1	/*
2	FUSE: Filesystem in Userspace
3	Copyright (C) 2001-2008 Miklos Szeredi <miklos@szeredi.hu>
4
5	This program can be distributed under the terms of the GNU GPL.
6	See the file COPYING.
7	*/
8
9	#include "fuse_i.h"
10
11	#include <linux/pagemap.h>
12	#include <linux/file.h>
13	#include <linux/fs_context.h>
14	#include <linux/moduleparam.h>
15	#include <linux/sched.h>
16	#include <linux/namei.h>
17	#include <linux/slab.h>
18	#include <linux/xattr.h>
19	#include <linux/iversion.h>
20	#include <linux/posix_acl.h>
21	#include <linux/security.h>
22	#include <linux/types.h>
23	#include <linux/kernel.h>
24
25	static bool __read_mostly allow_sys_admin_access;
26	module_param(allow_sys_admin_access, bool, 0644);
27	MODULE_PARM_DESC(allow_sys_admin_access,
28	"Allow users with CAP_SYS_ADMIN in initial userns to bypass allow_other access check");
29
30	struct dentry_bucket {
31	struct rb_root tree;
32	spinlock_t lock;
33	};
34
35	#define FUSE_HASH_BITS 5
36	#define FUSE_HASH_SIZE (1 << FUSE_HASH_BITS)
37	static struct dentry_bucket dentry_hash[FUSE_HASH_SIZE];
38	struct delayed_work dentry_tree_work;
39
40	/* Minimum invalidation work queue frequency */
41	#define FUSE_DENTRY_INVAL_FREQ_MIN 5
42
43	unsigned __read_mostly inval_wq;
44	static int inval_wq_set(const char *val, const struct kernel_param *kp)
45	{
46	unsigned int num;
47	unsigned int old = inval_wq;
48	int ret;
49
50	if (!val)
51	return -EINVAL;
52
53	ret = kstrtouint(s: val, base: 0, res: &num);
54	if (ret)
55	return ret;
56
57	if ((num < FUSE_DENTRY_INVAL_FREQ_MIN) && (num != 0))
58	return -EINVAL;
59
60	/* This should prevent overflow in secs_to_jiffies() */
61	if (num > USHRT_MAX)
62	return -EINVAL;
63
64	*((unsigned int *)kp->arg) = num;
65
66	if (num && !old)
67	schedule_delayed_work(dwork: &dentry_tree_work,
68	secs_to_jiffies(num));
69	else if (!num && old)
70	cancel_delayed_work_sync(dwork: &dentry_tree_work);
71
72	return 0;
73	}
74	static const struct kernel_param_ops inval_wq_ops = {
75	.set = inval_wq_set,
76	.get = param_get_uint,
77	};
78	module_param_cb(inval_wq, &inval_wq_ops, &inval_wq, 0644);
79	__MODULE_PARM_TYPE(inval_wq, "uint");
80	MODULE_PARM_DESC(inval_wq,
81	"Dentries invalidation work queue period in secs (>= "
82	__stringify(FUSE_DENTRY_INVAL_FREQ_MIN) ").");
83
84	static inline struct dentry_bucket *get_dentry_bucket(struct dentry *dentry)
85	{
86	int i = hash_ptr(ptr: dentry, FUSE_HASH_BITS);
87
88	return &dentry_hash[i];
89	}
90
91	static void fuse_advise_use_readdirplus(struct inode *dir)
92	{
93	struct fuse_inode *fi = get_fuse_inode(inode: dir);
94
95	set_bit(nr: FUSE_I_ADVISE_RDPLUS, addr: &fi->state);
96	}
97
98	struct fuse_dentry {
99	u64 time;
100	union {
101	struct rcu_head rcu;
102	struct rb_node node;
103	};
104	struct dentry *dentry;
105	};
106
107	static void __fuse_dentry_tree_del_node(struct fuse_dentry *fd,
108	struct dentry_bucket *bucket)
109	{
110	if (!RB_EMPTY_NODE(&fd->node)) {
111	rb_erase(&fd->node, &bucket->tree);
112	RB_CLEAR_NODE(&fd->node);
113	}
114	}
115
116	static void fuse_dentry_tree_del_node(struct dentry *dentry)
117	{
118	struct fuse_dentry *fd = dentry->d_fsdata;
119	struct dentry_bucket *bucket = get_dentry_bucket(dentry);
120
121	spin_lock(lock: &bucket->lock);
122	__fuse_dentry_tree_del_node(fd, bucket);
123	spin_unlock(lock: &bucket->lock);
124	}
125
126	static void fuse_dentry_tree_add_node(struct dentry *dentry)
127	{
128	struct fuse_dentry *fd = dentry->d_fsdata;
129	struct dentry_bucket *bucket;
130	struct fuse_dentry *cur;
131	struct rb_node **p, *parent = NULL;
132
133	if (!inval_wq)
134	return;
135
136	bucket = get_dentry_bucket(dentry);
137
138	spin_lock(lock: &bucket->lock);
139
140	__fuse_dentry_tree_del_node(fd, bucket);
141
142	p = &bucket->tree.rb_node;
143	while (*p) {
144	parent = *p;
145	cur = rb_entry(*p, struct fuse_dentry, node);
146	if (fd->time < cur->time)
147	p = &(*p)->rb_left;
148	else
149	p = &(*p)->rb_right;
150	}
151	rb_link_node(node: &fd->node, parent, rb_link: p);
152	rb_insert_color(&fd->node, &bucket->tree);
153	spin_unlock(lock: &bucket->lock);
154	}
155
156	/*
157	* work queue which, when enabled, will periodically check for expired dentries
158	* in the dentries tree.
159	*/
160	static void fuse_dentry_tree_work(struct work_struct *work)
161	{
162	LIST_HEAD(dispose);
163	struct fuse_dentry *fd;
164	struct rb_node *node;
165	int i;
166
167	for (i = 0; i < FUSE_HASH_SIZE; i++) {
168	spin_lock(lock: &dentry_hash[i].lock);
169	node = rb_first(root: &dentry_hash[i].tree);
170	while (node) {
171	fd = rb_entry(node, struct fuse_dentry, node);
172	if (!time_before64(fd->time, get_jiffies_64()))
173	break;
174
175	rb_erase(&fd->node, &dentry_hash[i].tree);
176	RB_CLEAR_NODE(&fd->node);
177	spin_lock(lock: &fd->dentry->d_lock);
178	/* If dentry is still referenced, let next dput release it */
179	fd->dentry->d_flags |= DCACHE_OP_DELETE;
180	spin_unlock(lock: &fd->dentry->d_lock);
181	d_dispose_if_unused(fd->dentry, &dispose);
182	if (need_resched()) {
183	spin_unlock(lock: &dentry_hash[i].lock);
184	cond_resched();
185	spin_lock(lock: &dentry_hash[i].lock);
186	}
187	node = rb_first(root: &dentry_hash[i].tree);
188	}
189	spin_unlock(lock: &dentry_hash[i].lock);
190	}
191	shrink_dentry_list(&dispose);
192
193	if (inval_wq)
194	schedule_delayed_work(dwork: &dentry_tree_work,
195	secs_to_jiffies(inval_wq));
196	}
197
198	void fuse_epoch_work(struct work_struct *work)
199	{
200	struct fuse_conn *fc = container_of(work, struct fuse_conn,
201	epoch_work);
202	struct fuse_mount *fm;
203	struct inode *inode;
204
205	down_read(sem: &fc->killsb);
206
207	inode = fuse_ilookup(fc, FUSE_ROOT_ID, fm: &fm);
208	if (inode) {
209	iput(inode);
210	/* Remove all possible active references to cached inodes */
211	shrink_dcache_sb(fm->sb);
212	} else
213	pr_warn("Failed to get root inode");
214
215	up_read(sem: &fc->killsb);
216	}
217
218	void fuse_dentry_tree_init(void)
219	{
220	int i;
221
222	for (i = 0; i < FUSE_HASH_SIZE; i++) {
223	spin_lock_init(&dentry_hash[i].lock);
224	dentry_hash[i].tree = RB_ROOT;
225	}
226	INIT_DELAYED_WORK(&dentry_tree_work, fuse_dentry_tree_work);
227	}
228
229	void fuse_dentry_tree_cleanup(void)
230	{
231	int i;
232
233	inval_wq = 0;
234	cancel_delayed_work_sync(dwork: &dentry_tree_work);
235
236	for (i = 0; i < FUSE_HASH_SIZE; i++)
237	WARN_ON_ONCE(!RB_EMPTY_ROOT(&dentry_hash[i].tree));
238	}
239
240	static inline void __fuse_dentry_settime(struct dentry *dentry, u64 time)
241	{
242	((struct fuse_dentry *) dentry->d_fsdata)->time = time;
243	}
244
245	static inline u64 fuse_dentry_time(const struct dentry *entry)
246	{
247	return ((struct fuse_dentry *) entry->d_fsdata)->time;
248	}
249
250	static void fuse_dentry_settime(struct dentry *dentry, u64 time)
251	{
252	struct fuse_conn *fc = get_fuse_conn_super(sb: dentry->d_sb);
253	bool delete = !time && fc->delete_stale;
254	/*
255	* Mess with DCACHE_OP_DELETE because dput() will be faster without it.
256	* Don't care about races, either way it's just an optimization
257	*/
258	if ((!delete && (dentry->d_flags & DCACHE_OP_DELETE)) ||
259	(delete && !(dentry->d_flags & DCACHE_OP_DELETE))) {
260	spin_lock(lock: &dentry->d_lock);
261	if (!delete)
262	dentry->d_flags &= ~DCACHE_OP_DELETE;
263	else
264	dentry->d_flags |= DCACHE_OP_DELETE;
265	spin_unlock(lock: &dentry->d_lock);
266	}
267
268	__fuse_dentry_settime(dentry, time);
269	fuse_dentry_tree_add_node(dentry);
270	}
271
272	/*
273	* FUSE caches dentries and attributes with separate timeout. The
274	* time in jiffies until the dentry/attributes are valid is stored in
275	* dentry->d_fsdata and fuse_inode->i_time respectively.
276	*/
277
278	/*
279	* Calculate the time in jiffies until a dentry/attributes are valid
280	*/
281	u64 fuse_time_to_jiffies(u64 sec, u32 nsec)
282	{
283	if (sec || nsec) {
284	struct timespec64 ts = {
285	sec,
286	min_t(u32, nsec, NSEC_PER_SEC - 1)
287	};
288
289	return get_jiffies_64() + timespec64_to_jiffies(value: &ts);
290	} else
291	return 0;
292	}
293
294	/*
295	* Set dentry and possibly attribute timeouts from the lookup/mk*
296	* replies
297	*/
298	void fuse_change_entry_timeout(struct dentry *entry, struct fuse_entry_out *o)
299	{
300	fuse_dentry_settime(dentry: entry,
301	time: fuse_time_to_jiffies(sec: o->entry_valid, nsec: o->entry_valid_nsec));
302	}
303
304	void fuse_invalidate_attr_mask(struct inode *inode, u32 mask)
305	{
306	set_mask_bits(&get_fuse_inode(inode)->inval_mask, 0, mask);
307	}
308
309	/*
310	* Mark the attributes as stale, so that at the next call to
311	* ->getattr() they will be fetched from userspace
312	*/
313	void fuse_invalidate_attr(struct inode *inode)
314	{
315	fuse_invalidate_attr_mask(inode, STATX_BASIC_STATS);
316	}
317
318	static void fuse_dir_changed(struct inode *dir)
319	{
320	fuse_invalidate_attr(inode: dir);
321	inode_maybe_inc_iversion(inode: dir, force: false);
322	}
323
324	/*
325	* Mark the attributes as stale due to an atime change. Avoid the invalidate if
326	* atime is not used.
