Merge branch 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs (139351f1) · Commits · 戴 / test

Documentation/filesystems/overlayfs.txt

+103 −3

Original line number	Diff line number	Diff line
		@@ -190,6 +190,20 @@ Mount options:
		Redirects are not created and not followed (equivalent to "redirect_dir=off"
		if "redirect_always_follow" feature is not enabled).

		When the NFS export feature is enabled, every copied up directory is
		indexed by the file handle of the lower inode and a file handle of the
		upper directory is stored in a "trusted.overlay.upper" extended attribute
		on the index entry. On lookup of a merged directory, if the upper
		directory does not match the file handle stores in the index, that is an
		indication that multiple upper directories may be redirected to the same
		lower directory. In that case, lookup returns an error and warns about
		a possible inconsistency.

		Because lower layer redirects cannot be verified with the index, enabling
		NFS export support on an overlay filesystem with no upper layer requires
		turning off redirect follow (e.g. "redirect_dir=nofollow").


		Non-directories
		---------------

		@@ -281,9 +295,9 @@ filesystem, so both st_dev and st_ino of the file may change.

		Any open files referring to this inode will access the old data.

		If a file with multiple hard links is copied up, then this will
		"break" the link. Changes will not be propagated to other names
		referring to the same inode.
		Unless "inode index" feature is enabled, if a file with multiple hard
		links is copied up, then this will "break" the link. Changes will not be
		propagated to other names referring to the same inode.

		Unless "redirect_dir" feature is enabled, rename(2) on a lower or merged
		directory will fail with EXDEV.
		@@ -299,6 +313,92 @@ filesystem are not allowed. If the underlying filesystem is changed,
		the behavior of the overlay is undefined, though it will not result in
		a crash or deadlock.

		When the overlay NFS export feature is enabled, overlay filesystems
		behavior on offline changes of the underlying lower layer is different
		than the behavior when NFS export is disabled.

		On every copy_up, an NFS file handle of the lower inode, along with the
		UUID of the lower filesystem, are encoded and stored in an extended
		attribute "trusted.overlay.origin" on the upper inode.

		When the NFS export feature is enabled, a lookup of a merged directory,
		that found a lower directory at the lookup path or at the path pointed
		to by the "trusted.overlay.redirect" extended attribute, will verify
		that the found lower directory file handle and lower filesystem UUID
		match the origin file handle that was stored at copy_up time. If a
		found lower directory does not match the stored origin, that directory
		will not be merged with the upper directory.



		NFS export
		----------

		When the underlying filesystems supports NFS export and the "nfs_export"
		feature is enabled, an overlay filesystem may be exported to NFS.

		With the "nfs_export" feature, on copy_up of any lower object, an index
		entry is created under the index directory. The index entry name is the
		hexadecimal representation of the copy up origin file handle. For a
		non-directory object, the index entry is a hard link to the upper inode.
		For a directory object, the index entry has an extended attribute
		"trusted.overlay.upper" with an encoded file handle of the upper
		directory inode.

		When encoding a file handle from an overlay filesystem object, the
		following rules apply:

		1. For a non-upper object, encode a lower file handle from lower inode
		2. For an indexed object, encode a lower file handle from copy_up origin
		3. For a pure-upper object and for an existing non-indexed upper object,
		encode an upper file handle from upper inode

		The encoded overlay file handle includes:
		- Header including path type information (e.g. lower/upper)
		- UUID of the underlying filesystem
		- Underlying filesystem encoding of underlying inode

		This encoding format is identical to the encoding format file handles that
		are stored in extended attribute "trusted.overlay.origin".

		When decoding an overlay file handle, the following steps are followed:

		1. Find underlying layer by UUID and path type information.
		2. Decode the underlying filesystem file handle to underlying dentry.
		3. For a lower file handle, lookup the handle in index directory by name.
		4. If a whiteout is found in index, return ESTALE. This represents an
		overlay object that was deleted after its file handle was encoded.
		5. For a non-directory, instantiate a disconnected overlay dentry from the
		decoded underlying dentry, the path type and index inode, if found.
		6. For a directory, use the connected underlying decoded dentry, path type
		and index, to lookup a connected overlay dentry.

		Decoding a non-directory file handle may return a disconnected dentry.
		copy_up of that disconnected dentry will create an upper index entry with
		no upper alias.

