Orange Pi5 kernel

/* SPDX-License-Identifier: GPL-2.0 */
#include <linux/syscalls.h>
#include <linux/export.h>
#include <linux/uaccess.h>
#include <linux/fs_struct.h>
#include <linux/fs.h>
#include <linux/slab.h>
#include <linux/prefetch.h>
#include "mount.h"
 
static int prepend(char **buffer, int *buflen, const char *str, int namelen)
{
<------>*buflen -= namelen;
<------>if (*buflen < 0)
<------><------>return -ENAMETOOLONG;
<------>*buffer -= namelen;
<------>memcpy(*buffer, str, namelen);
<------>return 0;
}
 
/**
 * prepend_name - prepend a pathname in front of current buffer pointer
 * @buffer: buffer pointer
 * @buflen: allocated length of the buffer
 * @name:   name string and length qstr structure
 *
 * With RCU path tracing, it may race with d_move(). Use READ_ONCE() to
 * make sure that either the old or the new name pointer and length are
 * fetched. However, there may be mismatch between length and pointer.
 * The length cannot be trusted, we need to copy it byte-by-byte until
 * the length is reached or a null byte is found. It also prepends "/" at
 * the beginning of the name. The sequence number check at the caller will
 * retry it again when a d_move() does happen. So any garbage in the buffer
 * due to mismatched pointer and length will be discarded.
 *
 * Load acquire is needed to make sure that we see that terminating NUL.
 */
static int prepend_name(char **buffer, int *buflen, const struct qstr *name)
{
<------>const char *dname = smp_load_acquire(&name->name); /* ^^^ */
<------>u32 dlen = READ_ONCE(name->len);
<------>char *p;
 
<------>*buflen -= dlen + 1;
<------>if (*buflen < 0)
<------><------>return -ENAMETOOLONG;
<------>p = *buffer -= dlen + 1;
<------>*p++ = '/';
<------>while (dlen--) {
<------><------>char c = *dname++;
<------><------>if (!c)
<------><------><------>break;
<------><------>*p++ = c;
<------>}
<------>return 0;
}
 
/**
 * prepend_path - Prepend path string to a buffer
 * @path: the dentry/vfsmount to report
 * @root: root vfsmnt/dentry
 * @buffer: pointer to the end of the buffer
 * @buflen: pointer to buffer length
 *
 * The function will first try to write out the pathname without taking any
 * lock other than the RCU read lock to make sure that dentries won't go away.
 * It only checks the sequence number of the global rename_lock as any change
 * in the dentry's d_seq will be preceded by changes in the rename_lock
 * sequence number. If the sequence number had been changed, it will restart
 * the whole pathname back-tracing sequence again by taking the rename_lock.
 * In this case, there is no need to take the RCU read lock as the recursive
 * parent pointer references will keep the dentry chain alive as long as no
 * rename operation is performed.
 */
static int prepend_path(const struct path *path,
<------><------><------>const struct path *root,
<------><------><------>char **buffer, int *buflen)
{
<------>struct dentry *dentry;
<------>struct vfsmount *vfsmnt;
<------>struct mount *mnt;
<------>int error = 0;
<------>unsigned seq, m_seq = 0;
<------>char *bptr;
<------>int blen;
 
<------>rcu_read_lock();
restart_mnt:
<------>read_seqbegin_or_lock(&mount_lock, &m_seq);
<------>seq = 0;
<------>rcu_read_lock();
restart:
<------>bptr = *buffer;
<------>blen = *buflen;
<------>error = 0;
<------>dentry = path->dentry;
<------>vfsmnt = path->mnt;
<------>mnt = real_mount(vfsmnt);
<------>read_seqbegin_or_lock(&rename_lock, &seq);
<------>while (dentry != root->dentry || vfsmnt != root->mnt) {
<------><------>struct dentry * parent;
 
<------><------>if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
<------><------><------>struct mount *parent = READ_ONCE(mnt->mnt_parent);
<------><------><------>struct mnt_namespace *mnt_ns;
 