327	*/
328	void fuse_invalidate_atime(struct inode *inode)
329	{
330	if (!IS_RDONLY(inode))
331	fuse_invalidate_attr_mask(inode, STATX_ATIME);
332	}
333
334	/*
335	* Just mark the entry as stale, so that a next attempt to look it up
336	* will result in a new lookup call to userspace
337	*
338	* This is called when a dentry is about to become negative and the
339	* timeout is unknown (unlink, rmdir, rename and in some cases
340	* lookup)
341	*/
342	void fuse_invalidate_entry_cache(struct dentry *entry)
343	{
344	fuse_dentry_settime(dentry: entry, time: 0);
345	}
346
347	/*
348	* Same as fuse_invalidate_entry_cache(), but also try to remove the
349	* dentry from the hash
350	*/
351	static void fuse_invalidate_entry(struct dentry *entry)
352	{
353	d_invalidate(entry);
354	fuse_invalidate_entry_cache(entry);
355	}
356
357	static void fuse_lookup_init(struct fuse_conn *fc, struct fuse_args *args,
358	u64 nodeid, const struct qstr *name,
359	struct fuse_entry_out *outarg)
360	{
361	memset(outarg, 0, sizeof(struct fuse_entry_out));
362	args->opcode = FUSE_LOOKUP;
363	args->nodeid = nodeid;
364	args->in_numargs = 3;
365	fuse_set_zero_arg0(args);
366	args->in_args[1].size = name->len;
367	args->in_args[1].value = name->name;
368	args->in_args[2].size = 1;
369	args->in_args[2].value = "";
370	args->out_numargs = 1;
371	args->out_args[0].size = sizeof(struct fuse_entry_out);
372	args->out_args[0].value = outarg;
373	}
374
375	/*
376	* Check whether the dentry is still valid
377	*
378	* If the entry validity timeout has expired and the dentry is
379	* positive, try to redo the lookup. If the lookup results in a
380	* different inode, then let the VFS invalidate the dentry and redo
381	* the lookup once more. If the lookup results in the same inode,
382	* then refresh the attributes, timeouts and mark the dentry valid.
383	*/
384	static int fuse_dentry_revalidate(struct inode *dir, const struct qstr *name,
385	struct dentry *entry, unsigned int flags)
386	{
387	struct inode *inode;
388	struct fuse_mount *fm;
389	struct fuse_conn *fc;
390	struct fuse_inode *fi;
391	int ret;
392
393	fc = get_fuse_conn_super(sb: dir->i_sb);
394	if (entry->d_time < atomic_read(v: &fc->epoch))
395	goto invalid;
396
397	inode = d_inode_rcu(dentry: entry);
398	if (inode && fuse_is_bad(inode))
399	goto invalid;
400	else if (time_before64(fuse_dentry_time(entry), get_jiffies_64()) ||
401	(flags & (LOOKUP_EXCL | LOOKUP_REVAL | LOOKUP_RENAME_TARGET))) {
402	struct fuse_entry_out outarg;
403	FUSE_ARGS(args);
404	struct fuse_forget_link *forget;
405	u64 attr_version;
406
407	/* For negative dentries, always do a fresh lookup */
408	if (!inode)
409	goto invalid;
410
411	ret = -ECHILD;
412	if (flags & LOOKUP_RCU)
413	goto out;
414
415	fm = get_fuse_mount(inode);
416
417	forget = fuse_alloc_forget();
418	ret = -ENOMEM;
419	if (!forget)
420	goto out;
421
422	attr_version = fuse_get_attr_version(fc: fm->fc);
423
424	fuse_lookup_init(fc: fm->fc, args: &args, nodeid: get_node_id(inode: dir),
425	name, outarg: &outarg);
426	ret = fuse_simple_request(fm, args: &args);
427	/* Zero nodeid is same as -ENOENT */
428	if (!ret && !outarg.nodeid)
429	ret = -ENOENT;
430	if (!ret) {
431	fi = get_fuse_inode(inode);
432	if (outarg.nodeid != get_node_id(inode) ||
433	(bool) IS_AUTOMOUNT(inode) != (bool) (outarg.attr.flags & FUSE_ATTR_SUBMOUNT)) {
434	fuse_queue_forget(fc: fm->fc, forget,
435	nodeid: outarg.nodeid, nlookup: 1);
436	goto invalid;
437	}
438	spin_lock(lock: &fi->lock);
439	fi->nlookup++;
440	spin_unlock(lock: &fi->lock);
441	}
442	kfree(objp: forget);
443	if (ret == -ENOMEM || ret == -EINTR)
444	goto out;
445	if (ret || fuse_invalid_attr(attr: &outarg.attr) ||
446	fuse_stale_inode(inode, generation: outarg.generation, attr: &outarg.attr))
447	goto invalid;
448
449	forget_all_cached_acls(inode);
450	fuse_change_attributes(inode, attr: &outarg.attr, NULL,
451	ATTR_TIMEOUT(&outarg),
452	attr_version);
453	fuse_change_entry_timeout(entry, o: &outarg);
454	} else if (inode) {
455	fi = get_fuse_inode(inode);
456	if (flags & LOOKUP_RCU) {
457	if (test_bit(FUSE_I_INIT_RDPLUS, &fi->state))
458	return -ECHILD;
459	} else if (test_and_clear_bit(nr: FUSE_I_INIT_RDPLUS, addr: &fi->state)) {
460	fuse_advise_use_readdirplus(dir);
461	}
462	}
463	ret = 1;
464	out:
465	return ret;
466
467	invalid:
468	ret = 0;
469	goto out;
470	}
471
472	static int fuse_dentry_init(struct dentry *dentry)
473	{
474	struct fuse_dentry *fd;
475
476	fd = kzalloc(sizeof(struct fuse_dentry),
477	GFP_KERNEL_ACCOUNT | __GFP_RECLAIMABLE);
478	if (!fd)
479	return -ENOMEM;
480
481	fd->dentry = dentry;
482	RB_CLEAR_NODE(&fd->node);
483	dentry->d_fsdata = fd;
484
485	return 0;
486	}
487
488	static void fuse_dentry_release(struct dentry *dentry)
489	{
490	struct fuse_dentry *fd = dentry->d_fsdata;
491
492	if (!RB_EMPTY_NODE(&fd->node))
493	fuse_dentry_tree_del_node(dentry);
494	kfree_rcu(fd, rcu);
495	}
496
497	static int fuse_dentry_delete(const struct dentry *dentry)
498	{
499	return time_before64(fuse_dentry_time(dentry), get_jiffies_64());
500	}
501
502	/*
503	* Create a fuse_mount object with a new superblock (with path->dentry
504	* as the root), and return that mount so it can be auto-mounted on
505	* @path.
506	*/
507	static struct vfsmount *fuse_dentry_automount(struct path *path)
508	{
509	struct fs_context *fsc;
510	struct vfsmount *mnt;
511	struct fuse_inode *mp_fi = get_fuse_inode(inode: d_inode(dentry: path->dentry));
512
513	fsc = fs_context_for_submount(fs_type: path->mnt->mnt_sb->s_type, reference: path->dentry);
514	if (IS_ERR(ptr: fsc))
515	return ERR_CAST(ptr: fsc);
516
517	/* Pass the FUSE inode of the mount for fuse_get_tree_submount() */
518	fsc->fs_private = mp_fi;
519
520	/* Create the submount */
521	mnt = fc_mount(fc: fsc);
522	put_fs_context(fc: fsc);
523	return mnt;
524	}
525
526	const struct dentry_operations fuse_dentry_operations = {
527	.d_revalidate = fuse_dentry_revalidate,
528	.d_delete = fuse_dentry_delete,
529	.d_init = fuse_dentry_init,
530	.d_release = fuse_dentry_release,
531	.d_automount = fuse_dentry_automount,
532	};
533
534	int fuse_valid_type(int m)
535	{
536	return S_ISREG(m) || S_ISDIR(m) || S_ISLNK(m) || S_ISCHR(m) ||
537	S_ISBLK(m) || S_ISFIFO(m) || S_ISSOCK(m);
538	}
539
540	static bool fuse_valid_size(u64 size)
541	{
542	return size <= LLONG_MAX;
543	}
544
545	bool fuse_invalid_attr(struct fuse_attr *attr)
546	{
547	return !fuse_valid_type(m: attr->mode) || !fuse_valid_size(size: attr->size);
548	}
549
550	int fuse_lookup_name(struct super_block *sb, u64 nodeid, const struct qstr *name,
551	struct fuse_entry_out *outarg, struct inode **inode)
552	{
553	struct fuse_mount *fm = get_fuse_mount_super(sb);
554	FUSE_ARGS(args);
555	struct fuse_forget_link *forget;
556	u64 attr_version, evict_ctr;
557	int err;
558
559	*inode = NULL;
560	err = -ENAMETOOLONG;
561	if (name->len > fm->fc->name_max)
562	goto out;
563
564
565	forget = fuse_alloc_forget();
566	err = -ENOMEM;
567	if (!forget)
568	goto out;
569
570	attr_version = fuse_get_attr_version(fc: fm->fc);
571	evict_ctr = fuse_get_evict_ctr(fc: fm->fc);
572
573	fuse_lookup_init(fc: fm->fc, args: &args, nodeid, name, outarg);
574	err = fuse_simple_request(fm, args: &args);
575	/* Zero nodeid is same as -ENOENT, but with valid timeout */
576	if (err || !outarg->nodeid)
577	goto out_put_forget;
578
579	err = -EIO;
580	if (fuse_invalid_attr(attr: &outarg->attr))
581	goto out_put_forget;
582	if (outarg->nodeid == FUSE_ROOT_ID && outarg->generation != 0) {
583	pr_warn_once("root generation should be zero\n");
584	outarg->generation = 0;
585	}
586
587	*inode = fuse_iget(sb, nodeid: outarg->nodeid, generation: outarg->generation,
588	attr: &outarg->attr, ATTR_TIMEOUT(outarg),
589	attr_version, evict_ctr);
590	err = -ENOMEM;
591	if (!*inode) {
592	fuse_queue_forget(fc: fm->fc, forget, nodeid: outarg->nodeid, nlookup: 1);
593	goto out;
594	}
595	err = 0;
596
597	out_put_forget:
598	kfree(objp: forget);
599	out:
600	return err;
601	}
602
603	static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
604	unsigned int flags)
605	{
606	struct fuse_entry_out outarg;
607	struct fuse_conn *fc;
608	struct inode *inode;
609	struct dentry *newent;
610	int err, epoch;
611	bool outarg_valid = true;
612	bool locked;
613
614	if (fuse_is_bad(inode: dir))
615	return ERR_PTR(error: -EIO);
616
617	fc = get_fuse_conn_super(sb: dir->i_sb);
618	epoch = atomic_read(v: &fc->epoch);
619
620	locked = fuse_lock_inode(inode: dir);
621	err = fuse_lookup_name(sb: dir->i_sb, nodeid: get_node_id(inode: dir), name: &entry->d_name,
622	outarg: &outarg, inode: &inode);
623	fuse_unlock_inode(inode: dir, locked);
624	if (err == -ENOENT) {
625	outarg_valid = false;
626	err = 0;
627	}
628	if (err)
629	goto out_err;
630
631	err = -EIO;
632	if (inode && get_node_id(inode) == FUSE_ROOT_ID)
633	goto out_iput;
634
635	newent = d_splice_alias(inode, entry);
636	err = PTR_ERR(ptr: newent);
637	if (IS_ERR(ptr: newent))
638	goto out_err;
639
640	entry = newent ? newent : entry;
641	entry->d_time = epoch;
642	if (outarg_valid)
643	fuse_change_entry_timeout(entry, o: &outarg);
644	else
645	fuse_invalidate_entry_cache(entry);
646
647	if (inode)
648	fuse_advise_use_readdirplus(dir);
649	return newent;
650
651	out_iput:
652	iput(inode);
653	out_err:
654	return ERR_PTR(error: err);
655	}
656
657	static int get_security_context(struct dentry *entry, umode_t mode,
658	struct fuse_in_arg *ext)
659	{
660	struct fuse_secctx *fctx;
661	struct fuse_secctx_header *header;
662	struct lsm_context lsmctx = { };
663	void *ptr;
664	u32 total_len = sizeof(*header);
665	int err, nr_ctx = 0;
666	const char *name = NULL;
667	size_t namesize;
668
669	err = security_dentry_init_security(dentry: entry, mode, name: &entry->d_name,
670	xattr_name: &name, lsmcxt: &lsmctx);
671
672	/* If no LSM is supporting this security hook ignore error */
673	if (err && err != -EOPNOTSUPP)
674	goto out_err;
675
676	if (lsmctx.len) {
677	nr_ctx = 1;
678	namesize = strlen(name) + 1;
679	err = -EIO;
680	if (WARN_ON(namesize > XATTR_NAME_MAX + 1 ||
681	lsmctx.len > S32_MAX))
682	goto out_err;
683	total_len += FUSE_REC_ALIGN(sizeof(*fctx) + namesize +
684	lsmctx.len);
685	}
686
687	err = -ENOMEM;
688	header = ptr = kzalloc(total_len, GFP_KERNEL);
689	if (!ptr)
690	goto out_err;
691
692	header->nr_secctx = nr_ctx;
693	header->size = total_len;
694	ptr += sizeof(*header);
695	if (nr_ctx) {
696	fctx = ptr;
697	fctx->size = lsmctx.len;
698	ptr += sizeof(*fctx);
699
700	strscpy(ptr, name, namesize);
701	ptr += namesize;
702
703	memcpy(ptr, lsmctx.context, lsmctx.len);
704	}
705	ext->size = total_len;
706	ext->value = header;
707	err = 0;
708	out_err:
709	if (nr_ctx)
710	security_release_secctx(cp: &lsmctx);
711	return err;
712	}
713
714	static void *extend_arg(struct fuse_in_arg *buf, u32 bytes)
715	{
716	void *p;
717	u32 newlen = buf->size + bytes;
718
719	p = krealloc(buf->value, newlen, GFP_KERNEL);
720	if (!p) {
721	kfree(objp: buf->value);
722	buf->size = 0;
723	buf->value = NULL;
724	return NULL;
725	}
726
727	memset(p + buf->size, 0, bytes);
728	buf->value = p;
729	buf->size = newlen;
730
731	return p + newlen - bytes;
732	}
733
734	static u32 fuse_ext_size(size_t size)
735	{
736	return FUSE_REC_ALIGN(sizeof(struct fuse_ext_header) + size);
737	}
738
739	/*
740	* This adds just a single supplementary group that matches the parent's group.
