2626				move_from_ns(p);
2627		}
2628	}
2629
2630	mnt_set_mountpoint(dest_mnt, dest_mp, source_mnt);
2631	/*
2632	 * Now the original copy is in the same state as the secondaries -
2633	 * its root attached to mountpoint, but not hashed and all mounts
2634	 * in it are either in our namespace or in no namespace at all.
2635	 * Add the original to the list of copies and deal with the
2636	 * rest of work for all of them uniformly.
2637	 */
2638	hlist_add_head(&source_mnt->mnt_hash, &tree_list);
2639
2640	hlist_for_each_entry_safe(child, n, &tree_list, mnt_hash) {
2641		struct mount *q;
2642		hlist_del_init(&child->mnt_hash);
2643		/* Notice when we are propagating across user namespaces */
2644		if (child->mnt_parent->mnt_ns->user_ns != user_ns)
2645			lock_mnt_tree(child);
2646		q = __lookup_mnt(&child->mnt_parent->mnt,
2647				 child->mnt_mountpoint);
2648		commit_tree(child);
2649		if (q) {
2650			struct mount *r = topmost_overmount(child);
2651			struct mountpoint *mp = root.mp;
2652
2653			if (unlikely(shorter) && child != source_mnt)
2654				mp = shorter;
2655			mnt_change_mountpoint(r, mp, q);
2656		}
2657	}
2658	unpin_mountpoint(&root);
2659	unlock_mount_hash();
2660
2661	return 0;
2662
2663 out_cleanup_ids:
2664	while (!hlist_empty(&tree_list)) {
2665		child = hlist_entry(tree_list.first, struct mount, mnt_hash);
2666		child->mnt_parent->mnt_ns->pending_mounts = 0;
2667		umount_tree(child, UMOUNT_SYNC);
2668	}
2669	unlock_mount_hash();
2670	cleanup_group_ids(source_mnt, NULL);
2671 out:
2672	ns->pending_mounts = 0;
2673
2674	read_seqlock_excl(&mount_lock);
2675	unpin_mountpoint(&root);
2676	read_sequnlock_excl(&mount_lock);
2677
2678	return err;
2679}
2680
2681static inline struct mount *where_to_mount(const struct path *path,
2682					   struct dentry **dentry,
2683					   bool beneath)
2684{
2685	struct mount *m;
2686
2687	if (unlikely(beneath)) {
2688		m = topmost_overmount(real_mount(path->mnt));
2689		*dentry = m->mnt_mountpoint;
2690		return m->mnt_parent;
2691	}
2692	m = __lookup_mnt(path->mnt, path->dentry);
2693	if (unlikely(m)) {
2694		m = topmost_overmount(m);
2695		*dentry = m->mnt.mnt_root;
2696		return m;
2697	}
2698	*dentry = path->dentry;
2699	return real_mount(path->mnt);
2700}
2701
2702/**
2703 * do_lock_mount - acquire environment for mounting
2704 * @path:	target path
2705 * @res:	context to set up
2706 * @beneath:	whether the intention is to mount beneath @path
2707 *
2708 * To mount something at given location, we need
2709 *	namespace_sem locked exclusive
2710 *	inode of dentry we are mounting on locked exclusive
2711 *	struct mountpoint for that dentry
2712 *	struct mount we are mounting on
2713 *
2714 * Results are stored in caller-supplied context (pinned_mountpoint);
2715 * on success we have res->parent and res->mp pointing to parent and
2716 * mountpoint respectively and res->node inserted into the ->m_list
2717 * of the mountpoint, making sure the mountpoint won't disappear.
2718 * On failure we have res->parent set to ERR_PTR(-E...), res->mp
2719 * left NULL, res->node - empty.
2720 * In case of success do_lock_mount returns with locks acquired (in
2721 * proper order - inode lock nests outside of namespace_sem).
2722 *
2723 * Request to mount on overmounted location is treated as "mount on
2724 * top of whatever's overmounting it"; request to mount beneath
2725 * a location - "mount immediately beneath the topmost mount at that
2726 * place".
2727 *
2728 * In all cases the location must not have been unmounted and the
2729 * chosen mountpoint must be allowed to be mounted on.  For "beneath"
2730 * case we also require the location to be at the root of a mount
2731 * that has a parent (i.e. is not a root of some namespace).
2732 */
2733static void do_lock_mount(const struct path *path,
2734			  struct pinned_mountpoint *res,
2735			  bool beneath)
2736{
2737	int err;
2738
2739	if (unlikely(beneath) && !path_mounted(path)) {
2740		res->parent = ERR_PTR(-EINVAL);
2741		return;
2742	}
2743
2744	do {
2745		struct dentry *dentry, *d;
2746		struct mount *m, *n;
2747
2748		scoped_guard(mount_locked_reader) {
2749			m = where_to_mount(path, &dentry, beneath);
2750			if (&m->mnt != path->mnt) {
2751				mntget(&m->mnt);
2752				dget(dentry);
2753			}
2754		}
2755
2756		inode_lock(dentry->d_inode);
2757		namespace_lock();
2758
2759		// check if the chain of mounts (if any) has changed.
2760		scoped_guard(mount_locked_reader)
2761			n = where_to_mount(path, &d, beneath);
2762
2763		if (unlikely(n != m || dentry != d))
2764			err = -EAGAIN;		// something moved, retry
2765		else if (unlikely(cant_mount(dentry) || !is_mounted(path->mnt)))
2766			err = -ENOENT;		// not to be mounted on
2767		else if (beneath && &m->mnt == path->mnt && !m->overmount)
2768			err = -EINVAL;
2769		else
2770			err = get_mountpoint(dentry, res);
2771
2772		if (unlikely(err)) {
2773			res->parent = ERR_PTR(err);
2774			namespace_unlock();
2775			inode_unlock(dentry->d_inode);
2776		} else {
2777			res->parent = m;
2778		}
2779		/*
2780		 * Drop the temporary references.  This is subtle - on success
2781		 * we are doing that under namespace_sem, which would normally
2782		 * be forbidden.  However, in that case we are guaranteed that
2783		 * refcounts won't reach zero, since we know that path->mnt
2784		 * is mounted and thus all mounts reachable from it are pinned
2785		 * and stable, along with their mountpoints and roots.
2786		 */
2787		if (&m->mnt != path->mnt) {
2788			dput(dentry);
2789			mntput(&m->mnt);
2790		}
2791	} while (err == -EAGAIN);
2792}
2793
2794static void __unlock_mount(struct pinned_mountpoint *m)
2795{
2796	inode_unlock(m->mp->m_dentry->d_inode);
2797	read_seqlock_excl(&mount_lock);
2798	unpin_mountpoint(m);
2799	read_sequnlock_excl(&mount_lock);
2800	namespace_unlock();
2801}
2802
2803static inline void unlock_mount(struct pinned_mountpoint *m)
2804{
2805	if (!IS_ERR(m->parent))
2806		__unlock_mount(m);
2807}
2808
2809#define LOCK_MOUNT_MAYBE_BENEATH(mp, path, beneath) \
2810	struct pinned_mountpoint mp __cleanup(unlock_mount) = {}; \
2811	do_lock_mount((path), &mp, (beneath))
2812#define LOCK_MOUNT(mp, path) LOCK_MOUNT_MAYBE_BENEATH(mp, (path), false)
2813#define LOCK_MOUNT_EXACT(mp, path) \
2814	struct pinned_mountpoint mp __cleanup(unlock_mount) = {}; \
2815	lock_mount_exact((path), &mp)
2816
2817static int graft_tree(struct mount *mnt, const struct pinned_mountpoint *mp)
2818{
2819	if (mnt->mnt.mnt_sb->s_flags & SB_NOUSER)
2820		return -EINVAL;
2821
2822	if (d_is_dir(mp->mp->m_dentry) !=
2823	      d_is_dir(mnt->mnt.mnt_root))
2824		return -ENOTDIR;
2825
2826	return attach_recursive_mnt(mnt, mp);
2827}
2828
2829static int may_change_propagation(const struct mount *m)
2830{
2831        struct mnt_namespace *ns = m->mnt_ns;
2832
2833	 // it must be mounted in some namespace
2834	 if (IS_ERR_OR_NULL(ns))         // is_mounted()
2835		 return -EINVAL;
2836	 // and the caller must be admin in userns of that namespace
2837	 if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
2838		 return -EPERM;
2839	 return 0;
2840}
2841
2842/*
2843 * Sanity check the flags to change_mnt_propagation.
2844 */
2845
2846static int flags_to_propagation_type(int ms_flags)
2847{
2848	int type = ms_flags & ~(MS_REC | MS_SILENT);
2849
2850	/* Fail if any non-propagation flags are set */
2851	if (type & ~(MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
2852		return 0;
2853	/* Only one propagation flag should be set */
2854	if (!is_power_of_2(type))
2855		return 0;
2856	return type;
2857}
2858
2859/*
2860 * recursively change the type of the mountpoint.
2861 */
2862static int do_change_type(const struct path *path, int ms_flags)
2863{
2864	struct mount *m;
2865	struct mount *mnt = real_mount(path->mnt);
2866	int recurse = ms_flags & MS_REC;
2867	int type;
2868	int err;
2869
2870	if (!path_mounted(path))
2871		return -EINVAL;
2872
2873	type = flags_to_propagation_type(ms_flags);
2874	if (!type)
2875		return -EINVAL;
2876
2877	guard(namespace_excl)();
2878
2879	err = may_change_propagation(mnt);
2880	if (err)
2881		return err;
2882
2883	if (type == MS_SHARED) {
2884		err = invent_group_ids(mnt, recurse);
2885		if (err)
2886			return err;
2887	}
2888
2889	for (m = mnt; m; m = (recurse ? next_mnt(m, mnt) : NULL))
2890		change_mnt_propagation(m, type);
2891
2892	return 0;
2893}
2894
2895/* may_copy_tree() - check if a mount tree can be copied
2896 * @path: path to the mount tree to be copied
2897 *
2898 * This helper checks if the caller may copy the mount tree starting
2899 * from @path->mnt. The caller may copy the mount tree under the
2900 * following circumstances:
2901 *
2902 * (1) The caller is located in the mount namespace of the mount tree.
2903 *     This also implies that the mount does not belong to an anonymous
2904 *     mount namespace.
2905 * (2) The caller tries to copy an nfs mount referring to a mount
2906 *     namespace, i.e., the caller is trying to copy a mount namespace
2907 *     entry from nsfs.
2908 * (3) The caller tries to copy a pidfs mount referring to a pidfd.
2909 * (4) The caller is trying to copy a mount tree that belongs to an
2910 *     anonymous mount namespace.
2911 *
2912 *     For that to be safe, this helper enforces that the origin mount
2913 *     namespace the anonymous mount namespace was created from is the
2914 *     same as the caller's mount namespace by comparing the sequence
2915 *     numbers.
2916 *
2917 *     This is not strictly necessary. The current semantics of the new
2918 *     mount api enforce that the caller must be located in the same
2919 *     mount namespace as the mount tree it interacts with. Using the
2920 *     origin sequence number preserves these semantics even for
2921 *     anonymous mount namespaces. However, one could envision extending
2922 *     the api to directly operate across mount namespace if needed.
2923 *
2924 *     The ownership of a non-anonymous mount namespace such as the
2925 *     caller's cannot change.
2926 *     => We know that the caller's mount namespace is stable.
2927 *
2928 *     If the origin sequence number of the anonymous mount namespace is
2929 *     the same as the sequence number of the caller's mount namespace.
2930 *     => The owning namespaces are the same.
2931 *
2932 *     ==> The earlier capability check on the owning namespace of the
2933 *         caller's mount namespace ensures that the caller has the
2934 *         ability to copy the mount tree.
2935 *
2936 * Returns true if the mount tree can be copied, false otherwise.
2937 */
2938static inline bool may_copy_tree(const struct path *path)
2939{
2940	struct mount *mnt = real_mount(path->mnt);
2941	const struct dentry_operations *d_op;
2942
2943	if (check_mnt(mnt))
2944		return true;
2945
2946	d_op = path->dentry->d_op;
2947	if (d_op == &ns_dentry_operations)
2948		return true;
2949
2950	if (d_op == &pidfs_dentry_operations)
2951		return true;
2952
2953	if (!is_mounted(path->mnt))
2954		return false;
2955
2956	return check_anonymous_mnt(mnt);
2957}
2958
2959
2960static struct mount *__do_loopback(const struct path *old_path, int recurse)
2961{
2962	struct mount *old = real_mount(old_path->mnt);
2963
2964	if (IS_MNT_UNBINDABLE(old))
2965		return ERR_PTR(-EINVAL);
2966
2967	if (!may_copy_tree(old_path))
2968		return ERR_PTR(-EINVAL);
2969
2970	if (!recurse && __has_locked_children(old, old_path->dentry))
2971		return ERR_PTR(-EINVAL);
2972
2973	if (recurse)
2974		return copy_tree(old, old_path->dentry, CL_COPY_MNT_NS_FILE);
2975	else
2976		return clone_mnt(old, old_path->dentry, 0);
2977}
2978
2979/*
2980 * do loopback mount.
2981 */
2982static int do_loopback(const struct path *path, const char *old_name,
2983		       int recurse)
2984{
2985	struct path old_path __free(path_put) = {};
2986	struct mount *mnt = NULL;
2987	int err;
2988	if (!old_name || !*old_name)
2989		return -EINVAL;
2990	err = kern_path(old_name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &old_path);
2991	if (err)
2992		return err;
2993
2994	if (mnt_ns_loop(old_path.dentry))
2995		return -EINVAL;
2996
2997	LOCK_MOUNT(mp, path);
2998	if (IS_ERR(mp.parent))
2999		return PTR_ERR(mp.parent);
3000
3001	if (!check_mnt(mp.parent))
3002		return -EINVAL;
3003
3004	mnt = __do_loopback(&old_path, recurse);
3005	if (IS_ERR(mnt))
3006		return PTR_ERR(mnt);
3007
3008	err = graft_tree(mnt, &mp);
3009	if (err) {
3010		lock_mount_hash();
3011		umount_tree(mnt, UMOUNT_SYNC);
3012		unlock_mount_hash();
3013	}
3014	return err;
3015}
3016
3017static struct mnt_namespace *get_detached_copy(const struct path *path, bool recursive)
3018{
3019	struct mnt_namespace *ns, *mnt_ns = current->nsproxy->mnt_ns, *src_mnt_ns;
3020	struct user_namespace *user_ns = mnt_ns->user_ns;
3021	struct mount *mnt, *p;
3022
3023	ns = alloc_mnt_ns(user_ns, true);
3024	if (IS_ERR(ns))
3025		return ns;
3026
3027	guard(namespace_excl)();
3028
3029	/*
3030	 * Record the sequence number of the source mount namespace.
3031	 * This needs to hold namespace_sem to ensure that the mount
3032	 * doesn't get attached.
3033	 */
3034	if (is_mounted(path->mnt)) {
3035		src_mnt_ns = real_mount(path->mnt)->mnt_ns;
3036		if (is_anon_ns(src_mnt_ns))
3037			ns->seq_origin = src_mnt_ns->seq_origin;
3038		else
3039			ns->seq_origin = src_mnt_ns->ns.ns_id;
3040	}
3041
3042	mnt = __do_loopback(path, recursive);
3043	if (IS_ERR(mnt)) {
3044		emptied_ns = ns;
3045		return ERR_CAST(mnt);
3046	}
3047
3048	for (p = mnt; p; p = next_mnt(p, mnt)) {
3049		mnt_add_to_ns(ns, p);
3050		ns->nr_mounts++;
3051	}
3052	ns->root = mnt;
3053	return ns;
3054}
3055
3056static struct file *open_detached_copy(struct path *path, bool recursive)
3057{
3058	struct mnt_namespace *ns = get_detached_copy(path, recursive);
3059	struct file *file;
3060
3061	if (IS_ERR(ns))
3062		return ERR_CAST(ns);
3063
3064	mntput(path->mnt);
3065	path->mnt = mntget(&ns->root->mnt);
3066	file = dentry_open(path, O_PATH, current_cred());
3067	if (IS_ERR(file))
3068		dissolve_on_fput(path->mnt);
3069	else
3070		file->f_mode |= FMODE_NEED_UNMOUNT;
3071	return file;
3072}
3073
3074static struct file *vfs_open_tree(int dfd, const char __user *filename, unsigned int flags)
3075{
3076	int ret;
3077	struct path path __free(path_put) = {};
3078	int lookup_flags = LOOKUP_AUTOMOUNT | LOOKUP_FOLLOW;
3079	bool detached = flags & OPEN_TREE_CLONE;
3080
3081	BUILD_BUG_ON(OPEN_TREE_CLOEXEC != O_CLOEXEC);
3082
3083	if (flags & ~(AT_EMPTY_PATH | AT_NO_AUTOMOUNT | AT_RECURSIVE |
3084		      AT_SYMLINK_NOFOLLOW | OPEN_TREE_CLONE |
3085		      OPEN_TREE_CLOEXEC))
3086		return ERR_PTR(-EINVAL);
3087
3088	if ((flags & (AT_RECURSIVE | OPEN_TREE_CLONE)) == AT_RECURSIVE)
3089		return ERR_PTR(-EINVAL);
3090
3091	if (flags & AT_NO_AUTOMOUNT)
3092		lookup_flags &= ~LOOKUP_AUTOMOUNT;
3093	if (flags & AT_SYMLINK_NOFOLLOW)
3094		lookup_flags &= ~LOOKUP_FOLLOW;
3095	if (flags & AT_EMPTY_PATH)
3096		lookup_flags |= LOOKUP_EMPTY;
3097
3098	if (detached && !may_mount())
3099		return ERR_PTR(-EPERM);
3100
3101	ret = user_path_at(dfd, filename, lookup_flags, &path);
3102	if (unlikely(ret))
3103		return ERR_PTR(ret);
3104
3105	if (detached)
3106		return open_detached_copy(&path, flags & AT_RECURSIVE);
3107
3108	return dentry_open(&path, O_PATH, current_cred());
3109}
3110
3111SYSCALL_DEFINE3(open_tree, int, dfd, const char __user *, filename, unsigned, flags)
3112{
3113	return FD_ADD(flags, vfs_open_tree(dfd, filename, flags));
3114}
3115
3116/*
3117 * Don't allow locked mount flags to be cleared.
