namei.c

   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * Copyright (C) 2011 Novell Inc.
   4 * Copyright (C) 2016 Red Hat, Inc.
   5 */
   6
   7#include <linux/fs.h>
   8#include <linux/cred.h>
   9#include <linux/ctype.h>
  10#include <linux/namei.h>
  11#include <linux/xattr.h>
  12#include <linux/ratelimit.h>
  13#include <linux/mount.h>
  14#include <linux/exportfs.h>
  15#include "overlayfs.h"
  16
  17struct ovl_lookup_data {
  18	struct super_block *sb;
  19	struct dentry *dentry;
  20	const struct ovl_layer *layer;
  21	struct qstr name;
  22	bool is_dir;
  23	bool opaque;
  24	bool xwhiteouts;
  25	bool stop;
  26	bool last;
  27	char *redirect;
  28	char *upperredirect;
  29	int metacopy;
  30	/* Referring to last redirect xattr */
  31	bool absolute_redirect;
  32};
  33
  34static int ovl_check_redirect(const struct path *path, struct ovl_lookup_data *d,
  35			      size_t prelen, const char *post)
  36{
  37	int res;
  38	char *buf;
  39	struct ovl_fs *ofs = OVL_FS(d->sb);
  40
  41	d->absolute_redirect = false;
  42	buf = ovl_get_redirect_xattr(ofs, path, prelen + strlen(post));
  43	if (IS_ERR_OR_NULL(buf))
  44		return PTR_ERR(buf);
  45
  46	if (buf[0] == '/') {
  47		d->absolute_redirect = true;
  48		/*
  49		 * One of the ancestor path elements in an absolute path
  50		 * lookup in ovl_lookup_layer() could have been opaque and
  51		 * that will stop further lookup in lower layers (d->stop=true)
  52		 * But we have found an absolute redirect in descendant path
  53		 * element and that should force continue lookup in lower
  54		 * layers (reset d->stop).
  55		 */
  56		d->stop = false;
  57	} else {
  58		res = strlen(buf) + 1;
  59		memmove(buf + prelen, buf, res);
  60		memcpy(buf, d->name.name, prelen);
  61	}
  62
  63	strcat(buf, post);
  64	kfree(d->redirect);
  65	d->redirect = buf;
  66	d->name.name = d->redirect;
  67	d->name.len = strlen(d->redirect);
  68
  69	return 0;
  70}
  71
  72static int ovl_acceptable(void *ctx, struct dentry *dentry)
  73{
  74	/*
  75	 * A non-dir origin may be disconnected, which is fine, because
  76	 * we only need it for its unique inode number.
  77	 */
  78	if (!d_is_dir(dentry))
  79		return 1;
  80
  81	/* Don't decode a deleted empty directory */
  82	if (d_unhashed(dentry))
  83		return 0;
  84
  85	/* Check if directory belongs to the layer we are decoding from */
  86	return is_subdir(dentry, ((struct vfsmount *)ctx)->mnt_root);
  87}
  88
  89/*
  90 * Check validity of an overlay file handle buffer.
  91 *
  92 * Return 0 for a valid file handle.
  93 * Return -ENODATA for "origin unknown".
  94 * Return <0 for an invalid file handle.
  95 */
  96int ovl_check_fb_len(struct ovl_fb *fb, int fb_len)
  97{
  98	if (fb_len < sizeof(struct ovl_fb) || fb_len < fb->len)
  99		return -EINVAL;
 100
 101	if (fb->magic != OVL_FH_MAGIC)
 102		return -EINVAL;
 103
 104	/* Treat larger version and unknown flags as "origin unknown" */
 105	if (fb->version > OVL_FH_VERSION || fb->flags & ~OVL_FH_FLAG_ALL)
 106		return -ENODATA;
 107
 108	/* Treat endianness mismatch as "origin unknown" */
 109	if (!(fb->flags & OVL_FH_FLAG_ANY_ENDIAN) &&
 110	    (fb->flags & OVL_FH_FLAG_BIG_ENDIAN) != OVL_FH_FLAG_CPU_ENDIAN)
 111		return -ENODATA;
 112
 113	return 0;
 114}
 115
 116static struct ovl_fh *ovl_get_fh(struct ovl_fs *ofs, struct dentry *upperdentry,
 117				 enum ovl_xattr ox)
 118{
 119	int res, err;
 120	struct ovl_fh *fh = NULL;
 121
 122	res = ovl_getxattr_upper(ofs, upperdentry, ox, NULL, 0);
 123	if (res < 0) {
 124		if (res == -ENODATA || res == -EOPNOTSUPP)
 125			return NULL;
 126		goto fail;
 127	}
 128	/* Zero size value means "copied up but origin unknown" */
 129	if (res == 0)
 130		return NULL;
 131
 132	fh = kzalloc(res + OVL_FH_WIRE_OFFSET, GFP_KERNEL);
 133	if (!fh)
 134		return ERR_PTR(-ENOMEM);
 135
 136	res = ovl_getxattr_upper(ofs, upperdentry, ox, fh->buf, res);
 137	if (res < 0)
 138		goto fail;
 139
 140	err = ovl_check_fb_len(&fh->fb, res);
 141	if (err < 0) {
 142		if (err == -ENODATA)
 143			goto out;
 144		goto invalid;
 145	}
 146
 147	return fh;
 148
 149out:
 150	kfree(fh);
 151	return NULL;
 152
 153fail:
 154	pr_warn_ratelimited("failed to get origin (%i)\n", res);
 155	goto out;
 156invalid:
 157	pr_warn_ratelimited("invalid origin (%*phN)\n", res, fh);
 158	goto out;
 159}
 160
 161struct dentry *ovl_decode_real_fh(struct ovl_fs *ofs, struct ovl_fh *fh,
 162				  struct vfsmount *mnt, bool connected)
 163{
 164	struct dentry *real;
 165	int bytes;
 166
 167	if (!capable(CAP_DAC_READ_SEARCH))
 168		return NULL;
 169
 170	/*
 171	 * Make sure that the stored uuid matches the uuid of the lower
 172	 * layer where file handle will be decoded.
 173	 * In case of uuid=off option just make sure that stored uuid is null.
 174	 */
 175	if (ovl_origin_uuid(ofs) ?
 176	    !uuid_equal(&fh->fb.uuid, &mnt->mnt_sb->s_uuid) :
 177	    !uuid_is_null(&fh->fb.uuid))
 178		return NULL;
 179
 180	bytes = (fh->fb.len - offsetof(struct ovl_fb, fid));
 181	real = exportfs_decode_fh(mnt, (struct fid *)fh->fb.fid,
 182				  bytes >> 2, (int)fh->fb.type,
 183				  connected ? ovl_acceptable : NULL, mnt);
 184	if (IS_ERR(real)) {
 185		/*
 186		 * Treat stale file handle to lower file as "origin unknown".
