super.c

   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 *
   4 * Copyright (C) 2011 Novell Inc.
   5 */
   6
   7#include <uapi/linux/magic.h>
   8#include <linux/fs.h>
   9#include <linux/namei.h>
  10#include <linux/xattr.h>
  11#include <linux/mount.h>
  12#include <linux/parser.h>
  13#include <linux/module.h>
  14#include <linux/statfs.h>
  15#include <linux/seq_file.h>
  16#include <linux/posix_acl_xattr.h>
  17#include <linux/exportfs.h>
  18#include <linux/file.h>
  19#include <linux/fs_context.h>
  20#include <linux/fs_parser.h>
  21#include "overlayfs.h"
  22#include "params.h"
  23
  24MODULE_AUTHOR("Miklos Szeredi <miklos@szeredi.hu>");
  25MODULE_DESCRIPTION("Overlay filesystem");
  26MODULE_LICENSE("GPL");
  27
  28
  29struct ovl_dir_cache;
  30
  31static struct dentry *ovl_d_real(struct dentry *dentry, enum d_real_type type)
  32{
  33	struct dentry *upper, *lower;
  34	int err;
  35
  36	switch (type) {
  37	case D_REAL_DATA:
  38	case D_REAL_METADATA:
  39		break;
  40	default:
  41		goto bug;
  42	}
  43
  44	if (!d_is_reg(dentry)) {
  45		/* d_real_inode() is only relevant for regular files */
  46		return dentry;
  47	}
  48
  49	upper = ovl_dentry_upper(dentry);
  50	if (upper && (type == D_REAL_METADATA ||
  51		      ovl_has_upperdata(d_inode(dentry))))
  52		return upper;
  53
  54	if (type == D_REAL_METADATA) {
  55		lower = ovl_dentry_lower(dentry);
  56		goto real_lower;
  57	}
  58
  59	/*
  60	 * Best effort lazy lookup of lowerdata for D_REAL_DATA case to return
  61	 * the real lowerdata dentry.  The only current caller of d_real() with
  62	 * D_REAL_DATA is d_real_inode() from trace_uprobe and this caller is
  63	 * likely going to be followed reading from the file, before placing
  64	 * uprobes on offset within the file, so lowerdata should be available
  65	 * when setting the uprobe.
  66	 */
  67	err = ovl_verify_lowerdata(dentry);
  68	if (err)
  69		goto bug;
  70	lower = ovl_dentry_lowerdata(dentry);
  71	if (!lower)
  72		goto bug;
  73
  74real_lower:
  75	/* Handle recursion into stacked lower fs */
  76	return d_real(lower, type);
  77
  78bug:
  79	WARN(1, "%s(%pd4, %d): real dentry not found\n", __func__, dentry, type);
  80	return dentry;
  81}
  82
  83static int ovl_revalidate_real(struct dentry *d, unsigned int flags, bool weak)
  84{
  85	int ret = 1;
  86
  87	if (!d)
  88		return 1;
  89
  90	if (weak) {
  91		if (d->d_flags & DCACHE_OP_WEAK_REVALIDATE)
  92			ret =  d->d_op->d_weak_revalidate(d, flags);
  93	} else if (d->d_flags & DCACHE_OP_REVALIDATE) {
  94		struct dentry *parent;
  95		struct inode *dir;
  96		struct name_snapshot n;
  97
  98		if (flags & LOOKUP_RCU) {
  99			parent = READ_ONCE(d->d_parent);
 100			dir = d_inode_rcu(parent);
 101			if (!dir)
 102				return -ECHILD;
 103		} else {
 104			parent = dget_parent(d);
 105			dir = d_inode(parent);
 106		}
 107		take_dentry_name_snapshot(&n, d);
 108		ret = d->d_op->d_revalidate(dir, &n.name, d, flags);
 109		release_dentry_name_snapshot(&n);
 110		if (!(flags & LOOKUP_RCU))
 111			dput(parent);
 112		if (!ret) {
 113			if (!(flags & LOOKUP_RCU))
 114				d_invalidate(d);
 115			ret = -ESTALE;
 116		}
 117	}
 118	return ret;
 119}
 120
 121static int ovl_dentry_revalidate_common(struct dentry *dentry,
 122					unsigned int flags, bool weak)
 123{
 124	struct ovl_entry *oe;
 125	struct ovl_path *lowerstack;
 126	struct inode *inode = d_inode_rcu(dentry);
 127	struct dentry *upper;
 128	unsigned int i;
 129	int ret = 1;
 130
 131	if (!inode) {
 132		/*
 133		 * Lookup of negative dentries will call ovl_dentry_init_flags()
 134		 * with NULL upperdentry and NULL oe, resulting in the
 135		 * DCACHE_OP*_REVALIDATE flags being cleared.  Hence the only
 136		 * way to get a negative inode is due to a race with dentry
 137		 * destruction.
 138		 */
 139		WARN_ON(!(flags & LOOKUP_RCU));
 140		return -ECHILD;
 141	}
 142
 143	oe = OVL_I_E(inode);
 144	lowerstack = ovl_lowerstack(oe);
 145	upper = ovl_i_dentry_upper(inode);
 146	if (upper)
 147		ret = ovl_revalidate_real(upper, flags, weak);
 148
 149	for (i = 0; ret > 0 && i < ovl_numlower(oe); i++)
 150		ret = ovl_revalidate_real(lowerstack[i].dentry, flags, weak);
 151
 152	return ret;
 153}
 154
 155static int ovl_dentry_revalidate(struct inode *dir, const struct qstr *name,
 156				 struct dentry *dentry, unsigned int flags)
 157{
 158	return ovl_dentry_revalidate_common(dentry, flags, false);
 159}
 160
 161static int ovl_dentry_weak_revalidate(struct dentry *dentry, unsigned int flags)
 162{
 163	return ovl_dentry_revalidate_common(dentry, flags, true);
 164}
 165
 166static const struct dentry_operations ovl_dentry_operations = {
 167	.d_real = ovl_d_real,
 168	.d_revalidate = ovl_dentry_revalidate,
 169	.d_weak_revalidate = ovl_dentry_weak_revalidate,
 170};
 171
 172#if IS_ENABLED(CONFIG_UNICODE)
 173static const struct dentry_operations ovl_dentry_ci_operations = {
 174	.d_real = ovl_d_real,
 175	.d_revalidate = ovl_dentry_revalidate,
 176	.d_weak_revalidate = ovl_dentry_weak_revalidate,
 177	.d_hash = generic_ci_d_hash,
 178	.d_compare = generic_ci_d_compare,
 179};
 180#endif
 181
 182static struct kmem_cache *ovl_inode_cachep;
 183
 184static struct inode *ovl_alloc_inode(struct super_block *sb)
 185{
 186	struct ovl_inode *oi = alloc_inode_sb(sb, ovl_inode_cachep, GFP_KERNEL);
 187
 188	if (!oi)
 189		return NULL;
 190
 191	oi->cache = NULL;
 192	oi->redirect = NULL;
 193	oi->version = 0;
 194	oi->flags = 0;
 195	oi->__upperdentry = NULL;
 196	oi->lowerdata_redirect = NULL;
 197	oi->oe = NULL;
 198	mutex_init(&oi->lock);
 199
 200	return &oi->vfs_inode;
 201}
 202
 203static void ovl_free_inode(struct inode *inode)
 204{
 205	struct ovl_inode *oi = OVL_I(inode);
 206
 207	kfree(oi->redirect);
 208	kfree(oi->oe);
 209	mutex_destroy(&oi->lock);
 210	kmem_cache_free(ovl_inode_cachep, oi);
 211}
 212
 213static void ovl_destroy_inode(struct inode *inode)
 214{
 215	struct ovl_inode *oi = OVL_I(inode);
 216
 217	dput(oi->__upperdentry);
 218	ovl_stack_put(ovl_lowerstack(oi->oe), ovl_numlower(oi->oe));
 219	if (S_ISDIR(inode->i_mode))
 220		ovl_dir_cache_free(inode);
 221	else
 222		kfree(oi->lowerdata_redirect);
 223}
 224
 225static void ovl_put_super(struct super_block *sb)
 226{
 227	struct ovl_fs *ofs = OVL_FS(sb);
 228
 229	if (ofs)
 230		ovl_free_fs(ofs);
 231}
 232
 233/* Sync real dirty inodes in upper filesystem (if it exists) */
 234static int ovl_sync_fs(struct super_block *sb, int wait)
 235{
 236	struct ovl_fs *ofs = OVL_FS(sb);
 237	struct super_block *upper_sb;
 238	int ret;
 239
 240	ret = ovl_sync_status(ofs);
 241
 242	if (ret < 0)
 243		return -EIO;
 244
 245	if (!ret)
 246		return ret;
 247
 248	/*
 249	 * Not called for sync(2) call or an emergency sync (SB_I_SKIP_SYNC).
