/*
- * Copyright (c) 2000-2008 Apple Inc. All rights reserved.
+ * Copyright (c) 2000-2015 Apple Inc. All rights reserved.
*
* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
*
#include <sys/time.h>
#include <sys/mount_internal.h>
#include <sys/vnode_internal.h>
+#include <miscfs/specfs/specdev.h>
#include <sys/namei.h>
#include <sys/errno.h>
#include <sys/malloc.h>
static vnode_t cache_lookup_locked(vnode_t dvp, struct componentname *cnp);
static const char *add_name_internal(const char *, uint32_t, u_int, boolean_t, u_int);
-static void init_string_table(void) __attribute__((section("__TEXT, initcode")));
+static void init_string_table(void);
static void cache_delete(struct namecache *, int);
static void cache_enter_locked(vnode_t dvp, vnode_t vp, struct componentname *cnp, const char *strname);
void dump_string_table(void);
#endif /* DUMP_STRING_TABLE */
-static void init_crc32(void) __attribute__((section("__TEXT, initcode")));
+static void init_crc32(void);
static unsigned int crc32tab[256];
#define NCHHASH(dvp, hash_val) \
(&nchashtbl[(dvp->v_id ^ (hash_val)) & nchashmask])
+/*
+ * This function tries to check if a directory vp is a subdirectory of dvp
+ * only from valid v_parent pointers. It is called with the name cache lock
+ * held and does not drop the lock anytime inside the function.
+ *
+ * It returns a boolean that indicates whether or not it was able to
+ * successfully infer the parent/descendent relationship via the v_parent
+ * pointers, or if it could not infer such relationship and that the decision
+ * must be delegated to the owning filesystem.
+ *
+ * If it does not defer the decision, i.e. it was successfuly able to determine
+ * the parent/descendent relationship, *is_subdir tells the caller if vp is a
+ * subdirectory of dvp.
+ *
+ * If the decision is deferred, *next_vp is where it stopped i.e. *next_vp
+ * is the vnode whose parent is to be determined from the filesystem.
+ * *is_subdir, in this case, is not indicative of anything and should be
+ * ignored.
+ *
+ * The return value and output args should be used as follows :
+ *
+ * defer = cache_check_vnode_issubdir(vp, dvp, is_subdir, next_vp);
+ * if (!defer) {
+ * if (*is_subdir)
+ * vp is subdirectory;
+ * else
+ * vp is not a subdirectory;
+ * } else {
+ * if (*next_vp)
+ * check this vnode's parent from the filesystem
+ * else
+ * error (likely because of forced unmount).
+ * }
+ *
+ */
+static boolean_t
+cache_check_vnode_issubdir(vnode_t vp, vnode_t dvp, boolean_t *is_subdir,
+ vnode_t *next_vp)
+{
+ vnode_t tvp = vp;
+ int defer = FALSE;
+
+ *is_subdir = FALSE;
+ *next_vp = NULLVP;
+ while (1) {
+ mount_t tmp;
+
+ if (tvp == dvp) {
+ *is_subdir = TRUE;
+ break;
+ } else if (tvp == rootvnode) {
+ /* *is_subdir = FALSE */
+ break;
+ }
+
+ tmp = tvp->v_mount;
+ while ((tvp->v_flag & VROOT) && tmp && tmp->mnt_vnodecovered &&
+ tvp != dvp && tvp != rootvnode) {
+ tvp = tmp->mnt_vnodecovered;
+ tmp = tvp->v_mount;
+ }
+
+ /*
+ * If dvp is not at the top of a mount "stack" then
+ * vp is not a subdirectory of dvp either.
+ */
+ if (tvp == dvp || tvp == rootvnode) {
+ /* *is_subdir = FALSE */
+ break;
+ }
+
+ if (!tmp) {
+ defer = TRUE;
+ *next_vp = NULLVP;
+ break;
+ }
+
+ if ((tvp->v_flag & VISHARDLINK) || !(tvp->v_parent)) {
+ defer = TRUE;
+ *next_vp = tvp;
+ break;
+ }
+ tvp = tvp->v_parent;
+ }
+
+ return (defer);
+}
+
+/* maximum times retry from potentially transient errors in vnode_issubdir */
+#define MAX_ERROR_RETRY 3
+
+/*
+ * This function checks if a given directory (vp) is a subdirectory of dvp.