 187		 * upper file handle could become stale when upper file is
 188		 * unlinked and this information is needed to handle stale
 189		 * index entries correctly.
 190		 */
 191		if (real == ERR_PTR(-ESTALE) &&
 192		    !(fh->fb.flags & OVL_FH_FLAG_PATH_UPPER))
 193			real = NULL;
 194		return real;
 195	}
 196
 197	if (ovl_dentry_weird(real)) {
 198		dput(real);
 199		return NULL;
 200	}
 201
 202	return real;
 203}
 204
 205static struct dentry *ovl_lookup_positive_unlocked(struct ovl_lookup_data *d,
 206						   const char *name,
 207						   struct dentry *base, int len,
 208						   bool drop_negative)
 209{
 210	struct dentry *ret = lookup_one_unlocked(mnt_idmap(d->layer->mnt),
 211						 &QSTR_LEN(name, len), base);
 212
 213	if (!IS_ERR(ret) && d_flags_negative(smp_load_acquire(&ret->d_flags))) {
 214		if (drop_negative && ret->d_lockref.count == 1) {
 215			spin_lock(&ret->d_lock);
 216			/* Recheck condition under lock */
 217			if (d_is_negative(ret) && ret->d_lockref.count == 1)
 218				__d_drop(ret);
 219			spin_unlock(&ret->d_lock);
 220		}
 221		dput(ret);
 222		ret = ERR_PTR(-ENOENT);
 223	}
 224	return ret;
 225}
 226
 227static int ovl_lookup_single(struct dentry *base, struct ovl_lookup_data *d,
 228			     const char *name, unsigned int namelen,
 229			     size_t prelen, const char *post,
 230			     struct dentry **ret, bool drop_negative)
 231{
 232	struct ovl_fs *ofs = OVL_FS(d->sb);
 233	struct dentry *this = NULL;
 234	const char *warn;
 235	struct path path;
 236	int err;
 237	bool last_element = !post[0];
 238	bool is_upper = d->layer->idx == 0;
 239	char val;
 240
 241	/*
 242	 * We allow filesystems that are case-folding capable as long as the
 243	 * layers are consistently enabled in the stack, enabled for every dir
 244	 * or disabled in all dirs. If someone has modified case folding on a
 245	 * directory on underlying layer, the warranty of the ovl stack is
 246	 * voided.
 247	 */
 248	if (ofs->casefold != ovl_dentry_casefolded(base)) {
 249		warn = "parent wrong casefold";
 250		err = -ESTALE;
 251		goto out_warn;
 252	}
 253
 254	this = ovl_lookup_positive_unlocked(d, name, base, namelen, drop_negative);
 255	if (IS_ERR(this)) {
 256		err = PTR_ERR(this);
 257		this = NULL;
 258		if (err == -ENOENT || err == -ENAMETOOLONG)
 259			goto out;
 260		goto out_err;
 261	}
 262
 263	if (ofs->casefold != ovl_dentry_casefolded(this)) {
 264		warn = "child wrong casefold";
 265		err = -EREMOTE;
 266		goto out_warn;
 267	}
 268
 269	if (ovl_dentry_weird(this)) {
 270		/* Don't support traversing automounts and other weirdness */
 271		warn = "unsupported object type";
 272		err = -EREMOTE;
 273		goto out_warn;
 274	}
 275
 276	path.dentry = this;
 277	path.mnt = d->layer->mnt;
 278	if (ovl_path_is_whiteout(ofs, &path)) {
 279		d->stop = d->opaque = true;
 280		goto put_and_out;
 281	}
 282	/*
 283	 * This dentry should be a regular file if previous layer lookup
 284	 * found a metacopy dentry.
 285	 */
 286	if (last_element && d->metacopy && !d_is_reg(this)) {
 287		d->stop = true;
 288		goto put_and_out;
 289	}
 290
 291	if (!d_can_lookup(this)) {
 292		if (d->is_dir || !last_element) {
 293			d->stop = true;
 294			goto put_and_out;
 295		}
 296		err = ovl_check_metacopy_xattr(ofs, &path, NULL);
 297		if (err < 0)
 298			goto out_err;
 299
 300		d->metacopy = err;
 301		d->stop = !d->metacopy;
 302		if (!d->metacopy || d->last)
 303			goto out;
 304	} else {
 305		if (ovl_lookup_trap_inode(d->sb, this)) {
 306			/* Caught in a trap of overlapping layers */
 307			warn = "overlapping layers";
 308			err = -ELOOP;
 309			goto out_warn;
 310		}
 311
 312		if (last_element)
 313			d->is_dir = true;
 314		if (d->last)
 315			goto out;
 316
 317		/* overlay.opaque=x means xwhiteouts directory */
 318		val = ovl_get_opaquedir_val(ofs, &path);
 319		if (last_element && !is_upper && val == 'x') {
 320			d->xwhiteouts = true;
 321			ovl_layer_set_xwhiteouts(ofs, d->layer);
 322		} else if (val == 'y') {
 323			d->stop = true;
 324			if (last_element)
 325				d->opaque = true;
 326			goto out;
 327		}
 328	}
 329	err = ovl_check_redirect(&path, d, prelen, post);
 330	if (err)
 331		goto out_err;
 332out:
 333	*ret = this;
 334	return 0;
 335
 336put_and_out:
 337	dput(this);
 338	this = NULL;
 339	goto out;
 340
 341out_warn:
 342	pr_warn_ratelimited("failed lookup in %s (%pd2, name='%.*s', err=%i): %s\n",
 343			    is_upper ? "upper" : "lower", base,
 344			    namelen, name, err, warn);
 345out_err:
 346	dput(this);
 347	return err;
 348}
 349
 350static int ovl_lookup_layer(struct dentry *base, struct ovl_lookup_data *d,
 351			    struct dentry **ret, bool drop_negative)
 352{
 353	/* Counting down from the end, since the prefix can change */
 354	size_t rem = d->name.len - 1;
 355	struct dentry *dentry = NULL;
 356	int err;
 357
 358	if (d->name.name[0] != '/')
 359		return ovl_lookup_single(base, d, d->name.name, d->name.len,
 360					 0, "", ret, drop_negative);
 361
 362	while (!IS_ERR_OR_NULL(base) && d_can_lookup(base)) {
 363		const char *s = d->name.name + d->name.len - rem;
 364		const char *next = strchrnul(s, '/');
 365		size_t thislen = next - s;