 250	 * All the super blocks will be iterated, including upper_sb.
 251	 *
 252	 * If this is a syncfs(2) call, then we do need to call
 253	 * sync_filesystem() on upper_sb, but enough if we do it when being
 254	 * called with wait == 1.
 255	 */
 256	if (!wait)
 257		return 0;
 258
 259	upper_sb = ovl_upper_mnt(ofs)->mnt_sb;
 260
 261	down_read(&upper_sb->s_umount);
 262	ret = sync_filesystem(upper_sb);
 263	up_read(&upper_sb->s_umount);
 264
 265	return ret;
 266}
 267
 268/**
 269 * ovl_statfs
 270 * @dentry: The dentry to query
 271 * @buf: The struct kstatfs to fill in with stats
 272 *
 273 * Get the filesystem statistics.  As writes always target the upper layer
 274 * filesystem pass the statfs to the upper filesystem (if it exists)
 275 */
 276static int ovl_statfs(struct dentry *dentry, struct kstatfs *buf)
 277{
 278	struct super_block *sb = dentry->d_sb;
 279	struct ovl_fs *ofs = OVL_FS(sb);
 280	struct dentry *root_dentry = sb->s_root;
 281	struct path path;
 282	int err;
 283
 284	ovl_path_real(root_dentry, &path);
 285
 286	err = vfs_statfs(&path, buf);
 287	if (!err) {
 288		buf->f_namelen = ofs->namelen;
 289		buf->f_type = OVERLAYFS_SUPER_MAGIC;
 290		if (ovl_has_fsid(ofs))
 291			buf->f_fsid = uuid_to_fsid(sb->s_uuid.b);
 292	}
 293
 294	return err;
 295}
 296
 297static const struct super_operations ovl_super_operations = {
 298	.alloc_inode	= ovl_alloc_inode,
 299	.free_inode	= ovl_free_inode,
 300	.destroy_inode	= ovl_destroy_inode,
 301	.drop_inode	= inode_just_drop,
 302	.put_super	= ovl_put_super,
 303	.sync_fs	= ovl_sync_fs,
 304	.statfs		= ovl_statfs,
 305	.show_options	= ovl_show_options,
 306};
 307
 308#define OVL_WORKDIR_NAME "work"
 309#define OVL_INDEXDIR_NAME "index"
 310
 311static struct dentry *ovl_workdir_create(struct ovl_fs *ofs,
 312					 const char *name, bool persist)
 313{
 314	struct inode *dir =  ofs->workbasedir->d_inode;
 315	struct vfsmount *mnt = ovl_upper_mnt(ofs);
 316	struct dentry *work;
 317	int err;
 318	bool retried = false;
 319
 320retry:
 321	work = ovl_start_creating_upper(ofs, ofs->workbasedir, &QSTR(name));
 322
 323	if (!IS_ERR(work)) {
 324		struct iattr attr = {
 325			.ia_valid = ATTR_MODE,
 326			.ia_mode = S_IFDIR | 0,
 327		};
 328
 329		if (work->d_inode) {
 330			end_creating_keep(work);
 331			if (persist)
 332				return work;
 333			err = -EEXIST;
 334			if (retried)
 335				goto out_dput;
 336			retried = true;
 337			err = ovl_workdir_cleanup(ofs, ofs->workbasedir, mnt, work, 0);
 338			dput(work);
 339			if (err == -EINVAL)
 340				return ERR_PTR(err);
 341
 342			goto retry;
 343		}
 344
 345		work = ovl_do_mkdir(ofs, dir, work, attr.ia_mode);
 346		end_creating_keep(work);
 347		err = PTR_ERR(work);
 348		if (IS_ERR(work))
 349			goto out_err;
 350
 351		/* Weird filesystem returning with hashed negative (kernfs)? */
 352		err = -EINVAL;
 353		if (d_really_is_negative(work))
 354			goto out_dput;
 355
 356		/*
 357		 * Try to remove POSIX ACL xattrs from workdir.  We are good if:
 358		 *
 359		 * a) success (there was a POSIX ACL xattr and was removed)
 360		 * b) -ENODATA (there was no POSIX ACL xattr)
 361		 * c) -EOPNOTSUPP (POSIX ACL xattrs are not supported)
 362		 *
 363		 * There are various other error values that could effectively
 364		 * mean that the xattr doesn't exist (e.g. -ERANGE is returned
 365		 * if the xattr name is too long), but the set of filesystems
 366		 * allowed as upper are limited to "normal" ones, where checking
 367		 * for the above two errors is sufficient.
 368		 */
 369		err = ovl_do_remove_acl(ofs, work, XATTR_NAME_POSIX_ACL_DEFAULT);
 370		if (err && err != -ENODATA && err != -EOPNOTSUPP)
 371			goto out_dput;
 372
 373		err = ovl_do_remove_acl(ofs, work, XATTR_NAME_POSIX_ACL_ACCESS);
 374		if (err && err != -ENODATA && err != -EOPNOTSUPP)
 375			goto out_dput;
 376
 377		/* Clear any inherited mode bits */
 378		inode_lock(work->d_inode);
 379		err = ovl_do_notify_change(ofs, work, &attr);
 380		inode_unlock(work->d_inode);
 381		if (err)
 382			goto out_dput;
 383	} else {
 384		err = PTR_ERR(work);
 385		goto out_err;
 386	}
 387	return work;
 388
 389out_dput:
 390	dput(work);
 391out_err:
 392	pr_warn("failed to create directory %s/%s (errno: %i); mounting read-only\n",
 393		ofs->config.workdir, name, -err);
 394	return NULL;
 395}
 396
 397static int ovl_check_namelen(const struct path *path, struct ovl_fs *ofs,
 398			     const char *name)
 399{
 400	struct kstatfs statfs;
 401	int err = vfs_statfs(path, &statfs);
 402
 403	if (err)
 404		pr_err("statfs failed on '%s'\n", name);
 405	else
 406		ofs->namelen = max(ofs->namelen, statfs.f_namelen);
 407
 408	return err;
 409}
 410
 411static int ovl_lower_dir(const char *name, const struct path *path,
 412			 struct ovl_fs *ofs, int *stack_depth)
 413{
 414	int fh_type;
 415	int err;
 416
 417	err = ovl_check_namelen(path, ofs, name);
 418	if (err)
 419		return err;
 420
 421	*stack_depth = max(*stack_depth, path->mnt->mnt_sb->s_stack_depth);
 422
 423	/*
 424	 * The inodes index feature and NFS export need to encode and decode
 425	 * file handles, so they require that all layers support them.