<------><------><------>/* Escaped? */
<------><------><------>if (dentry != vfsmnt->mnt_root) {
<------><------><------><------>bptr = *buffer;
<------><------><------><------>blen = *buflen;
<------><------><------><------>error = 3;
<------><------><------><------>break;
<------><------><------>}
<------><------><------>/* Global root? */
<------><------><------>if (mnt != parent) {
<------><------><------><------>dentry = READ_ONCE(mnt->mnt_mountpoint);
<------><------><------><------>mnt = parent;
<------><------><------><------>vfsmnt = &mnt->mnt;
<------><------><------><------>continue;
<------><------><------>}
<------><------><------>mnt_ns = READ_ONCE(mnt->mnt_ns);
<------><------><------>/* open-coded is_mounted() to use local mnt_ns */
<------><------><------>if (!IS_ERR_OR_NULL(mnt_ns) && !is_anon_ns(mnt_ns))
<------><------><------><------>error = 1;	// absolute root
<------><------><------>else
<------><------><------><------>error = 2;	// detached or not attached yet
<------><------><------>break;
<------><------>}
<------><------>parent = dentry->d_parent;
<------><------>prefetch(parent);
<------><------>error = prepend_name(&bptr, &blen, &dentry->d_name);
<------><------>if (error)
<------><------><------>break;
 
<------><------>dentry = parent;
<------>}
<------>if (!(seq & 1))
<------><------>rcu_read_unlock();
<------>if (need_seqretry(&rename_lock, seq)) {
<------><------>seq = 1;
<------><------>goto restart;
<------>}
<------>done_seqretry(&rename_lock, seq);
 
<------>if (!(m_seq & 1))
<------><------>rcu_read_unlock();
<------>if (need_seqretry(&mount_lock, m_seq)) {
<------><------>m_seq = 1;
<------><------>goto restart_mnt;
<------>}
<------>done_seqretry(&mount_lock, m_seq);
 
<------>if (error >= 0 && bptr == *buffer) {
<------><------>if (--blen < 0)
<------><------><------>error = -ENAMETOOLONG;
<------><------>else
<------><------><------>*--bptr = '/';
<------>}
<------>*buffer = bptr;
<------>*buflen = blen;
<------>return error;
}
 
/**
 * __d_path - return the path of a dentry
 * @path: the dentry/vfsmount to report
 * @root: root vfsmnt/dentry
 * @buf: buffer to return value in
 * @buflen: buffer length
 *
 * Convert a dentry into an ASCII path name.
 *
 * Returns a pointer into the buffer or an error code if the
 * path was too long.
 *
 * "buflen" should be positive.
 *
 * If the path is not reachable from the supplied root, return %NULL.
 */
char *__d_path(const struct path *path,
<------>       const struct path *root,
<------>       char *buf, int buflen)
{
<------>char *res = buf + buflen;
<------>int error;
 
<------>prepend(&res, &buflen, "\0", 1);
<------>error = prepend_path(path, root, &res, &buflen);
 
<------>if (error < 0)
<------><------>return ERR_PTR(error);
<------>if (error > 0)
<------><------>return NULL;
<------>return res;
}
 
char *d_absolute_path(const struct path *path,
<------>       char *buf, int buflen)
{
<------>struct path root = {};
<------>char *res = buf + buflen;
<------>int error;
 
<------>prepend(&res, &buflen, "\0", 1);
<------>error = prepend_path(path, &root, &res, &buflen);
 
<------>if (error > 1)
<------><------>error = -EINVAL;
<------>if (error < 0)
<------><------>return ERR_PTR(error);
<------>return res;
}
 
/*
 * same as __d_path but appends "(deleted)" for unlinked files.
 */
static int path_with_deleted(const struct path *path,
<------><------><------>     const struct path *root,
<------><------><------>     char **buf, int *buflen)
{
<------>prepend(buf, buflen, "\0", 1);
<------>if (d_unlinked(path->dentry)) {
<------><------>int error = prepend(buf, buflen, " (deleted)", 10);
<------><------>if (error)
<------><------><------>return error;
<------>}
 