 366		bool end = !next[0];
 367
 368		/* Verify we did not go off the rails */
 369		if (WARN_ON(s[-1] != '/'))
 370			return -EIO;
 371
 372		err = ovl_lookup_single(base, d, s, thislen,
 373					d->name.len - rem, next, &base,
 374					drop_negative);
 375		dput(dentry);
 376		if (err)
 377			return err;
 378		dentry = base;
 379		if (end)
 380			break;
 381
 382		rem -= thislen + 1;
 383
 384		if (WARN_ON(rem >= d->name.len))
 385			return -EIO;
 386	}
 387	*ret = dentry;
 388	return 0;
 389}
 390
 391static int ovl_lookup_data_layer(struct dentry *dentry, const char *redirect,
 392				 const struct ovl_layer *layer,
 393				 struct path *datapath)
 394{
 395	int err;
 396
 397	err = vfs_path_lookup(layer->mnt->mnt_root, layer->mnt, redirect,
 398			LOOKUP_BENEATH | LOOKUP_NO_SYMLINKS | LOOKUP_NO_XDEV,
 399			datapath);
 400	pr_debug("lookup lowerdata (%pd2, redirect=\"%s\", layer=%d, err=%i)\n",
 401		 dentry, redirect, layer->idx, err);
 402
 403	if (err)
 404		return err;
 405
 406	err = -EREMOTE;
 407	if (ovl_dentry_weird(datapath->dentry))
 408		goto out_path_put;
 409
 410	err = -ENOENT;
 411	/* Only regular file is acceptable as lower data */
 412	if (!d_is_reg(datapath->dentry))
 413		goto out_path_put;
 414
 415	return 0;
 416
 417out_path_put:
 418	path_put(datapath);
 419
 420	return err;
 421}
 422
 423/* Lookup in data-only layers by absolute redirect to layer root */
 424static int ovl_lookup_data_layers(struct dentry *dentry, const char *redirect,
 425				  struct ovl_path *lowerdata)
 426{
 427	struct ovl_fs *ofs = OVL_FS(dentry->d_sb);
 428	const struct ovl_layer *layer;
 429	struct path datapath;
 430	int err = -ENOENT;
 431	int i;
 432
 433	layer = &ofs->layers[ofs->numlayer - ofs->numdatalayer];
 434	for (i = 0; i < ofs->numdatalayer; i++, layer++) {
 435		err = ovl_lookup_data_layer(dentry, redirect, layer, &datapath);
 436		if (!err) {
 437			mntput(datapath.mnt);
 438			lowerdata->dentry = datapath.dentry;
 439			lowerdata->layer = layer;
 440			return 0;
 441		}
 442	}
 443
 444	return err;
 445}
 446
 447int ovl_check_origin_fh(struct ovl_fs *ofs, struct ovl_fh *fh, bool connected,
 448			struct dentry *upperdentry, struct ovl_path **stackp)
 449{
 450	struct dentry *origin = NULL;
 451	int i;
 452
 453	for (i = 1; i <= ovl_numlowerlayer(ofs); i++) {
 454		/*
 455		 * If lower fs uuid is not unique among lower fs we cannot match
 456		 * fh->uuid to layer.
 457		 */
 458		if (ofs->layers[i].fsid &&
 459		    ofs->layers[i].fs->bad_uuid)
 460			continue;
 461
 462		origin = ovl_decode_real_fh(ofs, fh, ofs->layers[i].mnt,
 463					    connected);
 464		if (origin)
 465			break;
 466	}
 467
 468	if (!origin)
 469		return -ESTALE;
 470	else if (IS_ERR(origin))
 471		return PTR_ERR(origin);
 472
 473	if (upperdentry && !ovl_upper_is_whiteout(ofs, upperdentry) &&
 474	    inode_wrong_type(d_inode(upperdentry), d_inode(origin)->i_mode))
 475		goto invalid;
 476
 477	if (!*stackp)
 478		*stackp = kmalloc(sizeof(struct ovl_path), GFP_KERNEL);
 479	if (!*stackp) {
 480		dput(origin);
 481		return -ENOMEM;
 482	}
 483	**stackp = (struct ovl_path){
 484		.dentry = origin,
 485		.layer = &ofs->layers[i]
 486	};
 487
 488	return 0;
 489
 490invalid:
 491	pr_warn_ratelimited("invalid origin (%pd2, ftype=%x, origin ftype=%x).\n",
 492			    upperdentry, d_inode(upperdentry)->i_mode & S_IFMT,
 493			    d_inode(origin)->i_mode & S_IFMT);
 494	dput(origin);
 495	return -ESTALE;
 496}
 497
 498static int ovl_check_origin(struct ovl_fs *ofs, struct dentry *upperdentry,
 499			    struct ovl_path **stackp)
 500{
 501	struct ovl_fh *fh = ovl_get_fh(ofs, upperdentry, OVL_XATTR_ORIGIN);
 502	int err;
 503
 504	if (IS_ERR_OR_NULL(fh))
 505		return PTR_ERR(fh);
 506
 507	err = ovl_check_origin_fh(ofs, fh, false, upperdentry, stackp);
 508	kfree(fh);
 509
 510	if (err) {
 511		if (err == -ESTALE)
 512			return 0;
 513		return err;
 514	}
 515
 516	return 0;
 517}
 518
 519/*
 520 * Verify that @fh matches the file handle stored in xattr @name.
 521 * Return 0 on match, -ESTALE on mismatch, < 0 on error.
 522 */
 523static int ovl_verify_fh(struct ovl_fs *ofs, struct dentry *dentry,
 524			 enum ovl_xattr ox, const struct ovl_fh *fh)
 525{
 526	struct ovl_fh *ofh = ovl_get_fh(ofs, dentry, ox);
 527	int err = 0;
 528
 529	if (!ofh)
 530		return -ENODATA;
 531
 532	if (IS_ERR(ofh))
 533		return PTR_ERR(ofh);
 534
 535	if (fh->fb.len != ofh->fb.len || memcmp(&fh->fb, &ofh->fb, fh->fb.len))
 536		err = -ESTALE;
 537
 538	kfree(ofh);
 539	return err;
 540}
 541
 542int ovl_verify_set_fh(struct ovl_fs *ofs, struct dentry *dentry,
 543		      enum ovl_xattr ox, const struct ovl_fh *fh,
 544		      bool is_upper, bool set)
 545{
 546	int err;
 547
 548	err = ovl_verify_fh(ofs, dentry, ox, fh);
 549	if (set && err == -ENODATA)
 550		err = ovl_setxattr(ofs, dentry, ox, fh->buf, fh->fb.len);
 551
 552	return err;
 553}
 554
 555/*
 556 * Verify that @real dentry matches the file handle stored in xattr @name.
 557 *
 558 * If @set is true and there is no stored file handle, encode @real and store
 559 * file handle in xattr @name.
 560 *
 561 * Return 0 on match, -ESTALE on mismatch, -ENODATA on no xattr, < 0 on error.