 426	 */
 427	fh_type = ovl_can_decode_fh(path->dentry->d_sb);
 428	if ((ofs->config.nfs_export ||
 429	     (ofs->config.index && ofs->config.upperdir)) && !fh_type) {
 430		ofs->config.index = false;
 431		ofs->config.nfs_export = false;
 432		pr_warn("fs on '%s' does not support file handles, falling back to index=off,nfs_export=off.\n",
 433			name);
 434	}
 435	ofs->nofh |= !fh_type;
 436	/*
 437	 * Decoding origin file handle is required for persistent st_ino.
 438	 * Without persistent st_ino, xino=auto falls back to xino=off.
 439	 */
 440	if (ofs->config.xino == OVL_XINO_AUTO &&
 441	    ofs->config.upperdir && !fh_type) {
 442		ofs->config.xino = OVL_XINO_OFF;
 443		pr_warn("fs on '%s' does not support file handles, falling back to xino=off.\n",
 444			name);
 445	}
 446
 447	/* Check if lower fs has 32bit inode numbers */
 448	if (fh_type != FILEID_INO32_GEN)
 449		ofs->xino_mode = -1;
 450
 451	return 0;
 452}
 453
 454/* Workdir should not be subdir of upperdir and vice versa */
 455static bool ovl_workdir_ok(struct dentry *workdir, struct dentry *upperdir)
 456{
 457	bool ok = false;
 458
 459	if (workdir != upperdir) {
 460		struct dentry *trap = lock_rename(workdir, upperdir);
 461		if (!IS_ERR(trap))
 462			unlock_rename(workdir, upperdir);
 463		ok = (trap == NULL);
 464	}
 465	return ok;
 466}
 467
 468static int ovl_setup_trap(struct super_block *sb, struct dentry *dir,
 469			  struct inode **ptrap, const char *name)
 470{
 471	struct inode *trap;
 472	int err;
 473
 474	trap = ovl_get_trap_inode(sb, dir);
 475	err = PTR_ERR_OR_ZERO(trap);
 476	if (err) {
 477		if (err == -ELOOP)
 478			pr_err("conflicting %s path\n", name);
 479		return err;
 480	}
 481
 482	*ptrap = trap;
 483	return 0;
 484}
 485
 486/*
 487 * Determine how we treat concurrent use of upperdir/workdir based on the
 488 * index feature. This is papering over mount leaks of container runtimes,
 489 * for example, an old overlay mount is leaked and now its upperdir is
 490 * attempted to be used as a lower layer in a new overlay mount.
 491 */
 492static int ovl_report_in_use(struct ovl_fs *ofs, const char *name)
 493{
 494	if (ofs->config.index) {
 495		pr_err("%s is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.\n",
 496		       name);
 497		return -EBUSY;
 498	} else {
 499		pr_warn("%s is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior.\n",
 500			name);
 501		return 0;
 502	}
 503}
 504
 505static int ovl_get_upper(struct super_block *sb, struct ovl_fs *ofs,
 506			 struct ovl_layer *upper_layer,
 507			 const struct path *upperpath)
 508{
 509	struct vfsmount *upper_mnt;
 510	int err;
 511
 512	/* Upperdir path should not be r/o */
 513	if (__mnt_is_readonly(upperpath->mnt)) {
 514		pr_err("upper fs is r/o, try multi-lower layers mount\n");
 515		err = -EINVAL;
 516		goto out;
 517	}
 518
 519	err = ovl_check_namelen(upperpath, ofs, ofs->config.upperdir);
 520	if (err)
 521		goto out;
 522
 523	err = ovl_setup_trap(sb, upperpath->dentry, &upper_layer->trap,
 524			     "upperdir");
 525	if (err)
 526		goto out;
 527
 528	upper_mnt = clone_private_mount(upperpath);
 529	err = PTR_ERR(upper_mnt);
 530	if (IS_ERR(upper_mnt)) {
 531		pr_err("failed to clone upperpath\n");
 532		goto out;
 533	}
 534
 535	/* Don't inherit atime flags */
 536	upper_mnt->mnt_flags &= ~(MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME);
 537	upper_layer->mnt = upper_mnt;
 538	upper_layer->idx = 0;
 539	upper_layer->fsid = 0;
 540
 541	/*
 542	 * Inherit SB_NOSEC flag from upperdir.
 543	 *
 544	 * This optimization changes behavior when a security related attribute
 545	 * (suid/sgid/security.*) is changed on an underlying layer.  This is
 546	 * okay because we don't yet have guarantees in that case, but it will
 547	 * need careful treatment once we want to honour changes to underlying
 548	 * filesystems.
 549	 */
 550	if (upper_mnt->mnt_sb->s_flags & SB_NOSEC)
 551		sb->s_flags |= SB_NOSEC;
 552
 553	if (ovl_inuse_trylock(ovl_upper_mnt(ofs)->mnt_root)) {
 554		ofs->upperdir_locked = true;
 555	} else {
 556		err = ovl_report_in_use(ofs, "upperdir");
 557		if (err)
 558			goto out;
 559	}
 560
 561	err = 0;
 562out:
 563	return err;
 564}
 565
 566/*
 567 * Returns 1 if RENAME_WHITEOUT is supported, 0 if not supported and
 568 * negative values if error is encountered.
 569 */
 570static int ovl_check_rename_whiteout(struct ovl_fs *ofs)
 571{
 572	struct dentry *workdir = ofs->workdir;
 573	struct dentry *temp;
 574	struct dentry *whiteout;
 575	struct name_snapshot name;
 576	struct renamedata rd = {};
 577	char name2[OVL_TEMPNAME_SIZE];
 578	int err;
 579
 580	temp = ovl_create_temp(ofs, workdir, OVL_CATTR(S_IFREG | 0));
 581	err = PTR_ERR(temp);
 582	if (IS_ERR(temp))
 583		return err;
 584
 585	rd.mnt_idmap = ovl_upper_mnt_idmap(ofs);
 586	rd.old_parent = workdir;
 587	rd.new_parent = workdir;
 588	rd.flags = RENAME_WHITEOUT;
 589	ovl_tempname(name2);
 590	err = start_renaming_dentry(&rd, 0, temp, &QSTR(name2));
 591	if (err) {
 592		dput(temp);
 593		return err;
 594	}
 595
 596	/* Name is inline and stable - using snapshot as a copy helper */
 597	take_dentry_name_snapshot(&name, temp);
 598	err = ovl_do_rename_rd(&rd);
 599	end_renaming(&rd);
 600	if (err) {
 601		if (err == -EINVAL)
 602			err = 0;
 603		goto cleanup_temp;
 604	}
 605
 606	whiteout = ovl_lookup_upper_unlocked(ofs, name.name.name,
 607					     workdir, name.name.len);
 608	err = PTR_ERR(whiteout);
 609	if (IS_ERR(whiteout))
 610		goto cleanup_temp;
 611
 612	err = ovl_upper_is_whiteout(ofs, whiteout);
 613
 614	/* Best effort cleanup of whiteout and temp file */
 615	if (err)
 616		ovl_cleanup(ofs, workdir, whiteout);
 617	dput(whiteout);
 618
 619cleanup_temp:
 620	ovl_cleanup(ofs, workdir, temp);
 621	release_dentry_name_snapshot(&name);
 622	dput(temp);
 623
 624	return err;
 625}
 626
 627static struct dentry *ovl_lookup_or_create(struct ovl_fs *ofs,
 628					   struct dentry *parent,
 629					   const char *name, umode_t mode)
 630{
 631	struct dentry *child;
 632
 633	child = ovl_start_creating_upper(ofs, parent, &QSTR(name));
 634	if (!IS_ERR(child)) {
 635		if (!child->d_inode)
 636			child = ovl_create_real(ofs, parent, child,
 637						OVL_CATTR(mode));
 638		end_creating_keep(child);
 639	}
 640	dput(parent);
 641
 642	return child;
 643}
 644
 645/*
 646 * Creates $workdir/work/incompat/volatile/dirty file if it is not already
 647 * present.