+ * It walks backwards from vp and if it hits dvp in its parent chain,
+ * it is a subdirectory. If it encounters the root directory, it is not
+ * a subdirectory.
+ *
+ * This function returns an error if it is unsuccessful and 0 on success.
+ *
+ * On entry (and exit) vp has an iocount and if this function has to take
+ * any iocounts on other vnodes in the parent chain traversal, it releases them.
+ */
+int
+vnode_issubdir(vnode_t vp, vnode_t dvp, int *is_subdir, vfs_context_t ctx)
+{
+ vnode_t start_vp, tvp;
+ vnode_t vp_with_iocount;
+ int error = 0;
+ char dotdotbuf[] = "..";
+ int error_retry_count = 0; /* retry count for potentially transient
+ errors */
+
+ *is_subdir = FALSE;
+ tvp = start_vp = vp;
+ /*
+ * Anytime we acquire an iocount in this function, we save the vnode
+ * in this variable and release it before exiting.
+ */
+ vp_with_iocount = NULLVP;
+
+ while (1) {
+ boolean_t defer;
+ vnode_t pvp;
+ uint32_t vid;
+ struct componentname cn;
+ boolean_t is_subdir_locked = FALSE;
+
+ if (tvp == dvp) {
+ *is_subdir = TRUE;
+ break;
+ } else if (tvp == rootvnode) {
+ /* *is_subdir = FALSE */
+ break;
+ }
+
+ NAME_CACHE_LOCK_SHARED();
+
+ defer = cache_check_vnode_issubdir(tvp, dvp, &is_subdir_locked,
+ &tvp);
+
+ if (defer && tvp)
+ vid = vnode_vid(tvp);
+
+ NAME_CACHE_UNLOCK();
+
+ if (!defer) {
+ *is_subdir = is_subdir_locked;
+ break;
+ }
+
+ if (!tvp) {
+ if (error_retry_count++ < MAX_ERROR_RETRY) {
+ tvp = vp;
+ continue;
+ }
+ error = ENOENT;
+ break;
+ }
+
+ if (tvp != start_vp) {
+ if (vp_with_iocount) {
+ vnode_put(vp_with_iocount);
+ vp_with_iocount = NULLVP;
+ }
+
+ error = vnode_getwithvid(tvp, vid);
+ if (error) {
+ if (error_retry_count++ < MAX_ERROR_RETRY) {
+ tvp = vp;
+ error = 0;
+ continue;
+ }
+ break;
+ }
+
+ vp_with_iocount = tvp;
+ }
+
+ bzero(&cn, sizeof(cn));
+ cn.cn_nameiop = LOOKUP;
+ cn.cn_flags = ISLASTCN | ISDOTDOT;
+ cn.cn_context = ctx;
+ cn.cn_pnbuf = &dotdotbuf[0];
+ cn.cn_pnlen = sizeof(dotdotbuf);
+ cn.cn_nameptr = cn.cn_pnbuf;
+ cn.cn_namelen = 2;
+
+ pvp = NULLVP;
+ if ((error = VNOP_LOOKUP(tvp, &pvp, &cn, ctx)))
+ break;
+
+ if (!(tvp->v_flag & VISHARDLINK) && tvp->v_parent != pvp) {
+ (void)vnode_update_identity(tvp, pvp, NULL, 0, 0,
+ VNODE_UPDATE_PARENT);
+ }
+
+ if (vp_with_iocount)
+ vnode_put(vp_with_iocount);
+
+ vp_with_iocount = tvp = pvp;
+ }
+
+ if (vp_with_iocount)
+ vnode_put(vp_with_iocount);
+
+ return (error);
+}
/*
* This function builds the path to a filename in "buff". The
* If BUILDPATH_NO_FS_ENTER is set in flags, it only uses values present
* in the name cache and does not enter the file system.