3118 *
3119 * No locks need to be held here while testing the various MNT_LOCK
3120 * flags because those flags can never be cleared once they are set.
3121 */
3122static bool can_change_locked_flags(struct mount *mnt, unsigned int mnt_flags)
3123{
3124	unsigned int fl = mnt->mnt.mnt_flags;
3125
3126	if ((fl & MNT_LOCK_READONLY) &&
3127	    !(mnt_flags & MNT_READONLY))
3128		return false;
3129
3130	if ((fl & MNT_LOCK_NODEV) &&
3131	    !(mnt_flags & MNT_NODEV))
3132		return false;
3133
3134	if ((fl & MNT_LOCK_NOSUID) &&
3135	    !(mnt_flags & MNT_NOSUID))
3136		return false;
3137
3138	if ((fl & MNT_LOCK_NOEXEC) &&
3139	    !(mnt_flags & MNT_NOEXEC))
3140		return false;
3141
3142	if ((fl & MNT_LOCK_ATIME) &&
3143	    ((fl & MNT_ATIME_MASK) != (mnt_flags & MNT_ATIME_MASK)))
3144		return false;
3145
3146	return true;
3147}
3148
3149static int change_mount_ro_state(struct mount *mnt, unsigned int mnt_flags)
3150{
3151	bool readonly_request = (mnt_flags & MNT_READONLY);
3152
3153	if (readonly_request == __mnt_is_readonly(&mnt->mnt))
3154		return 0;
3155
3156	if (readonly_request)
3157		return mnt_make_readonly(mnt);
3158
3159	mnt->mnt.mnt_flags &= ~MNT_READONLY;
3160	return 0;
3161}
3162
3163static void set_mount_attributes(struct mount *mnt, unsigned int mnt_flags)
3164{
3165	mnt_flags |= mnt->mnt.mnt_flags & ~MNT_USER_SETTABLE_MASK;
3166	mnt->mnt.mnt_flags = mnt_flags;
3167	touch_mnt_namespace(mnt->mnt_ns);
3168}
3169
3170static void mnt_warn_timestamp_expiry(const struct path *mountpoint,
3171				      struct vfsmount *mnt)
3172{
3173	struct super_block *sb = mnt->mnt_sb;
3174
3175	if (!__mnt_is_readonly(mnt) &&
3176	   (!(sb->s_iflags & SB_I_TS_EXPIRY_WARNED)) &&
3177	   (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) {
3178		char *buf, *mntpath;
3179
3180		buf = (char *)__get_free_page(GFP_KERNEL);
3181		if (buf)
3182			mntpath = d_path(mountpoint, buf, PAGE_SIZE);
3183		else
3184			mntpath = ERR_PTR(-ENOMEM);
3185		if (IS_ERR(mntpath))
3186			mntpath = "(unknown)";
3187
3188		pr_warn("%s filesystem being %s at %s supports timestamps until %ptTd (0x%llx)\n",
3189			sb->s_type->name,
3190			is_mounted(mnt) ? "remounted" : "mounted",
3191			mntpath, &sb->s_time_max,
3192			(unsigned long long)sb->s_time_max);
3193
3194		sb->s_iflags |= SB_I_TS_EXPIRY_WARNED;
3195		if (buf)
3196			free_page((unsigned long)buf);
3197	}
3198}
3199
3200/*
3201 * Handle reconfiguration of the mountpoint only without alteration of the
3202 * superblock it refers to.  This is triggered by specifying MS_REMOUNT|MS_BIND
3203 * to mount(2).
3204 */
3205static int do_reconfigure_mnt(const struct path *path, unsigned int mnt_flags)
3206{
3207	struct super_block *sb = path->mnt->mnt_sb;
3208	struct mount *mnt = real_mount(path->mnt);
3209	int ret;
3210
3211	if (!check_mnt(mnt))
3212		return -EINVAL;
3213
3214	if (!path_mounted(path))
3215		return -EINVAL;
3216
3217	if (!can_change_locked_flags(mnt, mnt_flags))
3218		return -EPERM;
3219
3220	/*
3221	 * We're only checking whether the superblock is read-only not
3222	 * changing it, so only take down_read(&sb->s_umount).
3223	 */
3224	down_read(&sb->s_umount);
3225	lock_mount_hash();
3226	ret = change_mount_ro_state(mnt, mnt_flags);
3227	if (ret == 0)
3228		set_mount_attributes(mnt, mnt_flags);
3229	unlock_mount_hash();
3230	up_read(&sb->s_umount);
3231
3232	mnt_warn_timestamp_expiry(path, &mnt->mnt);
3233
3234	return ret;
3235}
3236
3237/*
3238 * change filesystem flags. dir should be a physical root of filesystem.
3239 * If you've mounted a non-root directory somewhere and want to do remount
3240 * on it - tough luck.
3241 */
3242static int do_remount(const struct path *path, int sb_flags,
3243		      int mnt_flags, void *data)
3244{
3245	int err;
3246	struct super_block *sb = path->mnt->mnt_sb;
3247	struct mount *mnt = real_mount(path->mnt);
3248	struct fs_context *fc;
3249
3250	if (!check_mnt(mnt))
3251		return -EINVAL;
3252
3253	if (!path_mounted(path))
3254		return -EINVAL;
3255
3256	if (!can_change_locked_flags(mnt, mnt_flags))
3257		return -EPERM;
3258
3259	fc = fs_context_for_reconfigure(path->dentry, sb_flags, MS_RMT_MASK);
3260	if (IS_ERR(fc))
3261		return PTR_ERR(fc);
3262
3263	/*
3264	 * Indicate to the filesystem that the remount request is coming
3265	 * from the legacy mount system call.
3266	 */
3267	fc->oldapi = true;
3268
3269	err = parse_monolithic_mount_data(fc, data);
3270	if (!err) {
3271		down_write(&sb->s_umount);
3272		err = -EPERM;
3273		if (ns_capable(sb->s_user_ns, CAP_SYS_ADMIN)) {
3274			err = reconfigure_super(fc);
3275			if (!err) {
3276				lock_mount_hash();
3277				set_mount_attributes(mnt, mnt_flags);
3278				unlock_mount_hash();
3279			}
3280		}
3281		up_write(&sb->s_umount);
3282	}
3283
3284	mnt_warn_timestamp_expiry(path, &mnt->mnt);
3285
3286	put_fs_context(fc);
3287	return err;
3288}
3289
3290static inline int tree_contains_unbindable(struct mount *mnt)
3291{
3292	struct mount *p;
3293	for (p = mnt; p; p = next_mnt(p, mnt)) {
3294		if (IS_MNT_UNBINDABLE(p))
3295			return 1;
3296	}
3297	return 0;
3298}
3299
3300static int do_set_group(const struct path *from_path, const struct path *to_path)
3301{
3302	struct mount *from = real_mount(from_path->mnt);
3303	struct mount *to = real_mount(to_path->mnt);
3304	int err;
3305
3306	guard(namespace_excl)();
3307
3308	err = may_change_propagation(from);
3309	if (err)
3310		return err;
3311	err = may_change_propagation(to);
3312	if (err)
3313		return err;
3314
3315	/* To and From paths should be mount roots */
3316	if (!path_mounted(from_path))
3317		return -EINVAL;
3318	if (!path_mounted(to_path))
3319		return -EINVAL;
3320
3321	/* Setting sharing groups is only allowed across same superblock */
3322	if (from->mnt.mnt_sb != to->mnt.mnt_sb)
3323		return -EINVAL;
3324
3325	/* From mount root should be wider than To mount root */
3326	if (!is_subdir(to->mnt.mnt_root, from->mnt.mnt_root))
3327		return -EINVAL;
3328
3329	/* From mount should not have locked children in place of To's root */
3330	if (__has_locked_children(from, to->mnt.mnt_root))
3331		return -EINVAL;
3332
3333	/* Setting sharing groups is only allowed on private mounts */
3334	if (IS_MNT_SHARED(to) || IS_MNT_SLAVE(to))
3335		return -EINVAL;
3336
3337	/* From should not be private */
3338	if (!IS_MNT_SHARED(from) && !IS_MNT_SLAVE(from))
3339		return -EINVAL;
3340
3341	if (IS_MNT_SLAVE(from)) {
3342		hlist_add_behind(&to->mnt_slave, &from->mnt_slave);
3343		to->mnt_master = from->mnt_master;
3344	}
3345
3346	if (IS_MNT_SHARED(from)) {
3347		to->mnt_group_id = from->mnt_group_id;
3348		list_add(&to->mnt_share, &from->mnt_share);
3349		set_mnt_shared(to);
3350	}
3351	return 0;
3352}
3353
3354/**
3355 * path_overmounted - check if path is overmounted
3356 * @path: path to check
3357 *
3358 * Check if path is overmounted, i.e., if there's a mount on top of
3359 * @path->mnt with @path->dentry as mountpoint.
3360 *
3361 * Context: namespace_sem must be held at least shared.
3362 * MUST NOT be called under lock_mount_hash() (there one should just
3363 * call __lookup_mnt() and check if it returns NULL).
3364 * Return: If path is overmounted true is returned, false if not.
3365 */
3366static inline bool path_overmounted(const struct path *path)
3367{
3368	unsigned seq = read_seqbegin(&mount_lock);
3369	bool no_child;
3370
3371	rcu_read_lock();
3372	no_child = !__lookup_mnt(path->mnt, path->dentry);
3373	rcu_read_unlock();
3374	if (need_seqretry(&mount_lock, seq)) {
3375		read_seqlock_excl(&mount_lock);
3376		no_child = !__lookup_mnt(path->mnt, path->dentry);
3377		read_sequnlock_excl(&mount_lock);
3378	}
3379	return unlikely(!no_child);
3380}
3381
3382/*
3383 * Check if there is a possibly empty chain of descent from p1 to p2.
3384 * Locks: namespace_sem (shared) or mount_lock (read_seqlock_excl).
3385 */
3386static bool mount_is_ancestor(const struct mount *p1, const struct mount *p2)
3387{
3388	while (p2 != p1 && mnt_has_parent(p2))
3389		p2 = p2->mnt_parent;
3390	return p2 == p1;
3391}
3392
3393/**
3394 * can_move_mount_beneath - check that we can mount beneath the top mount
3395 * @mnt_from: mount we are trying to move
3396 * @mnt_to:   mount under which to mount
3397 * @mp:   mountpoint of @mnt_to
3398 *
3399 * - Make sure that nothing can be mounted beneath the caller's current
3400 *   root or the rootfs of the namespace.
3401 * - Make sure that the caller can unmount the topmost mount ensuring
3402 *   that the caller could reveal the underlying mountpoint.
3403 * - Ensure that nothing has been mounted on top of @mnt_from before we
3404 *   grabbed @namespace_sem to avoid creating pointless shadow mounts.
3405 * - Prevent mounting beneath a mount if the propagation relationship
3406 *   between the source mount, parent mount, and top mount would lead to
3407 *   nonsensical mount trees.
3408 *
3409 * Context: This function expects namespace_lock() to be held.
3410 * Return: On success 0, and on error a negative error code is returned.
3411 */
3412static int can_move_mount_beneath(const struct mount *mnt_from,
3413				  const struct mount *mnt_to,
3414				  const struct mountpoint *mp)
3415{
3416	struct mount *parent_mnt_to = mnt_to->mnt_parent;
3417
3418	if (IS_MNT_LOCKED(mnt_to))
3419		return -EINVAL;
3420
3421	/* Avoid creating shadow mounts during mount propagation. */
3422	if (mnt_from->overmount)
3423		return -EINVAL;
3424
3425	/*
3426	 * Mounting beneath the rootfs only makes sense when the
3427	 * semantics of pivot_root(".", ".") are used.
3428	 */
3429	if (&mnt_to->mnt == current->fs->root.mnt)
3430		return -EINVAL;
3431	if (parent_mnt_to == current->nsproxy->mnt_ns->root)
3432		return -EINVAL;
3433
3434	if (mount_is_ancestor(mnt_to, mnt_from))
3435		return -EINVAL;
3436
3437	/*
3438	 * If the parent mount propagates to the child mount this would
3439	 * mean mounting @mnt_from on @mnt_to->mnt_parent and then
3440	 * propagating a copy @c of @mnt_from on top of @mnt_to. This
3441	 * defeats the whole purpose of mounting beneath another mount.
3442	 */
3443	if (propagation_would_overmount(parent_mnt_to, mnt_to, mp))
3444		return -EINVAL;
3445
3446	/*
3447	 * If @mnt_to->mnt_parent propagates to @mnt_from this would
3448	 * mean propagating a copy @c of @mnt_from on top of @mnt_from.
3449	 * Afterwards @mnt_from would be mounted on top of
3450	 * @mnt_to->mnt_parent and @mnt_to would be unmounted from
3451	 * @mnt->mnt_parent and remounted on @mnt_from. But since @c is
3452	 * already mounted on @mnt_from, @mnt_to would ultimately be
3453	 * remounted on top of @c. Afterwards, @mnt_from would be
3454	 * covered by a copy @c of @mnt_from and @c would be covered by
3455	 * @mnt_from itself. This defeats the whole purpose of mounting
3456	 * @mnt_from beneath @mnt_to.
3457	 */
3458	if (check_mnt(mnt_from) &&
3459	    propagation_would_overmount(parent_mnt_to, mnt_from, mp))
3460		return -EINVAL;
3461
3462	return 0;
3463}
3464
3465/* may_use_mount() - check if a mount tree can be used
3466 * @mnt: vfsmount to be used
3467 *
3468 * This helper checks if the caller may use the mount tree starting
3469 * from @path->mnt. The caller may use the mount tree under the
3470 * following circumstances:
3471 *
3472 * (1) The caller is located in the mount namespace of the mount tree.
3473 *     This also implies that the mount does not belong to an anonymous
3474 *     mount namespace.
3475 * (2) The caller is trying to use a mount tree that belongs to an
3476 *     anonymous mount namespace.
3477 *
3478 *     For that to be safe, this helper enforces that the origin mount
3479 *     namespace the anonymous mount namespace was created from is the
3480 *     same as the caller's mount namespace by comparing the sequence
3481 *     numbers.
3482 *
3483 *     The ownership of a non-anonymous mount namespace such as the
3484 *     caller's cannot change.
3485 *     => We know that the caller's mount namespace is stable.
3486 *
3487 *     If the origin sequence number of the anonymous mount namespace is
3488 *     the same as the sequence number of the caller's mount namespace.
3489 *     => The owning namespaces are the same.
3490 *
3491 *     ==> The earlier capability check on the owning namespace of the
3492 *         caller's mount namespace ensures that the caller has the
3493 *         ability to use the mount tree.
3494 *
3495 * Returns true if the mount tree can be used, false otherwise.
3496 */
3497static inline bool may_use_mount(struct mount *mnt)
3498{
3499	if (check_mnt(mnt))
3500		return true;
3501
3502	/*
3503	 * Make sure that noone unmounted the target path or somehow
3504	 * managed to get their hands on something purely kernel
3505	 * internal.
3506	 */
3507	if (!is_mounted(&mnt->mnt))
3508		return false;
3509
3510	return check_anonymous_mnt(mnt);
3511}
3512
3513static int do_move_mount(const struct path *old_path,
3514			 const struct path *new_path,
3515			 enum mnt_tree_flags_t flags)
3516{
3517	struct mount *old = real_mount(old_path->mnt);
3518	int err;
3519	bool beneath = flags & MNT_TREE_BENEATH;
3520
3521	if (!path_mounted(old_path))
3522		return -EINVAL;
3523
3524	if (d_is_dir(new_path->dentry) != d_is_dir(old_path->dentry))
3525		return -EINVAL;
3526
3527	LOCK_MOUNT_MAYBE_BENEATH(mp, new_path, beneath);
3528	if (IS_ERR(mp.parent))
3529		return PTR_ERR(mp.parent);
3530
3531	if (check_mnt(old)) {
3532		/* if the source is in our namespace... */
3533		/* ... it should be detachable from parent */
3534		if (!mnt_has_parent(old) || IS_MNT_LOCKED(old))
3535			return -EINVAL;
3536		/* ... which should not be shared */
3537		if (IS_MNT_SHARED(old->mnt_parent))
3538			return -EINVAL;
3539		/* ... and the target should be in our namespace */
3540		if (!check_mnt(mp.parent))
3541			return -EINVAL;
3542	} else {
3543		/*
3544		 * otherwise the source must be the root of some anon namespace.