 648 */
 649static int ovl_create_volatile_dirty(struct ovl_fs *ofs)
 650{
 651	unsigned int ctr;
 652	struct dentry *d = dget(ofs->workbasedir);
 653	static const char *const volatile_path[] = {
 654		OVL_WORKDIR_NAME, "incompat", "volatile", "dirty"
 655	};
 656	const char *const *name = volatile_path;
 657
 658	for (ctr = ARRAY_SIZE(volatile_path); ctr; ctr--, name++) {
 659		d = ovl_lookup_or_create(ofs, d, *name, ctr > 1 ? S_IFDIR : S_IFREG);
 660		if (IS_ERR(d))
 661			return PTR_ERR(d);
 662	}
 663	dput(d);
 664	return 0;
 665}
 666
 667static int ovl_make_workdir(struct super_block *sb, struct ovl_fs *ofs,
 668			    const struct path *workpath)
 669{
 670	struct vfsmount *mnt = ovl_upper_mnt(ofs);
 671	struct dentry *workdir;
 672	struct file *tmpfile;
 673	bool rename_whiteout;
 674	bool d_type;
 675	int fh_type;
 676	int err;
 677
 678	err = mnt_want_write(mnt);
 679	if (err)
 680		return err;
 681
 682	workdir = ovl_workdir_create(ofs, OVL_WORKDIR_NAME, false);
 683	err = PTR_ERR(workdir);
 684	if (IS_ERR_OR_NULL(workdir))
 685		goto out;
 686
 687	ofs->workdir = workdir;
 688
 689	err = ovl_setup_trap(sb, ofs->workdir, &ofs->workdir_trap, "workdir");
 690	if (err)
 691		goto out;
 692
 693	/*
 694	 * Upper should support d_type, else whiteouts are visible.  Given
 695	 * workdir and upper are on same fs, we can do iterate_dir() on
 696	 * workdir. This check requires successful creation of workdir in
 697	 * previous step.
 698	 */
 699	err = ovl_check_d_type_supported(workpath);
 700	if (err < 0)
 701		goto out;
 702
 703	d_type = err;
 704	if (!d_type)
 705		pr_warn("upper fs needs to support d_type.\n");
 706
 707	/* Check if upper/work fs supports O_TMPFILE */
 708	tmpfile = ovl_do_tmpfile(ofs, ofs->workdir, S_IFREG | 0);
 709	ofs->tmpfile = !IS_ERR(tmpfile);
 710	if (ofs->tmpfile)
 711		fput(tmpfile);
 712	else
 713		pr_warn("upper fs does not support tmpfile.\n");
 714
 715
 716	/* Check if upper/work fs supports RENAME_WHITEOUT */
 717	err = ovl_check_rename_whiteout(ofs);
 718	if (err < 0)
 719		goto out;
 720
 721	rename_whiteout = err;
 722	if (!rename_whiteout)
 723		pr_warn("upper fs does not support RENAME_WHITEOUT.\n");
 724
 725	/*
 726	 * Check if upper/work fs supports (trusted|user).overlay.* xattr
 727	 */
 728	err = ovl_setxattr(ofs, ofs->workdir, OVL_XATTR_OPAQUE, "0", 1);
 729	if (err) {
 730		pr_warn("failed to set xattr on upper\n");
 731		ofs->noxattr = true;
 732		if (ovl_redirect_follow(ofs)) {
 733			ofs->config.redirect_mode = OVL_REDIRECT_NOFOLLOW;
 734			pr_warn("...falling back to redirect_dir=nofollow.\n");
 735		}
 736		if (ofs->config.metacopy) {
 737			ofs->config.metacopy = false;
 738			pr_warn("...falling back to metacopy=off.\n");
 739		}
 740		if (ofs->config.index) {
 741			ofs->config.index = false;
 742			pr_warn("...falling back to index=off.\n");
 743		}
 744		if (ovl_has_fsid(ofs)) {
 745			ofs->config.uuid = OVL_UUID_NULL;
 746			pr_warn("...falling back to uuid=null.\n");
 747		}
 748		/*
 749		 * xattr support is required for persistent st_ino.
 750		 * Without persistent st_ino, xino=auto falls back to xino=off.
 751		 */
 752		if (ofs->config.xino == OVL_XINO_AUTO) {
 753			ofs->config.xino = OVL_XINO_OFF;
 754			pr_warn("...falling back to xino=off.\n");
 755		}
 756		if (err == -EPERM && !ofs->config.userxattr)
 757			pr_info("try mounting with 'userxattr' option\n");
 758		err = 0;
 759	} else {
 760		ovl_removexattr(ofs, ofs->workdir, OVL_XATTR_OPAQUE);
 761	}
 762
 763	/*
 764	 * We allowed sub-optimal upper fs configuration and don't want to break
 765	 * users over kernel upgrade, but we never allowed remote upper fs, so
 766	 * we can enforce strict requirements for remote upper fs.
 767	 */
 768	if (ovl_dentry_remote(ofs->workdir) &&
 769	    (!d_type || !rename_whiteout || ofs->noxattr)) {
 770		pr_err("upper fs missing required features.\n");
 771		err = -EINVAL;
 772		goto out;
 773	}
 774
 775	/*
 776	 * For volatile mount, create a incompat/volatile/dirty file to keep
 777	 * track of it.
 778	 */
 779	if (ovl_is_volatile(&ofs->config)) {
 780		err = ovl_create_volatile_dirty(ofs);
 781		if (err < 0) {
 782			pr_err("Failed to create volatile/dirty file.\n");
 783			goto out;
 784		}
 785	}
 786
 787	/* Check if upper/work fs supports file handles */
 788	fh_type = ovl_can_decode_fh(ofs->workdir->d_sb);
 789	if (ofs->config.index && !fh_type) {
 790		ofs->config.index = false;
 791		pr_warn("upper fs does not support file handles, falling back to index=off.\n");
 792	}
 793	ofs->nofh |= !fh_type;
 794
 795	/* Check if upper fs has 32bit inode numbers */
 796	if (fh_type != FILEID_INO32_GEN)
 797		ofs->xino_mode = -1;
 798
 799	/* NFS export of r/w mount depends on index */
 800	if (ofs->config.nfs_export && !ofs->config.index) {
 801		pr_warn("NFS export requires \"index=on\", falling back to nfs_export=off.\n");
 802		ofs->config.nfs_export = false;
 803	}
 804out:
 805	mnt_drop_write(mnt);
 806	return err;
 807}
 808
 809static int ovl_get_workdir(struct super_block *sb, struct ovl_fs *ofs,
 810			   const struct path *upperpath,
 811			   const struct path *workpath)
 812{
 813	int err;
 814
 815	err = -EINVAL;
 816	if (upperpath->mnt != workpath->mnt) {
 817		pr_err("workdir and upperdir must reside under the same mount\n");
 818		return err;
 819	}
 820	if (!ovl_workdir_ok(workpath->dentry, upperpath->dentry)) {
 821		pr_err("workdir and upperdir must be separate subtrees\n");
 822		return err;
 823	}
 824
 825	ofs->workbasedir = dget(workpath->dentry);
 826
 827	if (ovl_inuse_trylock(ofs->workbasedir)) {
 828		ofs->workdir_locked = true;
 829	} else {
 830		err = ovl_report_in_use(ofs, "workdir");
 831		if (err)
 832			return err;
 833	}
 834
 835	err = ovl_setup_trap(sb, ofs->workbasedir, &ofs->workbasedir_trap,
 836			     "workdir");
 837	if (err)
 838		return err;
 839
 840	return ovl_make_workdir(sb, ofs, workpath);
 841}
 842
 843static int ovl_get_indexdir(struct super_block *sb, struct ovl_fs *ofs,
 844			    struct ovl_entry *oe, const struct path *upperpath)
 845{
 846	struct vfsmount *mnt = ovl_upper_mnt(ofs);
 847	struct dentry *indexdir;
 848	struct dentry *origin = ovl_lowerstack(oe)->dentry;
 849	const struct ovl_fh *fh;
 850	int err;
 851
 852	fh = ovl_get_origin_fh(ofs, origin);
 853	if (IS_ERR(fh))
 854		return PTR_ERR(fh);
 855
 856	err = mnt_want_write(mnt);
 857	if (err)
 858		goto out_free_fh;
 859
 860	/* Verify lower root is upper root origin */
 861	err = ovl_verify_origin_fh(ofs, upperpath->dentry, fh, true);
 862	if (err) {
 863		pr_err("failed to verify upper root origin\n");
 864		goto out;
 865	}
 866
 867	/* index dir will act also as workdir */
 868	iput(ofs->workdir_trap);
 869	ofs->workdir_trap = NULL;
 870	dput(ofs->workdir);
 871	ofs->workdir = NULL;
 872	indexdir = ovl_workdir_create(ofs, OVL_INDEXDIR_NAME, true);
 873	if (IS_ERR(indexdir)) {
 874		err = PTR_ERR(indexdir);
 875	} else if (indexdir) {
 876		ofs->workdir = indexdir;
 877		err = ovl_setup_trap(sb, indexdir, &ofs->workdir_trap,
 878				     "indexdir");
 879		if (err)
 880			goto out;
 881
 882		/*
 883		 * Verify upper root is exclusively associated with index dir.
