Merge tag 'ovl-update-5.7' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs

underlying filesystem, the same compliant behavior could be achieved

with the "xino" feature.  The "xino" feature composes a unique object

identifier from the real object st_ino and an underlying fsid index.

If all underlying filesystems support NFS file handles and export file

handles with 32bit inode number encoding (e.g. ext4), overlay filesystem

will use the high inode number bits for fsid.  Even when the underlying

filesystem uses 64bit inode numbers, users can still enable the "xino"

feature with the "-o xino=on" overlay mount option.  That is useful for the

case of underlying filesystems like xfs and tmpfs, which use 64bit inode

numbers, but are very unlikely to use the high inode number bit.

numbers, but are very unlikely to use the high inode number bits.  In case

the underlying inode number does overflow into the high xino bits, overlay

filesystem will fall back to the non xino behavior for that inode.

The following table summarizes what can be expected in different overlay

configurations.

Inode properties

````````````````

+--------------+------------+------------+-----------------+----------------+

|Configuration | Persistent | Uniform    | st_ino == d_ino | d_ino == i_ino |

|              | st_ino     | st_dev     |                 | [*]            |

+==============+=====+======+=====+======+========+========+========+=======+

|              | dir | !dir | dir | !dir |  dir   +  !dir  |  dir   | !dir  |

+--------------+-----+------+-----+------+--------+--------+--------+-------+

| All layers   |  Y  |  Y   |  Y  |  Y   |  Y     |   Y    |  Y     |  Y    |

| on same fs   |     |      |     |      |        |        |        |       |

+--------------+-----+------+-----+------+--------+--------+--------+-------+

| Layers not   |  N  |  Y   |  Y  |  N   |  N     |   Y    |  N     |  Y    |

| on same fs,  |     |      |     |      |        |        |        |       |

| xino=off     |     |      |     |      |        |        |        |       |

+--------------+-----+------+-----+------+--------+--------+--------+-------+

| xino=on/auto |  Y  |  Y   |  Y  |  Y   |  Y     |   Y    |  Y     |  Y    |

|              |     |      |     |      |        |        |        |       |

+--------------+-----+------+-----+------+--------+--------+--------+-------+

| xino=on/auto,|  N  |  Y   |  Y  |  N   |  N     |   Y    |  N     |  Y    |

| ino overflow |     |      |     |      |        |        |        |       |

+--------------+-----+------+-----+------+--------+--------+--------+-------+

[*] nfsd v3 readdirplus verifies d_ino == i_ino. i_ino is exposed via several

/proc files, such as /proc/locks and /proc/self/fdinfo/<fd> of an inotify

file descriptor.

Upper and Lower

rename or unlink will of course be noticed and handled).

Permission model

----------------

Permission checking in the overlay filesystem follows these principles:

 1) permission check SHOULD return the same result before and after copy up

 2) task creating the overlay mount MUST NOT gain additional privileges

 3) non-mounting task MAY gain additional privileges through the overlay,

 compared to direct access on underlying lower or upper filesystems

This is achieved by performing two permission checks on each access

 a) check if current task is allowed access based on local DAC (owner,

    group, mode and posix acl), as well as MAC checks

 b) check if mounting task would be allowed real operation on lower or

    upper layer based on underlying filesystem permissions, again including

    MAC checks

Check (a) ensures consistency (1) since owner, group, mode and posix acls

are copied up.  On the other hand it can result in server enforced

permissions (used by NFS, for example) being ignored (3).

Check (b) ensures that no task gains permissions to underlying layers that

the mounting task does not have (2).  This also means that it is possible

to create setups where the consistency rule (1) does not hold; normally,

however, the mounting task will have sufficient privileges to perform all

operations.

Another way to demonstrate this model is drawing parallels between

  mount -t overlay overlay -olowerdir=/lower,upperdir=/upper,... /merged

and

  cp -a /lower /upper

  mount --bind /upper /merged

The resulting access permissions should be the same.  The difference is in

the time of copy (on-demand vs. up-front).