*
+ * If BUILDPATH_CHECK_MOVED is set in flags, we return EAGAIN when
+ * we encounter ENOENT during path reconstruction. ENOENT means that
+ * one of the parents moved while we were building the path. The
+ * caller can special handle this case by calling build_path again.
+ *
+ * If BUILDPATH_VOLUME_RELATIVE is set in flags, we return path
+ * that is relative to the nearest mount point, i.e. do not
+ * cross over mount points during building the path.
+ *
* passed in vp must have a valid io_count reference
*/
int
if (first_vp == NULLVP)
return (EINVAL);
+
+ if (buflen <= 1)
+ return (ENOSPC);
/*
* Grab the process fd so we can evaluate fd_rdir.
goto out_unlock;
} else {
- vp = vp->v_mount->mnt_vnodecovered;
+ /*
+ * This the root of the volume and the caller does not
+ * want to cross mount points. Therefore just return
+ * '/' as the relative path.
+ */
+ if (flags & BUILDPATH_VOLUME_RELATIVE) {
+ *--end = '/';
+ goto out_unlock;
+ } else {
+ vp = vp->v_mount->mnt_vnodecovered;
+ }
}
}
* Walk up the parent chain.
*/
if (((vp->v_parent != NULLVP) && !fixhardlink) ||
- (flags & BUILDPATH_NO_FS_ENTER)) {
+ (flags & BUILDPATH_NO_FS_ENTER)) {
+
/*
* In this if () block we are not allowed to enter the filesystem
* to conclusively get the most accurate parent identifier.
* and disallow further path construction
*/
if ((vp->v_parent == NULLVP) && (rootvnode != vp)) {
- /* Only '/' is allowed to have a NULL parent pointer */
- ret = EINVAL;
+ /*
+ * Only '/' is allowed to have a NULL parent
+ * pointer. Upper level callers should ideally
+ * re-drive name lookup on receiving a ENOENT.
+ */
+ ret = ENOENT;
/* The code below will exit early if 'tvp = vp' == NULL */
}
-
vp = vp->v_parent;
-
+
/*
* if the vnode we have in hand isn't a directory and it
* has a v_parent, then we started with the resource fork
* so skip up to avoid getting a duplicate copy of the
* file name in the path.
*/
- if (vp && !vnode_isdir(vp) && vp->v_parent)
+ if (vp && !vnode_isdir(vp) && vp->v_parent) {
vp = vp->v_parent;
+ }
} else {
/*
* No parent, go get it if supported.
if (vp && !vnode_isdir(vp) && vp->v_parent)
vp = vp->v_parent;
}
- /*
- * When a mount point is crossed switch the vp.
- * Continue until we find the root or we find
- * a vnode that's not the root of a mounted
- * file system.
- */
- tvp = vp;
-
- while (tvp) {
- if (tvp == proc_root_dir_vp)
- goto out_unlock; /* encountered the root */
-
- if (!(tvp->v_flag & VROOT) || !tvp->v_mount)
- break; /* not the root of a mounted FS */
- tvp = tvp->v_mount->mnt_vnodecovered;
- }
- if (tvp == NULLVP)
- goto out_unlock;
- vp = tvp;
if (vp && (flags & BUILDPATH_CHECKACCESS)) {
vid = vp->v_id;
NAME_CACHE_LOCK_SHARED();
}
+
+ /*
+ * When a mount point is crossed switch the vp.
+ * Continue until we find the root or we find
+ * a vnode that's not the root of a mounted
+ * file system.
+ */
+ tvp = vp;
+
+ while (tvp) {
+ if (tvp == proc_root_dir_vp)
+ goto out_unlock; /* encountered the root */
+
+ if (!(tvp->v_flag & VROOT) || !tvp->v_mount)
+ break; /* not the root of a mounted FS */
+
+ if (flags & BUILDPATH_VOLUME_RELATIVE) {
+ /* Do not cross over mount points */
+ tvp = NULL;
+ } else {
+ tvp = tvp->v_mount->mnt_vnodecovered;
+ }
+ }
+ if (tvp == NULLVP)
+ goto out_unlock;
+ vp = tvp;
}
out_unlock:
NAME_CACHE_UNLOCK();
*/
*outlen = &buff[buflen] - end;
+ /* One of the parents was moved during path reconstruction.