 562 */
 563int ovl_verify_origin_xattr(struct ovl_fs *ofs, struct dentry *dentry,
 564			    enum ovl_xattr ox, struct dentry *real,
 565			    bool is_upper, bool set)
 566{
 567	struct inode *inode;
 568	struct ovl_fh *fh;
 569	int err;
 570
 571	fh = ovl_encode_real_fh(ofs, d_inode(real), is_upper);
 572	err = PTR_ERR(fh);
 573	if (IS_ERR(fh)) {
 574		fh = NULL;
 575		goto fail;
 576	}
 577
 578	err = ovl_verify_set_fh(ofs, dentry, ox, fh, is_upper, set);
 579	if (err)
 580		goto fail;
 581
 582out:
 583	kfree(fh);
 584	return err;
 585
 586fail:
 587	inode = d_inode(real);
 588	pr_warn_ratelimited("failed to verify %s (%pd2, ino=%lu, err=%i)\n",
 589			    is_upper ? "upper" : "origin", real,
 590			    inode ? inode->i_ino : 0, err);
 591	goto out;
 592}
 593
 594
 595/* Get upper dentry from index */
 596struct dentry *ovl_index_upper(struct ovl_fs *ofs, struct dentry *index,
 597			       bool connected)
 598{
 599	struct ovl_fh *fh;
 600	struct dentry *upper;
 601
 602	if (!d_is_dir(index))
 603		return dget(index);
 604
 605	fh = ovl_get_fh(ofs, index, OVL_XATTR_UPPER);
 606	if (IS_ERR_OR_NULL(fh))
 607		return ERR_CAST(fh);
 608
 609	upper = ovl_decode_real_fh(ofs, fh, ovl_upper_mnt(ofs), connected);
 610	kfree(fh);
 611
 612	if (IS_ERR_OR_NULL(upper))
 613		return upper ?: ERR_PTR(-ESTALE);
 614
 615	if (!d_is_dir(upper)) {
 616		pr_warn_ratelimited("invalid index upper (%pd2, upper=%pd2).\n",
 617				    index, upper);
 618		dput(upper);
 619		return ERR_PTR(-EIO);
 620	}
 621
 622	return upper;
 623}
 624
 625/*
 626 * Verify that an index entry name matches the origin file handle stored in
 627 * OVL_XATTR_ORIGIN and that origin file handle can be decoded to lower path.
 628 * Return 0 on match, -ESTALE on mismatch or stale origin, < 0 on error.
 629 */
 630int ovl_verify_index(struct ovl_fs *ofs, struct dentry *index)
 631{
 632	struct ovl_fh *fh = NULL;
 633	size_t len;
 634	struct ovl_path origin = { };
 635	struct ovl_path *stack = &origin;
 636	struct dentry *upper = NULL;
 637	int err;
 638
 639	if (!d_inode(index))
 640		return 0;
 641
 642	err = -EINVAL;
 643	if (index->d_name.len < sizeof(struct ovl_fb)*2)
 644		goto fail;
 645
 646	err = -ENOMEM;
 647	len = index->d_name.len / 2;
 648	fh = kzalloc(len + OVL_FH_WIRE_OFFSET, GFP_KERNEL);
 649	if (!fh)
 650		goto fail;
 651
 652	err = -EINVAL;
 653	if (hex2bin(fh->buf, index->d_name.name, len))
 654		goto fail;
 655
 656	err = ovl_check_fb_len(&fh->fb, len);
 657	if (err)
 658		goto fail;
 659
 660	/*
 661	 * Whiteout index entries are used as an indication that an exported
 662	 * overlay file handle should be treated as stale (i.e. after unlink
 663	 * of the overlay inode). These entries contain no origin xattr.
 664	 */
 665	if (ovl_is_whiteout(index))
 666		goto out;
 667
 668	/*
 669	 * Verifying directory index entries are not stale is expensive, so
 670	 * only verify stale dir index if NFS export is enabled.
 671	 */
 672	if (d_is_dir(index) && !ofs->config.nfs_export)
 673		goto out;
 674
 675	/*
 676	 * Directory index entries should have 'upper' xattr pointing to the
 677	 * real upper dir. Non-dir index entries are hardlinks to the upper
 678	 * real inode. For non-dir index, we can read the copy up origin xattr
 679	 * directly from the index dentry, but for dir index we first need to
 680	 * decode the upper directory.
 681	 */
 682	upper = ovl_index_upper(ofs, index, false);
 683	if (IS_ERR_OR_NULL(upper)) {
 684		err = PTR_ERR(upper);
 685		/*
 686		 * Directory index entries with no 'upper' xattr need to be
 687		 * removed. When dir index entry has a stale 'upper' xattr,
 688		 * we assume that upper dir was removed and we treat the dir
 689		 * index as orphan entry that needs to be whited out.
 690		 */
 691		if (err == -ESTALE)
 692			goto orphan;
 693		else if (!err)
 694			err = -ESTALE;
 695		goto fail;
 696	}
 697
 698	err = ovl_verify_fh(ofs, upper, OVL_XATTR_ORIGIN, fh);
 699	dput(upper);
 700	if (err)
 701		goto fail;
 702
 703	/* Check if non-dir index is orphan and don't warn before cleaning it */
 704	if (!d_is_dir(index) && d_inode(index)->i_nlink == 1) {
 705		err = ovl_check_origin_fh(ofs, fh, false, index, &stack);
 706		if (err)
 707			goto fail;
 708
 709		if (ovl_get_nlink(ofs, origin.dentry, index, 0) == 0)
 710			goto orphan;
 711	}
 712
 713out:
 714	dput(origin.dentry);
 715	kfree(fh);
 716	return err;
 717
 718fail:
 719	pr_warn_ratelimited("failed to verify index (%pd2, ftype=%x, err=%i)\n",
 720			    index, d_inode(index)->i_mode & S_IFMT, err);
 721	goto out;
 722
 723orphan:
 724	pr_warn_ratelimited("orphan index entry (%pd2, ftype=%x, nlink=%u)\n",
 725			    index, d_inode(index)->i_mode & S_IFMT,
 726			    d_inode(index)->i_nlink);
 727	err = -ENOENT;
 728	goto out;
 729}
 730
 731int ovl_get_index_name_fh(const struct ovl_fh *fh, struct qstr *name)
 732{
 733	char *n, *s;
 734
 735	n = kcalloc(fh->fb.len, 2, GFP_KERNEL);
 736	if (!n)
 737		return -ENOMEM;
 738
 739	s  = bin2hex(n, fh->buf, fh->fb.len);
 740	*name = (struct qstr) QSTR_INIT(n, s - n);
 741
 742	return 0;
 743
 744}
 745
 746/*
 747 * Lookup in indexdir for the index entry of a lower real inode or a copy up
 748 * origin inode. The index entry name is the hex representation of the lower
 749 * inode file handle.