3545		 */
3546		if (!anon_ns_root(old))
3547			return -EINVAL;
3548		/*
3549		 * Bail out early if the target is within the same namespace -
3550		 * subsequent checks would've rejected that, but they lose
3551		 * some corner cases if we check it early.
3552		 */
3553		if (old->mnt_ns == mp.parent->mnt_ns)
3554			return -EINVAL;
3555		/*
3556		 * Target should be either in our namespace or in an acceptable
3557		 * anon namespace, sensu check_anonymous_mnt().
3558		 */
3559		if (!may_use_mount(mp.parent))
3560			return -EINVAL;
3561	}
3562
3563	if (beneath) {
3564		struct mount *over = real_mount(new_path->mnt);
3565
3566		if (mp.parent != over->mnt_parent)
3567			over = mp.parent->overmount;
3568		err = can_move_mount_beneath(old, over, mp.mp);
3569		if (err)
3570			return err;
3571	}
3572
3573	/*
3574	 * Don't move a mount tree containing unbindable mounts to a destination
3575	 * mount which is shared.
3576	 */
3577	if (IS_MNT_SHARED(mp.parent) && tree_contains_unbindable(old))
3578		return -EINVAL;
3579	if (!check_for_nsfs_mounts(old))
3580		return -ELOOP;
3581	if (mount_is_ancestor(old, mp.parent))
3582		return -ELOOP;
3583
3584	return attach_recursive_mnt(old, &mp);
3585}
3586
3587static int do_move_mount_old(const struct path *path, const char *old_name)
3588{
3589	struct path old_path __free(path_put) = {};
3590	int err;
3591
3592	if (!old_name || !*old_name)
3593		return -EINVAL;
3594
3595	err = kern_path(old_name, LOOKUP_FOLLOW, &old_path);
3596	if (err)
3597		return err;
3598
3599	return do_move_mount(&old_path, path, 0);
3600}
3601
3602/*
3603 * add a mount into a namespace's mount tree
3604 */
3605static int do_add_mount(struct mount *newmnt, const struct pinned_mountpoint *mp,
3606			int mnt_flags)
3607{
3608	struct mount *parent = mp->parent;
3609
3610	if (IS_ERR(parent))
3611		return PTR_ERR(parent);
3612
3613	mnt_flags &= ~MNT_INTERNAL_FLAGS;
3614
3615	if (unlikely(!check_mnt(parent))) {
3616		/* that's acceptable only for automounts done in private ns */
3617		if (!(mnt_flags & MNT_SHRINKABLE))
3618			return -EINVAL;
3619		/* ... and for those we'd better have mountpoint still alive */
3620		if (!parent->mnt_ns)
3621			return -EINVAL;
3622	}
3623
3624	/* Refuse the same filesystem on the same mount point */
3625	if (parent->mnt.mnt_sb == newmnt->mnt.mnt_sb &&
3626	    parent->mnt.mnt_root == mp->mp->m_dentry)
3627		return -EBUSY;
3628
3629	if (d_is_symlink(newmnt->mnt.mnt_root))
3630		return -EINVAL;
3631
3632	newmnt->mnt.mnt_flags = mnt_flags;
3633	return graft_tree(newmnt, mp);
3634}
3635
3636static bool mount_too_revealing(const struct super_block *sb, int *new_mnt_flags);
3637
3638/*
3639 * Create a new mount using a superblock configuration and request it
3640 * be added to the namespace tree.
3641 */
3642static int do_new_mount_fc(struct fs_context *fc, const struct path *mountpoint,
3643			   unsigned int mnt_flags)
3644{
3645	struct super_block *sb;
3646	struct vfsmount *mnt __free(mntput) = fc_mount(fc);
3647	int error;
3648
3649	if (IS_ERR(mnt))
3650		return PTR_ERR(mnt);
3651
3652	sb = fc->root->d_sb;
3653	error = security_sb_kern_mount(sb);
3654	if (unlikely(error))
3655		return error;
3656
3657	if (unlikely(mount_too_revealing(sb, &mnt_flags))) {
3658		errorfcp(fc, "VFS", "Mount too revealing");
3659		return -EPERM;
3660	}
3661
3662	mnt_warn_timestamp_expiry(mountpoint, mnt);
3663
3664	LOCK_MOUNT(mp, mountpoint);
3665	error = do_add_mount(real_mount(mnt), &mp, mnt_flags);
3666	if (!error)
3667		retain_and_null_ptr(mnt); // consumed on success
3668	return error;
3669}
3670
3671/*
3672 * create a new mount for userspace and request it to be added into the
3673 * namespace's tree
3674 */
3675static int do_new_mount(const struct path *path, const char *fstype,
3676			int sb_flags, int mnt_flags,
3677			const char *name, void *data)
3678{
3679	struct file_system_type *type;
3680	struct fs_context *fc;
3681	const char *subtype = NULL;
3682	int err = 0;
3683
3684	if (!fstype)
3685		return -EINVAL;
3686
3687	type = get_fs_type(fstype);
3688	if (!type)
3689		return -ENODEV;
3690
3691	if (type->fs_flags & FS_HAS_SUBTYPE) {
3692		subtype = strchr(fstype, '.');
3693		if (subtype) {
3694			subtype++;
3695			if (!*subtype) {
3696				put_filesystem(type);
3697				return -EINVAL;
3698			}
3699		}
3700	}
3701
3702	fc = fs_context_for_mount(type, sb_flags);
3703	put_filesystem(type);
3704	if (IS_ERR(fc))
3705		return PTR_ERR(fc);
3706
3707	/*
3708	 * Indicate to the filesystem that the mount request is coming
3709	 * from the legacy mount system call.
3710	 */
3711	fc->oldapi = true;
3712
3713	if (subtype)
3714		err = vfs_parse_fs_string(fc, "subtype", subtype);
3715	if (!err && name)
3716		err = vfs_parse_fs_string(fc, "source", name);
3717	if (!err)
3718		err = parse_monolithic_mount_data(fc, data);
3719	if (!err && !mount_capable(fc))
3720		err = -EPERM;
3721	if (!err)
3722		err = do_new_mount_fc(fc, path, mnt_flags);
3723
3724	put_fs_context(fc);
3725	return err;
3726}
3727
3728static void lock_mount_exact(const struct path *path,
3729			     struct pinned_mountpoint *mp)
3730{
3731	struct dentry *dentry = path->dentry;
3732	int err;
3733
3734	inode_lock(dentry->d_inode);
3735	namespace_lock();
3736	if (unlikely(cant_mount(dentry)))
3737		err = -ENOENT;
3738	else if (path_overmounted(path))
3739		err = -EBUSY;
3740	else
3741		err = get_mountpoint(dentry, mp);
3742	if (unlikely(err)) {
3743		namespace_unlock();
3744		inode_unlock(dentry->d_inode);
3745		mp->parent = ERR_PTR(err);
3746	} else {
3747		mp->parent = real_mount(path->mnt);
3748	}
3749}
3750
3751int finish_automount(struct vfsmount *__m, const struct path *path)
3752{
3753	struct vfsmount *m __free(mntput) = __m;
3754	struct mount *mnt;
3755	int err;
3756
3757	if (!m)
3758		return 0;
3759	if (IS_ERR(m))
3760		return PTR_ERR(m);
3761
3762	mnt = real_mount(m);
3763
3764	if (m->mnt_root == path->dentry)
3765		return -ELOOP;
3766
3767	/*
3768	 * we don't want to use LOCK_MOUNT() - in this case finding something
3769	 * that overmounts our mountpoint to be means "quitely drop what we've
3770	 * got", not "try to mount it on top".
3771	 */
3772	LOCK_MOUNT_EXACT(mp, path);
3773	if (mp.parent == ERR_PTR(-EBUSY))
3774		return 0;
3775
3776	err = do_add_mount(mnt, &mp, path->mnt->mnt_flags | MNT_SHRINKABLE);
3777	if (likely(!err))
3778		retain_and_null_ptr(m);
3779	return err;
3780}
3781
3782/**
3783 * mnt_set_expiry - Put a mount on an expiration list
3784 * @mnt: The mount to list.
3785 * @expiry_list: The list to add the mount to.
3786 */
3787void mnt_set_expiry(struct vfsmount *mnt, struct list_head *expiry_list)
3788{
3789	guard(mount_locked_reader)();
3790	list_add_tail(&real_mount(mnt)->mnt_expire, expiry_list);
3791}
3792EXPORT_SYMBOL(mnt_set_expiry);
3793
3794/*
3795 * process a list of expirable mountpoints with the intent of discarding any
3796 * mountpoints that aren't in use and haven't been touched since last we came
3797 * here
3798 */
3799void mark_mounts_for_expiry(struct list_head *mounts)
3800{
3801	struct mount *mnt, *next;
3802	LIST_HEAD(graveyard);
3803
3804	if (list_empty(mounts))
3805		return;
3806
3807	guard(namespace_excl)();
3808	guard(mount_writer)();
3809
3810	/* extract from the expiration list every vfsmount that matches the
3811	 * following criteria:
3812	 * - already mounted
3813	 * - only referenced by its parent vfsmount
3814	 * - still marked for expiry (marked on the last call here; marks are
3815	 *   cleared by mntput())
3816	 */
3817	list_for_each_entry_safe(mnt, next, mounts, mnt_expire) {
3818		if (!is_mounted(&mnt->mnt))
3819			continue;
3820		if (!xchg(&mnt->mnt_expiry_mark, 1) ||
3821			propagate_mount_busy(mnt, 1))
3822			continue;
3823		list_move(&mnt->mnt_expire, &graveyard);
3824	}
3825	while (!list_empty(&graveyard)) {
3826		mnt = list_first_entry(&graveyard, struct mount, mnt_expire);
3827		touch_mnt_namespace(mnt->mnt_ns);
3828		umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC);
3829	}
3830}
3831
3832EXPORT_SYMBOL_GPL(mark_mounts_for_expiry);
3833
3834/*
3835 * Ripoff of 'select_parent()'
3836 *
3837 * search the list of submounts for a given mountpoint, and move any
3838 * shrinkable submounts to the 'graveyard' list.
3839 */
3840static int select_submounts(struct mount *parent, struct list_head *graveyard)
3841{
3842	struct mount *this_parent = parent;
3843	struct list_head *next;
3844	int found = 0;
3845
3846repeat:
3847	next = this_parent->mnt_mounts.next;
3848resume:
3849	while (next != &this_parent->mnt_mounts) {
3850		struct list_head *tmp = next;
3851		struct mount *mnt = list_entry(tmp, struct mount, mnt_child);
3852
3853		next = tmp->next;
3854		if (!(mnt->mnt.mnt_flags & MNT_SHRINKABLE))
3855			continue;
3856		/*
3857		 * Descend a level if the d_mounts list is non-empty.
3858		 */
3859		if (!list_empty(&mnt->mnt_mounts)) {
3860			this_parent = mnt;
3861			goto repeat;
3862		}
3863
3864		if (!propagate_mount_busy(mnt, 1)) {
3865			list_move_tail(&mnt->mnt_expire, graveyard);
3866			found++;
3867		}
3868	}
3869	/*
3870	 * All done at this level ... ascend and resume the search
3871	 */
3872	if (this_parent != parent) {
3873		next = this_parent->mnt_child.next;
3874		this_parent = this_parent->mnt_parent;
3875		goto resume;
3876	}
3877	return found;
3878}
3879
3880/*
3881 * process a list of expirable mountpoints with the intent of discarding any
3882 * submounts of a specific parent mountpoint
3883 *
3884 * mount_lock must be held for write
3885 */
3886static void shrink_submounts(struct mount *mnt)
3887{
3888	LIST_HEAD(graveyard);
3889	struct mount *m;
3890
3891	/* extract submounts of 'mountpoint' from the expiration list */
3892	while (select_submounts(mnt, &graveyard)) {
3893		while (!list_empty(&graveyard)) {
3894			m = list_first_entry(&graveyard, struct mount,
3895						mnt_expire);
3896			touch_mnt_namespace(m->mnt_ns);
3897			umount_tree(m, UMOUNT_PROPAGATE|UMOUNT_SYNC);
3898		}
3899	}
3900}
3901
3902static void *copy_mount_options(const void __user * data)
3903{
3904	char *copy;
3905	unsigned left, offset;
3906
3907	if (!data)
3908		return NULL;
3909
3910	copy = kmalloc(PAGE_SIZE, GFP_KERNEL);
3911	if (!copy)
3912		return ERR_PTR(-ENOMEM);
3913
3914	left = copy_from_user(copy, data, PAGE_SIZE);
3915
3916	/*
3917	 * Not all architectures have an exact copy_from_user(). Resort to
3918	 * byte at a time.
3919	 */
3920	offset = PAGE_SIZE - left;
3921	while (left) {
3922		char c;
3923		if (get_user(c, (const char __user *)data + offset))
3924			break;
3925		copy[offset] = c;
3926		left--;
3927		offset++;
3928	}
3929
3930	if (left == PAGE_SIZE) {
3931		kfree(copy);
3932		return ERR_PTR(-EFAULT);
3933	}
3934
3935	return copy;
3936}
3937
3938static char *copy_mount_string(const void __user *data)
3939{
3940	return data ? strndup_user(data, PATH_MAX) : NULL;
3941}
3942
3943/*
3944 * Flags is a 32-bit value that allows up to 31 non-fs dependent flags to
3945 * be given to the mount() call (ie: read-only, no-dev, no-suid etc).
3946 *
3947 * data is a (void *) that can point to any structure up to
3948 * PAGE_SIZE-1 bytes, which can contain arbitrary fs-dependent
3949 * information (or be NULL).
3950 *
3951 * Pre-0.97 versions of mount() didn't have a flags word.
3952 * When the flags word was introduced its top half was required
3953 * to have the magic value 0xC0ED, and this remained so until 2.4.0-test9.
3954 * Therefore, if this magic number is present, it carries no information
3955 * and must be discarded.