<------>return prepend_path(path, root, buf, buflen);
}
 
static int prepend_unreachable(char **buffer, int *buflen)
{
<------>return prepend(buffer, buflen, "(unreachable)", 13);
}
 
static void get_fs_root_rcu(struct fs_struct *fs, struct path *root)
{
<------>unsigned seq;
 
<------>do {
<------><------>seq = read_seqcount_begin(&fs->seq);
<------><------>*root = fs->root;
<------>} while (read_seqcount_retry(&fs->seq, seq));
}
 
/**
 * d_path - return the path of a dentry
 * @path: path to report
 * @buf: buffer to return value in
 * @buflen: buffer length
 *
 * Convert a dentry into an ASCII path name. If the entry has been deleted
 * the string " (deleted)" is appended. Note that this is ambiguous.
 *
 * Returns a pointer into the buffer or an error code if the path was
 * too long. Note: Callers should use the returned pointer, not the passed
 * in buffer, to use the name! The implementation often starts at an offset
 * into the buffer, and may leave 0 bytes at the start.
 *
 * "buflen" should be positive.
 */
char *d_path(const struct path *path, char *buf, int buflen)
{
<------>char *res = buf + buflen;
<------>struct path root;
<------>int error;
 
<------>/*
<------> * We have various synthetic filesystems that never get mounted.  On
<------> * these filesystems dentries are never used for lookup purposes, and
<------> * thus don't need to be hashed.  They also don't need a name until a
<------> * user wants to identify the object in /proc/pid/fd/.  The little hack
<------> * below allows us to generate a name for these objects on demand:
<------> *
<------> * Some pseudo inodes are mountable.  When they are mounted
<------> * path->dentry == path->mnt->mnt_root.  In that case don't call d_dname
<------> * and instead have d_path return the mounted path.
<------> */
<------>if (path->dentry->d_op && path->dentry->d_op->d_dname &&
<------>    (!IS_ROOT(path->dentry) || path->dentry != path->mnt->mnt_root))
<------><------>return path->dentry->d_op->d_dname(path->dentry, buf, buflen);
 
<------>rcu_read_lock();
<------>get_fs_root_rcu(current->fs, &root);
<------>error = path_with_deleted(path, &root, &res, &buflen);
<------>rcu_read_unlock();
 
<------>if (error < 0)
<------><------>res = ERR_PTR(error);
<------>return res;
}
EXPORT_SYMBOL(d_path);
 
/*
 * Helper function for dentry_operations.d_dname() members
 */
char *dynamic_dname(struct dentry *dentry, char *buffer, int buflen,
<------><------><------>const char *fmt, ...)
{
<------>va_list args;
<------>char temp[64];
<------>int sz;
 
<------>va_start(args, fmt);
<------>sz = vsnprintf(temp, sizeof(temp), fmt, args) + 1;
<------>va_end(args);
 
<------>if (sz > sizeof(temp) || sz > buflen)
<------><------>return ERR_PTR(-ENAMETOOLONG);
 
<------>buffer += buflen - sz;
<------>return memcpy(buffer, temp, sz);
}
 
char *simple_dname(struct dentry *dentry, char *buffer, int buflen)
{
<------>char *end = buffer + buflen;
<------>/* these dentries are never renamed, so d_lock is not needed */
<------>if (prepend(&end, &buflen, " (deleted)", 11) ||
<------>    prepend(&end, &buflen, dentry->d_name.name, dentry->d_name.len) ||
<------>    prepend(&end, &buflen, "/", 1))  
<------><------>end = ERR_PTR(-ENAMETOOLONG);
<------>return end;
}
 
/*
 * Write full pathname from the root of the filesystem into the buffer.
 */
static char *__dentry_path(struct dentry *d, char *buf, int buflen)
{
<------>struct dentry *dentry;
<------>char *end, *retval;
<------>int len, seq = 0;
<------>int error = 0;
 
<------>if (buflen < 2)
<------><------>goto Elong;
 
<------>rcu_read_lock();
restart:
<------>dentry = d;
<------>end = buf + buflen;
<------>len = buflen;
<------>prepend(&end, &len, "\0", 1);
<------>/* Get '/' right */
<------>retval = end-1;
<------>*retval = '/';
<------>read_seqbegin_or_lock(&rename_lock, &seq);
<------>while (!IS_ROOT(dentry)) {
<------><------>struct dentry *parent = dentry->d_parent;
 