+ * The caller is interested in knowing whether any of the
+ * parents moved via BUILDPATH_CHECK_MOVED, so return EAGAIN.
+ */
+ if ((ret == ENOENT) && (flags & BUILDPATH_CHECK_MOVED)) {
+ ret = EAGAIN;
+ }
+
return (ret);
}
vfs_removename(name);
}
+static const char unknown_vnodename[] = "(unknown vnode name)";
+
+const char *
+vnode_getname_printable(vnode_t vp)
+{
+ const char *name = vnode_getname(vp);
+ if (name != NULL)
+ return name;
+
+ switch (vp->v_type) {
+ case VCHR:
+ case VBLK:
+ {
+ /*
+ * Create an artificial dev name from
+ * major and minor device number
+ */
+ char dev_name[64];
+ (void) snprintf(dev_name, sizeof(dev_name),
+ "%c(%u, %u)", VCHR == vp->v_type ? 'c':'b',
+ major(vp->v_rdev), minor(vp->v_rdev));
+ /*
+ * Add the newly created dev name to the name
+ * cache to allow easier cleanup. Also,
+ * vfs_addname allocates memory for the new name
+ * and returns it.
+ */
+ NAME_CACHE_LOCK_SHARED();
+ name = vfs_addname(dev_name, strlen(dev_name), 0, 0);
+ NAME_CACHE_UNLOCK();
+ return name;
+ }
+ default:
+ return unknown_vnodename;
+ }
+}
+
+void
+vnode_putname_printable(const char *name)
+{
+ if (name == unknown_vnodename)
+ return;
+ vnode_putname(name);
+}
+
/*
* if VNODE_UPDATE_PARENT, and we can take
while ( (ncp = LIST_FIRST(&vp->v_nclinks)) )
cache_delete(ncp, 1);
- while ( (ncp = LIST_FIRST(&vp->v_ncchildren)) )
+ while ( (ncp = TAILQ_FIRST(&vp->v_ncchildren)) )
cache_delete(ncp, 1);
/*
mount_t mp;
unsigned int hash;
int error = 0;
+ boolean_t dotdotchecked = FALSE;
#if CONFIG_TRIGGERS
vnode_t trigger_vp;
microuptime(&tv);
}
for (;;) {
- /*
+ /*
* Search a directory.
*
* The cn_hash value is for use by cache_lookup
/*
* NAME_CACHE_LOCK holds these fields stable
+ *
+ * We can't cache KAUTH_VNODE_SEARCHBYANYONE for root correctly
+ * so we make an ugly check for root here. root is always
+ * allowed and breaking out of here only to find out that is
+ * authorized by virtue of being root is very very expensive.
*/
if ((dp->v_cred != ucred || !(dp->v_authorized_actions & KAUTH_VNODE_SEARCH)) &&
- !(dp->v_authorized_actions & KAUTH_VNODE_SEARCHBYANYONE))
+ !(dp->v_authorized_actions & KAUTH_VNODE_SEARCHBYANYONE) &&
+ !vfs_context_issuser(ctx))
break;
/*
}
}
+ if ((cnp->cn_flags & CN_SKIPNAMECACHE)) {
+ /*
+ * Force lookup to go to the filesystem with
+ * all cnp fields set up.
+ */
+ break;
+ }
+
/*
* "." and ".." aren't supposed to be cached, so check
* for them before checking the cache.
*/
if (cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.')
vp = dp;
- else if ( (cnp->cn_flags & ISDOTDOT) )
- vp = dp->v_parent;
- else {
+ else if ( (cnp->cn_flags & ISDOTDOT) ) {
+ /*
+ * If this is a chrooted process, we need to check if
+ * the process is trying to break out of its chrooted
+ * jail. We do that by trying to determine if dp is
+ * a subdirectory of ndp->ni_rootdir. If we aren't
+ * able to determine that by the v_parent pointers, we
+ * will leave the fast path.
+ *
+ * Since this function may see dotdot components
+ * many times and it has the name cache lock held for
+ * the entire duration, we optimise this by doing this
+ * check only once per cache_lookup_path call.