3956 */
3957int path_mount(const char *dev_name, const struct path *path,
3958		const char *type_page, unsigned long flags, void *data_page)
3959{
3960	unsigned int mnt_flags = 0, sb_flags;
3961	int ret;
3962
3963	/* Discard magic */
3964	if ((flags & MS_MGC_MSK) == MS_MGC_VAL)
3965		flags &= ~MS_MGC_MSK;
3966
3967	/* Basic sanity checks */
3968	if (data_page)
3969		((char *)data_page)[PAGE_SIZE - 1] = 0;
3970
3971	if (flags & MS_NOUSER)
3972		return -EINVAL;
3973
3974	ret = security_sb_mount(dev_name, path, type_page, flags, data_page);
3975	if (ret)
3976		return ret;
3977	if (!may_mount())
3978		return -EPERM;
3979	if (flags & SB_MANDLOCK)
3980		warn_mandlock();
3981
3982	/* Default to relatime unless overriden */
3983	if (!(flags & MS_NOATIME))
3984		mnt_flags |= MNT_RELATIME;
3985
3986	/* Separate the per-mountpoint flags */
3987	if (flags & MS_NOSUID)
3988		mnt_flags |= MNT_NOSUID;
3989	if (flags & MS_NODEV)
3990		mnt_flags |= MNT_NODEV;
3991	if (flags & MS_NOEXEC)
3992		mnt_flags |= MNT_NOEXEC;
3993	if (flags & MS_NOATIME)
3994		mnt_flags |= MNT_NOATIME;
3995	if (flags & MS_NODIRATIME)
3996		mnt_flags |= MNT_NODIRATIME;
3997	if (flags & MS_STRICTATIME)
3998		mnt_flags &= ~(MNT_RELATIME | MNT_NOATIME);
3999	if (flags & MS_RDONLY)
4000		mnt_flags |= MNT_READONLY;
4001	if (flags & MS_NOSYMFOLLOW)
4002		mnt_flags |= MNT_NOSYMFOLLOW;
4003
4004	/* The default atime for remount is preservation */
4005	if ((flags & MS_REMOUNT) &&
4006	    ((flags & (MS_NOATIME | MS_NODIRATIME | MS_RELATIME |
4007		       MS_STRICTATIME)) == 0)) {
4008		mnt_flags &= ~MNT_ATIME_MASK;
4009		mnt_flags |= path->mnt->mnt_flags & MNT_ATIME_MASK;
4010	}
4011
4012	sb_flags = flags & (SB_RDONLY |
4013			    SB_SYNCHRONOUS |
4014			    SB_MANDLOCK |
4015			    SB_DIRSYNC |
4016			    SB_SILENT |
4017			    SB_POSIXACL |
4018			    SB_LAZYTIME |
4019			    SB_I_VERSION);
4020
4021	if ((flags & (MS_REMOUNT | MS_BIND)) == (MS_REMOUNT | MS_BIND))
4022		return do_reconfigure_mnt(path, mnt_flags);
4023	if (flags & MS_REMOUNT)
4024		return do_remount(path, sb_flags, mnt_flags, data_page);
4025	if (flags & MS_BIND)
4026		return do_loopback(path, dev_name, flags & MS_REC);
4027	if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
4028		return do_change_type(path, flags);
4029	if (flags & MS_MOVE)
4030		return do_move_mount_old(path, dev_name);
4031
4032	return do_new_mount(path, type_page, sb_flags, mnt_flags, dev_name,
4033			    data_page);
4034}
4035
4036int do_mount(const char *dev_name, const char __user *dir_name,
4037		const char *type_page, unsigned long flags, void *data_page)
4038{
4039	struct path path __free(path_put) = {};
4040	int ret;
4041
4042	ret = user_path_at(AT_FDCWD, dir_name, LOOKUP_FOLLOW, &path);
4043	if (ret)
4044		return ret;
4045	return path_mount(dev_name, &path, type_page, flags, data_page);
4046}
4047
4048static struct ucounts *inc_mnt_namespaces(struct user_namespace *ns)
4049{
4050	return inc_ucount(ns, current_euid(), UCOUNT_MNT_NAMESPACES);
4051}
4052
4053static void dec_mnt_namespaces(struct ucounts *ucounts)
4054{
4055	dec_ucount(ucounts, UCOUNT_MNT_NAMESPACES);
4056}
4057
4058static void free_mnt_ns(struct mnt_namespace *ns)
4059{
4060	if (!is_anon_ns(ns))
4061		ns_common_free(ns);
4062	dec_mnt_namespaces(ns->ucounts);
4063	mnt_ns_tree_remove(ns);
4064}
4065
4066static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns, bool anon)
4067{
4068	struct mnt_namespace *new_ns;
4069	struct ucounts *ucounts;
4070	int ret;
4071
4072	ucounts = inc_mnt_namespaces(user_ns);
4073	if (!ucounts)
4074		return ERR_PTR(-ENOSPC);
4075
4076	new_ns = kzalloc(sizeof(struct mnt_namespace), GFP_KERNEL_ACCOUNT);
4077	if (!new_ns) {
4078		dec_mnt_namespaces(ucounts);
4079		return ERR_PTR(-ENOMEM);
4080	}
4081
4082	if (anon)
4083		ret = ns_common_init_inum(new_ns, MNT_NS_ANON_INO);
4084	else
4085		ret = ns_common_init(new_ns);
4086	if (ret) {
4087		kfree(new_ns);
4088		dec_mnt_namespaces(ucounts);
4089		return ERR_PTR(ret);
4090	}
4091	ns_tree_gen_id(new_ns);
4092
4093	new_ns->is_anon = anon;
4094	refcount_set(&new_ns->passive, 1);
4095	new_ns->mounts = RB_ROOT;
4096	init_waitqueue_head(&new_ns->poll);
4097	new_ns->user_ns = get_user_ns(user_ns);
4098	new_ns->ucounts = ucounts;
4099	return new_ns;
4100}
4101
4102__latent_entropy
4103struct mnt_namespace *copy_mnt_ns(u64 flags, struct mnt_namespace *ns,
4104		struct user_namespace *user_ns, struct fs_struct *new_fs)
4105{
4106	struct mnt_namespace *new_ns;
4107	struct vfsmount *rootmnt __free(mntput) = NULL;
4108	struct vfsmount *pwdmnt __free(mntput) = NULL;
4109	struct mount *p, *q;
4110	struct mount *old;
4111	struct mount *new;
4112	int copy_flags;
4113
4114	BUG_ON(!ns);
4115
4116	if (likely(!(flags & CLONE_NEWNS))) {
4117		get_mnt_ns(ns);
4118		return ns;
4119	}
4120
4121	old = ns->root;
4122
4123	new_ns = alloc_mnt_ns(user_ns, false);
4124	if (IS_ERR(new_ns))
4125		return new_ns;
4126
4127	guard(namespace_excl)();
4128	/* First pass: copy the tree topology */
4129	copy_flags = CL_COPY_UNBINDABLE | CL_EXPIRE;
4130	if (user_ns != ns->user_ns)
4131		copy_flags |= CL_SLAVE;
4132	new = copy_tree(old, old->mnt.mnt_root, copy_flags);
4133	if (IS_ERR(new)) {
4134		emptied_ns = new_ns;
4135		return ERR_CAST(new);
4136	}
4137	if (user_ns != ns->user_ns) {
4138		guard(mount_writer)();
4139		lock_mnt_tree(new);
4140	}
4141	new_ns->root = new;
4142
4143	/*
4144	 * Second pass: switch the tsk->fs->* elements and mark new vfsmounts
4145	 * as belonging to new namespace.  We have already acquired a private
4146	 * fs_struct, so tsk->fs->lock is not needed.
4147	 */
4148	p = old;
4149	q = new;
4150	while (p) {
4151		mnt_add_to_ns(new_ns, q);
4152		new_ns->nr_mounts++;
4153		if (new_fs) {
4154			if (&p->mnt == new_fs->root.mnt) {
4155				new_fs->root.mnt = mntget(&q->mnt);
4156				rootmnt = &p->mnt;
4157			}
4158			if (&p->mnt == new_fs->pwd.mnt) {
4159				new_fs->pwd.mnt = mntget(&q->mnt);
4160				pwdmnt = &p->mnt;
4161			}
4162		}
4163		p = next_mnt(p, old);
4164		q = next_mnt(q, new);
4165		if (!q)
4166			break;
4167		// an mntns binding we'd skipped?
4168		while (p->mnt.mnt_root != q->mnt.mnt_root)
4169			p = next_mnt(skip_mnt_tree(p), old);
4170	}
4171	ns_tree_add_raw(new_ns);
4172	return new_ns;
4173}
4174
4175struct dentry *mount_subtree(struct vfsmount *m, const char *name)
4176{
4177	struct mount *mnt = real_mount(m);
4178	struct mnt_namespace *ns;
4179	struct super_block *s;
4180	struct path path;
4181	int err;
4182
4183	ns = alloc_mnt_ns(&init_user_ns, true);
4184	if (IS_ERR(ns)) {
4185		mntput(m);
4186		return ERR_CAST(ns);
4187	}
4188	ns->root = mnt;
4189	ns->nr_mounts++;
4190	mnt_add_to_ns(ns, mnt);
4191
4192	err = vfs_path_lookup(m->mnt_root, m,
4193			name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &path);
4194
4195	put_mnt_ns(ns);
4196
4197	if (err)
4198		return ERR_PTR(err);
4199
4200	/* trade a vfsmount reference for active sb one */
4201	s = path.mnt->mnt_sb;
4202	atomic_inc(&s->s_active);
4203	mntput(path.mnt);
4204	/* lock the sucker */
4205	down_write(&s->s_umount);
4206	/* ... and return the root of (sub)tree on it */
4207	return path.dentry;
4208}
4209EXPORT_SYMBOL(mount_subtree);
4210
4211SYSCALL_DEFINE5(mount, char __user *, dev_name, char __user *, dir_name,
4212		char __user *, type, unsigned long, flags, void __user *, data)
4213{
4214	int ret;
4215	char *kernel_type;
4216	char *kernel_dev;
4217	void *options;
4218
4219	kernel_type = copy_mount_string(type);
4220	ret = PTR_ERR(kernel_type);
4221	if (IS_ERR(kernel_type))
4222		goto out_type;
4223
4224	kernel_dev = copy_mount_string(dev_name);
4225	ret = PTR_ERR(kernel_dev);
4226	if (IS_ERR(kernel_dev))
4227		goto out_dev;
4228
4229	options = copy_mount_options(data);
4230	ret = PTR_ERR(options);
4231	if (IS_ERR(options))
4232		goto out_data;
4233
4234	ret = do_mount(kernel_dev, dir_name, kernel_type, flags, options);
4235
4236	kfree(options);
4237out_data:
4238	kfree(kernel_dev);
4239out_dev:
4240	kfree(kernel_type);
4241out_type:
4242	return ret;
4243}
4244
4245#define FSMOUNT_VALID_FLAGS                                                    \
4246	(MOUNT_ATTR_RDONLY | MOUNT_ATTR_NOSUID | MOUNT_ATTR_NODEV |            \
4247	 MOUNT_ATTR_NOEXEC | MOUNT_ATTR__ATIME | MOUNT_ATTR_NODIRATIME |       \
4248	 MOUNT_ATTR_NOSYMFOLLOW)
4249
4250#define MOUNT_SETATTR_VALID_FLAGS (FSMOUNT_VALID_FLAGS | MOUNT_ATTR_IDMAP)
4251
4252#define MOUNT_SETATTR_PROPAGATION_FLAGS \
4253	(MS_UNBINDABLE | MS_PRIVATE | MS_SLAVE | MS_SHARED)
4254
4255static unsigned int attr_flags_to_mnt_flags(u64 attr_flags)
4256{
4257	unsigned int mnt_flags = 0;
4258
4259	if (attr_flags & MOUNT_ATTR_RDONLY)
4260		mnt_flags |= MNT_READONLY;
4261	if (attr_flags & MOUNT_ATTR_NOSUID)
4262		mnt_flags |= MNT_NOSUID;
4263	if (attr_flags & MOUNT_ATTR_NODEV)
4264		mnt_flags |= MNT_NODEV;
4265	if (attr_flags & MOUNT_ATTR_NOEXEC)
4266		mnt_flags |= MNT_NOEXEC;
4267	if (attr_flags & MOUNT_ATTR_NODIRATIME)
4268		mnt_flags |= MNT_NODIRATIME;
4269	if (attr_flags & MOUNT_ATTR_NOSYMFOLLOW)
4270		mnt_flags |= MNT_NOSYMFOLLOW;
4271
4272	return mnt_flags;
4273}
4274
4275/*
4276 * Create a kernel mount representation for a new, prepared superblock
4277 * (specified by fs_fd) and attach to an open_tree-like file descriptor.
4278 */
4279SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags,
4280		unsigned int, attr_flags)
4281{
4282	struct path new_path __free(path_put) = {};
4283	struct mnt_namespace *ns;
4284	struct fs_context *fc;
4285	struct vfsmount *new_mnt;
4286	struct mount *mnt;
4287	unsigned int mnt_flags = 0;
4288	long ret;
4289
4290	if (!may_mount())
4291		return -EPERM;
4292
4293	if ((flags & ~(FSMOUNT_CLOEXEC)) != 0)
4294		return -EINVAL;
4295
4296	if (attr_flags & ~FSMOUNT_VALID_FLAGS)
4297		return -EINVAL;
4298
4299	mnt_flags = attr_flags_to_mnt_flags(attr_flags);
4300
4301	switch (attr_flags & MOUNT_ATTR__ATIME) {
4302	case MOUNT_ATTR_STRICTATIME:
4303		break;
4304	case MOUNT_ATTR_NOATIME:
4305		mnt_flags |= MNT_NOATIME;
4306		break;
4307	case MOUNT_ATTR_RELATIME:
4308		mnt_flags |= MNT_RELATIME;
4309		break;
4310	default:
4311		return -EINVAL;
4312	}
4313
4314	CLASS(fd, f)(fs_fd);
4315	if (fd_empty(f))
4316		return -EBADF;
4317
4318	if (fd_file(f)->f_op != &fscontext_fops)
4319		return -EINVAL;
4320
4321	fc = fd_file(f)->private_data;
4322
4323	ACQUIRE(mutex_intr, uapi_mutex)(&fc->uapi_mutex);
4324	ret = ACQUIRE_ERR(mutex_intr, &uapi_mutex);
4325	if (ret)
4326		return ret;
4327
4328	/* There must be a valid superblock or we can't mount it */
4329	ret = -EINVAL;
4330	if (!fc->root)
4331		return ret;
4332
4333	ret = -EPERM;
4334	if (mount_too_revealing(fc->root->d_sb, &mnt_flags)) {
4335		errorfcp(fc, "VFS", "Mount too revealing");
4336		return ret;
4337	}
4338
4339	ret = -EBUSY;
4340	if (fc->phase != FS_CONTEXT_AWAITING_MOUNT)
4341		return ret;
4342
4343	if (fc->sb_flags & SB_MANDLOCK)
4344		warn_mandlock();
4345
4346	new_mnt = vfs_create_mount(fc);
4347	if (IS_ERR(new_mnt))
4348		return PTR_ERR(new_mnt);
4349	new_mnt->mnt_flags = mnt_flags;
4350
4351	new_path.dentry = dget(fc->root);
4352	new_path.mnt = new_mnt;
4353
4354	/* We've done the mount bit - now move the file context into more or
4355	 * less the same state as if we'd done an fspick().  We don't want to
4356	 * do any memory allocation or anything like that at this point as we
4357	 * don't want to have to handle any errors incurred.
4358	 */
4359	vfs_clean_context(fc);
4360
4361	ns = alloc_mnt_ns(current->nsproxy->mnt_ns->user_ns, true);
4362	if (IS_ERR(ns))
4363		return PTR_ERR(ns);
4364	mnt = real_mount(new_path.mnt);
4365	ns->root = mnt;
4366	ns->nr_mounts = 1;
4367	mnt_add_to_ns(ns, mnt);
4368	mntget(new_path.mnt);
4369
4370	FD_PREPARE(fdf, (flags & FSMOUNT_CLOEXEC) ? O_CLOEXEC : 0,
4371		   dentry_open(&new_path, O_PATH, fc->cred));
4372	if (fdf.err) {
4373		dissolve_on_fput(new_path.mnt);
4374		return fdf.err;
4375	}
4376
4377	/*
4378	 * Attach to an apparent O_PATH fd with a note that we
4379	 * need to unmount it, not just simply put it.
4380	 */
4381	fd_prepare_file(fdf)->f_mode |= FMODE_NEED_UNMOUNT;
4382	return fd_publish(fdf);
4383}
4384
4385static inline int vfs_move_mount(const struct path *from_path,
4386				 const struct path *to_path,
4387				 enum mnt_tree_flags_t mflags)
4388{
4389	int ret;
4390
4391	ret = security_move_mount(from_path, to_path);
4392	if (ret)
4393		return ret;
4394
4395	if (mflags & MNT_TREE_PROPAGATION)
4396		return do_set_group(from_path, to_path);
4397
4398	return do_move_mount(from_path, to_path, mflags);
4399}
4400
4401/*
4402 * Move a mount from one place to another.  In combination with
4403 * fsopen()/fsmount() this is used to install a new mount and in combination
4404 * with open_tree(OPEN_TREE_CLONE [| AT_RECURSIVE]) it can be used to copy
4405 * a mount subtree.
4406 *
4407 * Note the flags value is a combination of MOVE_MOUNT_* flags.
4408 */
4409SYSCALL_DEFINE5(move_mount,
4410		int, from_dfd, const char __user *, from_pathname,
4411		int, to_dfd, const char __user *, to_pathname,
4412		unsigned int, flags)
4413{
4414	struct path to_path __free(path_put) = {};
4415	struct path from_path __free(path_put) = {};
4416	struct filename *to_name __free(putname) = NULL;
4417	struct filename *from_name __free(putname) = NULL;
4418	unsigned int lflags, uflags;
4419	enum mnt_tree_flags_t mflags = 0;
4420	int ret = 0;
4421
4422	if (!may_mount())
4423		return -EPERM;
4424
4425	if (flags & ~MOVE_MOUNT__MASK)
4426		return -EINVAL;
4427
4428	if ((flags & (MOVE_MOUNT_BENEATH | MOVE_MOUNT_SET_GROUP)) ==
4429	    (MOVE_MOUNT_BENEATH | MOVE_MOUNT_SET_GROUP))
4430		return -EINVAL;
4431
4432	if (flags & MOVE_MOUNT_SET_GROUP)	mflags |= MNT_TREE_PROPAGATION;
4433	if (flags & MOVE_MOUNT_BENEATH)		mflags |= MNT_TREE_BENEATH;
4434
4435	uflags = 0;
4436	if (flags & MOVE_MOUNT_T_EMPTY_PATH)
4437		uflags = AT_EMPTY_PATH;
4438
4439	to_name = getname_maybe_null(to_pathname, uflags);
4440	if (IS_ERR(to_name))
4441		return PTR_ERR(to_name);
4442
4443	if (!to_name && to_dfd >= 0) {
4444		CLASS(fd_raw, f_to)(to_dfd);
4445		if (fd_empty(f_to))
4446			return -EBADF;
4447
4448		to_path = fd_file(f_to)->f_path;
4449		path_get(&to_path);
4450	} else {
4451		lflags = 0;
4452		if (flags & MOVE_MOUNT_T_SYMLINKS)
4453			lflags |= LOOKUP_FOLLOW;
4454		if (flags & MOVE_MOUNT_T_AUTOMOUNTS)
4455			lflags |= LOOKUP_AUTOMOUNT;
4456		ret = filename_lookup(to_dfd, to_name, lflags, &to_path, NULL);
4457		if (ret)
4458			return ret;
4459	}
4460
4461	uflags = 0;
4462	if (flags & MOVE_MOUNT_F_EMPTY_PATH)
4463		uflags = AT_EMPTY_PATH;
4464
4465	from_name = getname_maybe_null(from_pathname, uflags);
4466	if (IS_ERR(from_name))
4467		return PTR_ERR(from_name);
4468
4469	if (!from_name && from_dfd >= 0) {
4470		CLASS(fd_raw, f_from)(from_dfd);
4471		if (fd_empty(f_from))
4472			return -EBADF;
4473
4474		return vfs_move_mount(&fd_file(f_from)->f_path, &to_path, mflags);
4475	}
4476
4477	lflags = 0;
4478	if (flags & MOVE_MOUNT_F_SYMLINKS)
4479		lflags |= LOOKUP_FOLLOW;
4480	if (flags & MOVE_MOUNT_F_AUTOMOUNTS)
4481		lflags |= LOOKUP_AUTOMOUNT;
4482	ret = filename_lookup(from_dfd, from_name, lflags, &from_path, NULL);
4483	if (ret)
4484		return ret;
4485
4486	return vfs_move_mount(&from_path, &to_path, mflags);
4487}
4488
4489/*
4490 * Return true if path is reachable from root
4491 *
4492 * locks: mount_locked_reader || namespace_shared && is_mounted(mnt)
4493 */
4494bool is_path_reachable(struct mount *mnt, struct dentry *dentry,
4495			 const struct path *root)
4496{
4497	while (&mnt->mnt != root->mnt && mnt_has_parent(mnt)) {
4498		dentry = mnt->mnt_mountpoint;
4499		mnt = mnt->mnt_parent;
4500	}
4501	return &mnt->mnt == root->mnt && is_subdir(dentry, root->dentry);
4502}
4503
4504bool path_is_under(const struct path *path1, const struct path *path2)
4505{
4506	guard(mount_locked_reader)();
4507	return is_path_reachable(real_mount(path1->mnt), path1->dentry, path2);
4508}
4509EXPORT_SYMBOL(path_is_under);
4510
4511/*
4512 * pivot_root Semantics:
4513 * Moves the root file system of the current process to the directory put_old,
4514 * makes new_root as the new root file system of the current process, and sets
4515 * root/cwd of all processes which had them on the current root to new_root.