		When overlay filesystem has multiple lower layers, a middle layer
		directory may have a "redirect" to lower directory. Because middle layer
		"redirects" are not indexed, a lower file handle that was encoded from the
		"redirect" origin directory, cannot be used to find the middle or upper
		layer directory. Similarly, a lower file handle that was encoded from a
		descendant of the "redirect" origin directory, cannot be used to
		reconstruct a connected overlay path. To mitigate the cases of
		directories that cannot be decoded from a lower file handle, these
		directories are copied up on encode and encoded as an upper file handle.
		On an overlay filesystem with no upper layer this mitigation cannot be
		used NFS export in this setup requires turning off redirect follow (e.g.
		"redirect_dir=nofollow").

		The overlay filesystem does not support non-directory connectable file
		handles, so exporting with the 'subtree_check' exportfs configuration will
		cause failures to lookup files over NFS.

		When the NFS export feature is enabled, all directory index entries are
		verified on mount time to check that upper file handles are not stale.
		This verification may cause significant overhead in some cases.


		Testsuite
		---------

fs/dcache.c

+57 −31

Original line number	Diff line number	Diff line
		@@ -1698,9 +1698,15 @@ struct dentry d_alloc(struct dentry parent, const struct qstr *name)
		}
		EXPORT_SYMBOL(d_alloc);

		struct dentry d_alloc_anon(struct super_block sb)
		{
		return __d_alloc(sb, NULL);
		}
		EXPORT_SYMBOL(d_alloc_anon);

		struct dentry d_alloc_cursor(struct dentry parent)
		{
		struct dentry *dentry = __d_alloc(parent->d_sb, NULL);
		struct dentry *dentry = d_alloc_anon(parent->d_sb);
		if (dentry) {
		dentry->d_flags \|= DCACHE_RCUACCESS \| DCACHE_DENTRY_CURSOR;
		dentry->d_parent = dget(parent);
		@@ -1886,7 +1892,7 @@ struct dentry d_make_root(struct inode root_inode)
		struct dentry *res = NULL;

		if (root_inode) {
		res = __d_alloc(root_inode->i_sb, NULL);
		res = d_alloc_anon(root_inode->i_sb);
		if (res)
		d_instantiate(res, root_inode);
		else
		@@ -1925,33 +1931,19 @@ struct dentry d_find_any_alias(struct inode inode)
		}
		EXPORT_SYMBOL(d_find_any_alias);

		static struct dentry __d_obtain_alias(struct inode inode, int disconnected)
		static struct dentry __d_instantiate_anon(struct dentry dentry,
		struct inode *inode,
		bool disconnected)
		{
		struct dentry *tmp;
		struct dentry *res;
		unsigned add_flags;

		if (!inode)
		return ERR_PTR(-ESTALE);
		if (IS_ERR(inode))
		return ERR_CAST(inode);

		res = d_find_any_alias(inode);
		if (res)
		goto out_iput;

		tmp = __d_alloc(inode->i_sb, NULL);
		if (!tmp) {
		res = ERR_PTR(-ENOMEM);
		goto out_iput;
		}

		security_d_instantiate(tmp, inode);
		security_d_instantiate(dentry, inode);
		spin_lock(&inode->i_lock);
		res = __d_find_any_alias(inode);
		if (res) {
		spin_unlock(&inode->i_lock);
		dput(tmp);
		dput(dentry);
		goto out_iput;
		}

		@@ -1961,18 +1953,51 @@ static struct dentry __d_obtain_alias(struct inode inode, int disconnected)
		if (disconnected)
		add_flags \|= DCACHE_DISCONNECTED;

		spin_lock(&tmp->d_lock);
		__d_set_inode_and_type(tmp, inode, add_flags);
		hlist_add_head(&tmp->d_u.d_alias, &inode->i_dentry);
		spin_lock(&dentry->d_lock);
		__d_set_inode_and_type(dentry, inode, add_flags);
		hlist_add_head(&dentry->d_u.d_alias, &inode->i_dentry);
		if (!disconnected) {
		hlist_bl_lock(&tmp->d_sb->s_roots);
		hlist_bl_add_head(&tmp->d_hash, &tmp->d_sb->s_roots);
		hlist_bl_unlock(&tmp->d_sb->s_roots);
		hlist_bl_lock(&dentry->d_sb->s_roots);
		hlist_bl_add_head(&dentry->d_hash, &dentry->d_sb->s_roots);
		hlist_bl_unlock(&dentry->d_sb->s_roots);
		}
		spin_unlock(&tmp->d_lock);
		spin_unlock(&dentry->d_lock);
		spin_unlock(&inode->i_lock);

		return tmp;
		return dentry;

		out_iput:
		iput(inode);
		return res;
		}

		struct dentry d_instantiate_anon(struct dentry dentry, struct inode *inode)
		{
		return __d_instantiate_anon(dentry, inode, true);
		}
		EXPORT_SYMBOL(d_instantiate_anon);