741	*/
742	static int get_create_supp_group(struct mnt_idmap *idmap,
743	struct inode *dir,
744	struct fuse_in_arg *ext)
745	{
746	struct fuse_conn *fc = get_fuse_conn(inode: dir);
747	struct fuse_ext_header *xh;
748	struct fuse_supp_groups *sg;
749	kgid_t kgid = dir->i_gid;
750	vfsgid_t vfsgid = make_vfsgid(idmap, fs_userns: fc->user_ns, kgid);
751	gid_t parent_gid = from_kgid(to: fc->user_ns, gid: kgid);
752
753	u32 sg_len = fuse_ext_size(size: sizeof(*sg) + sizeof(sg->groups[0]));
754
755	if (parent_gid == (gid_t) -1 || vfsgid_eq_kgid(vfsgid, current_fsgid()) ||
756	!vfsgid_in_group_p(vfsgid))
757	return 0;
758
759	xh = extend_arg(buf: ext, bytes: sg_len);
760	if (!xh)
761	return -ENOMEM;
762
763	xh->size = sg_len;
764	xh->type = FUSE_EXT_GROUPS;
765
766	sg = (struct fuse_supp_groups *) &xh[1];
767	sg->nr_groups = 1;
768	sg->groups[0] = parent_gid;
769
770	return 0;
771	}
772
773	static int get_create_ext(struct mnt_idmap *idmap,
774	struct fuse_args *args,
775	struct inode *dir, struct dentry *dentry,
776	umode_t mode)
777	{
778	struct fuse_conn *fc = get_fuse_conn_super(sb: dentry->d_sb);
779	struct fuse_in_arg ext = { .size = 0, .value = NULL };
780	int err = 0;
781
782	if (fc->init_security)
783	err = get_security_context(entry: dentry, mode, ext: &ext);
784	if (!err && fc->create_supp_group)
785	err = get_create_supp_group(idmap, dir, ext: &ext);
786
787	if (!err && ext.size) {
788	WARN_ON(args->in_numargs >= ARRAY_SIZE(args->in_args));
789	args->is_ext = true;
790	args->ext_idx = args->in_numargs++;
791	args->in_args[args->ext_idx] = ext;
792	} else {
793	kfree(objp: ext.value);
794	}
795
796	return err;
797	}
798
799	static void free_ext_value(struct fuse_args *args)
800	{
801	if (args->is_ext)
802	kfree(objp: args->in_args[args->ext_idx].value);
803	}
804
805	/*
806	* Atomic create+open operation
807	*
808	* If the filesystem doesn't support this, then fall back to separate
809	* 'mknod' + 'open' requests.
810	*/
811	static int fuse_create_open(struct mnt_idmap *idmap, struct inode *dir,
812	struct dentry *entry, struct file *file,
813	unsigned int flags, umode_t mode, u32 opcode)
814	{
815	struct inode *inode;
816	struct fuse_mount *fm = get_fuse_mount(inode: dir);
817	FUSE_ARGS(args);
818	struct fuse_forget_link *forget;
819	struct fuse_create_in inarg;
820	struct fuse_open_out *outopenp;
821	struct fuse_entry_out outentry;
822	struct fuse_inode *fi;
823	struct fuse_file *ff;
824	int epoch, err;
825	bool trunc = flags & O_TRUNC;
826
827	/* Userspace expects S_IFREG in create mode */
828	BUG_ON((mode & S_IFMT) != S_IFREG);
829
830	epoch = atomic_read(v: &fm->fc->epoch);
831	forget = fuse_alloc_forget();
832	err = -ENOMEM;
833	if (!forget)
834	goto out_err;
835
836	err = -ENOMEM;
837	ff = fuse_file_alloc(fm, release: true);
838	if (!ff)
839	goto out_put_forget_req;
840
841	if (!fm->fc->dont_mask)
842	mode &= ~current_umask();
843
844	flags &= ~O_NOCTTY;
845	memset(&inarg, 0, sizeof(inarg));
846	memset(&outentry, 0, sizeof(outentry));
847	inarg.flags = flags;
848	inarg.mode = mode;
849	inarg.umask = current_umask();
850
851	if (fm->fc->handle_killpriv_v2 && trunc &&
852	!(flags & O_EXCL) && !capable(CAP_FSETID)) {
853	inarg.open_flags |= FUSE_OPEN_KILL_SUIDGID;
854	}
855
856	args.opcode = opcode;
857	args.nodeid = get_node_id(inode: dir);
858	args.in_numargs = 2;
859	args.in_args[0].size = sizeof(inarg);
860	args.in_args[0].value = &inarg;
861	args.in_args[1].size = entry->d_name.len + 1;
862	args.in_args[1].value = entry->d_name.name;
863	args.out_numargs = 2;
864	args.out_args[0].size = sizeof(outentry);
865	args.out_args[0].value = &outentry;
866	/* Store outarg for fuse_finish_open() */
867	outopenp = &ff->args->open_outarg;
868	args.out_args[1].size = sizeof(*outopenp);
869	args.out_args[1].value = outopenp;
870
871	err = get_create_ext(idmap, args: &args, dir, dentry: entry, mode);
872	if (err)
873	goto out_free_ff;
874
875	err = fuse_simple_idmap_request(idmap, fm, args: &args);
876	free_ext_value(args: &args);
877	if (err)
878	goto out_free_ff;
879
880	err = -EIO;
881	if (!S_ISREG(outentry.attr.mode) || invalid_nodeid(nodeid: outentry.nodeid) ||
882	fuse_invalid_attr(attr: &outentry.attr))
883	goto out_free_ff;
884
885	ff->fh = outopenp->fh;
886	ff->nodeid = outentry.nodeid;
887	ff->open_flags = outopenp->open_flags;
888	inode = fuse_iget(sb: dir->i_sb, nodeid: outentry.nodeid, generation: outentry.generation,
889	attr: &outentry.attr, ATTR_TIMEOUT(&outentry), attr_version: 0, evict_ctr: 0);
890	if (!inode) {
891	flags &= ~(O_CREAT | O_EXCL | O_TRUNC);
892	fuse_sync_release(NULL, ff, flags);
893	fuse_queue_forget(fc: fm->fc, forget, nodeid: outentry.nodeid, nlookup: 1);
894	err = -ENOMEM;
895	goto out_err;
896	}
897	kfree(objp: forget);
898	d_instantiate(entry, inode);
899	entry->d_time = epoch;
900	fuse_change_entry_timeout(entry, o: &outentry);
901	fuse_dir_changed(dir);
902	err = generic_file_open(inode, filp: file);
903	if (!err) {
904	file->private_data = ff;
905	err = finish_open(file, dentry: entry, open: fuse_finish_open);
906	}
907	if (err) {
908	fi = get_fuse_inode(inode);
909	fuse_sync_release(fi, ff, flags);
910	} else {
911	if (fm->fc->atomic_o_trunc && trunc)
912	truncate_pagecache(inode, new: 0);
913	else if (!(ff->open_flags & FOPEN_KEEP_CACHE))
914	invalidate_inode_pages2(mapping: inode->i_mapping);
915	}
916	return err;
917
918	out_free_ff:
919	fuse_file_free(ff);
920	out_put_forget_req:
921	kfree(objp: forget);
922	out_err:
923	return err;
924	}
925
926	static int fuse_mknod(struct mnt_idmap *, struct inode *, struct dentry *,
927	umode_t, dev_t);
928	static int fuse_atomic_open(struct inode *dir, struct dentry *entry,
929	struct file *file, unsigned flags,
930	umode_t mode)
931	{
932	int err;
933	struct mnt_idmap *idmap = file_mnt_idmap(file);
934	struct fuse_conn *fc = get_fuse_conn(inode: dir);
935
936	if (fuse_is_bad(inode: dir))
937	return -EIO;
938
939	if (d_in_lookup(dentry: entry)) {
940	struct dentry *res = fuse_lookup(dir, entry, flags: 0);
941	if (res || d_really_is_positive(dentry: entry))
942	return finish_no_open(file, dentry: res);
943	}
944
945	if (!(flags & O_CREAT))
946	return finish_no_open(file, NULL);
947
948	/* Only creates */
949	file->f_mode |= FMODE_CREATED;
950
951	if (fc->no_create)
952	goto mknod;
953
954	err = fuse_create_open(idmap, dir, entry, file, flags, mode, opcode: FUSE_CREATE);
955	if (err == -ENOSYS) {
956	fc->no_create = 1;
957	goto mknod;
958	} else if (err == -EEXIST)
959	fuse_invalidate_entry(entry);
960	return err;
961
962	mknod:
963	err = fuse_mknod(idmap, dir, entry, mode, 0);
964	if (err)
965	return err;
966	return finish_no_open(file, NULL);
967	}
968
969	/*
970	* Code shared between mknod, mkdir, symlink and link
971	*/
972	static struct dentry *create_new_entry(struct mnt_idmap *idmap, struct fuse_mount *fm,
973	struct fuse_args *args, struct inode *dir,
974	struct dentry *entry, umode_t mode)
975	{
976	struct fuse_entry_out outarg;
977	struct inode *inode;
978	struct dentry *d;
979	struct fuse_forget_link *forget;
980	int epoch, err;
981
982	if (fuse_is_bad(inode: dir))
983	return ERR_PTR(error: -EIO);
984
985	epoch = atomic_read(v: &fm->fc->epoch);
986
987	forget = fuse_alloc_forget();
988	if (!forget)
989	return ERR_PTR(error: -ENOMEM);
990
991	memset(&outarg, 0, sizeof(outarg));
992	args->nodeid = get_node_id(inode: dir);
993	args->out_numargs = 1;
994	args->out_args[0].size = sizeof(outarg);
995	args->out_args[0].value = &outarg;
996
997	if (args->opcode != FUSE_LINK) {
998	err = get_create_ext(idmap, args, dir, dentry: entry, mode);
999	if (err)
1000	goto out_put_forget_req;
1001	}
1002
1003	err = fuse_simple_idmap_request(idmap, fm, args);
1004	free_ext_value(args);
1005	if (err)
1006	goto out_put_forget_req;
1007
1008	err = -EIO;
1009	if (invalid_nodeid(nodeid: outarg.nodeid) || fuse_invalid_attr(attr: &outarg.attr))
1010	goto out_put_forget_req;
1011
1012	if ((outarg.attr.mode ^ mode) & S_IFMT)
1013	goto out_put_forget_req;
1014
1015	inode = fuse_iget(sb: dir->i_sb, nodeid: outarg.nodeid, generation: outarg.generation,
1016	attr: &outarg.attr, ATTR_TIMEOUT(&outarg), attr_version: 0, evict_ctr: 0);
1017	if (!inode) {
1018	fuse_queue_forget(fc: fm->fc, forget, nodeid: outarg.nodeid, nlookup: 1);
1019	return ERR_PTR(error: -ENOMEM);
1020	}
1021	kfree(objp: forget);
1022
1023	d_drop(dentry: entry);
1024	d = d_splice_alias(inode, entry);
1025	if (IS_ERR(ptr: d))
1026	return d;
1027
1028	if (d) {
1029	d->d_time = epoch;
1030	fuse_change_entry_timeout(entry: d, o: &outarg);
1031	} else {
1032	entry->d_time = epoch;
1033	fuse_change_entry_timeout(entry, o: &outarg);
1034	}
1035	fuse_dir_changed(dir);
1036	return d;
1037
1038	out_put_forget_req:
1039	if (err == -EEXIST)
1040	fuse_invalidate_entry(entry);
1041	kfree(objp: forget);
1042	return ERR_PTR(error: err);
1043	}
1044
1045	static int create_new_nondir(struct mnt_idmap *idmap, struct fuse_mount *fm,
1046	struct fuse_args *args, struct inode *dir,
1047	struct dentry *entry, umode_t mode)
1048	{
1049	/*
1050	* Note that when creating anything other than a directory we
1051	* can be sure create_new_entry() will NOT return an alternate
1052	* dentry as d_splice_alias() only returns an alternate dentry
1053	* for directories. So we don't need to check for that case
1054	* when passing back the result.