 884		 * Older kernels stored upper fh in ".overlay.origin"
 885		 * xattr. If that xattr exists, verify that it is a match to
 886		 * upper dir file handle. In any case, verify or set xattr
 887		 * ".overlay.upper" to indicate that index may have
 888		 * directory entries.
 889		 */
 890		if (ovl_check_origin_xattr(ofs, indexdir)) {
 891			err = ovl_verify_origin_xattr(ofs, indexdir,
 892						      OVL_XATTR_ORIGIN,
 893						      upperpath->dentry, true,
 894						      false);
 895			if (err)
 896				pr_err("failed to verify index dir 'origin' xattr\n");
 897		}
 898		err = ovl_verify_upper(ofs, indexdir, upperpath->dentry, true);
 899		if (err)
 900			pr_err("failed to verify index dir 'upper' xattr\n");
 901
 902		/* Cleanup bad/stale/orphan index entries */
 903		if (!err)
 904			err = ovl_indexdir_cleanup(ofs);
 905	}
 906	if (err || !indexdir)
 907		pr_warn("try deleting index dir or mounting with '-o index=off' to disable inodes index.\n");
 908
 909out:
 910	mnt_drop_write(mnt);
 911out_free_fh:
 912	kfree(fh);
 913	return err;
 914}
 915
 916static bool ovl_lower_uuid_ok(struct ovl_fs *ofs, const uuid_t *uuid)
 917{
 918	unsigned int i;
 919
 920	if (!ofs->config.nfs_export && !ovl_upper_mnt(ofs))
 921		return true;
 922
 923	/*
 924	 * We allow using single lower with null uuid for index and nfs_export
 925	 * for example to support those features with single lower squashfs.
 926	 * To avoid regressions in setups of overlay with re-formatted lower
 927	 * squashfs, do not allow decoding origin with lower null uuid unless
 928	 * user opted-in to one of the new features that require following the
 929	 * lower inode of non-dir upper.
 930	 */
 931	if (ovl_allow_offline_changes(ofs) && uuid_is_null(uuid))
 932		return false;
 933
 934	for (i = 0; i < ofs->numfs; i++) {
 935		/*
 936		 * We use uuid to associate an overlay lower file handle with a
 937		 * lower layer, so we can accept lower fs with null uuid as long
 938		 * as all lower layers with null uuid are on the same fs.
 939		 * if we detect multiple lower fs with the same uuid, we
 940		 * disable lower file handle decoding on all of them.
 941		 */
 942		if (ofs->fs[i].is_lower &&
 943		    uuid_equal(&ofs->fs[i].sb->s_uuid, uuid)) {
 944			ofs->fs[i].bad_uuid = true;
 945			return false;
 946		}
 947	}
 948	return true;
 949}
 950
 951/* Get a unique fsid for the layer */
 952static int ovl_get_fsid(struct ovl_fs *ofs, const struct path *path)
 953{
 954	struct super_block *sb = path->mnt->mnt_sb;
 955	unsigned int i;
 956	dev_t dev;
 957	int err;
 958	bool bad_uuid = false;
 959	bool warn = false;
 960
 961	for (i = 0; i < ofs->numfs; i++) {
 962		if (ofs->fs[i].sb == sb)
 963			return i;
 964	}
 965
 966	if (!ovl_lower_uuid_ok(ofs, &sb->s_uuid)) {
 967		bad_uuid = true;
 968		if (ofs->config.xino == OVL_XINO_AUTO) {
 969			ofs->config.xino = OVL_XINO_OFF;
 970			warn = true;
 971		}
 972		if (ofs->config.index || ofs->config.nfs_export) {
 973			ofs->config.index = false;
 974			ofs->config.nfs_export = false;
 975			warn = true;
 976		}
 977		if (warn) {
 978			pr_warn("%s uuid detected in lower fs '%pd2', falling back to xino=%s,index=off,nfs_export=off.\n",
 979				uuid_is_null(&sb->s_uuid) ? "null" :
 980							    "conflicting",
 981				path->dentry, ovl_xino_mode(&ofs->config));
 982		}
 983	}
 984
 985	err = get_anon_bdev(&dev);
 986	if (err) {
 987		pr_err("failed to get anonymous bdev for lowerpath\n");
 988		return err;
 989	}
 990
 991	ofs->fs[ofs->numfs].sb = sb;
 992	ofs->fs[ofs->numfs].pseudo_dev = dev;
 993	ofs->fs[ofs->numfs].bad_uuid = bad_uuid;
 994
 995	return ofs->numfs++;
 996}
 997
 998/*
 999 * The fsid after the last lower fsid is used for the data layers.
1000 * It is a "null fs" with a null sb, null uuid, and no pseudo dev.
1001 */
1002static int ovl_get_data_fsid(struct ovl_fs *ofs)
1003{
1004	return ofs->numfs;
1005}
1006
1007/*
1008 * Set the ovl sb encoding as the same one used by the first layer
1009 */
1010static int ovl_set_encoding(struct super_block *sb, struct super_block *fs_sb)
1011{
1012	if (!sb_has_encoding(fs_sb))
1013		return 0;
1014
1015#if IS_ENABLED(CONFIG_UNICODE)
1016	if (sb_has_strict_encoding(fs_sb)) {
1017		pr_err("strict encoding not supported\n");
1018		return -EINVAL;
1019	}
1020
1021	sb->s_encoding = fs_sb->s_encoding;
1022	sb->s_encoding_flags = fs_sb->s_encoding_flags;
1023#endif
1024	return 0;
1025}
1026
1027static int ovl_get_layers(struct super_block *sb, struct ovl_fs *ofs,
1028			  struct ovl_fs_context *ctx, struct ovl_layer *layers)
1029{
1030	int err;
1031	unsigned int i;
1032	size_t nr_merged_lower;
1033
1034	ofs->fs = kcalloc(ctx->nr + 2, sizeof(struct ovl_sb), GFP_KERNEL);
1035	if (ofs->fs == NULL)
1036		return -ENOMEM;
1037
1038	/*
1039	 * idx/fsid 0 are reserved for upper fs even with lower only overlay
1040	 * and the last fsid is reserved for "null fs" of the data layers.