		static struct dentry __d_obtain_alias(struct inode inode, bool disconnected)
		{
		struct dentry *tmp;
		struct dentry *res;

		if (!inode)
		return ERR_PTR(-ESTALE);
		if (IS_ERR(inode))
		return ERR_CAST(inode);

		res = d_find_any_alias(inode);
		if (res)
		goto out_iput;

		tmp = d_alloc_anon(inode->i_sb);
		if (!tmp) {
		res = ERR_PTR(-ENOMEM);
		goto out_iput;
		}

		return __d_instantiate_anon(tmp, inode, disconnected);

		out_iput:
		iput(inode);
		@@ -1999,7 +2024,7 @@ static struct dentry __d_obtain_alias(struct inode inode, int disconnected)
		*/
		struct dentry d_obtain_alias(struct inode inode)
		{
		return __d_obtain_alias(inode, 1);
		return __d_obtain_alias(inode, true);
		}
		EXPORT_SYMBOL(d_obtain_alias);

		@@ -2020,7 +2045,7 @@ EXPORT_SYMBOL(d_obtain_alias);
		*/
		struct dentry d_obtain_root(struct inode inode)
		{
		return __d_obtain_alias(inode, 0);
		return __d_obtain_alias(inode, false);
		}
		EXPORT_SYMBOL(d_obtain_root);

		@@ -3527,6 +3552,7 @@ bool is_subdir(struct dentry new_dentry, struct dentry old_dentry)

		return result;
		}
		EXPORT_SYMBOL(is_subdir);

		static enum d_walk_ret d_genocide_kill(void data, struct dentry dentry)
		{

fs/overlayfs/Kconfig

+25 −6

Original line number	Diff line number	Diff line
		@@ -47,9 +47,28 @@ config OVERLAY_FS_INDEX
		The inodes index feature prevents breaking of lower hardlinks on copy
		up.

		Note, that the inodes index feature is read-only backward compatible.
		That is, mounting an overlay which has an index dir on a kernel that
		doesn't support this feature read-only, will not have any negative
		outcomes. However, mounting the same overlay with an old kernel
		read-write and then mounting it again with a new kernel, will have
		unexpected results.
		Note, that the inodes index feature is not backward compatible.
		That is, mounting an overlay which has an inodes index on a kernel
		that doesn't support this feature will have unexpected results.

		config OVERLAY_FS_NFS_EXPORT
		bool "Overlayfs: turn on NFS export feature by default"
		depends on OVERLAY_FS
		depends on OVERLAY_FS_INDEX
		help
		If this config option is enabled then overlay filesystems will use
		the inodes index dir to decode overlay NFS file handles by default.
		In this case, it is still possible to turn off NFS export support
		globally with the "nfs_export=off" module option or on a filesystem
		instance basis with the "nfs_export=off" mount option.

		The NFS export feature creates an index on copy up of every file and
		directory. This full index is used to detect overlay filesystems
		inconsistencies on lookup, like redirect from multiple upper dirs to
		the same lower dir. The full index may incur some overhead on mount
		time, especially when verifying that directory file handles are not
		stale.

		Note, that the NFS export feature is not backward compatible.
		That is, mounting an overlay which has a full index on a kernel
		that doesn't support this feature will have unexpected results.

fs/overlayfs/Makefile

+2 −1

Original line number	Diff line number	Diff line
		@@ -4,4 +4,5 @@

		obj-$(CONFIG_OVERLAY_FS) += overlay.o

		overlay-objs := super.o namei.o util.o inode.o dir.o readdir.o copy_up.o
		overlay-objs := super.o namei.o util.o inode.o dir.o readdir.o copy_up.o \
		export.o

fs/overlayfs/copy_up.c

+160 −28

Original line number	Diff line number	Diff line
		@@ -232,13 +232,13 @@ int ovl_set_attr(struct dentry upperdentry, struct kstat stat)
		return err;
		}

		struct ovl_fh ovl_encode_fh(struct dentry lower, bool is_upper)
		struct ovl_fh ovl_encode_fh(struct dentry real, bool is_upper)
		{
		struct ovl_fh *fh;
		int fh_type, fh_len, dwords;
		void *buf;
		int buflen = MAX_HANDLE_SZ;
		uuid_t *uuid = &lower->d_sb->s_uuid;
		uuid_t *uuid = &real->d_sb->s_uuid;

		buf = kmalloc(buflen, GFP_KERNEL);
		if (!buf)
		@@ -250,7 +250,7 @@ struct ovl_fh ovl_encode_fh(struct dentry lower, bool is_upper)
		* the price or reconnecting the dentry.
		*/
		dwords = buflen >> 2;
		fh_type = exportfs_encode_fh(lower, buf, &dwords, 0);
		fh_type = exportfs_encode_fh(real, buf, &dwords, 0);
		buflen = (dwords << 2);

		fh = ERR_PTR(-EIO);
		@@ -288,7 +288,7 @@ out:
		return fh;
		}

		static int ovl_set_origin(struct dentry dentry, struct dentry lower,
		int ovl_set_origin(struct dentry dentry, struct dentry lower,
		struct dentry *upper)
		{
		const struct ovl_fh *fh = NULL;
		@@ -315,6 +315,94 @@ static int ovl_set_origin(struct dentry dentry, struct dentry lower,
		return err;
		}