+ * If dotdotchecked is set, it means we've done this
+ * check once already and don't need to do it again.
+ */
+ if (!dotdotchecked && (ndp->ni_rootdir != rootvnode)) {
+ vnode_t tvp = dp;
+ boolean_t defer = FALSE;
+ boolean_t is_subdir = FALSE;
+
+ defer = cache_check_vnode_issubdir(tvp,
+ ndp->ni_rootdir, &is_subdir, &tvp);
+
+ if (defer) {
+ /* defer to Filesystem */
+ break;
+ } else if (!is_subdir) {
+ /*
+ * This process is trying to break out
+ * of its chrooted jail, so all its
+ * dotdot accesses will be translated to
+ * its root directory.
+ */
+ vp = ndp->ni_rootdir;
+ } else {
+ /*
+ * All good, let this dotdot access
+ * proceed normally
+ */
+ vp = dp->v_parent;
+ }
+ dotdotchecked = TRUE;
+ } else {
+ vp = dp->v_parent;
+ }
+ } else {
if ( (vp = cache_lookup_locked(dp, cnp)) == NULLVP)
break;
}
if ( (mp = vp->v_mountedhere) && ((cnp->cn_flags & NOCROSSMOUNT) == 0)) {
-
- if (mp->mnt_realrootvp == NULLVP || mp->mnt_generation != mount_generation ||
- mp->mnt_realrootvp_vid != mp->mnt_realrootvp->v_id)
- break;
- vp = mp->mnt_realrootvp;
+ vnode_t tmp_vp = mp->mnt_realrootvp;
+ if (tmp_vp == NULLVP || mp->mnt_generation != mount_generation ||
+ mp->mnt_realrootvp_vid != tmp_vp->v_id)
+ break;
+ vp = tmp_vp;
}
#if CONFIG_TRIGGERS
* trigger in hand, resolve it. Note that we don't need to
* leave the fast path if the mount has already happened.
*/
- if ((vp->v_resolve != NULL) &&
- (vp->v_resolve->vr_resolve_func != NULL)) {
+ if (vp->v_resolve)
break;
- }
#endif /* CONFIG_TRIGGERS */
* immediately w/o waiting... it always succeeds
*/
vnode_get(dp);
- } else if ( (vnode_getwithvid_drainok(dp, vid)) ) {
+ } else if ((error = vnode_getwithvid_drainok(dp, vid))) {
/*
* failure indicates the vnode
* changed identity or is being
* don't necessarily return ENOENT, though, because
* we really want to go back to disk and make sure it's
* there or not if someone else is changing this
- * vnode.
+ * vnode. That being said, the one case where we do want
+ * to return ENOENT is when the vnode's mount point is
+ * in the process of unmounting and we might cause a deadlock
+ * in our attempt to take an iocount. An ENODEV error return
+ * is from vnode_get* is an indication this but we change that
+ * ENOENT for upper layers.
*/
- error = ERECYCLE;
+ if (error == ENODEV) {
+ error = ENOENT;
+ } else {
+ error = ERECYCLE;
+ }
goto errorout;
}
}
struct namecache *ncp;
struct nchashhead *ncpp;
long namelen = cnp->cn_namelen;
- unsigned int hashval = (cnp->cn_hash & NCHASHMASK);
+ unsigned int hashval = cnp->cn_hash;
if (nc_disabled) {
return NULL;
}
+unsigned int hash_string(const char *cp, int len);
//
// Have to take a len argument because we may only need to
// hash part of a componentname.
//
-static unsigned int
+unsigned int
hash_string(const char *cp, int len)
{
unsigned hash = 0;
if (cnp->cn_hash == 0)
cnp->cn_hash = hash_string(cnp->cn_nameptr, cnp->cn_namelen);
- hashval = (cnp->cn_hash & NCHASHMASK);
+ hashval = cnp->cn_hash;
if (nc_disabled) {
return 0;
/*
* We found a "negative" match, ENOENT notifies client of this match.
- * The nc_whiteout field records whether this is a whiteout.