1055	*/
1056	WARN_ON_ONCE(S_ISDIR(mode));
1057
1058	return PTR_ERR(ptr: create_new_entry(idmap, fm, args, dir, entry, mode));
1059	}
1060
1061	static int fuse_mknod(struct mnt_idmap *idmap, struct inode *dir,
1062	struct dentry *entry, umode_t mode, dev_t rdev)
1063	{
1064	struct fuse_mknod_in inarg;
1065	struct fuse_mount *fm = get_fuse_mount(inode: dir);
1066	FUSE_ARGS(args);
1067
1068	if (!fm->fc->dont_mask)
1069	mode &= ~current_umask();
1070
1071	memset(&inarg, 0, sizeof(inarg));
1072	inarg.mode = mode;
1073	inarg.rdev = new_encode_dev(dev: rdev);
1074	inarg.umask = current_umask();
1075	args.opcode = FUSE_MKNOD;
1076	args.in_numargs = 2;
1077	args.in_args[0].size = sizeof(inarg);
1078	args.in_args[0].value = &inarg;
1079	args.in_args[1].size = entry->d_name.len + 1;
1080	args.in_args[1].value = entry->d_name.name;
1081	return create_new_nondir(idmap, fm, args: &args, dir, entry, mode);
1082	}
1083
1084	static int fuse_create(struct mnt_idmap *idmap, struct inode *dir,
1085	struct dentry *entry, umode_t mode, bool excl)
1086	{
1087	return fuse_mknod(idmap, dir, entry, mode, rdev: 0);
1088	}
1089
1090	static int fuse_tmpfile(struct mnt_idmap *idmap, struct inode *dir,
1091	struct file *file, umode_t mode)
1092	{
1093	struct fuse_conn *fc = get_fuse_conn(inode: dir);
1094	int err;
1095
1096	if (fc->no_tmpfile)
1097	return -EOPNOTSUPP;
1098
1099	err = fuse_create_open(idmap, dir, entry: file->f_path.dentry, file,
1100	flags: file->f_flags, mode, opcode: FUSE_TMPFILE);
1101	if (err == -ENOSYS) {
1102	fc->no_tmpfile = 1;
1103	err = -EOPNOTSUPP;
1104	}
1105	return err;
1106	}
1107
1108	static struct dentry *fuse_mkdir(struct mnt_idmap *idmap, struct inode *dir,
1109	struct dentry *entry, umode_t mode)
1110	{
1111	struct fuse_mkdir_in inarg;
1112	struct fuse_mount *fm = get_fuse_mount(inode: dir);
1113	FUSE_ARGS(args);
1114
1115	if (!fm->fc->dont_mask)
1116	mode &= ~current_umask();
1117
1118	memset(&inarg, 0, sizeof(inarg));
1119	inarg.mode = mode;
1120	inarg.umask = current_umask();
1121	args.opcode = FUSE_MKDIR;
1122	args.in_numargs = 2;
1123	args.in_args[0].size = sizeof(inarg);
1124	args.in_args[0].value = &inarg;
1125	args.in_args[1].size = entry->d_name.len + 1;
1126	args.in_args[1].value = entry->d_name.name;
1127	return create_new_entry(idmap, fm, args: &args, dir, entry, S_IFDIR);
1128	}
1129
1130	static int fuse_symlink(struct mnt_idmap *idmap, struct inode *dir,
1131	struct dentry *entry, const char *link)
1132	{
1133	struct fuse_mount *fm = get_fuse_mount(inode: dir);
1134	unsigned len = strlen(link) + 1;
1135	FUSE_ARGS(args);
1136
1137	args.opcode = FUSE_SYMLINK;
1138	args.in_numargs = 3;
1139	fuse_set_zero_arg0(args: &args);
1140	args.in_args[1].size = entry->d_name.len + 1;
1141	args.in_args[1].value = entry->d_name.name;
1142	args.in_args[2].size = len;
1143	args.in_args[2].value = link;
1144	return create_new_nondir(idmap, fm, args: &args, dir, entry, S_IFLNK);
1145	}
1146
1147	void fuse_flush_time_update(struct inode *inode)
1148	{
1149	int err = sync_inode_metadata(inode, wait: 1);
1150
1151	mapping_set_error(mapping: inode->i_mapping, error: err);
1152	}
1153
1154	static void fuse_update_ctime_in_cache(struct inode *inode)
1155	{
1156	if (!IS_NOCMTIME(inode)) {
1157	inode_set_ctime_current(inode);
1158	mark_inode_dirty_sync(inode);
1159	fuse_flush_time_update(inode);
1160	}
1161	}
1162
1163	void fuse_update_ctime(struct inode *inode)
1164	{
1165	fuse_invalidate_attr_mask(inode, STATX_CTIME);
1166	fuse_update_ctime_in_cache(inode);
1167	}
1168
1169	static void fuse_entry_unlinked(struct dentry *entry)
1170	{
1171	struct inode *inode = d_inode(dentry: entry);
1172	struct fuse_conn *fc = get_fuse_conn(inode);
1173	struct fuse_inode *fi = get_fuse_inode(inode);
1174
1175	spin_lock(lock: &fi->lock);
1176	fi->attr_version = atomic64_inc_return(v: &fc->attr_version);
1177	/*
1178	* If i_nlink == 0 then unlink doesn't make sense, yet this can
1179	* happen if userspace filesystem is careless. It would be
1180	* difficult to enforce correct nlink usage so just ignore this
1181	* condition here
1182	*/
1183	if (S_ISDIR(inode->i_mode))
1184	clear_nlink(inode);
1185	else if (inode->i_nlink > 0)
1186	drop_nlink(inode);
1187	spin_unlock(lock: &fi->lock);
1188	fuse_invalidate_entry_cache(entry);
1189	fuse_update_ctime(inode);
1190	}
1191
1192	static int fuse_unlink(struct inode *dir, struct dentry *entry)
1193	{
1194	int err;
1195	struct fuse_mount *fm = get_fuse_mount(inode: dir);
1196	FUSE_ARGS(args);
1197
1198	if (fuse_is_bad(inode: dir))
1199	return -EIO;
1200
1201	args.opcode = FUSE_UNLINK;
1202	args.nodeid = get_node_id(inode: dir);
1203	args.in_numargs = 2;
1204	fuse_set_zero_arg0(args: &args);
1205	args.in_args[1].size = entry->d_name.len + 1;
1206	args.in_args[1].value = entry->d_name.name;
1207	err = fuse_simple_request(fm, args: &args);
1208	if (!err) {
1209	fuse_dir_changed(dir);
1210	fuse_entry_unlinked(entry);
1211	} else if (err == -EINTR || err == -ENOENT)
1212	fuse_invalidate_entry(entry);
1213	return err;
1214	}
1215
1216	static int fuse_rmdir(struct inode *dir, struct dentry *entry)
1217	{
1218	int err;
1219	struct fuse_mount *fm = get_fuse_mount(inode: dir);
1220	FUSE_ARGS(args);
1221
1222	if (fuse_is_bad(inode: dir))
1223	return -EIO;
1224
1225	args.opcode = FUSE_RMDIR;
1226	args.nodeid = get_node_id(inode: dir);
1227	args.in_numargs = 2;
1228	fuse_set_zero_arg0(args: &args);
1229	args.in_args[1].size = entry->d_name.len + 1;
1230	args.in_args[1].value = entry->d_name.name;
1231	err = fuse_simple_request(fm, args: &args);
1232	if (!err) {
1233	fuse_dir_changed(dir);
1234	fuse_entry_unlinked(entry);
1235	} else if (err == -EINTR || err == -ENOENT)
1236	fuse_invalidate_entry(entry);
1237	return err;
1238	}
1239
1240	static int fuse_rename_common(struct mnt_idmap *idmap, struct inode *olddir, struct dentry *oldent,
1241	struct inode *newdir, struct dentry *newent,
1242	unsigned int flags, int opcode, size_t argsize)
1243	{
1244	int err;
1245	struct fuse_rename2_in inarg;
1246	struct fuse_mount *fm = get_fuse_mount(inode: olddir);
1247	FUSE_ARGS(args);
1248
1249	memset(&inarg, 0, argsize);
1250	inarg.newdir = get_node_id(inode: newdir);
1251	inarg.flags = flags;
1252	args.opcode = opcode;
1253	args.nodeid = get_node_id(inode: olddir);
1254	args.in_numargs = 3;
1255	args.in_args[0].size = argsize;
1256	args.in_args[0].value = &inarg;
1257	args.in_args[1].size = oldent->d_name.len + 1;
1258	args.in_args[1].value = oldent->d_name.name;
1259	args.in_args[2].size = newent->d_name.len + 1;
1260	args.in_args[2].value = newent->d_name.name;
1261	err = fuse_simple_idmap_request(idmap, fm, args: &args);
1262	if (!err) {
1263	/* ctime changes */
1264	fuse_update_ctime(inode: d_inode(dentry: oldent));
1265
1266	if (flags & RENAME_EXCHANGE)
1267	fuse_update_ctime(inode: d_inode(dentry: newent));
1268
1269	fuse_dir_changed(dir: olddir);
1270	if (olddir != newdir)
1271	fuse_dir_changed(dir: newdir);
1272
1273	/* newent will end up negative */
1274	if (!(flags & RENAME_EXCHANGE) && d_really_is_positive(dentry: newent))
1275	fuse_entry_unlinked(entry: newent);
1276	} else if (err == -EINTR || err == -ENOENT) {
1277	/* If request was interrupted, DEITY only knows if the
1278	rename actually took place. If the invalidation
1279	fails (e.g. some process has CWD under the renamed
1280	directory), then there can be inconsistency between
1281	the dcache and the real filesystem. Tough luck. */
1282	fuse_invalidate_entry(entry: oldent);
1283	if (d_really_is_positive(dentry: newent))
1284	fuse_invalidate_entry(entry: newent);
1285	}
1286
1287	return err;
1288	}
1289
1290	static int fuse_rename2(struct mnt_idmap *idmap, struct inode *olddir,
1291	struct dentry *oldent, struct inode *newdir,
1292	struct dentry *newent, unsigned int flags)
1293	{
1294	struct fuse_conn *fc = get_fuse_conn(inode: olddir);
1295	int err;
1296
1297	if (fuse_is_bad(inode: olddir))
1298	return -EIO;
1299
1300	if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT))
1301	return -EINVAL;
1302
1303	if (flags) {
1304	if (fc->no_rename2 || fc->minor < 23)
1305	return -EINVAL;
1306
1307	err = fuse_rename_common(idmap: (flags & RENAME_WHITEOUT) ? idmap : &invalid_mnt_idmap,
1308	olddir, oldent, newdir, newent, flags,
1309	opcode: FUSE_RENAME2,
1310	argsize: sizeof(struct fuse_rename2_in));
1311	if (err == -ENOSYS) {
1312	fc->no_rename2 = 1;
1313	err = -EINVAL;
1314	}
1315	} else {
1316	err = fuse_rename_common(idmap: &invalid_mnt_idmap, olddir, oldent, newdir, newent, flags: 0,
1317	opcode: FUSE_RENAME,
1318	argsize: sizeof(struct fuse_rename_in));
1319	}
1320
1321	return err;
1322	}
1323
1324	static int fuse_link(struct dentry *entry, struct inode *newdir,
1325	struct dentry *newent)
1326	{
1327	int err;
1328	struct fuse_link_in inarg;