4516 *
4517 * Restrictions:
4518 * The new_root and put_old must be directories, and  must not be on the
4519 * same file  system as the current process root. The put_old  must  be
4520 * underneath new_root,  i.e. adding a non-zero number of /.. to the string
4521 * pointed to by put_old must yield the same directory as new_root. No other
4522 * file system may be mounted on put_old. After all, new_root is a mountpoint.
4523 *
4524 * Also, the current root cannot be on the 'rootfs' (initial ramfs) filesystem.
4525 * See Documentation/filesystems/ramfs-rootfs-initramfs.rst for alternatives
4526 * in this situation.
4527 *
4528 * Notes:
4529 *  - we don't move root/cwd if they are not at the root (reason: if something
4530 *    cared enough to change them, it's probably wrong to force them elsewhere)
4531 *  - it's okay to pick a root that isn't the root of a file system, e.g.
4532 *    /nfs/my_root where /nfs is the mount point. It must be a mountpoint,
4533 *    though, so you may need to say mount --bind /nfs/my_root /nfs/my_root
4534 *    first.
4535 */
4536SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
4537		const char __user *, put_old)
4538{
4539	struct path new __free(path_put) = {};
4540	struct path old __free(path_put) = {};
4541	struct path root __free(path_put) = {};
4542	struct mount *new_mnt, *root_mnt, *old_mnt, *root_parent, *ex_parent;
4543	int error;
4544
4545	if (!may_mount())
4546		return -EPERM;
4547
4548	error = user_path_at(AT_FDCWD, new_root,
4549			     LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &new);
4550	if (error)
4551		return error;
4552
4553	error = user_path_at(AT_FDCWD, put_old,
4554			     LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &old);
4555	if (error)
4556		return error;
4557
4558	error = security_sb_pivotroot(&old, &new);
4559	if (error)
4560		return error;
4561
4562	get_fs_root(current->fs, &root);
4563
4564	LOCK_MOUNT(old_mp, &old);
4565	old_mnt = old_mp.parent;
4566	if (IS_ERR(old_mnt))
4567		return PTR_ERR(old_mnt);
4568
4569	new_mnt = real_mount(new.mnt);
4570	root_mnt = real_mount(root.mnt);
4571	ex_parent = new_mnt->mnt_parent;
4572	root_parent = root_mnt->mnt_parent;
4573	if (IS_MNT_SHARED(old_mnt) ||
4574		IS_MNT_SHARED(ex_parent) ||
4575		IS_MNT_SHARED(root_parent))
4576		return -EINVAL;
4577	if (!check_mnt(root_mnt) || !check_mnt(new_mnt))
4578		return -EINVAL;
4579	if (new_mnt->mnt.mnt_flags & MNT_LOCKED)
4580		return -EINVAL;
4581	if (d_unlinked(new.dentry))
4582		return -ENOENT;
4583	if (new_mnt == root_mnt || old_mnt == root_mnt)
4584		return -EBUSY; /* loop, on the same file system  */
4585	if (!path_mounted(&root))
4586		return -EINVAL; /* not a mountpoint */
4587	if (!mnt_has_parent(root_mnt))
4588		return -EINVAL; /* absolute root */
4589	if (!path_mounted(&new))
4590		return -EINVAL; /* not a mountpoint */
4591	if (!mnt_has_parent(new_mnt))
4592		return -EINVAL; /* absolute root */
4593	/* make sure we can reach put_old from new_root */
4594	if (!is_path_reachable(old_mnt, old_mp.mp->m_dentry, &new))
4595		return -EINVAL;
4596	/* make certain new is below the root */
4597	if (!is_path_reachable(new_mnt, new.dentry, &root))
4598		return -EINVAL;
4599	lock_mount_hash();
4600	umount_mnt(new_mnt);
4601	if (root_mnt->mnt.mnt_flags & MNT_LOCKED) {
4602		new_mnt->mnt.mnt_flags |= MNT_LOCKED;
4603		root_mnt->mnt.mnt_flags &= ~MNT_LOCKED;
4604	}
4605	/* mount new_root on / */
4606	attach_mnt(new_mnt, root_parent, root_mnt->mnt_mp);
4607	umount_mnt(root_mnt);
4608	/* mount old root on put_old */
4609	attach_mnt(root_mnt, old_mnt, old_mp.mp);
4610	touch_mnt_namespace(current->nsproxy->mnt_ns);
4611	/* A moved mount should not expire automatically */
4612	list_del_init(&new_mnt->mnt_expire);
4613	unlock_mount_hash();
4614	mnt_notify_add(root_mnt);
4615	mnt_notify_add(new_mnt);
4616	chroot_fs_refs(&root, &new);
4617	return 0;
4618}
4619
4620static unsigned int recalc_flags(struct mount_kattr *kattr, struct mount *mnt)
4621{
4622	unsigned int flags = mnt->mnt.mnt_flags;
4623
4624	/*  flags to clear */
4625	flags &= ~kattr->attr_clr;
4626	/* flags to raise */
4627	flags |= kattr->attr_set;
4628
4629	return flags;
4630}
4631
4632static int can_idmap_mount(const struct mount_kattr *kattr, struct mount *mnt)
4633{
4634	struct vfsmount *m = &mnt->mnt;
4635	struct user_namespace *fs_userns = m->mnt_sb->s_user_ns;
4636
4637	if (!kattr->mnt_idmap)
4638		return 0;
4639
4640	/*
4641	 * Creating an idmapped mount with the filesystem wide idmapping
4642	 * doesn't make sense so block that. We don't allow mushy semantics.
4643	 */
4644	if (kattr->mnt_userns == m->mnt_sb->s_user_ns)
4645		return -EINVAL;
4646
4647	/*
4648	 * We only allow an mount to change it's idmapping if it has
4649	 * never been accessible to userspace.
4650	 */
4651	if (!(kattr->kflags & MOUNT_KATTR_IDMAP_REPLACE) && is_idmapped_mnt(m))
4652		return -EPERM;
4653
4654	/* The underlying filesystem doesn't support idmapped mounts yet. */
4655	if (!(m->mnt_sb->s_type->fs_flags & FS_ALLOW_IDMAP))
4656		return -EINVAL;
4657
4658	/* The filesystem has turned off idmapped mounts. */
4659	if (m->mnt_sb->s_iflags & SB_I_NOIDMAP)
4660		return -EINVAL;
4661
4662	/* We're not controlling the superblock. */
4663	if (!ns_capable(fs_userns, CAP_SYS_ADMIN))
4664		return -EPERM;
4665
4666	/* Mount has already been visible in the filesystem hierarchy. */
4667	if (!is_anon_ns(mnt->mnt_ns))
4668		return -EINVAL;
4669
4670	return 0;
4671}
4672
4673/**
4674 * mnt_allow_writers() - check whether the attribute change allows writers
4675 * @kattr: the new mount attributes
4676 * @mnt: the mount to which @kattr will be applied
4677 *
4678 * Check whether thew new mount attributes in @kattr allow concurrent writers.
4679 *
4680 * Return: true if writers need to be held, false if not
4681 */
4682static inline bool mnt_allow_writers(const struct mount_kattr *kattr,
4683				     const struct mount *mnt)
4684{
4685	return (!(kattr->attr_set & MNT_READONLY) ||
4686		(mnt->mnt.mnt_flags & MNT_READONLY)) &&
4687	       !kattr->mnt_idmap;
4688}
4689
4690static int mount_setattr_prepare(struct mount_kattr *kattr, struct mount *mnt)
4691{
4692	struct mount *m;
4693	int err;
4694
4695	for (m = mnt; m; m = next_mnt(m, mnt)) {
4696		if (!can_change_locked_flags(m, recalc_flags(kattr, m))) {
4697			err = -EPERM;
4698			break;
4699		}
4700
4701		err = can_idmap_mount(kattr, m);
4702		if (err)
4703			break;
4704
4705		if (!mnt_allow_writers(kattr, m)) {
4706			err = mnt_hold_writers(m);
4707			if (err) {
4708				m = next_mnt(m, mnt);
4709				break;
4710			}
4711		}
4712
4713		if (!(kattr->kflags & MOUNT_KATTR_RECURSE))
4714			return 0;
4715	}
4716
4717	if (err) {
4718		/* undo all mnt_hold_writers() we'd done */
4719		for (struct mount *p = mnt; p != m; p = next_mnt(p, mnt))
4720			mnt_unhold_writers(p);
4721	}
4722	return err;
4723}
4724
4725static void do_idmap_mount(const struct mount_kattr *kattr, struct mount *mnt)
4726{
4727	struct mnt_idmap *old_idmap;
4728
4729	if (!kattr->mnt_idmap)
4730		return;
4731
4732	old_idmap = mnt_idmap(&mnt->mnt);
4733
4734	/* Pairs with smp_load_acquire() in mnt_idmap(). */
4735	smp_store_release(&mnt->mnt.mnt_idmap, mnt_idmap_get(kattr->mnt_idmap));
4736	mnt_idmap_put(old_idmap);
4737}
4738
4739static void mount_setattr_commit(struct mount_kattr *kattr, struct mount *mnt)
4740{
4741	struct mount *m;
4742
4743	for (m = mnt; m; m = next_mnt(m, mnt)) {
4744		unsigned int flags;
4745
4746		do_idmap_mount(kattr, m);
4747		flags = recalc_flags(kattr, m);
4748		WRITE_ONCE(m->mnt.mnt_flags, flags);
4749
4750		/* If we had to hold writers unblock them. */
4751		mnt_unhold_writers(m);
4752
4753		if (kattr->propagation)
4754			change_mnt_propagation(m, kattr->propagation);
4755		if (!(kattr->kflags & MOUNT_KATTR_RECURSE))
4756			break;
4757	}
4758	touch_mnt_namespace(mnt->mnt_ns);
4759}
4760
4761static int do_mount_setattr(const struct path *path, struct mount_kattr *kattr)
4762{
4763	struct mount *mnt = real_mount(path->mnt);
4764	int err = 0;
4765
4766	if (!path_mounted(path))
4767		return -EINVAL;
4768
4769	if (kattr->mnt_userns) {
4770		struct mnt_idmap *mnt_idmap;
4771
4772		mnt_idmap = alloc_mnt_idmap(kattr->mnt_userns);
4773		if (IS_ERR(mnt_idmap))
4774			return PTR_ERR(mnt_idmap);
4775		kattr->mnt_idmap = mnt_idmap;
4776	}
4777
4778	if (kattr->propagation) {
4779		/*
4780		 * Only take namespace_lock() if we're actually changing
4781		 * propagation.
4782		 */
4783		namespace_lock();
4784		if (kattr->propagation == MS_SHARED) {
4785			err = invent_group_ids(mnt, kattr->kflags & MOUNT_KATTR_RECURSE);
4786			if (err) {
4787				namespace_unlock();
4788				return err;
4789			}
4790		}
4791	}
4792
4793	err = -EINVAL;
4794	lock_mount_hash();
4795
4796	if (!anon_ns_root(mnt) && !check_mnt(mnt))
4797		goto out;
4798
4799	/*
4800	 * First, we get the mount tree in a shape where we can change mount
4801	 * properties without failure. If we succeeded to do so we commit all
4802	 * changes and if we failed we clean up.
4803	 */
4804	err = mount_setattr_prepare(kattr, mnt);
4805	if (!err)
4806		mount_setattr_commit(kattr, mnt);
4807
4808out:
4809	unlock_mount_hash();
4810
4811	if (kattr->propagation) {
4812		if (err)
4813			cleanup_group_ids(mnt, NULL);
4814		namespace_unlock();
4815	}
4816
4817	return err;
4818}
4819
4820static int build_mount_idmapped(const struct mount_attr *attr, size_t usize,
4821				struct mount_kattr *kattr)
4822{
4823	struct ns_common *ns;
4824	struct user_namespace *mnt_userns;
4825
4826	if (!((attr->attr_set | attr->attr_clr) & MOUNT_ATTR_IDMAP))
4827		return 0;
4828
4829	if (attr->attr_clr & MOUNT_ATTR_IDMAP) {
4830		/*
4831		 * We can only remove an idmapping if it's never been
4832		 * exposed to userspace.
4833		 */
4834		if (!(kattr->kflags & MOUNT_KATTR_IDMAP_REPLACE))
4835			return -EINVAL;
4836
4837		/*
4838		 * Removal of idmappings is equivalent to setting
4839		 * nop_mnt_idmap.
4840		 */
4841		if (!(attr->attr_set & MOUNT_ATTR_IDMAP)) {
4842			kattr->mnt_idmap = &nop_mnt_idmap;
4843			return 0;
4844		}
4845	}
4846
4847	if (attr->userns_fd > INT_MAX)
4848		return -EINVAL;
4849
4850	CLASS(fd, f)(attr->userns_fd);
4851	if (fd_empty(f))
4852		return -EBADF;
4853
4854	if (!proc_ns_file(fd_file(f)))
4855		return -EINVAL;
4856
4857	ns = get_proc_ns(file_inode(fd_file(f)));
4858	if (ns->ns_type != CLONE_NEWUSER)
4859		return -EINVAL;
4860
4861	/*
4862	 * The initial idmapping cannot be used to create an idmapped
4863	 * mount. We use the initial idmapping as an indicator of a mount
4864	 * that is not idmapped. It can simply be passed into helpers that
4865	 * are aware of idmapped mounts as a convenient shortcut. A user
4866	 * can just create a dedicated identity mapping to achieve the same
4867	 * result.
4868	 */
4869	mnt_userns = container_of(ns, struct user_namespace, ns);
4870	if (mnt_userns == &init_user_ns)
4871		return -EPERM;
4872
4873	/* We're not controlling the target namespace. */
4874	if (!ns_capable(mnt_userns, CAP_SYS_ADMIN))
4875		return -EPERM;
4876
4877	kattr->mnt_userns = get_user_ns(mnt_userns);
4878	return 0;
4879}
4880
4881static int build_mount_kattr(const struct mount_attr *attr, size_t usize,
4882			     struct mount_kattr *kattr)
4883{
4884	if (attr->propagation & ~MOUNT_SETATTR_PROPAGATION_FLAGS)
4885		return -EINVAL;
4886	if (hweight32(attr->propagation & MOUNT_SETATTR_PROPAGATION_FLAGS) > 1)
4887		return -EINVAL;
4888	kattr->propagation = attr->propagation;
4889
4890	if ((attr->attr_set | attr->attr_clr) & ~MOUNT_SETATTR_VALID_FLAGS)
4891		return -EINVAL;
4892
4893	kattr->attr_set = attr_flags_to_mnt_flags(attr->attr_set);
4894	kattr->attr_clr = attr_flags_to_mnt_flags(attr->attr_clr);
4895
4896	/*
4897	 * Since the MOUNT_ATTR_<atime> values are an enum, not a bitmap,
4898	 * users wanting to transition to a different atime setting cannot
4899	 * simply specify the atime setting in @attr_set, but must also
4900	 * specify MOUNT_ATTR__ATIME in the @attr_clr field.
4901	 * So ensure that MOUNT_ATTR__ATIME can't be partially set in
4902	 * @attr_clr and that @attr_set can't have any atime bits set if
4903	 * MOUNT_ATTR__ATIME isn't set in @attr_clr.
4904	 */
4905	if (attr->attr_clr & MOUNT_ATTR__ATIME) {
4906		if ((attr->attr_clr & MOUNT_ATTR__ATIME) != MOUNT_ATTR__ATIME)
4907			return -EINVAL;
4908
4909		/*
4910		 * Clear all previous time settings as they are mutually
4911		 * exclusive.