*/
NCHSTAT(ncs_neghits);
- if (ncp->nc_whiteout)
- cnp->cn_flags |= ISWHITEOUT;
NAME_CACHE_UNLOCK();
return (ENOENT);
}
ncp->nc_vp = vp;
ncp->nc_dvp = dvp;
ncp->nc_hashval = cnp->cn_hash;
- ncp->nc_whiteout = FALSE;
if (strname == NULL)
ncp->nc_name = add_name_internal(cnp->cn_nameptr, cnp->cn_namelen, cnp->cn_hash, FALSE, 0);
else
ncp->nc_name = strname;
+
+ //
+ // If the bytes of the name associated with the vnode differ,
+ // use the name associated with the vnode since the file system
+ // may have set that explicitly in the case of a lookup on a
+ // case-insensitive file system where the case of the looked up
+ // name differs from what is on disk. For more details, see:
+ // <rdar://problem/8044697> FSEvents doesn't always decompose diacritical unicode chars in the paths of the changed directories
+ //
+ const char *vn_name = vp ? vp->v_name : NULL;
+ unsigned int len = vn_name ? strlen(vn_name) : 0;
+ if (vn_name && ncp && ncp->nc_name && strncmp(ncp->nc_name, vn_name, len) != 0) {
+ unsigned int hash = hash_string(vn_name, len);
+
+ vfs_removename(ncp->nc_name);
+ ncp->nc_name = add_name_internal(vn_name, len, hash, FALSE, 0);
+ ncp->nc_hashval = hash;
+ }
+
/*
* make us the newest entry in the cache
* i.e. we'll be the last to be stolen
} else {
/*
* this is a negative cache entry (vp == NULL)
- * stick it on the negative cache list
- * and record the whiteout state
+ * stick it on the negative cache list.
*/
TAILQ_INSERT_TAIL(&neghead, ncp, nc_un.nc_negentry);
- if (cnp->cn_flags & ISWHITEOUT)
- ncp->nc_whiteout = TRUE;
ncs_negtotal++;
if (ncs_negtotal > desiredNegNodes) {
* add us to the list of name cache entries that
* are children of dvp
*/
- LIST_INSERT_HEAD(&dvp->v_ncchildren, ncp, nc_child);
+ if (vp)
+ TAILQ_INSERT_TAIL(&dvp->v_ncchildren, ncp, nc_child);
+ else
+ TAILQ_INSERT_HEAD(&dvp->v_ncchildren, ncp, nc_child);
}
TAILQ_REMOVE(&neghead, ncp, nc_un.nc_negentry);
ncs_negtotal--;
}
- LIST_REMOVE(ncp, nc_child);
+ TAILQ_REMOVE(&(ncp->nc_dvp->v_ncchildren), ncp, nc_child);
LIST_REMOVE(ncp, nc_hash);
/*
kauth_cred_t tcred = NULL;
if ((LIST_FIRST(&vp->v_nclinks) == NULL) &&
- (LIST_FIRST(&vp->v_ncchildren) == NULL) &&
+ (TAILQ_FIRST(&vp->v_ncchildren) == NULL) &&
(vp->v_cred == NOCRED) &&
(vp->v_parent == NULLVP))
return;
while ( (ncp = LIST_FIRST(&vp->v_nclinks)) )
cache_delete(ncp, 1);
- while ( (ncp = LIST_FIRST(&vp->v_ncchildren)) )
+ while ( (ncp = TAILQ_FIRST(&vp->v_ncchildren)) )
cache_delete(ncp, 1);
/*
NAME_CACHE_LOCK();
- LIST_FOREACH_SAFE(ncp, &vp->v_ncchildren, nc_child, next_ncp)
- if (ncp->nc_vp == NULL)
- cache_delete(ncp , 1);
+ TAILQ_FOREACH_SAFE(ncp, &vp->v_ncchildren, nc_child, next_ncp) {
+ if (ncp->nc_vp)
+ break;
+
+ cache_delete(ncp, 1);
+ }
NAME_CACHE_UNLOCK();
}
uint32_t lock_index;
char *ptr;
+ if (len > MAXPATHLEN)
+ len = MAXPATHLEN;
+
/*
* if the length already accounts for the null-byte, then
* subtract one so later on we don't index past the end
projects / apple / xnu.git / blobdiff