1329	struct inode *inode = d_inode(dentry: entry);
1330	struct fuse_mount *fm = get_fuse_mount(inode);
1331	FUSE_ARGS(args);
1332
1333	if (fm->fc->no_link)
1334	goto out;
1335
1336	memset(&inarg, 0, sizeof(inarg));
1337	inarg.oldnodeid = get_node_id(inode);
1338	args.opcode = FUSE_LINK;
1339	args.in_numargs = 2;
1340	args.in_args[0].size = sizeof(inarg);
1341	args.in_args[0].value = &inarg;
1342	args.in_args[1].size = newent->d_name.len + 1;
1343	args.in_args[1].value = newent->d_name.name;
1344	err = create_new_nondir(idmap: &invalid_mnt_idmap, fm, args: &args, dir: newdir, entry: newent, mode: inode->i_mode);
1345	if (!err)
1346	fuse_update_ctime_in_cache(inode);
1347	else if (err == -EINTR)
1348	fuse_invalidate_attr(inode);
1349
1350	if (err == -ENOSYS)
1351	fm->fc->no_link = 1;
1352	out:
1353	if (fm->fc->no_link)
1354	return -EPERM;
1355
1356	return err;
1357	}
1358
1359	static void fuse_fillattr(struct mnt_idmap *idmap, struct inode *inode,
1360	struct fuse_attr *attr, struct kstat *stat)
1361	{
1362	unsigned int blkbits;
1363	struct fuse_conn *fc = get_fuse_conn(inode);
1364	vfsuid_t vfsuid = make_vfsuid(idmap, fs_userns: fc->user_ns,
1365	kuid: make_kuid(from: fc->user_ns, uid: attr->uid));
1366	vfsgid_t vfsgid = make_vfsgid(idmap, fs_userns: fc->user_ns,
1367	kgid: make_kgid(from: fc->user_ns, gid: attr->gid));
1368
1369	stat->dev = inode->i_sb->s_dev;
1370	stat->ino = attr->ino;
1371	stat->mode = (inode->i_mode & S_IFMT) | (attr->mode & 07777);
1372	stat->nlink = attr->nlink;
1373	stat->uid = vfsuid_into_kuid(vfsuid);
1374	stat->gid = vfsgid_into_kgid(vfsgid);
1375	stat->rdev = inode->i_rdev;
1376	stat->atime.tv_sec = attr->atime;
1377	stat->atime.tv_nsec = attr->atimensec;
1378	stat->mtime.tv_sec = attr->mtime;
1379	stat->mtime.tv_nsec = attr->mtimensec;
1380	stat->ctime.tv_sec = attr->ctime;
1381	stat->ctime.tv_nsec = attr->ctimensec;
1382	stat->size = attr->size;
1383	stat->blocks = attr->blocks;
1384
1385	if (attr->blksize != 0)
1386	blkbits = ilog2(attr->blksize);
1387	else
1388	blkbits = inode->i_sb->s_blocksize_bits;
1389
1390	stat->blksize = 1 << blkbits;
1391	}
1392
1393	static void fuse_statx_to_attr(struct fuse_statx *sx, struct fuse_attr *attr)
1394	{
1395	memset(attr, 0, sizeof(*attr));
1396	attr->ino = sx->ino;
1397	attr->size = sx->size;
1398	attr->blocks = sx->blocks;
1399	attr->atime = sx->atime.tv_sec;
1400	attr->mtime = sx->mtime.tv_sec;
1401	attr->ctime = sx->ctime.tv_sec;
1402	attr->atimensec = sx->atime.tv_nsec;
1403	attr->mtimensec = sx->mtime.tv_nsec;
1404	attr->ctimensec = sx->ctime.tv_nsec;
1405	attr->mode = sx->mode;
1406	attr->nlink = sx->nlink;
1407	attr->uid = sx->uid;
1408	attr->gid = sx->gid;
1409	attr->rdev = new_encode_dev(MKDEV(sx->rdev_major, sx->rdev_minor));
1410	attr->blksize = sx->blksize;
1411	}
1412
1413	static int fuse_do_statx(struct mnt_idmap *idmap, struct inode *inode,
1414	struct file *file, struct kstat *stat)
1415	{
1416	int err;
1417	struct fuse_attr attr;
1418	struct fuse_statx *sx;
1419	struct fuse_statx_in inarg;
1420	struct fuse_statx_out outarg;
1421	struct fuse_mount *fm = get_fuse_mount(inode);
1422	u64 attr_version = fuse_get_attr_version(fc: fm->fc);
1423	FUSE_ARGS(args);
1424
1425	memset(&inarg, 0, sizeof(inarg));
1426	memset(&outarg, 0, sizeof(outarg));
1427	/* Directories have separate file-handle space */
1428	if (file && S_ISREG(inode->i_mode)) {
1429	struct fuse_file *ff = file->private_data;
1430
1431	inarg.getattr_flags |= FUSE_GETATTR_FH;
1432	inarg.fh = ff->fh;
1433	}
1434	/* For now leave sync hints as the default, request all stats. */
1435	inarg.sx_flags = 0;
1436	inarg.sx_mask = STATX_BASIC_STATS | STATX_BTIME;
1437	args.opcode = FUSE_STATX;
1438	args.nodeid = get_node_id(inode);
1439	args.in_numargs = 1;
1440	args.in_args[0].size = sizeof(inarg);
1441	args.in_args[0].value = &inarg;
1442	args.out_numargs = 1;
1443	args.out_args[0].size = sizeof(outarg);
1444	args.out_args[0].value = &outarg;
1445	err = fuse_simple_request(fm, args: &args);
1446	if (err)
1447	return err;
1448
1449	sx = &outarg.stat;
1450	if (((sx->mask & STATX_SIZE) && !fuse_valid_size(size: sx->size)) ||
1451	((sx->mask & STATX_TYPE) && (!fuse_valid_type(m: sx->mode) ||
1452	inode_wrong_type(inode, mode: sx->mode)))) {
1453	fuse_make_bad(inode);
1454	return -EIO;
1455	}
1456
1457	fuse_statx_to_attr(sx: &outarg.stat, attr: &attr);
1458	if ((sx->mask & STATX_BASIC_STATS) == STATX_BASIC_STATS) {
1459	fuse_change_attributes(inode, attr: &attr, sx: &outarg.stat,
1460	ATTR_TIMEOUT(&outarg), attr_version);
1461	}
1462
1463	if (stat) {
1464	stat->result_mask = sx->mask & (STATX_BASIC_STATS | STATX_BTIME);
1465	stat->btime.tv_sec = sx->btime.tv_sec;
1466	stat->btime.tv_nsec = min_t(u32, sx->btime.tv_nsec, NSEC_PER_SEC - 1);
1467	fuse_fillattr(idmap, inode, attr: &attr, stat);
1468	stat->result_mask |= STATX_TYPE;
1469	}
1470
1471	return 0;
1472	}
1473
1474	static int fuse_do_getattr(struct mnt_idmap *idmap, struct inode *inode,
1475	struct kstat *stat, struct file *file)
1476	{
1477	int err;
1478	struct fuse_getattr_in inarg;
1479	struct fuse_attr_out outarg;
1480	struct fuse_mount *fm = get_fuse_mount(inode);
1481	FUSE_ARGS(args);
1482	u64 attr_version;
1483
1484	attr_version = fuse_get_attr_version(fc: fm->fc);
1485
1486	memset(&inarg, 0, sizeof(inarg));
1487	memset(&outarg, 0, sizeof(outarg));
1488	/* Directories have separate file-handle space */
1489	if (file && S_ISREG(inode->i_mode)) {
1490	struct fuse_file *ff = file->private_data;
1491
1492	inarg.getattr_flags |= FUSE_GETATTR_FH;
1493	inarg.fh = ff->fh;
1494	}
1495	args.opcode = FUSE_GETATTR;
1496	args.nodeid = get_node_id(inode);
1497	args.in_numargs = 1;
1498	args.in_args[0].size = sizeof(inarg);
1499	args.in_args[0].value = &inarg;
1500	args.out_numargs = 1;
1501	args.out_args[0].size = sizeof(outarg);
1502	args.out_args[0].value = &outarg;
1503	err = fuse_simple_request(fm, args: &args);
1504	if (!err) {
1505	if (fuse_invalid_attr(attr: &outarg.attr) ||
1506	inode_wrong_type(inode, mode: outarg.attr.mode)) {
1507	fuse_make_bad(inode);
1508	err = -EIO;
1509	} else {
1510	fuse_change_attributes(inode, attr: &outarg.attr, NULL,
1511	ATTR_TIMEOUT(&outarg),
1512	attr_version);
1513	if (stat)
1514	fuse_fillattr(idmap, inode, attr: &outarg.attr, stat);
1515	}
1516	}
1517	return err;
1518	}
1519
1520	static int fuse_update_get_attr(struct mnt_idmap *idmap, struct inode *inode,
1521	struct file *file, struct kstat *stat,
1522	u32 request_mask, unsigned int flags)
1523	{
1524	struct fuse_inode *fi = get_fuse_inode(inode);
1525	struct fuse_conn *fc = get_fuse_conn(inode);
1526	int err = 0;
1527	bool sync;
1528	u32 inval_mask = READ_ONCE(fi->inval_mask);
1529	u32 cache_mask = fuse_get_cache_mask(inode);
1530
1531
1532	/* FUSE only supports basic stats and possibly btime */
1533	request_mask &= STATX_BASIC_STATS | STATX_BTIME;
1534	retry:
1535	if (fc->no_statx)
1536	request_mask &= STATX_BASIC_STATS;
1537
1538	if (!request_mask)
1539	sync = false;
1540	else if (flags & AT_STATX_FORCE_SYNC)
1541	sync = true;
1542	else if (flags & AT_STATX_DONT_SYNC)
1543	sync = false;
1544	else if (request_mask & inval_mask & ~cache_mask)
1545	sync = true;
1546	else
1547	sync = time_before64(fi->i_time, get_jiffies_64());
1548
1549	if (sync) {
1550	forget_all_cached_acls(inode);
1551	/* Try statx if BTIME is requested */
1552	if (!fc->no_statx && (request_mask & ~STATX_BASIC_STATS)) {
1553	err = fuse_do_statx(idmap, inode, file, stat);
1554	if (err == -ENOSYS) {
1555	fc->no_statx = 1;
1556	err = 0;
1557	goto retry;
1558	}
1559	} else {
1560	err = fuse_do_getattr(idmap, inode, stat, file);
1561	}
1562	} else if (stat) {
1563	generic_fillattr(idmap, request_mask, inode, stat);
1564	stat->mode = fi->orig_i_mode;
1565	stat->ino = fi->orig_ino;
1566	stat->blksize = 1 << fi->cached_i_blkbits;
1567	if (test_bit(FUSE_I_BTIME, &fi->state)) {
1568	stat->btime = fi->i_btime;
1569	stat->result_mask |= STATX_BTIME;
1570	}
1571	}
1572
1573	return err;
1574	}
1575
1576	int fuse_update_attributes(struct inode *inode, struct file *file, u32 mask)
1577	{
1578	return fuse_update_get_attr(idmap: &nop_mnt_idmap, inode, file, NULL, request_mask: mask, flags: 0);
1579	}
1580
1581	int fuse_reverse_inval_entry(struct fuse_conn *fc, u64 parent_nodeid,
1582	u64 child_nodeid, struct qstr *name, u32 flags)
1583	{
1584	int err = -ENOTDIR;
1585	struct inode *parent;
1586	struct dentry *dir = NULL;
1587	struct dentry *entry = NULL;
1588
1589	parent = fuse_ilookup(fc, nodeid: parent_nodeid, NULL);
1590	if (!parent)
1591	return -ENOENT;
1592
1593	if (!S_ISDIR(parent->i_mode))
1594	goto put_parent;
1595
1596	err = -ENOENT;
1597	dir = d_find_alias(parent);
1598	if (!dir)
1599	goto put_parent;
1600	while (!entry) {
1601	struct dentry *child = try_lookup_noperm(name, dir);