Multiple lower layers

---------------------

value of d_ino returned by readdir(3) will act like on a normal filesystem.

E.g. the value of st_dev may be different for two objects in the same

overlay filesystem and the value of st_ino for directory objects may not be

persistent and could change even while the overlay filesystem is mounted.

persistent and could change even while the overlay filesystem is mounted, as

summarized in the `Inode properties`_ table above.

Changes to underlying filesystems

module_param_call(check_copy_up, ovl_ccup_set, ovl_ccup_get, NULL, 0644);

MODULE_PARM_DESC(check_copy_up, "Obsolete; does nothing");

static bool ovl_must_copy_xattr(const char *name)

{

	return !strcmp(name, XATTR_POSIX_ACL_ACCESS) ||

	       !strcmp(name, XATTR_POSIX_ACL_DEFAULT) ||

	       !strncmp(name, XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN);

}

int ovl_copy_xattr(struct dentry *old, struct dentry *new)

{

	ssize_t list_size, size, value_size = 0;

			continue; /* Discard */

		}

		error = vfs_setxattr(new, name, value, size, 0);

		if (error)

		if (error) {

			if (error != -EOPNOTSUPP || ovl_must_copy_xattr(name))

				break;

			/* Ignore failure to copy unknown xattrs */

			error = 0;

		}

	}

	kfree(value);

out:

	return err;

}

static struct dentry *ovl_lookup_temp(struct dentry *workdir)

struct dentry *ovl_lookup_temp(struct dentry *workdir)

{

	struct dentry *temp;

	char name[20];

	ovl_dir_modified(dentry->d_parent, false);

	ovl_dentry_set_upper_alias(dentry);

	ovl_dentry_update_reval(dentry, newdentry,

			DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE);

	if (!hardlink) {

		/*

		 * ovl_obtain_alias() can be called after ovl_create_real()

	       !ovl_test_flag(OVL_WHITEOUTS, d_inode(dentry));

}

static void ovl_drop_nlink(struct dentry *dentry)

{

	struct inode *inode = d_inode(dentry);

	struct dentry *alias;

	/* Try to find another, hashed alias */

	spin_lock(&inode->i_lock);

	hlist_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) {

		if (alias != dentry && !d_unhashed(alias))

			break;

	}

	spin_unlock(&inode->i_lock);

	/*

	 * Changes to underlying layers may cause i_nlink to lose sync with

	 * reality.  In this case prevent the link count from going to zero

	 * prematurely.

	 */

	if (inode->i_nlink > !!alias)

		drop_nlink(inode);

}

static int ovl_do_remove(struct dentry *dentry, bool is_dir)

{

	int err;

		if (is_dir)

			clear_nlink(dentry->d_inode);

		else

			drop_nlink(dentry->d_inode);

			ovl_drop_nlink(dentry);

	}

	ovl_nlink_end(dentry);

		if (new_is_dir)

			clear_nlink(d_inode(new));

		else

			drop_nlink(d_inode(new));

			ovl_drop_nlink(new);

	}

	ovl_dir_modified(old->d_parent, ovl_type_origin(old) ||

		ovl_set_flag(OVL_UPPERDATA, inode);

	dentry = d_find_any_alias(inode);

	if (!dentry) {

	if (dentry)

		goto out_iput;

	dentry = d_alloc_anon(inode->i_sb);

		if (!dentry)

	if (unlikely(!dentry))

		goto nomem;

	oe = ovl_alloc_entry(lower ? 1 : 0);

	if (!oe)

	dentry->d_fsdata = oe;

	if (upper_alias)

		ovl_dentry_set_upper_alias(dentry);

	}

	ovl_dentry_update_reval(dentry, upper,

			DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE);

	return d_instantiate_anon(dentry, inode);

nomem:

	iput(inode);

	dput(dentry);

	return ERR_PTR(-ENOMEM);

	dentry = ERR_PTR(-ENOMEM);

out_iput:

	iput(inode);

	return dentry;

}

/* Get the upper or lower dentry in stach whose on layer @idx */

{

	bool samefs = ovl_same_fs(dentry->d_sb);

	unsigned int xinobits = ovl_xino_bits(dentry->d_sb);

	unsigned int xinoshift = 64 - xinobits;

	if (samefs) {

		/*

		stat->dev = dentry->d_sb->s_dev;

		return 0;

	} else if (xinobits) {

		unsigned int shift = 64 - xinobits;

		/*

		 * All inode numbers of underlying fs should not be using the

		 * high xinobits, so we use high xinobits to partition the

		 * overlay st_ino address space. The high bits holds the fsid

		 * (upper fsid is 0). This way overlay inode numbers are unique

		 * and all inodes use overlay st_dev. Inode numbers are also

		 * persistent for a given layer configuration.

		 * (upper fsid is 0). The lowest xinobit is reserved for mapping

		 * the non-peresistent inode numbers range in case of overflow.

		 * This way all overlay inode numbers are unique and use the

		 * overlay st_dev.

		 */

		if (stat->ino >> shift) {

			pr_warn_ratelimited("inode number too big (%pd2, ino=%llu, xinobits=%d)\n",