1041	 */
1042	ofs->numfs++;
1043
1044	/*
1045	 * All lower layers that share the same fs as upper layer, use the same
1046	 * pseudo_dev as upper layer.  Allocate fs[0].pseudo_dev even for lower
1047	 * only overlay to simplify ovl_fs_free().
1048	 * is_lower will be set if upper fs is shared with a lower layer.
1049	 */
1050	err = get_anon_bdev(&ofs->fs[0].pseudo_dev);
1051	if (err) {
1052		pr_err("failed to get anonymous bdev for upper fs\n");
1053		return err;
1054	}
1055
1056	if (ovl_upper_mnt(ofs)) {
1057		ofs->fs[0].sb = ovl_upper_mnt(ofs)->mnt_sb;
1058		ofs->fs[0].is_lower = false;
1059
1060		if (ofs->casefold) {
1061			err = ovl_set_encoding(sb, ofs->fs[0].sb);
1062			if (err)
1063				return err;
1064		}
1065	}
1066
1067	nr_merged_lower = ctx->nr - ctx->nr_data;
1068	for (i = 0; i < ctx->nr; i++) {
1069		struct ovl_fs_context_layer *l = &ctx->lower[i];
1070		struct vfsmount *mnt;
1071		struct inode *trap;
1072		int fsid;
1073
1074		if (i < nr_merged_lower)
1075			fsid = ovl_get_fsid(ofs, &l->path);
1076		else
1077			fsid = ovl_get_data_fsid(ofs);
1078		if (fsid < 0)
1079			return fsid;
1080
1081		/*
1082		 * Check if lower root conflicts with this overlay layers before
1083		 * checking if it is in-use as upperdir/workdir of "another"
1084		 * mount, because we do not bother to check in ovl_is_inuse() if
1085		 * the upperdir/workdir is in fact in-use by our
1086		 * upperdir/workdir.
1087		 */
1088		err = ovl_setup_trap(sb, l->path.dentry, &trap, "lowerdir");
1089		if (err)
1090			return err;
1091
1092		if (ovl_is_inuse(l->path.dentry)) {
1093			err = ovl_report_in_use(ofs, "lowerdir");
1094			if (err) {
1095				iput(trap);
1096				return err;
1097			}
1098		}
1099
1100		mnt = clone_private_mount(&l->path);
1101		err = PTR_ERR(mnt);
1102		if (IS_ERR(mnt)) {
1103			pr_err("failed to clone lowerpath\n");
1104			iput(trap);
1105			return err;
1106		}
1107
1108		/*
1109		 * Make lower layers R/O.  That way fchmod/fchown on lower file
1110		 * will fail instead of modifying lower fs.
1111		 */
1112		mnt->mnt_flags |= MNT_READONLY | MNT_NOATIME;
1113
1114		layers[ofs->numlayer].trap = trap;
1115		layers[ofs->numlayer].mnt = mnt;
1116		layers[ofs->numlayer].idx = ofs->numlayer;
1117		layers[ofs->numlayer].fsid = fsid;
1118		layers[ofs->numlayer].fs = &ofs->fs[fsid];
1119		/* Store for printing lowerdir=... in ovl_show_options() */
1120		ofs->config.lowerdirs[ofs->numlayer] = l->name;
1121		l->name = NULL;
1122		ofs->numlayer++;
1123		ofs->fs[fsid].is_lower = true;
1124
1125		if (ofs->casefold) {
1126			if (!ovl_upper_mnt(ofs) && !sb_has_encoding(sb)) {
1127				err = ovl_set_encoding(sb, ofs->fs[fsid].sb);
1128				if (err)
1129					return err;
1130			}
1131
1132			if (!sb_same_encoding(sb, mnt->mnt_sb)) {
1133				pr_err("all layers must have the same encoding\n");
1134				return -EINVAL;
1135			}
1136		}
1137	}
1138
1139	/*
1140	 * When all layers on same fs, overlay can use real inode numbers.
1141	 * With mount option "xino=<on|auto>", mounter declares that there are
1142	 * enough free high bits in underlying fs to hold the unique fsid.
1143	 * If overlayfs does encounter underlying inodes using the high xino
1144	 * bits reserved for fsid, it emits a warning and uses the original
1145	 * inode number or a non persistent inode number allocated from a
1146	 * dedicated range.
1147	 */
1148	if (ofs->numfs - !ovl_upper_mnt(ofs) == 1) {
1149		if (ofs->config.xino == OVL_XINO_ON)
1150			pr_info("\"xino=on\" is useless with all layers on same fs, ignore.\n");
1151		ofs->xino_mode = 0;
1152	} else if (ofs->config.xino == OVL_XINO_OFF) {
1153		ofs->xino_mode = -1;
1154	} else if (ofs->xino_mode < 0) {
1155		/*
1156		 * This is a roundup of number of bits needed for encoding
1157		 * fsid, where fsid 0 is reserved for upper fs (even with
1158		 * lower only overlay) +1 extra bit is reserved for the non
1159		 * persistent inode number range that is used for resolving
1160		 * xino lower bits overflow.
1161		 */
1162		BUILD_BUG_ON(ilog2(OVL_MAX_STACK) > 30);
1163		ofs->xino_mode = ilog2(ofs->numfs - 1) + 2;
1164	}
1165
1166	if (ofs->xino_mode > 0) {
1167		pr_info("\"xino\" feature enabled using %d upper inode bits.\n",
1168			ofs->xino_mode);
1169	}
1170
1171	return 0;
1172}
1173
1174static struct ovl_entry *ovl_get_lowerstack(struct super_block *sb,
1175					    struct ovl_fs_context *ctx,
1176					    struct ovl_fs *ofs,
1177					    struct ovl_layer *layers)
1178{
1179	int err;
1180	unsigned int i;
1181	size_t nr_merged_lower;
1182	struct ovl_entry *oe;
1183	struct ovl_path *lowerstack;
1184
1185	struct ovl_fs_context_layer *l;
1186
1187	if (!ofs->config.upperdir && ctx->nr == 1) {
1188		pr_err("at least 2 lowerdir are needed while upperdir nonexistent\n");
1189		return ERR_PTR(-EINVAL);
1190	}
1191
1192	if (ctx->nr == ctx->nr_data) {
1193		pr_err("at least one non-data lowerdir is required\n");
1194		return ERR_PTR(-EINVAL);
1195	}
1196
1197	err = -EINVAL;
1198	for (i = 0; i < ctx->nr; i++) {
1199		l = &ctx->lower[i];
1200
1201		err = ovl_lower_dir(l->name, &l->path, ofs, &sb->s_stack_depth);
1202		if (err)
1203			return ERR_PTR(err);
1204	}
1205
1206	err = -EINVAL;
1207	sb->s_stack_depth++;
1208	if (sb->s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) {
1209		pr_err("maximum fs stacking depth exceeded\n");
1210		return ERR_PTR(err);
1211	}
1212
1213	err = ovl_get_layers(sb, ofs, ctx, layers);
1214	if (err)
1215		return ERR_PTR(err);
1216
1217	err = -ENOMEM;
1218	/* Data-only layers are not merged in root directory */
1219	nr_merged_lower = ctx->nr - ctx->nr_data;
1220	oe = ovl_alloc_entry(nr_merged_lower);
1221	if (!oe)
1222		return ERR_PTR(err);
1223
1224	lowerstack = ovl_lowerstack(oe);
1225	for (i = 0; i < nr_merged_lower; i++) {
1226		l = &ctx->lower[i];
1227		lowerstack[i].dentry = dget(l->path.dentry);
1228		lowerstack[i].layer = &ofs->layers[i + 1];
1229	}
1230	ofs->numdatalayer = ctx->nr_data;
1231
1232	return oe;
1233}
1234
1235/*
1236 * Check if this layer root is a descendant of:
1237 * - another layer of this overlayfs instance
1238 * - upper/work dir of any overlayfs instance
1239 */
1240static int ovl_check_layer(struct super_block *sb, struct ovl_fs *ofs,
1241			   struct dentry *dentry, const char *name,
1242			   bool is_lower)
1243{
1244	struct dentry *next = dentry, *parent;
1245	int err = 0;
1246
1247	if (!dentry)
1248		return 0;
1249
1250	parent = dget_parent(next);
1251
1252	/* Walk back ancestors to root (inclusive) looking for traps */
1253	while (!err && parent != next) {
1254		if (is_lower && ovl_lookup_trap_inode(sb, parent)) {
1255			err = -ELOOP;
1256			pr_err("overlapping %s path\n", name);
1257		} else if (ovl_is_inuse(parent)) {
1258			err = ovl_report_in_use(ofs, name);
1259		}
1260		next = parent;
1261		parent = dget_parent(next);
1262		dput(next);
1263	}
1264
1265	dput(parent);
1266
1267	return err;
1268}
1269
1270/*
1271 * Check if any of the layers or work dirs overlap.