1602	if (!child || IS_ERR(ptr: child))
1603	goto put_parent;
1604	entry = start_removing_dentry(parent: dir, child);
1605	dput(child);
1606	if (IS_ERR(ptr: entry))
1607	goto put_parent;
1608	if (!d_same_name(dentry: entry, parent: dir, name)) {
1609	end_removing(child: entry);
1610	entry = NULL;
1611	}
1612	}
1613
1614	fuse_dir_changed(dir: parent);
1615	if (!(flags & FUSE_EXPIRE_ONLY))
1616	d_invalidate(entry);
1617	fuse_invalidate_entry_cache(entry);
1618
1619	if (child_nodeid != 0) {
1620	inode_lock(inode: d_inode(dentry: entry));
1621	if (get_node_id(inode: d_inode(dentry: entry)) != child_nodeid) {
1622	err = -ENOENT;
1623	goto badentry;
1624	}
1625	if (d_mountpoint(dentry: entry)) {
1626	err = -EBUSY;
1627	goto badentry;
1628	}
1629	if (d_is_dir(dentry: entry)) {
1630	shrink_dcache_parent(entry);
1631	if (!simple_empty(entry)) {
1632	err = -ENOTEMPTY;
1633	goto badentry;
1634	}
1635	d_inode(dentry: entry)->i_flags |= S_DEAD;
1636	}
1637	dont_mount(dentry: entry);
1638	clear_nlink(inode: d_inode(dentry: entry));
1639	err = 0;
1640	badentry:
1641	inode_unlock(inode: d_inode(dentry: entry));
1642	if (!err)
1643	d_delete(entry);
1644	} else {
1645	err = 0;
1646	}
1647
1648	end_removing(child: entry);
1649	put_parent:
1650	dput(dir);
1651	iput(parent);
1652	return err;
1653	}
1654
1655	static inline bool fuse_permissible_uidgid(struct fuse_conn *fc)
1656	{
1657	const struct cred *cred = current_cred();
1658
1659	return (uid_eq(left: cred->euid, right: fc->user_id) &&
1660	uid_eq(left: cred->suid, right: fc->user_id) &&
1661	uid_eq(left: cred->uid, right: fc->user_id) &&
1662	gid_eq(left: cred->egid, right: fc->group_id) &&
1663	gid_eq(left: cred->sgid, right: fc->group_id) &&
1664	gid_eq(left: cred->gid, right: fc->group_id));
1665	}
1666
1667	/*
1668	* Calling into a user-controlled filesystem gives the filesystem
1669	* daemon ptrace-like capabilities over the current process. This
1670	* means, that the filesystem daemon is able to record the exact
1671	* filesystem operations performed, and can also control the behavior
1672	* of the requester process in otherwise impossible ways. For example
1673	* it can delay the operation for arbitrary length of time allowing
1674	* DoS against the requester.
1675	*
1676	* For this reason only those processes can call into the filesystem,
1677	* for which the owner of the mount has ptrace privilege. This
1678	* excludes processes started by other users, suid or sgid processes.
1679	*/
1680	bool fuse_allow_current_process(struct fuse_conn *fc)
1681	{
1682	bool allow;
1683
1684	if (fc->allow_other)
1685	allow = current_in_userns(target_ns: fc->user_ns);
1686	else
1687	allow = fuse_permissible_uidgid(fc);
1688
1689	if (!allow && allow_sys_admin_access && capable(CAP_SYS_ADMIN))
1690	allow = true;
1691
1692	return allow;
1693	}
1694
1695	static int fuse_access(struct inode *inode, int mask)
1696	{
1697	struct fuse_mount *fm = get_fuse_mount(inode);
1698	FUSE_ARGS(args);
1699	struct fuse_access_in inarg;
1700	int err;
1701
1702	BUG_ON(mask & MAY_NOT_BLOCK);
1703
1704	/*
1705	* We should not send FUSE_ACCESS to the userspace
1706	* when idmapped mounts are enabled as for this case
1707	* we have fc->default_permissions = 1 and access
1708	* permission checks are done on the kernel side.
1709	*/
1710	WARN_ON_ONCE(!(fm->sb->s_iflags & SB_I_NOIDMAP));
1711
1712	if (fm->fc->no_access)
1713	return 0;
1714
1715	memset(&inarg, 0, sizeof(inarg));
1716	inarg.mask = mask & (MAY_READ | MAY_WRITE | MAY_EXEC);
1717	args.opcode = FUSE_ACCESS;
1718	args.nodeid = get_node_id(inode);
1719	args.in_numargs = 1;
1720	args.in_args[0].size = sizeof(inarg);
1721	args.in_args[0].value = &inarg;
1722	err = fuse_simple_request(fm, args: &args);
1723	if (err == -ENOSYS) {
1724	fm->fc->no_access = 1;
1725	err = 0;
1726	}
1727	return err;
1728	}
1729
1730	static int fuse_perm_getattr(struct inode *inode, int mask)
1731	{
1732	if (mask & MAY_NOT_BLOCK)
1733	return -ECHILD;
1734
1735	forget_all_cached_acls(inode);
1736	return fuse_do_getattr(idmap: &nop_mnt_idmap, inode, NULL, NULL);
1737	}
1738
1739	/*
1740	* Check permission. The two basic access models of FUSE are:
1741	*
1742	* 1) Local access checking ('default_permissions' mount option) based
1743	* on file mode. This is the plain old disk filesystem permission
1744	* model.
1745	*
1746	* 2) "Remote" access checking, where server is responsible for
1747	* checking permission in each inode operation. An exception to this
1748	* is if ->permission() was invoked from sys_access() in which case an
1749	* access request is sent. Execute permission is still checked
1750	* locally based on file mode.
1751	*/
1752	static int fuse_permission(struct mnt_idmap *idmap,
1753	struct inode *inode, int mask)
1754	{
1755	struct fuse_conn *fc = get_fuse_conn(inode);
1756	bool refreshed = false;
1757	int err = 0;
1758
1759	if (fuse_is_bad(inode))
1760	return -EIO;
1761
1762	if (!fuse_allow_current_process(fc))
1763	return -EACCES;
1764
1765	/*
1766	* If attributes are needed, refresh them before proceeding
1767	*/
1768	if (fc->default_permissions ||
1769	((mask & MAY_EXEC) && S_ISREG(inode->i_mode))) {
1770	struct fuse_inode *fi = get_fuse_inode(inode);
1771	u32 perm_mask = STATX_MODE | STATX_UID | STATX_GID;
1772
1773	if (perm_mask & READ_ONCE(fi->inval_mask) ||
1774	time_before64(fi->i_time, get_jiffies_64())) {
1775	refreshed = true;
1776
1777	err = fuse_perm_getattr(inode, mask);
1778	if (err)
1779	return err;
1780	}
1781	}
1782
1783	if (fc->default_permissions) {
1784	err = generic_permission(idmap, inode, mask);
1785
1786	/* If permission is denied, try to refresh file
1787	attributes. This is also needed, because the root
1788	node will at first have no permissions */
1789	if (err == -EACCES && !refreshed) {
1790	err = fuse_perm_getattr(inode, mask);
1791	if (!err)
1792	err = generic_permission(idmap,
1793	inode, mask);
1794	}
1795
1796	/* Note: the opposite of the above test does not
1797	exist. So if permissions are revoked this won't be
1798	noticed immediately, only after the attribute
1799	timeout has expired */
1800	} else if (mask & (MAY_ACCESS | MAY_CHDIR)) {
1801	err = fuse_access(inode, mask);
1802	} else if ((mask & MAY_EXEC) && S_ISREG(inode->i_mode)) {
1803	if (!(inode->i_mode & S_IXUGO)) {
1804	if (refreshed)
1805	return -EACCES;
1806
1807	err = fuse_perm_getattr(inode, mask);
1808	if (!err && !(inode->i_mode & S_IXUGO))
1809	return -EACCES;
1810	}
1811	}
1812	return err;
1813	}
1814
1815	static int fuse_readlink_folio(struct inode *inode, struct folio *folio)
1816	{
1817	struct fuse_mount *fm = get_fuse_mount(inode);
1818	struct fuse_folio_desc desc = { .length = folio_size(folio) - 1 };
1819	struct fuse_args_pages ap = {
1820	.num_folios = 1,
1821	.folios = &folio,
1822	.descs = &desc,
1823	};
1824	char *link;
1825	ssize_t res;
1826
1827	ap.args.opcode = FUSE_READLINK;
1828	ap.args.nodeid = get_node_id(inode);
1829	ap.args.out_pages = true;
1830	ap.args.out_argvar = true;
1831	ap.args.page_zeroing = true;
1832	ap.args.out_numargs = 1;
1833	ap.args.out_args[0].size = desc.length;
1834	res = fuse_simple_request(fm, args: &ap.args);
1835
1836	fuse_invalidate_atime(inode);
1837
1838	if (res < 0)
1839	return res;
1840
1841	if (WARN_ON(res >= PAGE_SIZE))
1842	return -EIO;
1843
1844	link = folio_address(folio);
1845	link[res] = '\0';
1846
1847	return 0;
1848	}
1849
1850	static const char *fuse_get_link(struct dentry *dentry, struct inode *inode,
1851	struct delayed_call *callback)
1852	{
1853	struct fuse_conn *fc = get_fuse_conn(inode);
1854	struct folio *folio;
1855	int err;
1856
1857	err = -EIO;
1858	if (fuse_is_bad(inode))
1859	goto out_err;
1860
1861	if (fc->cache_symlinks)
1862	return page_get_link_raw(dentry, inode, callback);
1863
1864	err = -ECHILD;
1865	if (!dentry)
1866	goto out_err;
1867
1868	folio = folio_alloc(GFP_KERNEL, 0);
1869	err = -ENOMEM;
1870	if (!folio)
1871	goto out_err;
1872
1873	err = fuse_readlink_folio(inode, folio);
1874	if (err) {
1875	folio_put(folio);
1876	goto out_err;
1877	}
1878
1879	set_delayed_call(call: callback, fn: page_put_link, arg: folio);
1880
1881	return folio_address(folio);
1882
1883	out_err:
1884	return ERR_PTR(error: err);
1885	}
1886
1887	static int fuse_dir_open(struct inode *inode, struct file *file)
1888	{
1889	struct fuse_mount *fm = get_fuse_mount(inode);
1890	int err;
1891
1892	if (fuse_is_bad(inode))
1893	return -EIO;
1894
1895	err = generic_file_open(inode, filp: file);
1896	if (err)
1897	return err;
1898
1899	err = fuse_do_open(fm, nodeid: get_node_id(inode), file, isdir: true);
1900	if (!err) {
1901	struct fuse_file *ff = file->private_data;
1902
1903	/*
1904	* Keep handling FOPEN_STREAM and FOPEN_NONSEEKABLE for
1905	* directories for backward compatibility, though it's unlikely
1906	* to be useful.