					    dentry, stat->ino, xinobits);

		} else {

			stat->ino |= ((u64)fsid) << shift;

		if (likely(!(stat->ino >> xinoshift))) {

			stat->ino |= ((u64)fsid) << (xinoshift + 1);

			stat->dev = dentry->d_sb->s_dev;

			return 0;

		} else if (ovl_xino_warn(dentry->d_sb)) {

			pr_warn_ratelimited("inode number too big (%pd2, ino=%llu, xinobits=%d)\n",

					    dentry, stat->ino, xinobits);

		}

	}

/*

 * It is possible to stack overlayfs instance on top of another

 * overlayfs instance as lower layer. We need to annonate the

 * overlayfs instance as lower layer. We need to annotate the

 * stackable i_mutex locks according to stack level of the super

 * block instance. An overlayfs instance can never be in stack

 * depth 0 (there is always a real fs below it).  An overlayfs

#endif

}

static void ovl_fill_inode(struct inode *inode, umode_t mode, dev_t rdev,

			   unsigned long ino, int fsid)

static void ovl_next_ino(struct inode *inode)

{

	struct ovl_fs *ofs = inode->i_sb->s_fs_info;

	inode->i_ino = atomic_long_inc_return(&ofs->last_ino);

	if (unlikely(!inode->i_ino))

		inode->i_ino = atomic_long_inc_return(&ofs->last_ino);

}

static void ovl_map_ino(struct inode *inode, unsigned long ino, int fsid)

{

	int xinobits = ovl_xino_bits(inode->i_sb);

	unsigned int xinoshift = 64 - xinobits;

	/*

	 * When d_ino is consistent with st_ino (samefs or i_ino has enough

	 * bits to encode layer), set the same value used for st_ino to i_ino,

	 * so inode number exposed via /proc/locks and a like will be

	 * consistent with d_ino and st_ino values. An i_ino value inconsistent

	 * with d_ino also causes nfsd readdirplus to fail.  When called from

	 * ovl_new_inode(), ino arg is 0, so i_ino will be updated to real

	 * upper inode i_ino on ovl_inode_init() or ovl_inode_update().

	 * with d_ino also causes nfsd readdirplus to fail.

	 */

	if (ovl_same_dev(inode->i_sb)) {

	inode->i_ino = ino;

		if (xinobits && fsid && !(ino >> (64 - xinobits)))

			inode->i_ino |= (unsigned long)fsid << (64 - xinobits);

	} else {

		inode->i_ino = get_next_ino();

	if (ovl_same_fs(inode->i_sb)) {

		return;

	} else if (xinobits && likely(!(ino >> xinoshift))) {

		inode->i_ino |= (unsigned long)fsid << (xinoshift + 1);

		return;

	}

	/*

	 * For directory inodes on non-samefs with xino disabled or xino

	 * overflow, we allocate a non-persistent inode number, to be used for

	 * resolving st_ino collisions in ovl_map_dev_ino().

	 *

	 * To avoid ino collision with legitimate xino values from upper

	 * layer (fsid 0), use the lowest xinobit to map the non

	 * persistent inode numbers to the unified st_ino address space.

	 */

	if (S_ISDIR(inode->i_mode)) {

		ovl_next_ino(inode);

		if (xinobits) {

			inode->i_ino &= ~0UL >> xinobits;

			inode->i_ino |= 1UL << xinoshift;

		}

	}

}

void ovl_inode_init(struct inode *inode, struct ovl_inode_params *oip,

		    unsigned long ino, int fsid)

{

	struct inode *realinode;

	if (oip->upperdentry)

		OVL_I(inode)->__upperdentry = oip->upperdentry;

	if (oip->lowerpath && oip->lowerpath->dentry)

		OVL_I(inode)->lower = igrab(d_inode(oip->lowerpath->dentry));

	if (oip->lowerdata)

		OVL_I(inode)->lowerdata = igrab(d_inode(oip->lowerdata));

	realinode = ovl_inode_real(inode);

	ovl_copyattr(realinode, inode);

	ovl_copyflags(realinode, inode);

	ovl_map_ino(inode, ino, fsid);

}

static void ovl_fill_inode(struct inode *inode, umode_t mode, dev_t rdev)

{

	inode->i_mode = mode;

	inode->i_flags |= S_NOCMTIME;

#ifdef CONFIG_FS_POSIX_ACL

	inode = new_inode(sb);

	if (inode)

		ovl_fill_inode(inode, mode, rdev, 0, 0);

		ovl_fill_inode(inode, mode, rdev);

	return inode;

}

	struct dentry *lowerdentry = lowerpath ? lowerpath->dentry : NULL;

	bool bylower = ovl_hash_bylower(sb, upperdentry, lowerdentry,

					oip->index);

	int fsid = bylower ? oip->lowerpath->layer->fsid : 0;

	int fsid = bylower ? lowerpath->layer->fsid : 0;

	bool is_dir, metacopy = false;

	unsigned long ino = 0;

	int err = oip->newinode ? -EEXIST : -ENOMEM;

			err = -ENOMEM;

			goto out_err;

		}

		ino = realinode->i_ino;

		fsid = lowerpath->layer->fsid;

	}

	ovl_fill_inode(inode, realinode->i_mode, realinode->i_rdev, ino, fsid);

	ovl_inode_init(inode, upperdentry, lowerdentry, oip->lowerdata);

	ovl_fill_inode(inode, realinode->i_mode, realinode->i_rdev);

	ovl_inode_init(inode, oip, ino, fsid);

	if (upperdentry && ovl_is_impuredir(upperdentry))

		ovl_set_flag(OVL_IMPURE, inode);