 750 *
 751 * If the index dentry in negative, then either no lower aliases have been
 752 * copied up yet, or aliases have been copied up in older kernels and are
 753 * not indexed.
 754 *
 755 * If the index dentry for a copy up origin inode is positive, but points
 756 * to an inode different than the upper inode, then either the upper inode
 757 * has been copied up and not indexed or it was indexed, but since then
 758 * index dir was cleared. Either way, that index cannot be used to identify
 759 * the overlay inode.
 760 */
 761int ovl_get_index_name(struct ovl_fs *ofs, struct dentry *origin,
 762		       struct qstr *name)
 763{
 764	struct ovl_fh *fh;
 765	int err;
 766
 767	fh = ovl_encode_real_fh(ofs, d_inode(origin), false);
 768	if (IS_ERR(fh))
 769		return PTR_ERR(fh);
 770
 771	err = ovl_get_index_name_fh(fh, name);
 772
 773	kfree(fh);
 774	return err;
 775}
 776
 777/* Lookup index by file handle for NFS export */
 778struct dentry *ovl_get_index_fh(struct ovl_fs *ofs, struct ovl_fh *fh)
 779{
 780	struct dentry *index;
 781	struct qstr name;
 782	int err;
 783
 784	err = ovl_get_index_name_fh(fh, &name);
 785	if (err)
 786		return ERR_PTR(err);
 787
 788	index = lookup_noperm_positive_unlocked(&name, ofs->workdir);
 789	kfree(name.name);
 790	if (IS_ERR(index)) {
 791		if (PTR_ERR(index) == -ENOENT)
 792			index = NULL;
 793		return index;
 794	}
 795
 796	if (ovl_is_whiteout(index))
 797		err = -ESTALE;
 798	else if (ovl_dentry_weird(index))
 799		err = -EIO;
 800	else
 801		return index;
 802
 803	dput(index);
 804	return ERR_PTR(err);
 805}
 806
 807struct dentry *ovl_lookup_index(struct ovl_fs *ofs, struct dentry *upper,
 808				struct dentry *origin, bool verify)
 809{
 810	struct dentry *index;
 811	struct inode *inode;
 812	struct qstr name;
 813	bool is_dir = d_is_dir(origin);
 814	int err;
 815
 816	err = ovl_get_index_name(ofs, origin, &name);
 817	if (err)
 818		return ERR_PTR(err);
 819
 820	index = lookup_one_positive_unlocked(ovl_upper_mnt_idmap(ofs), &name,
 821					     ofs->workdir);
 822	if (IS_ERR(index)) {
 823		err = PTR_ERR(index);
 824		if (err == -ENOENT) {
 825			index = NULL;
 826			goto out;
 827		}
 828		pr_warn_ratelimited("failed inode index lookup (ino=%lu, key=%.*s, err=%i);\n"
 829				    "overlayfs: mount with '-o index=off' to disable inodes index.\n",
 830				    d_inode(origin)->i_ino, name.len, name.name,
 831				    err);
 832		goto out;
 833	}
 834
 835	inode = d_inode(index);
 836	if (ovl_is_whiteout(index) && !verify) {
 837		/*
 838		 * When index lookup is called with !verify for decoding an
 839		 * overlay file handle, a whiteout index implies that decode
 840		 * should treat file handle as stale and no need to print a
 841		 * warning about it.
 842		 */
 843		dput(index);
 844		index = ERR_PTR(-ESTALE);
 845		goto out;
 846	} else if (ovl_dentry_weird(index) || ovl_is_whiteout(index) ||
 847		   inode_wrong_type(inode, d_inode(origin)->i_mode)) {
 848		/*
 849		 * Index should always be of the same file type as origin
 850		 * except for the case of a whiteout index. A whiteout
 851		 * index should only exist if all lower aliases have been
 852		 * unlinked, which means that finding a lower origin on lookup
 853		 * whose index is a whiteout should be treated as an error.
 854		 */
 855		pr_warn_ratelimited("bad index found (index=%pd2, ftype=%x, origin ftype=%x).\n",
 856				    index, d_inode(index)->i_mode & S_IFMT,
 857				    d_inode(origin)->i_mode & S_IFMT);
 858		goto fail;
 859	} else if (is_dir && verify) {
 860		if (!upper) {
 861			pr_warn_ratelimited("suspected uncovered redirected dir found (origin=%pd2, index=%pd2).\n",
 862					    origin, index);
 863			goto fail;
 864		}
 865
 866		/* Verify that dir index 'upper' xattr points to upper dir */
 867		err = ovl_verify_upper(ofs, index, upper, false);
 868		if (err) {
 869			if (err == -ESTALE) {
 870				pr_warn_ratelimited("suspected multiply redirected dir found (upper=%pd2, origin=%pd2, index=%pd2).\n",
 871						    upper, origin, index);
 872			}
 873			goto fail;
 874		}
 875	} else if (upper && d_inode(upper) != inode) {
 876		goto out_dput;
 877	}
 878out:
 879	kfree(name.name);
 880	return index;
 881
 882out_dput:
 883	dput(index);
 884	index = NULL;
 885	goto out;
 886
 887fail:
 888	dput(index);
 889	index = ERR_PTR(-EIO);
 890	goto out;
 891}
 892
 893/*
 894 * Returns next layer in stack starting from top.
 895 * Returns -1 if this is the last layer.