1907	*/
1908	if (ff->open_flags & (FOPEN_STREAM | FOPEN_NONSEEKABLE))
1909	nonseekable_open(inode, filp: file);
1910	if (!(ff->open_flags & FOPEN_KEEP_CACHE))
1911	invalidate_inode_pages2(mapping: inode->i_mapping);
1912	}
1913
1914	return err;
1915	}
1916
1917	static int fuse_dir_release(struct inode *inode, struct file *file)
1918	{
1919	fuse_release_common(file, isdir: true);
1920
1921	return 0;
1922	}
1923
1924	static int fuse_dir_fsync(struct file *file, loff_t start, loff_t end,
1925	int datasync)
1926	{
1927	struct inode *inode = file->f_mapping->host;
1928	struct fuse_conn *fc = get_fuse_conn(inode);
1929	int err;
1930
1931	if (fuse_is_bad(inode))
1932	return -EIO;
1933
1934	if (fc->no_fsyncdir)
1935	return 0;
1936
1937	inode_lock(inode);
1938	err = fuse_fsync_common(file, start, end, datasync, opcode: FUSE_FSYNCDIR);
1939	if (err == -ENOSYS) {
1940	fc->no_fsyncdir = 1;
1941	err = 0;
1942	}
1943	inode_unlock(inode);
1944
1945	return err;
1946	}
1947
1948	static long fuse_dir_ioctl(struct file *file, unsigned int cmd,
1949	unsigned long arg)
1950	{
1951	struct fuse_conn *fc = get_fuse_conn(inode: file->f_mapping->host);
1952
1953	/* FUSE_IOCTL_DIR only supported for API version >= 7.18 */
1954	if (fc->minor < 18)
1955	return -ENOTTY;
1956
1957	return fuse_ioctl_common(file, cmd, arg, FUSE_IOCTL_DIR);
1958	}
1959
1960	static long fuse_dir_compat_ioctl(struct file *file, unsigned int cmd,
1961	unsigned long arg)
1962	{
1963	struct fuse_conn *fc = get_fuse_conn(inode: file->f_mapping->host);
1964
1965	if (fc->minor < 18)
1966	return -ENOTTY;
1967
1968	return fuse_ioctl_common(file, cmd, arg,
1969	FUSE_IOCTL_COMPAT | FUSE_IOCTL_DIR);
1970	}
1971
1972	static bool update_mtime(unsigned ivalid, bool trust_local_mtime)
1973	{
1974	/* Always update if mtime is explicitly set */
1975	if (ivalid & ATTR_MTIME_SET)
1976	return true;
1977
1978	/* Or if kernel i_mtime is the official one */
1979	if (trust_local_mtime)
1980	return true;
1981
1982	/* If it's an open(O_TRUNC) or an ftruncate(), don't update */
1983	if ((ivalid & ATTR_SIZE) && (ivalid & (ATTR_OPEN | ATTR_FILE)))
1984	return false;
1985
1986	/* In all other cases update */
1987	return true;
1988	}
1989
1990	static void iattr_to_fattr(struct mnt_idmap *idmap, struct fuse_conn *fc,
1991	struct iattr *iattr, struct fuse_setattr_in *arg,
1992	bool trust_local_cmtime)
1993	{
1994	unsigned ivalid = iattr->ia_valid;
1995
1996	if (ivalid & ATTR_MODE)
1997	arg->valid |= FATTR_MODE, arg->mode = iattr->ia_mode;
1998
1999	if (ivalid & ATTR_UID) {
2000	kuid_t fsuid = from_vfsuid(idmap, fs_userns: fc->user_ns, vfsuid: iattr->ia_vfsuid);
2001
2002	arg->valid |= FATTR_UID;
2003	arg->uid = from_kuid(to: fc->user_ns, uid: fsuid);
2004	}
2005
2006	if (ivalid & ATTR_GID) {
2007	kgid_t fsgid = from_vfsgid(idmap, fs_userns: fc->user_ns, vfsgid: iattr->ia_vfsgid);
2008
2009	arg->valid |= FATTR_GID;
2010	arg->gid = from_kgid(to: fc->user_ns, gid: fsgid);
2011	}
2012
2013	if (ivalid & ATTR_SIZE)
2014	arg->valid |= FATTR_SIZE, arg->size = iattr->ia_size;
2015	if (ivalid & ATTR_ATIME) {
2016	arg->valid |= FATTR_ATIME;
2017	arg->atime = iattr->ia_atime.tv_sec;
2018	arg->atimensec = iattr->ia_atime.tv_nsec;
2019	if (!(ivalid & ATTR_ATIME_SET))
2020	arg->valid |= FATTR_ATIME_NOW;
2021	}
2022	if ((ivalid & ATTR_MTIME) && update_mtime(ivalid, trust_local_mtime: trust_local_cmtime)) {
2023	arg->valid |= FATTR_MTIME;
2024	arg->mtime = iattr->ia_mtime.tv_sec;
2025	arg->mtimensec = iattr->ia_mtime.tv_nsec;
2026	if (!(ivalid & ATTR_MTIME_SET) && !trust_local_cmtime)
2027	arg->valid |= FATTR_MTIME_NOW;
2028	}
2029	if ((ivalid & ATTR_CTIME) && trust_local_cmtime) {
2030	arg->valid |= FATTR_CTIME;
2031	arg->ctime = iattr->ia_ctime.tv_sec;
2032	arg->ctimensec = iattr->ia_ctime.tv_nsec;
2033	}
2034	}
2035
2036	/*
2037	* Prevent concurrent writepages on inode
2038	*
2039	* This is done by adding a negative bias to the inode write counter
2040	* and waiting for all pending writes to finish.
2041	*/
2042	void fuse_set_nowrite(struct inode *inode)
2043	{
2044	struct fuse_inode *fi = get_fuse_inode(inode);
2045
2046	BUG_ON(!inode_is_locked(inode));
2047
2048	spin_lock(lock: &fi->lock);
2049	BUG_ON(fi->writectr < 0);
2050	fi->writectr += FUSE_NOWRITE;
2051	spin_unlock(lock: &fi->lock);
2052	wait_event(fi->page_waitq, fi->writectr == FUSE_NOWRITE);
2053	}
2054
2055	/*
2056	* Allow writepages on inode
2057	*
2058	* Remove the bias from the writecounter and send any queued
2059	* writepages.
2060	*/
2061	static void __fuse_release_nowrite(struct inode *inode)
2062	{
2063	struct fuse_inode *fi = get_fuse_inode(inode);
2064
2065	BUG_ON(fi->writectr != FUSE_NOWRITE);
2066	fi->writectr = 0;
2067	fuse_flush_writepages(inode);
2068	}
2069
2070	void fuse_release_nowrite(struct inode *inode)
2071	{
2072	struct fuse_inode *fi = get_fuse_inode(inode);
2073
2074	spin_lock(lock: &fi->lock);
2075	__fuse_release_nowrite(inode);
2076	spin_unlock(lock: &fi->lock);
2077	}
2078
2079	static void fuse_setattr_fill(struct fuse_conn *fc, struct fuse_args *args,
2080	struct inode *inode,
2081	struct fuse_setattr_in *inarg_p,
2082	struct fuse_attr_out *outarg_p)
2083	{
2084	args->opcode = FUSE_SETATTR;
2085	args->nodeid = get_node_id(inode);
2086	args->in_numargs = 1;
2087	args->in_args[0].size = sizeof(*inarg_p);
2088	args->in_args[0].value = inarg_p;
2089	args->out_numargs = 1;
2090	args->out_args[0].size = sizeof(*outarg_p);
2091	args->out_args[0].value = outarg_p;
2092	}
2093
2094	/*
2095	* Flush inode->i_mtime to the server
2096	*/
2097	int fuse_flush_times(struct inode *inode, struct fuse_file *ff)
2098	{
2099	struct fuse_mount *fm = get_fuse_mount(inode);
2100	FUSE_ARGS(args);
2101	struct fuse_setattr_in inarg;
2102	struct fuse_attr_out outarg;
2103
2104	memset(&inarg, 0, sizeof(inarg));
2105	memset(&outarg, 0, sizeof(outarg));
2106
2107	inarg.valid = FATTR_MTIME;
2108	inarg.mtime = inode_get_mtime_sec(inode);
2109	inarg.mtimensec = inode_get_mtime_nsec(inode);
2110	if (fm->fc->minor >= 23) {
2111	inarg.valid |= FATTR_CTIME;
2112	inarg.ctime = inode_get_ctime_sec(inode);
2113	inarg.ctimensec = inode_get_ctime_nsec(inode);
2114	}
2115	if (ff) {
2116	inarg.valid |= FATTR_FH;
2117	inarg.fh = ff->fh;
2118	}
2119	fuse_setattr_fill(fc: fm->fc, args: &args, inode, inarg_p: &inarg, outarg_p: &outarg);
2120
2121	return fuse_simple_request(fm, args: &args);
2122	}
2123
2124	/*
2125	* Set attributes, and at the same time refresh them.
2126	*
2127	* Truncation is slightly complicated, because the 'truncate' request
2128	* may fail, in which case we don't want to touch the mapping.
2129	* vmtruncate() doesn't allow for this case, so do the rlimit checking
2130	* and the actual truncation by hand.
2131	*/
2132	int fuse_do_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
2133	struct iattr *attr, struct file *file)
2134	{
2135	struct inode *inode = d_inode(dentry);
2136	struct fuse_mount *fm = get_fuse_mount(inode);
2137	struct fuse_conn *fc = fm->fc;
2138	struct fuse_inode *fi = get_fuse_inode(inode);
2139	struct address_space *mapping = inode->i_mapping;
2140	FUSE_ARGS(args);
2141	struct fuse_setattr_in inarg;
2142	struct fuse_attr_out outarg;
2143	bool is_truncate = false;
2144	bool is_wb = fc->writeback_cache && S_ISREG(inode->i_mode);
2145	loff_t oldsize;
2146	int err;
2147	bool trust_local_cmtime = is_wb;
2148	bool fault_blocked = false;
2149	u64 attr_version;
2150
2151	if (!fc->default_permissions)
2152	attr->ia_valid |= ATTR_FORCE;
2153
2154	err = setattr_prepare(idmap, dentry, attr);
2155	if (err)
2156	return err;
2157
2158	if (attr->ia_valid & ATTR_SIZE) {
2159	if (WARN_ON(!S_ISREG(inode->i_mode)))
2160	return -EIO;
2161	is_truncate = true;
2162	}
2163
2164	if (FUSE_IS_DAX(inode) && is_truncate) {
2165	filemap_invalidate_lock(mapping);
2166	fault_blocked = true;
2167	err = fuse_dax_break_layouts(inode, dmap_start: 0, dmap_end: -1);
2168	if (err) {
2169	filemap_invalidate_unlock(mapping);
2170	return err;
2171	}
2172	}
2173
2174	if (attr->ia_valid & ATTR_OPEN) {
2175	/* This is coming from open(..., ... | O_TRUNC); */
2176	WARN_ON(!(attr->ia_valid & ATTR_SIZE));
2177	WARN_ON(attr->ia_size != 0);
2178	if (fc->atomic_o_trunc) {
2179	/*
2180	* No need to send request to userspace, since actual
2181	* truncation has already been done by OPEN. But still
2182	* need to truncate page cache.