4912		 */
4913		kattr->attr_clr |= MNT_RELATIME | MNT_NOATIME;
4914		switch (attr->attr_set & MOUNT_ATTR__ATIME) {
4915		case MOUNT_ATTR_RELATIME:
4916			kattr->attr_set |= MNT_RELATIME;
4917			break;
4918		case MOUNT_ATTR_NOATIME:
4919			kattr->attr_set |= MNT_NOATIME;
4920			break;
4921		case MOUNT_ATTR_STRICTATIME:
4922			break;
4923		default:
4924			return -EINVAL;
4925		}
4926	} else {
4927		if (attr->attr_set & MOUNT_ATTR__ATIME)
4928			return -EINVAL;
4929	}
4930
4931	return build_mount_idmapped(attr, usize, kattr);
4932}
4933
4934static void finish_mount_kattr(struct mount_kattr *kattr)
4935{
4936	if (kattr->mnt_userns) {
4937		put_user_ns(kattr->mnt_userns);
4938		kattr->mnt_userns = NULL;
4939	}
4940
4941	if (kattr->mnt_idmap)
4942		mnt_idmap_put(kattr->mnt_idmap);
4943}
4944
4945static int wants_mount_setattr(struct mount_attr __user *uattr, size_t usize,
4946			       struct mount_kattr *kattr)
4947{
4948	int ret;
4949	struct mount_attr attr;
4950
4951	BUILD_BUG_ON(sizeof(struct mount_attr) != MOUNT_ATTR_SIZE_VER0);
4952
4953	if (unlikely(usize > PAGE_SIZE))
4954		return -E2BIG;
4955	if (unlikely(usize < MOUNT_ATTR_SIZE_VER0))
4956		return -EINVAL;
4957
4958	if (!may_mount())
4959		return -EPERM;
4960
4961	ret = copy_struct_from_user(&attr, sizeof(attr), uattr, usize);
4962	if (ret)
4963		return ret;
4964
4965	/* Don't bother walking through the mounts if this is a nop. */
4966	if (attr.attr_set == 0 &&
4967	    attr.attr_clr == 0 &&
4968	    attr.propagation == 0)
4969		return 0; /* Tell caller to not bother. */
4970
4971	ret = build_mount_kattr(&attr, usize, kattr);
4972	if (ret < 0)
4973		return ret;
4974
4975	return 1;
4976}
4977
4978SYSCALL_DEFINE5(mount_setattr, int, dfd, const char __user *, path,
4979		unsigned int, flags, struct mount_attr __user *, uattr,
4980		size_t, usize)
4981{
4982	int err;
4983	struct path target;
4984	struct mount_kattr kattr;
4985	unsigned int lookup_flags = LOOKUP_AUTOMOUNT | LOOKUP_FOLLOW;
4986
4987	if (flags & ~(AT_EMPTY_PATH |
4988		      AT_RECURSIVE |
4989		      AT_SYMLINK_NOFOLLOW |
4990		      AT_NO_AUTOMOUNT))
4991		return -EINVAL;
4992
4993	if (flags & AT_NO_AUTOMOUNT)
4994		lookup_flags &= ~LOOKUP_AUTOMOUNT;
4995	if (flags & AT_SYMLINK_NOFOLLOW)
4996		lookup_flags &= ~LOOKUP_FOLLOW;
4997	if (flags & AT_EMPTY_PATH)
4998		lookup_flags |= LOOKUP_EMPTY;
4999
5000	kattr = (struct mount_kattr) {
5001		.lookup_flags	= lookup_flags,
5002	};
5003
5004	if (flags & AT_RECURSIVE)
5005		kattr.kflags |= MOUNT_KATTR_RECURSE;
5006
5007	err = wants_mount_setattr(uattr, usize, &kattr);
5008	if (err <= 0)
5009		return err;
5010
5011	err = user_path_at(dfd, path, kattr.lookup_flags, &target);
5012	if (!err) {
5013		err = do_mount_setattr(&target, &kattr);
5014		path_put(&target);
5015	}
5016	finish_mount_kattr(&kattr);
5017	return err;
5018}
5019
5020SYSCALL_DEFINE5(open_tree_attr, int, dfd, const char __user *, filename,
5021		unsigned, flags, struct mount_attr __user *, uattr,
5022		size_t, usize)
5023{
5024	if (!uattr && usize)
5025		return -EINVAL;
5026
5027	FD_PREPARE(fdf, flags, vfs_open_tree(dfd, filename, flags));
5028	if (fdf.err)
5029		return fdf.err;
5030
5031	if (uattr) {
5032		struct mount_kattr kattr = {};
5033		struct file *file = fd_prepare_file(fdf);
5034		int ret;
5035
5036		if (flags & OPEN_TREE_CLONE)
5037			kattr.kflags = MOUNT_KATTR_IDMAP_REPLACE;
5038		if (flags & AT_RECURSIVE)
5039			kattr.kflags |= MOUNT_KATTR_RECURSE;
5040
5041		ret = wants_mount_setattr(uattr, usize, &kattr);
5042		if (ret > 0) {
5043			ret = do_mount_setattr(&file->f_path, &kattr);
5044			finish_mount_kattr(&kattr);
5045		}
5046		if (ret)
5047			return ret;
5048	}
5049
5050	return fd_publish(fdf);
5051}
5052
5053int show_path(struct seq_file *m, struct dentry *root)
5054{
5055	if (root->d_sb->s_op->show_path)
5056		return root->d_sb->s_op->show_path(m, root);
5057
5058	seq_dentry(m, root, " \t\n\\");
5059	return 0;
5060}
5061
5062static struct vfsmount *lookup_mnt_in_ns(u64 id, struct mnt_namespace *ns)
5063{
5064	struct mount *mnt = mnt_find_id_at(ns, id);
5065
5066	if (!mnt || mnt->mnt_id_unique != id)
5067		return NULL;
5068
5069	return &mnt->mnt;
5070}
5071
5072struct kstatmount {
5073	struct statmount __user *buf;
5074	size_t bufsize;
5075	struct vfsmount *mnt;
5076	struct mnt_idmap *idmap;
5077	u64 mask;
5078	struct path root;
5079	struct seq_file seq;
5080
5081	/* Must be last --ends in a flexible-array member. */
5082	struct statmount sm;
5083};
5084
5085static u64 mnt_to_attr_flags(struct vfsmount *mnt)
5086{
5087	unsigned int mnt_flags = READ_ONCE(mnt->mnt_flags);
5088	u64 attr_flags = 0;
5089
5090	if (mnt_flags & MNT_READONLY)
5091		attr_flags |= MOUNT_ATTR_RDONLY;
5092	if (mnt_flags & MNT_NOSUID)
5093		attr_flags |= MOUNT_ATTR_NOSUID;
5094	if (mnt_flags & MNT_NODEV)
5095		attr_flags |= MOUNT_ATTR_NODEV;
5096	if (mnt_flags & MNT_NOEXEC)
5097		attr_flags |= MOUNT_ATTR_NOEXEC;
5098	if (mnt_flags & MNT_NODIRATIME)
5099		attr_flags |= MOUNT_ATTR_NODIRATIME;
5100	if (mnt_flags & MNT_NOSYMFOLLOW)
5101		attr_flags |= MOUNT_ATTR_NOSYMFOLLOW;
5102
5103	if (mnt_flags & MNT_NOATIME)
5104		attr_flags |= MOUNT_ATTR_NOATIME;
5105	else if (mnt_flags & MNT_RELATIME)
5106		attr_flags |= MOUNT_ATTR_RELATIME;
5107	else
5108		attr_flags |= MOUNT_ATTR_STRICTATIME;
5109
5110	if (is_idmapped_mnt(mnt))
5111		attr_flags |= MOUNT_ATTR_IDMAP;
5112
5113	return attr_flags;
5114}
5115
5116static u64 mnt_to_propagation_flags(struct mount *m)
5117{
5118	u64 propagation = 0;
5119
5120	if (IS_MNT_SHARED(m))
5121		propagation |= MS_SHARED;
5122	if (IS_MNT_SLAVE(m))
5123		propagation |= MS_SLAVE;
5124	if (IS_MNT_UNBINDABLE(m))
5125		propagation |= MS_UNBINDABLE;
5126	if (!propagation)
5127		propagation |= MS_PRIVATE;
5128
5129	return propagation;
5130}
5131
5132u64 vfsmount_to_propagation_flags(struct vfsmount *mnt)
5133{
5134	return mnt_to_propagation_flags(real_mount(mnt));
5135}
5136EXPORT_SYMBOL_GPL(vfsmount_to_propagation_flags);
5137
5138static void statmount_sb_basic(struct kstatmount *s)
5139{
5140	struct super_block *sb = s->mnt->mnt_sb;
5141
5142	s->sm.mask |= STATMOUNT_SB_BASIC;
5143	s->sm.sb_dev_major = MAJOR(sb->s_dev);
5144	s->sm.sb_dev_minor = MINOR(sb->s_dev);
5145	s->sm.sb_magic = sb->s_magic;
5146	s->sm.sb_flags = sb->s_flags & (SB_RDONLY|SB_SYNCHRONOUS|SB_DIRSYNC|SB_LAZYTIME);
5147}
5148
5149static void statmount_mnt_basic(struct kstatmount *s)
5150{
5151	struct mount *m = real_mount(s->mnt);
5152
5153	s->sm.mask |= STATMOUNT_MNT_BASIC;
5154	s->sm.mnt_id = m->mnt_id_unique;
5155	s->sm.mnt_parent_id = m->mnt_parent->mnt_id_unique;
5156	s->sm.mnt_id_old = m->mnt_id;
5157	s->sm.mnt_parent_id_old = m->mnt_parent->mnt_id;
5158	s->sm.mnt_attr = mnt_to_attr_flags(&m->mnt);
5159	s->sm.mnt_propagation = mnt_to_propagation_flags(m);
5160	s->sm.mnt_peer_group = m->mnt_group_id;
5161	s->sm.mnt_master = IS_MNT_SLAVE(m) ? m->mnt_master->mnt_group_id : 0;
5162}
5163
5164static void statmount_propagate_from(struct kstatmount *s)
5165{
5166	struct mount *m = real_mount(s->mnt);
5167
5168	s->sm.mask |= STATMOUNT_PROPAGATE_FROM;
5169	if (IS_MNT_SLAVE(m))
5170		s->sm.propagate_from = get_dominating_id(m, &current->fs->root);
5171}
5172
5173static int statmount_mnt_root(struct kstatmount *s, struct seq_file *seq)
5174{
5175	int ret;
5176	size_t start = seq->count;
5177
5178	ret = show_path(seq, s->mnt->mnt_root);
5179	if (ret)
5180		return ret;
5181
5182	if (unlikely(seq_has_overflowed(seq)))
5183		return -EAGAIN;
5184
5185	/*
5186         * Unescape the result. It would be better if supplied string was not
5187         * escaped in the first place, but that's a pretty invasive change.
5188         */
5189	seq->buf[seq->count] = '\0';
5190	seq->count = start;
5191	seq_commit(seq, string_unescape_inplace(seq->buf + start, UNESCAPE_OCTAL));
5192	return 0;
5193}
5194
5195static int statmount_mnt_point(struct kstatmount *s, struct seq_file *seq)
5196{
5197	struct vfsmount *mnt = s->mnt;
5198	struct path mnt_path = { .dentry = mnt->mnt_root, .mnt = mnt };
5199	int err;
5200
5201	err = seq_path_root(seq, &mnt_path, &s->root, "");
5202	return err == SEQ_SKIP ? 0 : err;
5203}
5204
5205static int statmount_fs_type(struct kstatmount *s, struct seq_file *seq)
5206{
5207	struct super_block *sb = s->mnt->mnt_sb;
5208
5209	seq_puts(seq, sb->s_type->name);
5210	return 0;
5211}
5212
5213static void statmount_fs_subtype(struct kstatmount *s, struct seq_file *seq)
5214{
5215	struct super_block *sb = s->mnt->mnt_sb;
5216
5217	if (sb->s_subtype)
5218		seq_puts(seq, sb->s_subtype);
5219}
5220
5221static int statmount_sb_source(struct kstatmount *s, struct seq_file *seq)
5222{
5223	struct super_block *sb = s->mnt->mnt_sb;
5224	struct mount *r = real_mount(s->mnt);
5225
5226	if (sb->s_op->show_devname) {
5227		size_t start = seq->count;
5228		int ret;
5229
5230		ret = sb->s_op->show_devname(seq, s->mnt->mnt_root);
5231		if (ret)
5232			return ret;
5233
5234		if (unlikely(seq_has_overflowed(seq)))
5235			return -EAGAIN;
5236
5237		/* Unescape the result */
5238		seq->buf[seq->count] = '\0';
5239		seq->count = start;
5240		seq_commit(seq, string_unescape_inplace(seq->buf + start, UNESCAPE_OCTAL));
5241	} else {
5242		seq_puts(seq, r->mnt_devname);
5243	}
5244	return 0;
5245}
5246
5247static void statmount_mnt_ns_id(struct kstatmount *s, struct mnt_namespace *ns)
5248{
5249	s->sm.mask |= STATMOUNT_MNT_NS_ID;
5250	s->sm.mnt_ns_id = ns->ns.ns_id;
5251}
5252
5253static int statmount_mnt_opts(struct kstatmount *s, struct seq_file *seq)
5254{
5255	struct vfsmount *mnt = s->mnt;
5256	struct super_block *sb = mnt->mnt_sb;
5257	size_t start = seq->count;
5258	int err;
5259
5260	err = security_sb_show_options(seq, sb);
5261	if (err)
5262		return err;
5263
5264	if (sb->s_op->show_options) {
5265		err = sb->s_op->show_options(seq, mnt->mnt_root);
5266		if (err)
5267			return err;
5268	}
5269
5270	if (unlikely(seq_has_overflowed(seq)))
5271		return -EAGAIN;
5272
5273	if (seq->count == start)
5274		return 0;
5275
5276	/* skip leading comma */
5277	memmove(seq->buf + start, seq->buf + start + 1,
5278		seq->count - start - 1);
5279	seq->count--;
5280
5281	return 0;
5282}
5283
5284static inline int statmount_opt_process(struct seq_file *seq, size_t start)
5285{
5286	char *buf_end, *opt_end, *src, *dst;
5287	int count = 0;
5288
5289	if (unlikely(seq_has_overflowed(seq)))
5290		return -EAGAIN;
5291
5292	buf_end = seq->buf + seq->count;
5293	dst = seq->buf + start;
5294	src = dst + 1;	/* skip initial comma */
5295
5296	if (src >= buf_end) {
5297		seq->count = start;
5298		return 0;
5299	}
5300
5301	*buf_end = '\0';
5302	for (; src < buf_end; src = opt_end + 1) {
5303		opt_end = strchrnul(src, ',');
5304		*opt_end = '\0';
5305		dst += string_unescape(src, dst, 0, UNESCAPE_OCTAL) + 1;
5306		if (WARN_ON_ONCE(++count == INT_MAX))
5307			return -EOVERFLOW;
5308	}
5309	seq->count = dst - 1 - seq->buf;
5310	return count;
5311}
5312
5313static int statmount_opt_array(struct kstatmount *s, struct seq_file *seq)
5314{
5315	struct vfsmount *mnt = s->mnt;
5316	struct super_block *sb = mnt->mnt_sb;
5317	size_t start = seq->count;
5318	int err;
5319
5320	if (!sb->s_op->show_options)
5321		return 0;
5322
5323	err = sb->s_op->show_options(seq, mnt->mnt_root);
5324	if (err)
5325		return err;
5326
5327	err = statmount_opt_process(seq, start);
5328	if (err < 0)
5329		return err;
5330
5331	s->sm.opt_num = err;
5332	return 0;
5333}
5334
5335static int statmount_opt_sec_array(struct kstatmount *s, struct seq_file *seq)
5336{
5337	struct vfsmount *mnt = s->mnt;
5338	struct super_block *sb = mnt->mnt_sb;
5339	size_t start = seq->count;
5340	int err;
5341
5342	err = security_sb_show_options(seq, sb);
5343	if (err)
5344		return err;
5345
5346	err = statmount_opt_process(seq, start);
5347	if (err < 0)
5348		return err;
5349
5350	s->sm.opt_sec_num = err;
5351	return 0;
5352}
5353
5354static inline int statmount_mnt_uidmap(struct kstatmount *s, struct seq_file *seq)
5355{
5356	int ret;
5357
5358	ret = statmount_mnt_idmap(s->idmap, seq, true);
5359	if (ret < 0)
5360		return ret;
5361
5362	s->sm.mnt_uidmap_num = ret;
5363	/*
5364	 * Always raise STATMOUNT_MNT_UIDMAP even if there are no valid
5365	 * mappings. This allows userspace to distinguish between a
5366	 * non-idmapped mount and an idmapped mount where none of the
5367	 * individual mappings are valid in the caller's idmapping.
5368	 */
5369	if (is_valid_mnt_idmap(s->idmap))
5370		s->sm.mask |= STATMOUNT_MNT_UIDMAP;
5371	return 0;
5372}
5373
5374static inline int statmount_mnt_gidmap(struct kstatmount *s, struct seq_file *seq)
5375{
5376	int ret;
5377
5378	ret = statmount_mnt_idmap(s->idmap, seq, false);
5379	if (ret < 0)
5380		return ret;
5381
5382	s->sm.mnt_gidmap_num = ret;
5383	/*
5384	 * Always raise STATMOUNT_MNT_GIDMAP even if there are no valid
5385	 * mappings. This allows userspace to distinguish between a
5386	 * non-idmapped mount and an idmapped mount where none of the
5387	 * individual mappings are valid in the caller's idmapping.