<------><------>prefetch(parent);
<------><------>error = prepend_name(&end, &len, &dentry->d_name);
<------><------>if (error)
<------><------><------>break;
 
<------><------>retval = end;
<------><------>dentry = parent;
<------>}
<------>if (!(seq & 1))
<------><------>rcu_read_unlock();
<------>if (need_seqretry(&rename_lock, seq)) {
<------><------>seq = 1;
<------><------>goto restart;
<------>}
<------>done_seqretry(&rename_lock, seq);
<------>if (error)
<------><------>goto Elong;
<------>return retval;
Elong:
<------>return ERR_PTR(-ENAMETOOLONG);
}
 
char *dentry_path_raw(struct dentry *dentry, char *buf, int buflen)
{
<------>return __dentry_path(dentry, buf, buflen);
}
EXPORT_SYMBOL(dentry_path_raw);
 
char *dentry_path(struct dentry *dentry, char *buf, int buflen)
{
<------>char *p = NULL;
<------>char *retval;
 
<------>if (d_unlinked(dentry)) {
<------><------>p = buf + buflen;
<------><------>if (prepend(&p, &buflen, "//deleted", 10) != 0)
<------><------><------>goto Elong;
<------><------>buflen++;
<------>}
<------>retval = __dentry_path(dentry, buf, buflen);
<------>if (!IS_ERR(retval) && p)
<------><------>*p = '/';	/* restore '/' overriden with '\0' */
<------>return retval;
Elong:
<------>return ERR_PTR(-ENAMETOOLONG);
}
 
static void get_fs_root_and_pwd_rcu(struct fs_struct *fs, struct path *root,
<------><------><------><------>    struct path *pwd)
{
<------>unsigned seq;
 
<------>do {
<------><------>seq = read_seqcount_begin(&fs->seq);
<------><------>*root = fs->root;
<------><------>*pwd = fs->pwd;
<------>} while (read_seqcount_retry(&fs->seq, seq));
}
 
/*
 * NOTE! The user-level library version returns a
 * character pointer. The kernel system call just
 * returns the length of the buffer filled (which
 * includes the ending '\0' character), or a negative
 * error value. So libc would do something like
 *
 *	char *getcwd(char * buf, size_t size)
 *	{
 *		int retval;
 *
 *		retval = sys_getcwd(buf, size);
 *		if (retval >= 0)
 *			return buf;
 *		errno = -retval;
 *		return NULL;
 *	}
 */
SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)
{
<------>int error;
<------>struct path pwd, root;
<------>char *page = __getname();
 
<------>if (!page)
<------><------>return -ENOMEM;
 
<------>rcu_read_lock();
<------>get_fs_root_and_pwd_rcu(current->fs, &root, &pwd);
 
<------>error = -ENOENT;
<------>if (!d_unlinked(pwd.dentry)) {
<------><------>unsigned long len;
<------><------>char *cwd = page + PATH_MAX;
<------><------>int buflen = PATH_MAX;
 
<------><------>prepend(&cwd, &buflen, "\0", 1);
<------><------>error = prepend_path(&pwd, &root, &cwd, &buflen);
<------><------>rcu_read_unlock();
 
<------><------>if (error < 0)
<------><------><------>goto out;
 
<------><------>/* Unreachable from current root */
<------><------>if (error > 0) {
<------><------><------>error = prepend_unreachable(&cwd, &buflen);
<------><------><------>if (error)
<------><------><------><------>goto out;
<------><------>}
 
<------><------>error = -ERANGE;
<------><------>len = PATH_MAX + page - cwd;
<------><------>if (len <= size) {
<------><------><------>error = len;
<------><------><------>if (copy_to_user(buf, cwd, len))
<------><------><------><------>error = -EFAULT;
<------><------>}
<------>} else {
<------><------>rcu_read_unlock();
<------>}
 
out:
<------>__putname(page);
<------>return error;
}