1272 */
1273static int ovl_check_overlapping_layers(struct super_block *sb,
1274					struct ovl_fs *ofs)
1275{
1276	int i, err;
1277
1278	if (ovl_upper_mnt(ofs)) {
1279		err = ovl_check_layer(sb, ofs, ovl_upper_mnt(ofs)->mnt_root,
1280				      "upperdir", false);
1281		if (err)
1282			return err;
1283
1284		/*
1285		 * Checking workbasedir avoids hitting ovl_is_inuse(parent) of
1286		 * this instance and covers overlapping work and index dirs,
1287		 * unless work or index dir have been moved since created inside
1288		 * workbasedir.  In that case, we already have their traps in
1289		 * inode cache and we will catch that case on lookup.
1290		 */
1291		err = ovl_check_layer(sb, ofs, ofs->workbasedir, "workdir",
1292				      false);
1293		if (err)
1294			return err;
1295	}
1296
1297	for (i = 1; i < ofs->numlayer; i++) {
1298		err = ovl_check_layer(sb, ofs,
1299				      ofs->layers[i].mnt->mnt_root,
1300				      "lowerdir", true);
1301		if (err)
1302			return err;
1303	}
1304
1305	return 0;
1306}
1307
1308static struct dentry *ovl_get_root(struct super_block *sb,
1309				   struct dentry *upperdentry,
1310				   struct ovl_entry *oe)
1311{
1312	struct dentry *root;
1313	struct ovl_fs *ofs = OVL_FS(sb);
1314	struct ovl_path *lowerpath = ovl_lowerstack(oe);
1315	unsigned long ino = d_inode(lowerpath->dentry)->i_ino;
1316	int fsid = lowerpath->layer->fsid;
1317	struct ovl_inode_params oip = {
1318		.upperdentry = upperdentry,
1319		.oe = oe,
1320	};
1321
1322	root = d_make_root(ovl_new_inode(sb, S_IFDIR, 0));
1323	if (!root)
1324		return NULL;
1325
1326	if (upperdentry) {
1327		/* Root inode uses upper st_ino/i_ino */
1328		ino = d_inode(upperdentry)->i_ino;
1329		fsid = 0;
1330		ovl_dentry_set_upper_alias(root);
1331		if (ovl_is_impuredir(sb, upperdentry))
1332			ovl_set_flag(OVL_IMPURE, d_inode(root));
1333	}
1334
1335	/* Look for xwhiteouts marker except in the lowermost layer */
1336	for (int i = 0; i < ovl_numlower(oe) - 1; i++, lowerpath++) {
1337		struct path path = {
1338			.mnt = lowerpath->layer->mnt,
1339			.dentry = lowerpath->dentry,
1340		};
1341
1342		/* overlay.opaque=x means xwhiteouts directory */
1343		if (ovl_get_opaquedir_val(ofs, &path) == 'x') {
1344			ovl_layer_set_xwhiteouts(ofs, lowerpath->layer);
1345			ovl_dentry_set_xwhiteouts(root);
1346		}
1347	}
1348
1349	/* Root is always merge -> can have whiteouts */
1350	ovl_set_flag(OVL_WHITEOUTS, d_inode(root));
1351	ovl_dentry_set_flag(OVL_E_CONNECTED, root);
1352	ovl_set_upperdata(d_inode(root));
1353	ovl_inode_init(d_inode(root), &oip, ino, fsid);
1354	WARN_ON(!!IS_CASEFOLDED(d_inode(root)) != ofs->casefold);
1355	ovl_dentry_init_flags(root, upperdentry, oe, DCACHE_OP_WEAK_REVALIDATE);
1356	/* root keeps a reference of upperdentry */
1357	dget(upperdentry);
1358
1359	return root;
1360}
1361
1362static void ovl_set_d_op(struct super_block *sb)
1363{
1364#if IS_ENABLED(CONFIG_UNICODE)
1365	struct ovl_fs *ofs = sb->s_fs_info;
1366
1367	if (ofs->casefold) {
1368		set_default_d_op(sb, &ovl_dentry_ci_operations);
1369		return;
1370	}
1371#endif
1372	set_default_d_op(sb, &ovl_dentry_operations);
1373}
1374
1375static int ovl_fill_super_creds(struct fs_context *fc, struct super_block *sb)
1376{
1377	struct ovl_fs *ofs = sb->s_fs_info;
1378	struct cred *creator_cred = (struct cred *)ofs->creator_cred;
1379	struct ovl_fs_context *ctx = fc->fs_private;
1380	struct ovl_layer *layers;
1381	struct ovl_entry *oe = NULL;
1382	int err;
1383
1384	err = ovl_fs_params_verify(ctx, &ofs->config);
1385	if (err)
1386		return err;
1387
1388	err = -EINVAL;
1389	if (ctx->nr == 0) {
1390		if (!(fc->sb_flags & SB_SILENT))
1391			pr_err("missing 'lowerdir'\n");
1392		return err;
1393	}
1394
1395	err = -ENOMEM;
1396	layers = kcalloc(ctx->nr + 1, sizeof(struct ovl_layer), GFP_KERNEL);
1397	if (!layers)
1398		return err;
1399
1400	ofs->config.lowerdirs = kcalloc(ctx->nr + 1, sizeof(char *), GFP_KERNEL);
1401	if (!ofs->config.lowerdirs) {
1402		kfree(layers);
1403		return err;
1404	}
1405	ofs->layers = layers;
1406	/*
1407	 * Layer 0 is reserved for upper even if there's no upper.
1408	 * config.lowerdirs[0] is used for storing the user provided colon
1409	 * separated lowerdir string.