5388	 */
5389	if (is_valid_mnt_idmap(s->idmap))
5390		s->sm.mask |= STATMOUNT_MNT_GIDMAP;
5391	return 0;
5392}
5393
5394static int statmount_string(struct kstatmount *s, u64 flag)
5395{
5396	int ret = 0;
5397	size_t kbufsize;
5398	struct seq_file *seq = &s->seq;
5399	struct statmount *sm = &s->sm;
5400	u32 start, *offp;
5401
5402	/* Reserve an empty string at the beginning for any unset offsets */
5403	if (!seq->count)
5404		seq_putc(seq, 0);
5405
5406	start = seq->count;
5407
5408	switch (flag) {
5409	case STATMOUNT_FS_TYPE:
5410		offp = &sm->fs_type;
5411		ret = statmount_fs_type(s, seq);
5412		break;
5413	case STATMOUNT_MNT_ROOT:
5414		offp = &sm->mnt_root;
5415		ret = statmount_mnt_root(s, seq);
5416		break;
5417	case STATMOUNT_MNT_POINT:
5418		offp = &sm->mnt_point;
5419		ret = statmount_mnt_point(s, seq);
5420		break;
5421	case STATMOUNT_MNT_OPTS:
5422		offp = &sm->mnt_opts;
5423		ret = statmount_mnt_opts(s, seq);
5424		break;
5425	case STATMOUNT_OPT_ARRAY:
5426		offp = &sm->opt_array;
5427		ret = statmount_opt_array(s, seq);
5428		break;
5429	case STATMOUNT_OPT_SEC_ARRAY:
5430		offp = &sm->opt_sec_array;
5431		ret = statmount_opt_sec_array(s, seq);
5432		break;
5433	case STATMOUNT_FS_SUBTYPE:
5434		offp = &sm->fs_subtype;
5435		statmount_fs_subtype(s, seq);
5436		break;
5437	case STATMOUNT_SB_SOURCE:
5438		offp = &sm->sb_source;
5439		ret = statmount_sb_source(s, seq);
5440		break;
5441	case STATMOUNT_MNT_UIDMAP:
5442		offp = &sm->mnt_uidmap;
5443		ret = statmount_mnt_uidmap(s, seq);
5444		break;
5445	case STATMOUNT_MNT_GIDMAP:
5446		offp = &sm->mnt_gidmap;
5447		ret = statmount_mnt_gidmap(s, seq);
5448		break;
5449	default:
5450		WARN_ON_ONCE(true);
5451		return -EINVAL;
5452	}
5453
5454	/*
5455	 * If nothing was emitted, return to avoid setting the flag
5456	 * and terminating the buffer.
5457	 */
5458	if (seq->count == start)
5459		return ret;
5460	if (unlikely(check_add_overflow(sizeof(*sm), seq->count, &kbufsize)))
5461		return -EOVERFLOW;
5462	if (kbufsize >= s->bufsize)
5463		return -EOVERFLOW;
5464
5465	/* signal a retry */
5466	if (unlikely(seq_has_overflowed(seq)))
5467		return -EAGAIN;
5468
5469	if (ret)
5470		return ret;
5471
5472	seq->buf[seq->count++] = '\0';
5473	sm->mask |= flag;
5474	*offp = start;
5475	return 0;
5476}
5477
5478static int copy_statmount_to_user(struct kstatmount *s)
5479{
5480	struct statmount *sm = &s->sm;
5481	struct seq_file *seq = &s->seq;
5482	char __user *str = ((char __user *)s->buf) + sizeof(*sm);
5483	size_t copysize = min_t(size_t, s->bufsize, sizeof(*sm));
5484
5485	if (seq->count && copy_to_user(str, seq->buf, seq->count))
5486		return -EFAULT;
5487
5488	/* Return the number of bytes copied to the buffer */
5489	sm->size = copysize + seq->count;
5490	if (copy_to_user(s->buf, sm, copysize))
5491		return -EFAULT;
5492
5493	return 0;
5494}
5495
5496static struct mount *listmnt_next(struct mount *curr, bool reverse)
5497{
5498	struct rb_node *node;
5499
5500	if (reverse)
5501		node = rb_prev(&curr->mnt_node);
5502	else
5503		node = rb_next(&curr->mnt_node);
5504
5505	return node_to_mount(node);
5506}
5507
5508static int grab_requested_root(struct mnt_namespace *ns, struct path *root)
5509{
5510	struct mount *first, *child;
5511
5512	rwsem_assert_held(&namespace_sem);
5513
5514	/* We're looking at our own ns, just use get_fs_root. */
5515	if (ns == current->nsproxy->mnt_ns) {
5516		get_fs_root(current->fs, root);
5517		return 0;
5518	}
5519
5520	/*
5521	 * We have to find the first mount in our ns and use that, however it
5522	 * may not exist, so handle that properly.
5523	 */
5524	if (mnt_ns_empty(ns))
5525		return -ENOENT;
5526
5527	first = child = ns->root;
5528	for (;;) {
5529		child = listmnt_next(child, false);
5530		if (!child)
5531			return -ENOENT;
5532		if (child->mnt_parent == first)
5533			break;
5534	}
5535
5536	root->mnt = mntget(&child->mnt);
5537	root->dentry = dget(root->mnt->mnt_root);
5538	return 0;
5539}
5540
5541/* This must be updated whenever a new flag is added */
5542#define STATMOUNT_SUPPORTED (STATMOUNT_SB_BASIC | \
5543			     STATMOUNT_MNT_BASIC | \
5544			     STATMOUNT_PROPAGATE_FROM | \
5545			     STATMOUNT_MNT_ROOT | \
5546			     STATMOUNT_MNT_POINT | \
5547			     STATMOUNT_FS_TYPE | \
5548			     STATMOUNT_MNT_NS_ID | \
5549			     STATMOUNT_MNT_OPTS | \
5550			     STATMOUNT_FS_SUBTYPE | \
5551			     STATMOUNT_SB_SOURCE | \
5552			     STATMOUNT_OPT_ARRAY | \
5553			     STATMOUNT_OPT_SEC_ARRAY | \
5554			     STATMOUNT_SUPPORTED_MASK | \
5555			     STATMOUNT_MNT_UIDMAP | \
5556			     STATMOUNT_MNT_GIDMAP)
5557
5558/* locks: namespace_shared */
5559static int do_statmount(struct kstatmount *s, u64 mnt_id, u64 mnt_ns_id,
5560			struct mnt_namespace *ns)
5561{
5562	struct mount *m;
5563	int err;
5564
5565	/* Has the namespace already been emptied? */
5566	if (mnt_ns_id && mnt_ns_empty(ns))
5567		return -ENOENT;
5568
5569	s->mnt = lookup_mnt_in_ns(mnt_id, ns);
5570	if (!s->mnt)
5571		return -ENOENT;
5572
5573	err = grab_requested_root(ns, &s->root);
5574	if (err)
5575		return err;
5576
5577	/*
5578	 * Don't trigger audit denials. We just want to determine what
5579	 * mounts to show users.
5580	 */
5581	m = real_mount(s->mnt);
5582	if (!is_path_reachable(m, m->mnt.mnt_root, &s->root) &&
5583	    !ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN))
5584		return -EPERM;
5585
5586	err = security_sb_statfs(s->mnt->mnt_root);
5587	if (err)
5588		return err;
5589
5590	/*
5591	 * Note that mount properties in mnt->mnt_flags, mnt->mnt_idmap
5592	 * can change concurrently as we only hold the read-side of the
5593	 * namespace semaphore and mount properties may change with only
5594	 * the mount lock held.
5595	 *
5596	 * We could sample the mount lock sequence counter to detect
5597	 * those changes and retry. But it's not worth it. Worst that
5598	 * happens is that the mnt->mnt_idmap pointer is already changed
5599	 * while mnt->mnt_flags isn't or vica versa. So what.
5600	 *
5601	 * Both mnt->mnt_flags and mnt->mnt_idmap are set and retrieved
5602	 * via READ_ONCE()/WRITE_ONCE() and guard against theoretical
5603	 * torn read/write. That's all we care about right now.
5604	 */
5605	s->idmap = mnt_idmap(s->mnt);
5606	if (s->mask & STATMOUNT_MNT_BASIC)
5607		statmount_mnt_basic(s);
5608
5609	if (s->mask & STATMOUNT_SB_BASIC)
5610		statmount_sb_basic(s);
5611
5612	if (s->mask & STATMOUNT_PROPAGATE_FROM)
5613		statmount_propagate_from(s);
5614
5615	if (s->mask & STATMOUNT_FS_TYPE)
5616		err = statmount_string(s, STATMOUNT_FS_TYPE);
5617
5618	if (!err && s->mask & STATMOUNT_MNT_ROOT)
5619		err = statmount_string(s, STATMOUNT_MNT_ROOT);
5620
5621	if (!err && s->mask & STATMOUNT_MNT_POINT)
5622		err = statmount_string(s, STATMOUNT_MNT_POINT);
5623
5624	if (!err && s->mask & STATMOUNT_MNT_OPTS)
5625		err = statmount_string(s, STATMOUNT_MNT_OPTS);
5626
5627	if (!err && s->mask & STATMOUNT_OPT_ARRAY)
5628		err = statmount_string(s, STATMOUNT_OPT_ARRAY);
5629
5630	if (!err && s->mask & STATMOUNT_OPT_SEC_ARRAY)
5631		err = statmount_string(s, STATMOUNT_OPT_SEC_ARRAY);
5632
5633	if (!err && s->mask & STATMOUNT_FS_SUBTYPE)
5634		err = statmount_string(s, STATMOUNT_FS_SUBTYPE);
5635
5636	if (!err && s->mask & STATMOUNT_SB_SOURCE)
5637		err = statmount_string(s, STATMOUNT_SB_SOURCE);
5638
5639	if (!err && s->mask & STATMOUNT_MNT_UIDMAP)
5640		err = statmount_string(s, STATMOUNT_MNT_UIDMAP);
5641
5642	if (!err && s->mask & STATMOUNT_MNT_GIDMAP)
5643		err = statmount_string(s, STATMOUNT_MNT_GIDMAP);
5644
5645	if (!err && s->mask & STATMOUNT_MNT_NS_ID)
5646		statmount_mnt_ns_id(s, ns);
5647
5648	if (!err && s->mask & STATMOUNT_SUPPORTED_MASK) {
5649		s->sm.mask |= STATMOUNT_SUPPORTED_MASK;
5650		s->sm.supported_mask = STATMOUNT_SUPPORTED;
5651	}
5652
5653	if (err)
5654		return err;
5655
5656	/* Are there bits in the return mask not present in STATMOUNT_SUPPORTED? */
5657	WARN_ON_ONCE(~STATMOUNT_SUPPORTED & s->sm.mask);
5658
5659	return 0;
5660}
5661
5662static inline bool retry_statmount(const long ret, size_t *seq_size)
5663{
5664	if (likely(ret != -EAGAIN))
5665		return false;
5666	if (unlikely(check_mul_overflow(*seq_size, 2, seq_size)))
5667		return false;
5668	if (unlikely(*seq_size > MAX_RW_COUNT))
5669		return false;
5670	return true;
5671}
5672
5673#define STATMOUNT_STRING_REQ (STATMOUNT_MNT_ROOT | STATMOUNT_MNT_POINT | \
5674			      STATMOUNT_FS_TYPE | STATMOUNT_MNT_OPTS | \
5675			      STATMOUNT_FS_SUBTYPE | STATMOUNT_SB_SOURCE | \
5676			      STATMOUNT_OPT_ARRAY | STATMOUNT_OPT_SEC_ARRAY | \
5677			      STATMOUNT_MNT_UIDMAP | STATMOUNT_MNT_GIDMAP)
5678
5679static int prepare_kstatmount(struct kstatmount *ks, struct mnt_id_req *kreq,
5680			      struct statmount __user *buf, size_t bufsize,
5681			      size_t seq_size)
5682{
5683	if (!access_ok(buf, bufsize))
5684		return -EFAULT;
5685
5686	memset(ks, 0, sizeof(*ks));
5687	ks->mask = kreq->param;
5688	ks->buf = buf;
5689	ks->bufsize = bufsize;
5690
5691	if (ks->mask & STATMOUNT_STRING_REQ) {
5692		if (bufsize == sizeof(ks->sm))
5693			return -EOVERFLOW;
5694
5695		ks->seq.buf = kvmalloc(seq_size, GFP_KERNEL_ACCOUNT);
5696		if (!ks->seq.buf)
5697			return -ENOMEM;
5698
5699		ks->seq.size = seq_size;
5700	}
5701
5702	return 0;
5703}
5704
5705static int copy_mnt_id_req(const struct mnt_id_req __user *req,
5706			   struct mnt_id_req *kreq)
5707{
5708	int ret;
5709	size_t usize;
5710
5711	BUILD_BUG_ON(sizeof(struct mnt_id_req) != MNT_ID_REQ_SIZE_VER1);
5712
5713	ret = get_user(usize, &req->size);
5714	if (ret)
5715		return -EFAULT;
5716	if (unlikely(usize > PAGE_SIZE))
5717		return -E2BIG;
5718	if (unlikely(usize < MNT_ID_REQ_SIZE_VER0))
5719		return -EINVAL;
5720	memset(kreq, 0, sizeof(*kreq));
5721	ret = copy_struct_from_user(kreq, sizeof(*kreq), req, usize);
5722	if (ret)
5723		return ret;
5724	if (kreq->mnt_ns_fd != 0 && kreq->mnt_ns_id)
5725		return -EINVAL;
5726	/* The first valid unique mount id is MNT_UNIQUE_ID_OFFSET + 1. */
5727	if (kreq->mnt_id <= MNT_UNIQUE_ID_OFFSET)
5728		return -EINVAL;
5729	return 0;
5730}
5731
5732/*
5733 * If the user requested a specific mount namespace id, look that up and return
5734 * that, or if not simply grab a passive reference on our mount namespace and
5735 * return that.
5736 */
5737static struct mnt_namespace *grab_requested_mnt_ns(const struct mnt_id_req *kreq)
5738{
5739	struct mnt_namespace *mnt_ns;
5740
5741	if (kreq->mnt_ns_id) {
5742		mnt_ns = lookup_mnt_ns(kreq->mnt_ns_id);
5743		if (!mnt_ns)
5744			return ERR_PTR(-ENOENT);
5745	} else if (kreq->mnt_ns_fd) {
5746		struct ns_common *ns;
5747
5748		CLASS(fd, f)(kreq->mnt_ns_fd);
5749		if (fd_empty(f))
5750			return ERR_PTR(-EBADF);
5751
5752		if (!proc_ns_file(fd_file(f)))
5753			return ERR_PTR(-EINVAL);
5754
5755		ns = get_proc_ns(file_inode(fd_file(f)));
5756		if (ns->ns_type != CLONE_NEWNS)
5757			return ERR_PTR(-EINVAL);
5758
5759		mnt_ns = to_mnt_ns(ns);
5760		refcount_inc(&mnt_ns->passive);
5761	} else {
5762		mnt_ns = current->nsproxy->mnt_ns;
5763		refcount_inc(&mnt_ns->passive);
5764	}
5765
5766	return mnt_ns;
5767}
5768
5769SYSCALL_DEFINE4(statmount, const struct mnt_id_req __user *, req,
5770		struct statmount __user *, buf, size_t, bufsize,
5771		unsigned int, flags)
5772{
5773	struct mnt_namespace *ns __free(mnt_ns_release) = NULL;
5774	struct kstatmount *ks __free(kfree) = NULL;
5775	struct mnt_id_req kreq;
5776	/* We currently support retrieval of 3 strings. */
5777	size_t seq_size = 3 * PATH_MAX;
5778	int ret;
5779
5780	if (flags)
5781		return -EINVAL;
5782
5783	ret = copy_mnt_id_req(req, &kreq);
5784	if (ret)
5785		return ret;
5786
5787	ns = grab_requested_mnt_ns(&kreq);
5788	if (IS_ERR(ns))
5789		return PTR_ERR(ns);
5790
5791	if (kreq.mnt_ns_id && (ns != current->nsproxy->mnt_ns) &&
5792	    !ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN))
5793		return -EPERM;
5794
5795	ks = kmalloc(sizeof(*ks), GFP_KERNEL_ACCOUNT);
5796	if (!ks)
5797		return -ENOMEM;
5798
5799retry:
5800	ret = prepare_kstatmount(ks, &kreq, buf, bufsize, seq_size);
5801	if (ret)
5802		return ret;
5803
5804	scoped_guard(namespace_shared)
5805		ret = do_statmount(ks, kreq.mnt_id, kreq.mnt_ns_id, ns);
5806
5807	if (!ret)
5808		ret = copy_statmount_to_user(ks);
5809	kvfree(ks->seq.buf);
5810	path_put(&ks->root);
5811	if (retry_statmount(ret, &seq_size))
5812		goto retry;
5813	return ret;
5814}
5815
5816struct klistmount {
5817	u64 last_mnt_id;
5818	u64 mnt_parent_id;
5819	u64 *kmnt_ids;
5820	u32 nr_mnt_ids;
5821	struct mnt_namespace *ns;
5822	struct path root;
5823};
5824
5825/* locks: namespace_shared */
5826static ssize_t do_listmount(struct klistmount *kls, bool reverse)
5827{
5828	struct mnt_namespace *ns = kls->ns;
5829	u64 mnt_parent_id = kls->mnt_parent_id;
5830	u64 last_mnt_id = kls->last_mnt_id;
5831	u64 *mnt_ids = kls->kmnt_ids;
5832	size_t nr_mnt_ids = kls->nr_mnt_ids;
5833	struct path orig;
5834	struct mount *r, *first;
5835	ssize_t ret;
5836
5837	rwsem_assert_held(&namespace_sem);
5838
5839	ret = grab_requested_root(ns, &kls->root);
5840	if (ret)
5841		return ret;
5842
5843	if (mnt_parent_id == LSMT_ROOT) {
5844		orig = kls->root;
5845	} else {
5846		orig.mnt = lookup_mnt_in_ns(mnt_parent_id, ns);
5847		if (!orig.mnt)
5848			return -ENOENT;
5849		orig.dentry = orig.mnt->mnt_root;
5850	}
5851
5852	/*
5853	 * Don't trigger audit denials. We just want to determine what
5854	 * mounts to show users.