2183	*/
2184	i_size_write(inode, i_size: 0);
2185	truncate_pagecache(inode, new: 0);
2186	goto out;
2187	}
2188	file = NULL;
2189	}
2190
2191	/* Flush dirty data/metadata before non-truncate SETATTR */
2192	if (is_wb &&
2193	attr->ia_valid &
2194	(ATTR_MODE | ATTR_UID | ATTR_GID | ATTR_MTIME_SET |
2195	ATTR_TIMES_SET)) {
2196	err = write_inode_now(inode, sync: true);
2197	if (err)
2198	return err;
2199
2200	fuse_set_nowrite(inode);
2201	fuse_release_nowrite(inode);
2202	}
2203
2204	if (is_truncate) {
2205	fuse_set_nowrite(inode);
2206	set_bit(nr: FUSE_I_SIZE_UNSTABLE, addr: &fi->state);
2207	if (trust_local_cmtime && attr->ia_size != inode->i_size)
2208	attr->ia_valid |= ATTR_MTIME | ATTR_CTIME;
2209	}
2210
2211	memset(&inarg, 0, sizeof(inarg));
2212	memset(&outarg, 0, sizeof(outarg));
2213	iattr_to_fattr(idmap, fc, iattr: attr, arg: &inarg, trust_local_cmtime);
2214	if (file) {
2215	struct fuse_file *ff = file->private_data;
2216	inarg.valid |= FATTR_FH;
2217	inarg.fh = ff->fh;
2218	}
2219
2220	/* Kill suid/sgid for non-directory chown unconditionally */
2221	if (fc->handle_killpriv_v2 && !S_ISDIR(inode->i_mode) &&
2222	attr->ia_valid & (ATTR_UID | ATTR_GID))
2223	inarg.valid |= FATTR_KILL_SUIDGID;
2224
2225	if (attr->ia_valid & ATTR_SIZE) {
2226	/* For mandatory locking in truncate */
2227	inarg.valid |= FATTR_LOCKOWNER;
2228	inarg.lock_owner = fuse_lock_owner_id(fc, current->files);
2229
2230	/* Kill suid/sgid for truncate only if no CAP_FSETID */
2231	if (fc->handle_killpriv_v2 && !capable(CAP_FSETID))
2232	inarg.valid |= FATTR_KILL_SUIDGID;
2233	}
2234
2235	attr_version = fuse_get_attr_version(fc: fm->fc);
2236	fuse_setattr_fill(fc, args: &args, inode, inarg_p: &inarg, outarg_p: &outarg);
2237	err = fuse_simple_request(fm, args: &args);
2238	if (err) {
2239	if (err == -EINTR)
2240	fuse_invalidate_attr(inode);
2241	goto error;
2242	}
2243
2244	if (fuse_invalid_attr(attr: &outarg.attr) ||
2245	inode_wrong_type(inode, mode: outarg.attr.mode)) {
2246	fuse_make_bad(inode);
2247	err = -EIO;
2248	goto error;
2249	}
2250
2251	spin_lock(lock: &fi->lock);
2252	/* the kernel maintains i_mtime locally */
2253	if (trust_local_cmtime) {
2254	if (attr->ia_valid & ATTR_MTIME)
2255	inode_set_mtime_to_ts(inode, ts: attr->ia_mtime);
2256	if (attr->ia_valid & ATTR_CTIME)
2257	inode_set_ctime_to_ts(inode, ts: attr->ia_ctime);
2258	/* FIXME: clear I_DIRTY_SYNC? */
2259	}
2260
2261	if (fi->attr_version > attr_version) {
2262	/*
2263	* Apply attributes, for example for fsnotify_change(), but set
2264	* attribute timeout to zero.
2265	*/
2266	outarg.attr_valid = outarg.attr_valid_nsec = 0;
2267	}
2268
2269	fuse_change_attributes_common(inode, attr: &outarg.attr, NULL,
2270	ATTR_TIMEOUT(&outarg),
2271	cache_mask: fuse_get_cache_mask(inode), evict_ctr: 0);
2272	oldsize = inode->i_size;
2273	/* see the comment in fuse_change_attributes() */
2274	if (!is_wb || is_truncate)
2275	i_size_write(inode, i_size: outarg.attr.size);
2276
2277	if (is_truncate) {
2278	/* NOTE: this may release/reacquire fi->lock */
2279	__fuse_release_nowrite(inode);
2280	}
2281	spin_unlock(lock: &fi->lock);
2282
2283	/*
2284	* Only call invalidate_inode_pages2() after removing
2285	* FUSE_NOWRITE, otherwise fuse_launder_folio() would deadlock.
2286	*/
2287	if ((is_truncate || !is_wb) &&
2288	S_ISREG(inode->i_mode) && oldsize != outarg.attr.size) {
2289	truncate_pagecache(inode, new: outarg.attr.size);
2290	invalidate_inode_pages2(mapping);
2291	}
2292
2293	clear_bit(nr: FUSE_I_SIZE_UNSTABLE, addr: &fi->state);
2294	out:
2295	if (fault_blocked)
2296	filemap_invalidate_unlock(mapping);
2297
2298	return 0;
2299
2300	error:
2301	if (is_truncate)
2302	fuse_release_nowrite(inode);
2303
2304	clear_bit(nr: FUSE_I_SIZE_UNSTABLE, addr: &fi->state);
2305
2306	if (fault_blocked)
2307	filemap_invalidate_unlock(mapping);
2308	return err;
2309	}
2310
2311	static int fuse_setattr(struct mnt_idmap *idmap, struct dentry *entry,
2312	struct iattr *attr)
2313	{
2314	struct inode *inode = d_inode(dentry: entry);
2315	struct fuse_conn *fc = get_fuse_conn(inode);
2316	struct file *file = (attr->ia_valid & ATTR_FILE) ? attr->ia_file : NULL;
2317	int ret;
2318
2319	if (fuse_is_bad(inode))
2320	return -EIO;
2321
2322	if (!fuse_allow_current_process(fc: get_fuse_conn(inode)))
2323	return -EACCES;
2324
2325	if (attr->ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID)) {
2326	attr->ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID |
2327	ATTR_MODE);
2328
2329	/*
2330	* The only sane way to reliably kill suid/sgid is to do it in
2331	* the userspace filesystem
2332	*
2333	* This should be done on write(), truncate() and chown().
2334	*/
2335	if (!fc->handle_killpriv && !fc->handle_killpriv_v2) {
2336	/*
2337	* ia_mode calculation may have used stale i_mode.
2338	* Refresh and recalculate.
2339	*/
2340	ret = fuse_do_getattr(idmap, inode, NULL, file);
2341	if (ret)
2342	return ret;
2343
2344	attr->ia_mode = inode->i_mode;
2345	if (inode->i_mode & S_ISUID) {
2346	attr->ia_valid |= ATTR_MODE;
2347	attr->ia_mode &= ~S_ISUID;
2348	}
2349	if ((inode->i_mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
2350	attr->ia_valid |= ATTR_MODE;
2351	attr->ia_mode &= ~S_ISGID;
2352	}
2353	}
2354	}
2355	if (!attr->ia_valid)
2356	return 0;
2357
2358	ret = fuse_do_setattr(idmap, dentry: entry, attr, file);
2359	if (!ret) {
2360	/*
2361	* If filesystem supports acls it may have updated acl xattrs in
2362	* the filesystem, so forget cached acls for the inode.
2363	*/
2364	if (fc->posix_acl)
2365	forget_all_cached_acls(inode);
2366
2367	/* Directory mode changed, may need to revalidate access */
2368	if (d_is_dir(dentry: entry) && (attr->ia_valid & ATTR_MODE))
2369	fuse_invalidate_entry_cache(entry);
2370	}
2371	return ret;
2372	}
2373
2374	static int fuse_getattr(struct mnt_idmap *idmap,
2375	const struct path *path, struct kstat *stat,
2376	u32 request_mask, unsigned int flags)
2377	{
2378	struct inode *inode = d_inode(dentry: path->dentry);
2379	struct fuse_conn *fc = get_fuse_conn(inode);
2380
2381	if (fuse_is_bad(inode))
2382	return -EIO;
2383
2384	if (!fuse_allow_current_process(fc)) {
2385	if (!request_mask) {
2386	/*
2387	* If user explicitly requested *nothing* then don't
2388	* error out, but return st_dev only.
2389	*/
2390	stat->result_mask = 0;
2391	stat->dev = inode->i_sb->s_dev;
2392	return 0;
2393	}
2394	return -EACCES;
2395	}
2396
2397	return fuse_update_get_attr(idmap, inode, NULL, stat, request_mask, flags);
2398	}
2399
2400	static const struct inode_operations fuse_dir_inode_operations = {
2401	.lookup = fuse_lookup,
2402	.mkdir = fuse_mkdir,
2403	.symlink = fuse_symlink,
2404	.unlink = fuse_unlink,
2405	.rmdir = fuse_rmdir,
2406	.rename = fuse_rename2,
2407	.link = fuse_link,
2408	.setattr = fuse_setattr,
2409	.create = fuse_create,
2410	.atomic_open = fuse_atomic_open,
2411	.tmpfile = fuse_tmpfile,
2412	.mknod = fuse_mknod,
2413	.permission = fuse_permission,
2414	.getattr = fuse_getattr,
2415	.listxattr = fuse_listxattr,
2416	.get_inode_acl = fuse_get_inode_acl,
2417	.get_acl = fuse_get_acl,
2418	.set_acl = fuse_set_acl,
2419	.fileattr_get = fuse_fileattr_get,
2420	.fileattr_set = fuse_fileattr_set,
2421	};
2422
2423	static const struct file_operations fuse_dir_operations = {
2424	.llseek = generic_file_llseek,
2425	.read = generic_read_dir,
2426	.iterate_shared = fuse_readdir,
2427	.open = fuse_dir_open,
2428	.release = fuse_dir_release,
2429	.fsync = fuse_dir_fsync,
2430	.unlocked_ioctl = fuse_dir_ioctl,
2431	.compat_ioctl = fuse_dir_compat_ioctl,
2432	.setlease = simple_nosetlease,
2433	};
2434
2435	static const struct inode_operations fuse_common_inode_operations = {
2436	.setattr = fuse_setattr,
2437	.permission = fuse_permission,
2438	.getattr = fuse_getattr,
2439	.listxattr = fuse_listxattr,
2440	.get_inode_acl = fuse_get_inode_acl,
2441	.get_acl = fuse_get_acl,
2442	.set_acl = fuse_set_acl,
2443	.fileattr_get = fuse_fileattr_get,
2444	.fileattr_set = fuse_fileattr_set,
2445	};
2446
2447	static const struct inode_operations fuse_symlink_inode_operations = {
2448	.setattr = fuse_setattr,
2449	.get_link = fuse_get_link,
2450	.getattr = fuse_getattr,
2451	.listxattr = fuse_listxattr,
2452	};
2453
2454	void fuse_init_common(struct inode *inode)
2455	{
2456	inode->i_op = &fuse_common_inode_operations;
2457	}
2458
2459	void fuse_init_dir(struct inode *inode)
2460	{
2461	struct fuse_inode *fi = get_fuse_inode(inode);
2462
2463	inode->i_op = &fuse_dir_inode_operations;
2464	inode->i_fop = &fuse_dir_operations;
2465
2466	spin_lock_init(&fi->rdc.lock);
2467	fi->rdc.cached = false;
2468	fi->rdc.size = 0;
2469	fi->rdc.pos = 0;
2470	fi->rdc.version = 0;
2471	}
2472
2473	static int fuse_symlink_read_folio(struct file *null, struct folio *folio)
2474	{
2475	int err = fuse_readlink_folio(inode: folio->mapping->host, folio);
2476
2477	if (!err)
2478	folio_mark_uptodate(folio);
2479
2480	folio_unlock(folio);
2481
2482	return err;
2483	}
2484
2485	static const struct address_space_operations fuse_symlink_aops = {
2486	.read_folio = fuse_symlink_read_folio,
2487	};
2488
2489	void fuse_init_symlink(struct inode *inode)
2490	{
2491	inode->i_op = &fuse_symlink_inode_operations;
2492	inode->i_data.a_ops = &fuse_symlink_aops;
2493	inode_nohighmem(inode);
2494	}
2495