 896 */
 897int ovl_path_next(int idx, struct dentry *dentry, struct path *path,
 898		  const struct ovl_layer **layer)
 899{
 900	struct ovl_entry *oe = OVL_E(dentry);
 901	struct ovl_path *lowerstack = ovl_lowerstack(oe);
 902
 903	BUG_ON(idx < 0);
 904	if (idx == 0) {
 905		ovl_path_upper(dentry, path);
 906		if (path->dentry) {
 907			*layer = &OVL_FS(dentry->d_sb)->layers[0];
 908			return ovl_numlower(oe) ? 1 : -1;
 909		}
 910		idx++;
 911	}
 912	BUG_ON(idx > ovl_numlower(oe));
 913	path->dentry = lowerstack[idx - 1].dentry;
 914	*layer = lowerstack[idx - 1].layer;
 915	path->mnt = (*layer)->mnt;
 916
 917	return (idx < ovl_numlower(oe)) ? idx + 1 : -1;
 918}
 919
 920/* Fix missing 'origin' xattr */
 921static int ovl_fix_origin(struct ovl_fs *ofs, struct dentry *dentry,
 922			  struct dentry *lower, struct dentry *upper)
 923{
 924	const struct ovl_fh *fh;
 925	int err;
 926
 927	if (ovl_check_origin_xattr(ofs, upper))
 928		return 0;
 929
 930	fh = ovl_get_origin_fh(ofs, lower);
 931	if (IS_ERR(fh))
 932		return PTR_ERR(fh);
 933
 934	err = ovl_want_write(dentry);
 935	if (err)
 936		goto out;
 937
 938	err = ovl_set_origin_fh(ofs, fh, upper);
 939	if (!err)
 940		err = ovl_set_impure(dentry->d_parent, upper->d_parent);
 941
 942	ovl_drop_write(dentry);
 943out:
 944	kfree(fh);
 945	return err;
 946}
 947
 948static int ovl_maybe_validate_verity(struct dentry *dentry)
 949{
 950	struct ovl_fs *ofs = OVL_FS(dentry->d_sb);
 951	struct inode *inode = d_inode(dentry);
 952	struct path datapath, metapath;
 953	int err;
 954
 955	if (!ofs->config.verity_mode ||
 956	    !ovl_is_metacopy_dentry(dentry) ||
 957	    ovl_test_flag(OVL_VERIFIED_DIGEST, inode))
 958		return 0;
 959
 960	if (!ovl_test_flag(OVL_HAS_DIGEST, inode)) {
 961		if (ofs->config.verity_mode == OVL_VERITY_REQUIRE) {
 962			pr_warn_ratelimited("metacopy file '%pd' has no digest specified\n",
 963					    dentry);
 964			return -EIO;
 965		}
 966		return 0;
 967	}
 968
 969	ovl_path_lowerdata(dentry, &datapath);
 970	if (!datapath.dentry)
 971		return -EIO;
 972
 973	ovl_path_real(dentry, &metapath);
 974	if (!metapath.dentry)
 975		return -EIO;
 976
 977	err = ovl_inode_lock_interruptible(inode);
 978	if (err)
 979		return err;
 980
 981	if (!ovl_test_flag(OVL_VERIFIED_DIGEST, inode)) {
 982		with_ovl_creds(dentry->d_sb)
 983			err = ovl_validate_verity(ofs, &metapath, &datapath);
 984		if (err == 0)
 985			ovl_set_flag(OVL_VERIFIED_DIGEST, inode);
 986	}
 987
 988	ovl_inode_unlock(inode);
 989
 990	return err;
 991}
 992
 993/* Lazy lookup of lowerdata */
 994static int ovl_maybe_lookup_lowerdata(struct dentry *dentry)
 995{
 996	struct inode *inode = d_inode(dentry);
 997	const char *redirect = ovl_lowerdata_redirect(inode);
 998	struct ovl_path datapath = {};
 999	int err;
1000
1001	if (!redirect || ovl_dentry_lowerdata(dentry))
1002		return 0;
1003
1004	if (redirect[0] != '/')
1005		return -EIO;
1006
1007	err = ovl_inode_lock_interruptible(inode);
1008	if (err)
1009		return err;
1010
1011	err = 0;
1012	/* Someone got here before us? */
1013	if (ovl_dentry_lowerdata(dentry))
1014		goto out;
1015
1016	with_ovl_creds(dentry->d_sb)
1017		err = ovl_lookup_data_layers(dentry, redirect, &datapath);
1018	if (err)
1019		goto out_err;
1020
1021	err = ovl_dentry_set_lowerdata(dentry, &datapath);
1022	if (err)
1023		goto out_err;
1024
1025out:
1026	ovl_inode_unlock(inode);
1027	dput(datapath.dentry);
1028
1029	return err;
1030
1031out_err:
1032	pr_warn_ratelimited("lazy lowerdata lookup failed (%pd2, err=%i)\n",
1033			    dentry, err);
1034	goto out;
1035}
1036
1037int ovl_verify_lowerdata(struct dentry *dentry)
1038{
1039	int err;
1040
1041	err = ovl_maybe_lookup_lowerdata(dentry);
1042	if (err)
1043		return err;
1044
1045	return ovl_maybe_validate_verity(dentry);
1046}
1047
1048/*
1049 * Following redirects/metacopy can have security consequences: it's like a
1050 * symlink into the lower layer without the permission checks.
1051 *
1052 * This is only a problem if the upper layer is untrusted (e.g comes from an USB
1053 * drive).  This can allow a non-readable file or directory to become readable.
1054 *
1055 * Only following redirects when redirects are enabled disables this attack
1056 * vector when not necessary.
1057 */
1058static bool ovl_check_follow_redirect(struct ovl_lookup_data *d)
1059{
1060	struct ovl_fs *ofs = OVL_FS(d->sb);
1061
1062	if (d->metacopy && !ofs->config.metacopy) {
1063		pr_warn_ratelimited("refusing to follow metacopy origin for (%pd2)\n", d->dentry);
1064		return false;
1065	}
1066	if ((d->redirect || d->upperredirect) && !ovl_redirect_follow(ofs)) {
1067		pr_warn_ratelimited("refusing to follow redirect for (%pd2)\n", d->dentry);
1068		return false;
1069	}
1070	return true;
1071}
1072
1073struct ovl_lookup_ctx {
1074	struct dentry *dentry;
1075	struct ovl_entry *oe;
1076	struct ovl_path *stack;
1077	struct ovl_path *origin_path;
1078	struct dentry *upperdentry;
1079	struct dentry *index;
1080	struct inode *inode;
1081	unsigned int ctr;
1082};
1083
1084static int ovl_lookup_layers(struct ovl_lookup_ctx *ctx, struct ovl_lookup_data *d)
1085{
1086	struct dentry *dentry = ctx->dentry;
1087	struct ovl_fs *ofs = OVL_FS(dentry->d_sb);
1088	struct ovl_entry *poe = OVL_E(dentry->d_parent);
1089	struct ovl_entry *roe = OVL_E(dentry->d_sb->s_root);
1090	bool check_redirect = (ovl_redirect_follow(ofs) || ofs->numdatalayer);
1091	struct dentry *upperdir;
1092	struct dentry *this;
1093	struct dentry *origin = NULL;
1094	bool upperopaque = false;
1095	bool uppermetacopy = false;
1096	int metacopy_size = 0;
1097	unsigned int i;
1098	int err;
1099
1100	upperdir = ovl_dentry_upper(dentry->d_parent);
1101	if (upperdir) {
1102		d->layer = &ofs->layers[0];
1103		err = ovl_lookup_layer(upperdir, d, &ctx->upperdentry, true);
1104		if (err)
1105			return err;
1106
1107		if (ctx->upperdentry && ctx->upperdentry->d_flags & DCACHE_OP_REAL)
1108			return -EREMOTE;
1109
1110		if (ctx->upperdentry && !d->is_dir) {
1111			/*
1112			 * Lookup copy up origin by decoding origin file handle.
1113			 * We may get a disconnected dentry, which is fine,
1114			 * because we only need to hold the origin inode in
1115			 * cache and use its inode number.  We may even get a
1116			 * connected dentry, that is not under any of the lower
1117			 * layers root.  That is also fine for using it's inode
1118			 * number - it's the same as if we held a reference
1119			 * to a dentry in lower layer that was moved under us.