5855	 */
5856	if (!is_path_reachable(real_mount(orig.mnt), orig.dentry, &kls->root) &&
5857	    !ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN))
5858		return -EPERM;
5859
5860	ret = security_sb_statfs(orig.dentry);
5861	if (ret)
5862		return ret;
5863
5864	if (!last_mnt_id) {
5865		if (reverse)
5866			first = node_to_mount(ns->mnt_last_node);
5867		else
5868			first = node_to_mount(ns->mnt_first_node);
5869	} else {
5870		if (reverse)
5871			first = mnt_find_id_at_reverse(ns, last_mnt_id - 1);
5872		else
5873			first = mnt_find_id_at(ns, last_mnt_id + 1);
5874	}
5875
5876	for (ret = 0, r = first; r && nr_mnt_ids; r = listmnt_next(r, reverse)) {
5877		if (r->mnt_id_unique == mnt_parent_id)
5878			continue;
5879		if (!is_path_reachable(r, r->mnt.mnt_root, &orig))
5880			continue;
5881		*mnt_ids = r->mnt_id_unique;
5882		mnt_ids++;
5883		nr_mnt_ids--;
5884		ret++;
5885	}
5886	return ret;
5887}
5888
5889static void __free_klistmount_free(const struct klistmount *kls)
5890{
5891	path_put(&kls->root);
5892	kvfree(kls->kmnt_ids);
5893	mnt_ns_release(kls->ns);
5894}
5895
5896static inline int prepare_klistmount(struct klistmount *kls, struct mnt_id_req *kreq,
5897				     size_t nr_mnt_ids)
5898{
5899	u64 last_mnt_id = kreq->param;
5900	struct mnt_namespace *ns;
5901
5902	/* The first valid unique mount id is MNT_UNIQUE_ID_OFFSET + 1. */
5903	if (last_mnt_id != 0 && last_mnt_id <= MNT_UNIQUE_ID_OFFSET)
5904		return -EINVAL;
5905
5906	kls->last_mnt_id = last_mnt_id;
5907
5908	kls->nr_mnt_ids = nr_mnt_ids;
5909	kls->kmnt_ids = kvmalloc_array(nr_mnt_ids, sizeof(*kls->kmnt_ids),
5910				       GFP_KERNEL_ACCOUNT);
5911	if (!kls->kmnt_ids)
5912		return -ENOMEM;
5913
5914	ns = grab_requested_mnt_ns(kreq);
5915	if (IS_ERR(ns))
5916		return PTR_ERR(ns);
5917	kls->ns = ns;
5918
5919	kls->mnt_parent_id = kreq->mnt_id;
5920	return 0;
5921}
5922
5923SYSCALL_DEFINE4(listmount, const struct mnt_id_req __user *, req,
5924		u64 __user *, mnt_ids, size_t, nr_mnt_ids, unsigned int, flags)
5925{
5926	struct klistmount kls __free(klistmount_free) = {};
5927	const size_t maxcount = 1000000;
5928	struct mnt_id_req kreq;
5929	ssize_t ret;
5930
5931	if (flags & ~LISTMOUNT_REVERSE)
5932		return -EINVAL;
5933
5934	/*
5935	 * If the mount namespace really has more than 1 million mounts the
5936	 * caller must iterate over the mount namespace (and reconsider their
5937	 * system design...).
5938	 */
5939	if (unlikely(nr_mnt_ids > maxcount))
5940		return -EOVERFLOW;
5941
5942	if (!access_ok(mnt_ids, nr_mnt_ids * sizeof(*mnt_ids)))
5943		return -EFAULT;
5944
5945	ret = copy_mnt_id_req(req, &kreq);
5946	if (ret)
5947		return ret;
5948
5949	ret = prepare_klistmount(&kls, &kreq, nr_mnt_ids);
5950	if (ret)
5951		return ret;
5952
5953	if (kreq.mnt_ns_id && (kls.ns != current->nsproxy->mnt_ns) &&
5954	    !ns_capable_noaudit(kls.ns->user_ns, CAP_SYS_ADMIN))
5955		return -ENOENT;
5956
5957	/*
5958	 * We only need to guard against mount topology changes as
5959	 * listmount() doesn't care about any mount properties.
5960	 */
5961	scoped_guard(namespace_shared)
5962		ret = do_listmount(&kls, (flags & LISTMOUNT_REVERSE));
5963	if (ret <= 0)
5964		return ret;
5965
5966	if (copy_to_user(mnt_ids, kls.kmnt_ids, ret * sizeof(*mnt_ids)))
5967		return -EFAULT;
5968
5969	return ret;
5970}
5971
5972struct mnt_namespace init_mnt_ns = {
5973	.ns		= NS_COMMON_INIT(init_mnt_ns),
5974	.user_ns	= &init_user_ns,
5975	.passive	= REFCOUNT_INIT(1),
5976	.mounts		= RB_ROOT,
5977	.poll		= __WAIT_QUEUE_HEAD_INITIALIZER(init_mnt_ns.poll),
5978};
5979
5980static void __init init_mount_tree(void)
5981{
5982	struct vfsmount *mnt;
5983	struct mount *m;
5984	struct path root;
5985
5986	mnt = vfs_kern_mount(&rootfs_fs_type, 0, "rootfs", initramfs_options);
5987	if (IS_ERR(mnt))
5988		panic("Can't create rootfs");
5989
5990	m = real_mount(mnt);
5991	init_mnt_ns.root = m;
5992	init_mnt_ns.nr_mounts = 1;
5993	mnt_add_to_ns(&init_mnt_ns, m);
5994	init_task.nsproxy->mnt_ns = &init_mnt_ns;
5995	get_mnt_ns(&init_mnt_ns);
5996
5997	root.mnt = mnt;
5998	root.dentry = mnt->mnt_root;
5999
6000	set_fs_pwd(current->fs, &root);
6001	set_fs_root(current->fs, &root);
6002
6003	ns_tree_add(&init_mnt_ns);
6004}
6005
6006void __init mnt_init(void)
6007{
6008	int err;
6009
6010	mnt_cache = kmem_cache_create("mnt_cache", sizeof(struct mount),
6011			0, SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT, NULL);
6012
6013	mount_hashtable = alloc_large_system_hash("Mount-cache",
6014				sizeof(struct hlist_head),
6015				mhash_entries, 19,
6016				HASH_ZERO,
6017				&m_hash_shift, &m_hash_mask, 0, 0);
6018	mountpoint_hashtable = alloc_large_system_hash("Mountpoint-cache",
6019				sizeof(struct hlist_head),
6020				mphash_entries, 19,
6021				HASH_ZERO,
6022				&mp_hash_shift, &mp_hash_mask, 0, 0);
6023
6024	if (!mount_hashtable || !mountpoint_hashtable)
6025		panic("Failed to allocate mount hash table\n");
6026
6027	kernfs_init();
6028
6029	err = sysfs_init();
6030	if (err)
6031		printk(KERN_WARNING "%s: sysfs_init error: %d\n",
6032			__func__, err);
6033	fs_kobj = kobject_create_and_add("fs", NULL);
6034	if (!fs_kobj)
6035		printk(KERN_WARNING "%s: kobj create error\n", __func__);
6036	shmem_init();
6037	init_rootfs();
6038	init_mount_tree();
6039}
6040
6041void put_mnt_ns(struct mnt_namespace *ns)
6042{
6043	if (!ns_ref_put(ns))
6044		return;
6045	guard(namespace_excl)();
6046	emptied_ns = ns;
6047	guard(mount_writer)();
6048	umount_tree(ns->root, 0);
6049}
6050
6051struct vfsmount *kern_mount(struct file_system_type *type)
6052{
6053	struct vfsmount *mnt;
6054	mnt = vfs_kern_mount(type, SB_KERNMOUNT, type->name, NULL);
6055	if (!IS_ERR(mnt)) {
6056		/*
6057		 * it is a longterm mount, don't release mnt until
6058		 * we unmount before file sys is unregistered
6059		*/
6060		real_mount(mnt)->mnt_ns = MNT_NS_INTERNAL;
6061	}
6062	return mnt;
6063}
6064EXPORT_SYMBOL_GPL(kern_mount);
6065
6066void kern_unmount(struct vfsmount *mnt)
6067{
6068	/* release long term mount so mount point can be released */
6069	if (!IS_ERR(mnt)) {
6070		mnt_make_shortterm(mnt);
6071		synchronize_rcu();	/* yecchhh... */
6072		mntput(mnt);
6073	}
6074}
6075EXPORT_SYMBOL(kern_unmount);
6076
6077void kern_unmount_array(struct vfsmount *mnt[], unsigned int num)
6078{
6079	unsigned int i;
6080
6081	for (i = 0; i < num; i++)
6082		mnt_make_shortterm(mnt[i]);
6083	synchronize_rcu_expedited();
6084	for (i = 0; i < num; i++)
6085		mntput(mnt[i]);
6086}
6087EXPORT_SYMBOL(kern_unmount_array);
6088
6089bool our_mnt(struct vfsmount *mnt)
6090{
6091	return check_mnt(real_mount(mnt));
6092}
6093
6094bool current_chrooted(void)
6095{
6096	/* Does the current process have a non-standard root */
6097	struct path fs_root __free(path_put) = {};
6098	struct mount *root;
6099
6100	get_fs_root(current->fs, &fs_root);
6101
6102	/* Find the namespace root */
6103
6104	guard(mount_locked_reader)();
6105
6106	root = topmost_overmount(current->nsproxy->mnt_ns->root);
6107
6108	return fs_root.mnt != &root->mnt || !path_mounted(&fs_root);
6109}
6110
6111static bool mnt_already_visible(struct mnt_namespace *ns,
6112				const struct super_block *sb,
6113				int *new_mnt_flags)
6114{
6115	int new_flags = *new_mnt_flags;
6116	struct mount *mnt, *n;
6117
6118	guard(namespace_shared)();
6119	rbtree_postorder_for_each_entry_safe(mnt, n, &ns->mounts, mnt_node) {
6120		struct mount *child;
6121		int mnt_flags;
6122
6123		if (mnt->mnt.mnt_sb->s_type != sb->s_type)
6124			continue;
6125
6126		/* This mount is not fully visible if it's root directory
6127		 * is not the root directory of the filesystem.
6128		 */
6129		if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root)
6130			continue;
6131
6132		/* A local view of the mount flags */
6133		mnt_flags = mnt->mnt.mnt_flags;
6134
6135		/* Don't miss readonly hidden in the superblock flags */
6136		if (sb_rdonly(mnt->mnt.mnt_sb))
6137			mnt_flags |= MNT_LOCK_READONLY;
6138
6139		/* Verify the mount flags are equal to or more permissive
6140		 * than the proposed new mount.
6141		 */
6142		if ((mnt_flags & MNT_LOCK_READONLY) &&
6143		    !(new_flags & MNT_READONLY))
6144			continue;
6145		if ((mnt_flags & MNT_LOCK_ATIME) &&
6146		    ((mnt_flags & MNT_ATIME_MASK) != (new_flags & MNT_ATIME_MASK)))
6147			continue;
6148
6149		/* This mount is not fully visible if there are any
6150		 * locked child mounts that cover anything except for
6151		 * empty directories.
6152		 */
6153		list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
6154			struct inode *inode = child->mnt_mountpoint->d_inode;
6155			/* Only worry about locked mounts */
6156			if (!(child->mnt.mnt_flags & MNT_LOCKED))
6157				continue;
6158			/* Is the directory permanently empty? */
6159			if (!is_empty_dir_inode(inode))
6160				goto next;
6161		}
6162		/* Preserve the locked attributes */
6163		*new_mnt_flags |= mnt_flags & (MNT_LOCK_READONLY | \
6164					       MNT_LOCK_ATIME);
6165		return true;
6166	next:	;
6167	}
6168	return false;
6169}
6170
6171static bool mount_too_revealing(const struct super_block *sb, int *new_mnt_flags)
6172{
6173	const unsigned long required_iflags = SB_I_NOEXEC | SB_I_NODEV;
6174	struct mnt_namespace *ns = current->nsproxy->mnt_ns;
6175	unsigned long s_iflags;
6176
6177	if (ns->user_ns == &init_user_ns)
6178		return false;
6179
6180	/* Can this filesystem be too revealing? */
6181	s_iflags = sb->s_iflags;
6182	if (!(s_iflags & SB_I_USERNS_VISIBLE))
6183		return false;
6184
6185	if ((s_iflags & required_iflags) != required_iflags) {
6186		WARN_ONCE(1, "Expected s_iflags to contain 0x%lx\n",
6187			  required_iflags);
6188		return true;
6189	}
6190
6191	return !mnt_already_visible(ns, sb, new_mnt_flags);
6192}
6193
6194bool mnt_may_suid(struct vfsmount *mnt)
6195{
6196	/*
6197	 * Foreign mounts (accessed via fchdir or through /proc
6198	 * symlinks) are always treated as if they are nosuid.  This
6199	 * prevents namespaces from trusting potentially unsafe
6200	 * suid/sgid bits, file caps, or security labels that originate
6201	 * in other namespaces.
6202	 */
6203	return !(mnt->mnt_flags & MNT_NOSUID) && check_mnt(real_mount(mnt)) &&
6204	       current_in_userns(mnt->mnt_sb->s_user_ns);
6205}
6206
6207static struct ns_common *mntns_get(struct task_struct *task)
6208{
6209	struct ns_common *ns = NULL;
6210	struct nsproxy *nsproxy;
6211
6212	task_lock(task);
6213	nsproxy = task->nsproxy;
6214	if (nsproxy) {
6215		ns = &nsproxy->mnt_ns->ns;
6216		get_mnt_ns(to_mnt_ns(ns));
6217	}
6218	task_unlock(task);
6219
6220	return ns;
6221}
6222
6223static void mntns_put(struct ns_common *ns)
6224{
6225	put_mnt_ns(to_mnt_ns(ns));
6226}
6227
6228static int mntns_install(struct nsset *nsset, struct ns_common *ns)
6229{
6230	struct nsproxy *nsproxy = nsset->nsproxy;
6231	struct fs_struct *fs = nsset->fs;
6232	struct mnt_namespace *mnt_ns = to_mnt_ns(ns), *old_mnt_ns;
6233	struct user_namespace *user_ns = nsset->cred->user_ns;
6234	struct path root;
6235	int err;
6236
6237	if (!ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN) ||
6238	    !ns_capable(user_ns, CAP_SYS_CHROOT) ||
6239	    !ns_capable(user_ns, CAP_SYS_ADMIN))
6240		return -EPERM;
6241
6242	if (is_anon_ns(mnt_ns))
6243		return -EINVAL;
6244
6245	if (fs->users != 1)
6246		return -EINVAL;
6247
6248	get_mnt_ns(mnt_ns);
6249	old_mnt_ns = nsproxy->mnt_ns;
6250	nsproxy->mnt_ns = mnt_ns;
6251
6252	/* Find the root */
6253	err = vfs_path_lookup(mnt_ns->root->mnt.mnt_root, &mnt_ns->root->mnt,
6254				"/", LOOKUP_DOWN, &root);
6255	if (err) {
6256		/* revert to old namespace */
6257		nsproxy->mnt_ns = old_mnt_ns;
6258		put_mnt_ns(mnt_ns);
6259		return err;
6260	}
6261
6262	put_mnt_ns(old_mnt_ns);
6263
6264	/* Update the pwd and root */
6265	set_fs_pwd(fs, &root);
6266	set_fs_root(fs, &root);
6267
6268	path_put(&root);
6269	return 0;
6270}
6271
6272static struct user_namespace *mntns_owner(struct ns_common *ns)
6273{
6274	return to_mnt_ns(ns)->user_ns;
6275}
6276
6277const struct proc_ns_operations mntns_operations = {
6278	.name		= "mnt",
6279	.get		= mntns_get,
6280	.put		= mntns_put,
6281	.install	= mntns_install,
6282	.owner		= mntns_owner,
6283};
6284
6285#ifdef CONFIG_SYSCTL
6286static const struct ctl_table fs_namespace_sysctls[] = {
6287	{
6288		.procname	= "mount-max",
6289		.data		= &sysctl_mount_max,
6290		.maxlen		= sizeof(unsigned int),
6291		.mode		= 0644,
6292		.proc_handler	= proc_dointvec_minmax,
6293		.extra1		= SYSCTL_ONE,
6294	},
6295};
6296
6297static int __init init_fs_namespace_sysctls(void)
6298{
6299	register_sysctl_init("fs", fs_namespace_sysctls);
6300	return 0;
6301}
6302fs_initcall(init_fs_namespace_sysctls);
6303
6304#endif /* CONFIG_SYSCTL */