		/* Store file handle of @upper dir in @index dir entry */
		static int ovl_set_upper_fh(struct dentry upper, struct dentry index)
		{
		const struct ovl_fh *fh;
		int err;

		fh = ovl_encode_fh(upper, true);
		if (IS_ERR(fh))
		return PTR_ERR(fh);

		err = ovl_do_setxattr(index, OVL_XATTR_UPPER, fh, fh->len, 0);

		kfree(fh);
		return err;
		}

		/*
		* Create and install index entry.
		*
		* Caller must hold i_mutex on indexdir.
		*/
		static int ovl_create_index(struct dentry dentry, struct dentry origin,
		struct dentry *upper)
		{
		struct dentry *indexdir = ovl_indexdir(dentry->d_sb);
		struct inode *dir = d_inode(indexdir);
		struct dentry *index = NULL;
		struct dentry *temp = NULL;
		struct qstr name = { };
		int err;

		/*
		* For now this is only used for creating index entry for directories,
		* because non-dir are copied up directly to index and then hardlinked
		* to upper dir.
		*
		* TODO: implement create index for non-dir, so we can call it when
		* encoding file handle for non-dir in case index does not exist.
		*/
		if (WARN_ON(!d_is_dir(dentry)))
		return -EIO;

		/* Directory not expected to be indexed before copy up */
		if (WARN_ON(ovl_test_flag(OVL_INDEX, d_inode(dentry))))
		return -EIO;

		err = ovl_get_index_name(origin, &name);
		if (err)
		return err;

		temp = ovl_lookup_temp(indexdir);
		if (IS_ERR(temp))
		goto temp_err;

		err = ovl_do_mkdir(dir, temp, S_IFDIR, true);
		if (err)
		goto out;

		err = ovl_set_upper_fh(upper, temp);
		if (err)
		goto out_cleanup;

		index = lookup_one_len(name.name, indexdir, name.len);
		if (IS_ERR(index)) {
		err = PTR_ERR(index);
		} else {
		err = ovl_do_rename(dir, temp, dir, index, 0);
		dput(index);
		}

		if (err)
		goto out_cleanup;

		out:
		dput(temp);
		kfree(name.name);
		return err;

		temp_err:
		err = PTR_ERR(temp);
		temp = NULL;
		goto out;

		out_cleanup:
		ovl_cleanup(dir, temp);
		goto out;
		}

		struct ovl_copy_up_ctx {
		struct dentry *parent;
		struct dentry *dentry;
		@@ -327,6 +415,7 @@ struct ovl_copy_up_ctx {
		struct dentry *workdir;
		bool tmpfile;
		bool origin;
		bool indexed;
		};

		static int ovl_link_up(struct ovl_copy_up_ctx *c)
		@@ -361,7 +450,10 @@ static int ovl_link_up(struct ovl_copy_up_ctx *c)
		}
		}
		inode_unlock(udir);
		ovl_set_nlink_upper(c->dentry);
		if (err)
		return err;

		err = ovl_set_nlink_upper(c->dentry);

		return err;
		}
		@@ -498,6 +590,12 @@ static int ovl_copy_up_locked(struct ovl_copy_up_ctx *c)
		if (err)
		goto out_cleanup;

		if (S_ISDIR(c->stat.mode) && c->indexed) {
		err = ovl_create_index(c->dentry, c->lowerpath.dentry, temp);
		if (err)
		goto out_cleanup;
		}

		if (c->tmpfile) {
		inode_lock_nested(udir, I_MUTEX_PARENT);
		err = ovl_install_temp(c, temp, &newdentry);
		@@ -536,20 +634,33 @@ static int ovl_do_copy_up(struct ovl_copy_up_ctx *c)
		{
		int err;
		struct ovl_fs *ofs = c->dentry->d_sb->s_fs_info;
		bool indexed = false;
		bool to_index = false;