1120			 */
1121			err = ovl_check_origin(ofs, ctx->upperdentry, &ctx->origin_path);
1122			if (err)
1123				return err;
1124
1125			if (d->metacopy)
1126				uppermetacopy = true;
1127			metacopy_size = d->metacopy;
1128		}
1129
1130		if (d->redirect) {
1131			err = -ENOMEM;
1132			d->upperredirect = kstrdup(d->redirect, GFP_KERNEL);
1133			if (!d->upperredirect)
1134				return err;
1135			if (d->redirect[0] == '/')
1136				poe = roe;
1137		}
1138		upperopaque = d->opaque;
1139	}
1140
1141	if (!d->stop && ovl_numlower(poe)) {
1142		err = -ENOMEM;
1143		ctx->stack = ovl_stack_alloc(ofs->numlayer - 1);
1144		if (!ctx->stack)
1145			return err;
1146	}
1147
1148	for (i = 0; !d->stop && i < ovl_numlower(poe); i++) {
1149		struct ovl_path lower = ovl_lowerstack(poe)[i];
1150
1151		if (!ovl_check_follow_redirect(d)) {
1152			err = -EPERM;
1153			return err;
1154		}
1155
1156		if (!check_redirect)
1157			d->last = i == ovl_numlower(poe) - 1;
1158		else if (d->is_dir || !ofs->numdatalayer)
1159			d->last = lower.layer->idx == ovl_numlower(roe);
1160
1161		d->layer = lower.layer;
1162		err = ovl_lookup_layer(lower.dentry, d, &this, false);
1163		if (err)
1164			return err;
1165
1166		if (!this)
1167			continue;
1168
1169		/*
1170		 * If no origin fh is stored in upper of a merge dir, store fh
1171		 * of lower dir and set upper parent "impure".
1172		 */
1173		if (ctx->upperdentry && !ctx->ctr && !ofs->noxattr && d->is_dir) {
1174			err = ovl_fix_origin(ofs, dentry, this, ctx->upperdentry);
1175			if (err) {
1176				dput(this);
1177				return err;
1178			}
1179		}
1180
1181		/*
1182		 * When "verify_lower" feature is enabled, do not merge with a
1183		 * lower dir that does not match a stored origin xattr. In any
1184		 * case, only verified origin is used for index lookup.
1185		 *
1186		 * For non-dir dentry, if index=on, then ensure origin
1187		 * matches the dentry found using path based lookup,
1188		 * otherwise error out.
1189		 */
1190		if (ctx->upperdentry && !ctx->ctr &&
1191		    ((d->is_dir && ovl_verify_lower(dentry->d_sb)) ||
1192		     (!d->is_dir && ofs->config.index && ctx->origin_path))) {
1193			err = ovl_verify_origin(ofs, ctx->upperdentry, this, false);
1194			if (err) {
1195				dput(this);
1196				if (d->is_dir)
1197					break;
1198				return err;
1199			}
1200			origin = this;
1201		}
1202
1203		if (!ctx->upperdentry && !d->is_dir && !ctx->ctr && d->metacopy)
1204			metacopy_size = d->metacopy;
1205
1206		if (d->metacopy && ctx->ctr) {
1207			/*
1208			 * Do not store intermediate metacopy dentries in
1209			 * lower chain, except top most lower metacopy dentry.
1210			 * Continue the loop so that if there is an absolute
1211			 * redirect on this dentry, poe can be reset to roe.
1212			 */
1213			dput(this);
1214			this = NULL;
1215		} else {
1216			ctx->stack[ctx->ctr].dentry = this;
1217			ctx->stack[ctx->ctr].layer = lower.layer;
1218			ctx->ctr++;
1219		}
1220
1221		if (d->stop)
1222			break;
1223
1224		if (d->redirect && d->redirect[0] == '/' && poe != roe) {
1225			poe = roe;
1226			/* Find the current layer on the root dentry */
1227			i = lower.layer->idx - 1;
1228		}
1229	}
1230
1231	/*
1232	 * Defer lookup of lowerdata in data-only layers to first access.
1233	 * Don't require redirect=follow and metacopy=on in this case.
1234	 */
1235	if (d->metacopy && ctx->ctr && ofs->numdatalayer && d->absolute_redirect) {
1236		d->metacopy = 0;
1237		ctx->ctr++;
1238	} else if (!ovl_check_follow_redirect(d)) {
1239		err = -EPERM;
1240		return err;
1241	}
1242
1243	/*
1244	 * For regular non-metacopy upper dentries, there is no lower
1245	 * path based lookup, hence ctr will be zero. If a dentry is found
1246	 * using ORIGIN xattr on upper, install it in stack.
1247	 *
1248	 * For metacopy dentry, path based lookup will find lower dentries.
1249	 * Just make sure a corresponding data dentry has been found.
1250	 */
1251	if (d->metacopy || (uppermetacopy && !ctx->ctr)) {
1252		pr_warn_ratelimited("metacopy with no lower data found - abort lookup (%pd2)\n",
1253				    dentry);
1254		err = -EIO;
1255		return err;
1256	} else if (!d->is_dir && ctx->upperdentry && !ctx->ctr && ctx->origin_path) {
1257		if (WARN_ON(ctx->stack != NULL)) {
1258			err = -EIO;
1259			return err;
1260		}
1261		ctx->stack = ctx->origin_path;
1262		ctx->ctr = 1;
1263		origin = ctx->origin_path->dentry;
1264		ctx->origin_path = NULL;
1265	}
1266
1267	/*
1268	 * Always lookup index if there is no-upperdentry.
1269	 *
1270	 * For the case of upperdentry, we have set origin by now if it
1271	 * needed to be set. There are basically three cases.
1272	 *
1273	 * For directories, lookup index by lower inode and verify it matches
1274	 * upper inode. We only trust dir index if we verified that lower dir
1275	 * matches origin, otherwise dir index entries may be inconsistent
1276	 * and we ignore them.
1277	 *
1278	 * For regular upper, we already set origin if upper had ORIGIN
1279	 * xattr. There is no verification though as there is no path
1280	 * based dentry lookup in lower in this case.
1281	 *
1282	 * For metacopy upper, we set a verified origin already if index
1283	 * is enabled and if upper had an ORIGIN xattr.