1410	 */
1411	ofs->config.lowerdirs[0] = ctx->lowerdir_all;
1412	ctx->lowerdir_all = NULL;
1413	ofs->numlayer = 1;
1414
1415	sb->s_stack_depth = 0;
1416	sb->s_maxbytes = MAX_LFS_FILESIZE;
1417	atomic_long_set(&ofs->last_ino, 1);
1418	/* Assume underlying fs uses 32bit inodes unless proven otherwise */
1419	if (ofs->config.xino != OVL_XINO_OFF) {
1420		ofs->xino_mode = BITS_PER_LONG - 32;
1421		if (!ofs->xino_mode) {
1422			pr_warn("xino not supported on 32bit kernel, falling back to xino=off.\n");
1423			ofs->config.xino = OVL_XINO_OFF;
1424		}
1425	}
1426
1427	/* alloc/destroy_inode needed for setting up traps in inode cache */
1428	sb->s_op = &ovl_super_operations;
1429
1430	if (ofs->config.upperdir) {
1431		struct super_block *upper_sb;
1432
1433		err = -EINVAL;
1434		if (!ofs->config.workdir) {
1435			pr_err("missing 'workdir'\n");
1436			return err;
1437		}
1438
1439		err = ovl_get_upper(sb, ofs, &layers[0], &ctx->upper);
1440		if (err)
1441			return err;
1442
1443		upper_sb = ovl_upper_mnt(ofs)->mnt_sb;
1444		if (!ovl_should_sync(ofs)) {
1445			ofs->errseq = errseq_sample(&upper_sb->s_wb_err);
1446			if (errseq_check(&upper_sb->s_wb_err, ofs->errseq)) {
1447				err = -EIO;
1448				pr_err("Cannot mount volatile when upperdir has an unseen error. Sync upperdir fs to clear state.\n");
1449				return err;
1450			}
1451		}
1452
1453		err = ovl_get_workdir(sb, ofs, &ctx->upper, &ctx->work);
1454		if (err)
1455			return err;
1456
1457		if (!ofs->workdir)
1458			sb->s_flags |= SB_RDONLY;
1459
1460		sb->s_stack_depth = upper_sb->s_stack_depth;
1461		sb->s_time_gran = upper_sb->s_time_gran;
1462	}
1463	oe = ovl_get_lowerstack(sb, ctx, ofs, layers);
1464	err = PTR_ERR(oe);
1465	if (IS_ERR(oe))
1466		return err;
1467
1468	/* If the upper fs is nonexistent, we mark overlayfs r/o too */
1469	if (!ovl_upper_mnt(ofs))
1470		sb->s_flags |= SB_RDONLY;
1471
1472	if (!ovl_origin_uuid(ofs) && ofs->numfs > 1) {
1473		pr_warn("The uuid=off requires a single fs for lower and upper, falling back to uuid=null.\n");
1474		ofs->config.uuid = OVL_UUID_NULL;
1475	} else if (ovl_has_fsid(ofs) && ovl_upper_mnt(ofs)) {
1476		/* Use per instance persistent uuid/fsid */
1477		ovl_init_uuid_xattr(sb, ofs, &ctx->upper);
1478	}
1479
1480	if (!ovl_force_readonly(ofs) && ofs->config.index) {
1481		err = ovl_get_indexdir(sb, ofs, oe, &ctx->upper);
1482		if (err)
1483			goto out_free_oe;
1484
1485		/* Force r/o mount with no index dir */
1486		if (!ofs->workdir)
1487			sb->s_flags |= SB_RDONLY;
1488	}
1489
1490	err = ovl_check_overlapping_layers(sb, ofs);
1491	if (err)
1492		goto out_free_oe;
1493
1494	/* Show index=off in /proc/mounts for forced r/o mount */
1495	if (!ofs->workdir) {
1496		ofs->config.index = false;
1497		if (ovl_upper_mnt(ofs) && ofs->config.nfs_export) {
1498			pr_warn("NFS export requires an index dir, falling back to nfs_export=off.\n");
1499			ofs->config.nfs_export = false;
1500		}
1501	}
1502
1503	if (ofs->config.metacopy && ofs->config.nfs_export) {
1504		pr_warn("NFS export is not supported with metadata only copy up, falling back to nfs_export=off.\n");
1505		ofs->config.nfs_export = false;
1506	}
1507
1508	/*
1509	 * Support encoding decodable file handles with nfs_export=on
1510	 * and encoding non-decodable file handles with nfs_export=off
1511	 * if all layers support file handles.
1512	 */
1513	if (ofs->config.nfs_export)
1514		sb->s_export_op = &ovl_export_operations;
1515	else if (!ofs->nofh)
1516		sb->s_export_op = &ovl_export_fid_operations;
1517
1518	/* Never override disk quota limits or use reserved space */
1519	cap_lower(creator_cred->cap_effective, CAP_SYS_RESOURCE);
1520
1521	sb->s_magic = OVERLAYFS_SUPER_MAGIC;
1522	sb->s_xattr = ovl_xattr_handlers(ofs);
1523	sb->s_fs_info = ofs;
1524#ifdef CONFIG_FS_POSIX_ACL
1525	sb->s_flags |= SB_POSIXACL;
1526#endif
1527	sb->s_iflags |= SB_I_SKIP_SYNC;
1528	/*
1529	 * Ensure that umask handling is done by the filesystems used
1530	 * for the the upper layer instead of overlayfs as that would
1531	 * lead to unexpected results.
1532	 */
1533	sb->s_iflags |= SB_I_NOUMASK;
1534	sb->s_iflags |= SB_I_EVM_HMAC_UNSUPPORTED;
1535
1536	err = -ENOMEM;
1537	sb->s_root = ovl_get_root(sb, ctx->upper.dentry, oe);
1538	if (!sb->s_root)
1539		goto out_free_oe;
1540
1541	return 0;
1542
1543out_free_oe:
1544	ovl_free_entry(oe);
1545	return err;
1546}
1547
1548int ovl_fill_super(struct super_block *sb, struct fs_context *fc)
1549{
1550	struct ovl_fs *ofs = sb->s_fs_info;
1551	int err;
1552
1553	err = -EIO;
1554	if (WARN_ON(fc->user_ns != current_user_ns()))
1555		goto out_err;
1556
1557	ovl_set_d_op(sb);
1558
1559	if (!ofs->creator_cred) {
1560		err = -ENOMEM;
1561		ofs->creator_cred = prepare_creds();
1562		if (!ofs->creator_cred)
1563			goto out_err;
1564	}
1565
1566	with_ovl_creds(sb)
1567		err = ovl_fill_super_creds(fc, sb);
1568
1569out_err:
1570	if (err) {
1571		ovl_free_fs(ofs);
1572		sb->s_fs_info = NULL;
1573	}
1574
1575	return err;
1576}
1577
1578struct file_system_type ovl_fs_type = {
1579	.owner			= THIS_MODULE,
1580	.name			= "overlay",
1581	.init_fs_context	= ovl_init_fs_context,
1582	.parameters		= ovl_parameter_spec,
1583	.fs_flags		= FS_USERNS_MOUNT,
1584	.kill_sb		= kill_anon_super,
1585};
1586MODULE_ALIAS_FS("overlay");
1587
1588static void ovl_inode_init_once(void *foo)
1589{
1590	struct ovl_inode *oi = foo;
1591
1592	inode_init_once(&oi->vfs_inode);
1593}
1594
1595static int __init ovl_init(void)
1596{
1597	int err;
1598
1599	ovl_inode_cachep = kmem_cache_create("ovl_inode",
1600					     sizeof(struct ovl_inode), 0,
1601					     (SLAB_RECLAIM_ACCOUNT|
1602					      SLAB_ACCOUNT),
1603					     ovl_inode_init_once);
1604	if (ovl_inode_cachep == NULL)
1605		return -ENOMEM;
1606
1607	err = register_filesystem(&ovl_fs_type);
1608	if (!err)
1609		return 0;
1610
1611	kmem_cache_destroy(ovl_inode_cachep);
1612
1613	return err;
1614}
1615
1616static void __exit ovl_exit(void)
1617{
1618	unregister_filesystem(&ovl_fs_type);
1619
1620	/*
1621	 * Make sure all delayed rcu free inodes are flushed before we
1622	 * destroy cache.
1623	 */
1624	rcu_barrier();
1625	kmem_cache_destroy(ovl_inode_cachep);
1626}
1627
1628module_init(ovl_init);
1629module_exit(ovl_exit);