ovl: don't allow writing ioctl on lower layer

[sfrench/cifs-2.6.git] / fs / namespace.c

diff --git a/fs/namespace.c b/fs/namespace.c
index 0e1fdb30613368c2aef348350ff744d0ef50c673..df0f7521979a211eee70ae6a0e848d88bb1c65c9 100644 (file)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -236,6 +236,7 @@ static struct mount *alloc_vfsmnt(const char *name)
                INIT_LIST_HEAD(&mnt->mnt_slave_list);
                INIT_LIST_HEAD(&mnt->mnt_slave);
                INIT_HLIST_NODE(&mnt->mnt_mp_list);
+               INIT_LIST_HEAD(&mnt->mnt_umounting);
                init_fs_pin(&mnt->mnt_umount, drop_mountpoint);
        }
        return mnt;
@@ -430,13 +431,18 @@ int __mnt_want_write_file(struct file *file)
 }
 
 /**
- * mnt_want_write_file - get write access to a file's mount
+ * mnt_want_write_file_path - get write access to a file's mount
  * @file: the file who's mount on which to take a write
  *
  * This is like mnt_want_write, but it takes a file and can
  * do some optimisations if the file is open for write already
+ *
+ * Called by the vfs for cases when we have an open file at hand, but will do an
+ * inode operation on it (important distinction for files opened on overlayfs,
+ * since the file operations will come from the real underlying file, while
+ * inode operations come from the overlay).
  */
-int mnt_want_write_file(struct file *file)
+int mnt_want_write_file_path(struct file *file)
 {
        int ret;
 
@@ -446,6 +452,53 @@ int mnt_want_write_file(struct file *file)
                sb_end_write(file->f_path.mnt->mnt_sb);
        return ret;
 }
+
+static inline int may_write_real(struct file *file)
+{
+       struct dentry *dentry = file->f_path.dentry;
+       struct dentry *upperdentry;
+
+       /* Writable file? */
+       if (file->f_mode & FMODE_WRITER)
+               return 0;
+
+       /* Not overlayfs? */
+       if (likely(!(dentry->d_flags & DCACHE_OP_REAL)))
+               return 0;
+
+       /* File refers to upper, writable layer? */
+       upperdentry = d_real(dentry, NULL, 0, D_REAL_UPPER);
+       if (upperdentry && file_inode(file) == d_inode(upperdentry))
+               return 0;
+
+       /* Lower layer: can't write to real file, sorry... */
+       return -EPERM;
+}
+
+/**
+ * mnt_want_write_file - get write access to a file's mount
+ * @file: the file who's mount on which to take a write
+ *
+ * This is like mnt_want_write, but it takes a file and can
+ * do some optimisations if the file is open for write already
+ *
+ * Mostly called by filesystems from their ioctl operation before performing
+ * modification.  On overlayfs this needs to check if the file is on a read-only
+ * lower layer and deny access in that case.
+ */
+int mnt_want_write_file(struct file *file)
+{
+       int ret;
+
+       ret = may_write_real(file);
+       if (!ret) {
+               sb_start_write(file_inode(file)->i_sb);
+               ret = __mnt_want_write_file(file);
+               if (ret)
+                       sb_end_write(file_inode(file)->i_sb);
+       }
+       return ret;
+}
 EXPORT_SYMBOL_GPL(mnt_want_write_file);
 
 /**
@@ -483,10 +536,16 @@ void __mnt_drop_write_file(struct file *file)
        __mnt_drop_write(file->f_path.mnt);
 }
 
-void mnt_drop_write_file(struct file *file)
+void mnt_drop_write_file_path(struct file *file)
 {
        mnt_drop_write(file->f_path.mnt);
 }
+
+void mnt_drop_write_file(struct file *file)
+{
+       __mnt_drop_write(file->f_path.mnt);
+       sb_end_write(file_inode(file)->i_sb);
+}
 EXPORT_SYMBOL(mnt_drop_write_file);
 
 static int mnt_make_readonly(struct mount *mnt)
@@ -3179,7 +3238,6 @@ static void __init init_mount_tree(void)
 
 void __init mnt_init(void)
 {
-       unsigned u;
        int err;
 
        mnt_cache = kmem_cache_create("mnt_cache", sizeof(struct mount),
@@ -3188,22 +3246,17 @@ void __init mnt_init(void)
        mount_hashtable = alloc_large_system_hash("Mount-cache",
                                sizeof(struct hlist_head),
                                mhash_entries, 19,
-                               0,
+                               HASH_ZERO,
                                &m_hash_shift, &m_hash_mask, 0, 0);
        mountpoint_hashtable = alloc_large_system_hash("Mountpoint-cache",
                                sizeof(struct hlist_head),
                                mphash_entries, 19,
-                               0,
+                               HASH_ZERO,
                                &mp_hash_shift, &mp_hash_mask, 0, 0);
 
        if (!mount_hashtable || !mountpoint_hashtable)
                panic("Failed to allocate mount hash table\n");
 
-       for (u = 0; u <= m_hash_mask; u++)
-               INIT_HLIST_HEAD(&mount_hashtable[u]);
-       for (u = 0; u <= mp_hash_mask; u++)
-               INIT_HLIST_HEAD(&mountpoint_hashtable[u]);
-
        kernfs_init();
 
        err = sysfs_init();