1284	 *
1285	 */
1286	if (!ctx->upperdentry && ctx->ctr)
1287		origin = ctx->stack[0].dentry;
1288
1289	if (origin && ovl_indexdir(dentry->d_sb) &&
1290	    (!d->is_dir || ovl_index_all(dentry->d_sb))) {
1291		ctx->index = ovl_lookup_index(ofs, ctx->upperdentry, origin, true);
1292		if (IS_ERR(ctx->index)) {
1293			err = PTR_ERR(ctx->index);
1294			ctx->index = NULL;
1295			return err;
1296		}
1297	}
1298
1299	if (ctx->ctr) {
1300		ctx->oe = ovl_alloc_entry(ctx->ctr);
1301		err = -ENOMEM;
1302		if (!ctx->oe)
1303			return err;
1304
1305		ovl_stack_cpy(ovl_lowerstack(ctx->oe), ctx->stack, ctx->ctr);
1306	}
1307
1308	if (upperopaque)
1309		ovl_dentry_set_opaque(dentry);
1310	if (d->xwhiteouts)
1311		ovl_dentry_set_xwhiteouts(dentry);
1312
1313	if (ctx->upperdentry)
1314		ovl_dentry_set_upper_alias(dentry);
1315	else if (ctx->index) {
1316		char *upperredirect;
1317		struct path upperpath = {
1318			.dentry = ctx->upperdentry = dget(ctx->index),
1319			.mnt = ovl_upper_mnt(ofs),
1320		};
1321
1322		/*
1323		 * It's safe to assign upperredirect here: the previous
1324		 * assignment happens only if upperdentry is non-NULL, and
1325		 * this one only if upperdentry is NULL.
1326		 */
1327		upperredirect = ovl_get_redirect_xattr(ofs, &upperpath, 0);
1328		if (IS_ERR(upperredirect))
1329			return PTR_ERR(upperredirect);
1330		d->upperredirect = upperredirect;
1331
1332		err = ovl_check_metacopy_xattr(ofs, &upperpath, NULL);
1333		if (err < 0)
1334			return err;
1335		d->metacopy = uppermetacopy = err;
1336		metacopy_size = err;
1337
1338		if (!ovl_check_follow_redirect(d)) {
1339			err = -EPERM;
1340			return err;
1341		}
1342	}
1343
1344	if (ctx->upperdentry || ctx->ctr) {
1345		struct inode *inode;
1346		struct ovl_inode_params oip = {
1347			.upperdentry = ctx->upperdentry,
1348			.oe = ctx->oe,
1349			.index = ctx->index,
1350			.redirect = d->upperredirect,
1351		};
1352
1353		/* Store lowerdata redirect for lazy lookup */
1354		if (ctx->ctr > 1 && !d->is_dir && !ctx->stack[ctx->ctr - 1].dentry) {
1355			oip.lowerdata_redirect = d->redirect;
1356			d->redirect = NULL;
1357		}
1358
1359		inode = ovl_get_inode(dentry->d_sb, &oip);
1360		if (IS_ERR(inode))
1361			return PTR_ERR(inode);
1362
1363		ctx->inode = inode;
1364		if (ctx->upperdentry && !uppermetacopy)
1365			ovl_set_flag(OVL_UPPERDATA, ctx->inode);
1366
1367		if (metacopy_size > OVL_METACOPY_MIN_SIZE)
1368			ovl_set_flag(OVL_HAS_DIGEST, ctx->inode);
1369	}
1370
1371	ovl_dentry_init_reval(dentry, ctx->upperdentry, OVL_I_E(ctx->inode));
1372
1373	return 0;
1374}
1375
1376struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
1377			  unsigned int flags)
1378{
1379	struct ovl_fs *ofs = OVL_FS(dentry->d_sb);
1380	struct ovl_entry *poe = OVL_E(dentry->d_parent);
1381	bool check_redirect = (ovl_redirect_follow(ofs) || ofs->numdatalayer);
1382	int err;
1383	struct ovl_lookup_ctx ctx = {
1384		.dentry = dentry,
1385	};
1386	struct ovl_lookup_data d = {
1387		.sb	= dentry->d_sb,
1388		.dentry = dentry,
1389		.name	= dentry->d_name,
1390		.last	= check_redirect ? false : !ovl_numlower(poe),
1391	};
1392
1393	if (dentry->d_name.len > ofs->namelen)
1394		return ERR_PTR(-ENAMETOOLONG);
1395
1396	with_ovl_creds(dentry->d_sb)
1397		err = ovl_lookup_layers(&ctx, &d);
1398
1399	if (ctx.origin_path) {
1400		dput(ctx.origin_path->dentry);
1401		kfree(ctx.origin_path);
1402	}
1403	dput(ctx.index);
1404	ovl_stack_free(ctx.stack, ctx.ctr);
1405	kfree(d.redirect);
1406
1407	if (err) {
1408		ovl_free_entry(ctx.oe);
1409		dput(ctx.upperdentry);
1410		kfree(d.upperredirect);
1411		return ERR_PTR(err);
1412	}
1413
1414	return d_splice_alias(ctx.inode, dentry);
1415}
1416
1417bool ovl_lower_positive(struct dentry *dentry)
1418{
1419	struct ovl_entry *poe = OVL_E(dentry->d_parent);
1420	const struct qstr *name = &dentry->d_name;
1421	unsigned int i;
1422	bool positive = false;
1423	bool done = false;
1424
1425	/*
1426	 * If dentry is negative, then lower is positive iff this is a
1427	 * whiteout.
1428	 */
1429	if (!dentry->d_inode)
1430		return ovl_dentry_is_opaque(dentry);
1431
1432	/* Negative upper -> positive lower */
1433	if (!ovl_dentry_upper(dentry))
1434		return true;
1435
1436	with_ovl_creds(dentry->d_sb) {
1437		/* Positive upper -> have to look up lower to see whether it exists */
1438		for (i = 0; !done && !positive && i < ovl_numlower(poe); i++) {
1439			struct dentry *this;
1440			struct ovl_path *parentpath = &ovl_lowerstack(poe)[i];
1441
1442			/*
1443			 * We need to make a non-const copy of dentry->d_name,
1444			 * because lookup_one_positive_unlocked() will hash name
1445			 * with parentpath base, which is on another (lower fs).
1446			 */
1447			this = lookup_one_positive_unlocked(mnt_idmap(parentpath->layer->mnt),
1448							    &QSTR_LEN(name->name, name->len),
1449							    parentpath->dentry);
1450			if (IS_ERR(this)) {
1451				switch (PTR_ERR(this)) {
1452				case -ENOENT:
1453				case -ENAMETOOLONG:
1454					break;
1455
1456				default:
1457					/*
1458					 * Assume something is there, we just couldn't
1459					 * access it.
1460					 */
1461					positive = true;
1462					break;
1463				}
1464			} else {
1465				struct path path = {
1466					.dentry = this,
1467					.mnt	= parentpath->layer->mnt,
1468				};
1469				positive = !ovl_path_is_whiteout(OVL_FS(dentry->d_sb), &path);
1470				done = true;
1471				dput(this);
1472			}
1473		}
1474	}
1475
1476	return positive;
1477}