		if (ovl_indexdir(c->dentry->d_sb) && !S_ISDIR(c->stat.mode) &&
		c->stat.nlink > 1)
		indexed = true;
		/*
		* Indexed non-dir is copied up directly to the index entry and then
		* hardlinked to upper dir. Indexed dir is copied up to indexdir,
		* then index entry is created and then copied up dir installed.
		* Copying dir up to indexdir instead of workdir simplifies locking.
		*/
		if (ovl_need_index(c->dentry)) {
		c->indexed = true;
		if (S_ISDIR(c->stat.mode))
		c->workdir = ovl_indexdir(c->dentry->d_sb);
		else
		to_index = true;
		}

		if (S_ISDIR(c->stat.mode) \|\| c->stat.nlink == 1 \|\| indexed)
		if (S_ISDIR(c->stat.mode) \|\| c->stat.nlink == 1 \|\| to_index)
		c->origin = true;

		if (indexed) {
		if (to_index) {
		c->destdir = ovl_indexdir(c->dentry->d_sb);
		err = ovl_get_index_name(c->lowerpath.dentry, &c->destname);
		if (err)
		return err;
		} else if (WARN_ON(!c->parent)) {
		/* Disconnected dentry must be copied up to index dir */
		return -EIO;
		} else {
		/*
		* Mark parent "impure" because it may now contain non-pure
		@@ -572,11 +683,17 @@ static int ovl_do_copy_up(struct ovl_copy_up_ctx *c)
		}
		}

		if (indexed) {
		if (!err)

		if (err)
		goto out;

		if (c->indexed)
		ovl_set_flag(OVL_INDEX, d_inode(c->dentry));
		kfree(c->destname.name);
		} else if (!err) {

		if (to_index) {
		/* Initialize nlink for copy up of disconnected dentry */
		err = ovl_set_nlink_upper(c->dentry);
		} else {
		struct inode *udir = d_inode(c->destdir);

		/* Restore timestamps on parent (best effort) */
		@@ -587,6 +704,9 @@ static int ovl_do_copy_up(struct ovl_copy_up_ctx *c)
		ovl_dentry_set_upper_alias(c->dentry);
		}

		out:
		if (to_index)
		kfree(c->destname.name);
		return err;
		}

		@@ -611,14 +731,17 @@ static int ovl_copy_up_one(struct dentry parent, struct dentry dentry,
		if (err)
		return err;

		if (parent) {
		ovl_path_upper(parent, &parentpath);
		ctx.destdir = parentpath.dentry;
		ctx.destname = dentry->d_name;

		err = vfs_getattr(&parentpath, &ctx.pstat,
		STATX_ATIME \| STATX_MTIME, AT_STATX_SYNC_AS_STAT);
		STATX_ATIME \| STATX_MTIME,
		AT_STATX_SYNC_AS_STAT);
		if (err)
		return err;
		}

		/* maybe truncate regular file. this has no effect on dirs */
		if (flags & O_TRUNC)
		@@ -639,7 +762,7 @@ static int ovl_copy_up_one(struct dentry parent, struct dentry dentry,
		} else {
		if (!ovl_dentry_upper(dentry))
		err = ovl_do_copy_up(&ctx);
		if (!err && !ovl_dentry_has_upper_alias(dentry))
		if (!err && parent && !ovl_dentry_has_upper_alias(dentry))
		err = ovl_link_up(&ctx);
		ovl_copy_up_end(dentry);
		}
		@@ -652,10 +775,19 @@ int ovl_copy_up_flags(struct dentry *dentry, int flags)
		{
		int err = 0;
		const struct cred *old_cred = ovl_override_creds(dentry->d_sb);
		bool disconnected = (dentry->d_flags & DCACHE_DISCONNECTED);

		/*
		* With NFS export, copy up can get called for a disconnected non-dir.
		* In this case, we will copy up lower inode to index dir without
		* linking it to upper dir.
		*/
		if (WARN_ON(disconnected && d_is_dir(dentry)))
		return -EIO;

		while (!err) {
		struct dentry *next;
		struct dentry *parent;
		struct dentry *parent = NULL;

		/*
		* Check if copy-up has happened as well as for upper alias (in
		@@ -671,12 +803,12 @@ int ovl_copy_up_flags(struct dentry *dentry, int flags)
		* with rename.
		*/
		if (ovl_dentry_upper(dentry) &&
		ovl_dentry_has_upper_alias(dentry))
		(ovl_dentry_has_upper_alias(dentry) \|\| disconnected))
		break;

		next = dget(dentry);
		/* find the topmost dentry not yet copied up */
		for (;;) {
		for (; !disconnected;) {
		parent = dget_parent(next);

		if (ovl_dentry_upper(parent))

Admin message