// SPDX-License-Identifier: GPL-2.0-only#include <linux/export.h>#include <linux/sched/signal.h>#include <linux/sched/task.h>#include <linux/fs.h>#include <linux/path.h>#include <linux/slab.h>#include <linux/fs_struct.h>#include <linux/init_task.h>#include "internal.h"#include "mount.h" /* * Replace the fs->{rootmnt,root} with {mnt,dentry}. Put the old values. * It can block. */void set_fs_root(struct fs_struct *fs, const struct path *path){	struct path old_root; 	path_get(path);	write_seqlock(&fs->seq);	old_root = fs->root;	fs->root = *path;	write_sequnlock(&fs->seq);	if (old_root.dentry)		path_put(&old_root);} /* * Replace the fs->{pwdmnt,pwd} with {mnt,dentry}. Put the old values. * It can block. */void set_fs_pwd(struct fs_struct *fs, const struct path *path){	struct path old_pwd; 	path_get(path);	write_seqlock(&fs->seq);	old_pwd = fs->pwd;	fs->pwd = *path;	write_sequnlock(&fs->seq); 	if (old_pwd.dentry)		path_put(&old_pwd);} static inline int replace_path(struct path *p, const struct path *old, const struct path *new){	if (likely(p->dentry != old->dentry || p->mnt != old->mnt))		return 0;	*p = *new;	return 1;} void chroot_fs_refs(const struct path *old_root, const struct path *new_root){	struct task_struct *g, *p;	struct fs_struct *fs;	int count = 0; 	read_lock(&tasklist_lock);	for_each_process_thread(g, p) {		if (p->flags & (PF_KTHREAD | PF_EXITING | PF_DUMPCORE))			continue; 		task_lock(p);		fs = p->real_fs;		if (fs) {			int hits = 0;			write_seqlock(&fs->seq);			hits += replace_path(&fs->root, old_root, new_root);			hits += replace_path(&fs->pwd, old_root, new_root);			while (hits--) {				count++;				path_get(new_root);			}			write_sequnlock(&fs->seq);		}		task_unlock(p);	}	read_unlock(&tasklist_lock);	while (count--)		path_put(old_root);} void free_fs_struct(struct fs_struct *fs){	path_put(&fs->root);	path_put(&fs->pwd);	kmem_cache_free(fs_cachep, fs);} void exit_fs(struct task_struct *tsk){	struct fs_struct *fs = tsk->real_fs; 	if (fs) {		int kill;		task_lock(tsk);		read_seqlock_excl(&fs->seq);		tsk->real_fs = NULL;		tsk->fs = NULL;		kill = !--fs->users;		read_sequnlock_excl(&fs->seq);		task_unlock(tsk);		if (kill)			free_fs_struct(fs);	}} struct fs_struct *copy_fs_struct(struct fs_struct *old){	struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);	/* We don't need to lock fs - think why ;-) */	if (fs) {		fs->users = 1;		fs->in_exec = 0;		seqlock_init(&fs->seq);		fs->umask = old->umask; 		read_seqlock_excl(&old->seq);		fs->root = old->root;		path_get(&fs->root);		fs->pwd = old->pwd;		path_get(&fs->pwd);		read_sequnlock_excl(&old->seq);	}	return fs;} int unshare_fs_struct(void){	struct fs_struct *fs = current->real_fs;	struct fs_struct *new_fs = copy_fs_struct(fs);	int kill; 	if (!new_fs)		return -ENOMEM; 	task_lock(current);	read_seqlock_excl(&fs->seq);	VFS_WARN_ON_ONCE(fs != current->fs);	kill = !--fs->users;	current->fs = new_fs;	current->real_fs = new_fs;	read_sequnlock_excl(&fs->seq);	task_unlock(current); 	if (kill)		free_fs_struct(fs); 	return 0;}EXPORT_SYMBOL_GPL(unshare_fs_struct); /* * PID 1 may choose to stop sharing fs_struct state with us. * Either via unshare(CLONE_FS) or unshare(CLONE_NEWNS). Of * course, PID 1 could have chosen to create arbitrary process * trees that all share fs_struct state via CLONE_FS. This is a * strong statement: We only care about PID 1 aka the thread-group * leader so subthread's fs_struct state doesn't matter. * * PID 1 unsharing fs_struct state is a bug. PID 1 relies on * various kthreads to be able to perform work based on its * fs_struct state. Breaking that contract sucks for both sides. * So just don't bother with extra work for this. No sane init * system should ever do this. * * On older kernels if PID 1 unshared its filesystem state with us the * kernel simply used the stale fs_struct state implicitly pinning * anything that PID 1 had last used. Even if PID 1 might've moved on to * some completely different fs_struct state and might've even unmounted * the old root. * * This has hilarious consequences: Think continuing to dump coredump * state into an implicitly pinned directory somewhere. Calling random * binaries in the old rootfs via usermodehelpers. * * Be aggressive about this: We simply reject operating on stale * fs_struct state by reverting to nullfs. Every kworker that does * lookups after this point will fail. Every usermodehelper call will * fail. Tough luck but let's be kind and emit a warning to userspace. */static inline void validate_fs_switch(struct fs_struct *old_fs){	might_sleep(); 	if (likely(current->pid != 1))		return;	/* @old_fs may be dangling but for comparison it's fine */	if (old_fs != userspace_init_fs)		return;	pr_warn("VFS: Pid 1 stopped sharing filesystem state\n");	set_fs_root(userspace_init_fs, &init_fs.root);	set_fs_pwd(userspace_init_fs, &init_fs.root);} struct fs_struct *switch_fs_struct(struct fs_struct *new_fs){	struct fs_struct *fs; 	scoped_guard(task_lock, current) {		fs = current->fs;		VFS_WARN_ON_ONCE(fs != current->real_fs);		read_seqlock_excl(&fs->seq);		current->fs = new_fs;		current->real_fs = new_fs;		if (--fs->users)			new_fs = NULL;		else			new_fs = fs;		read_sequnlock_excl(&fs->seq);	} 	validate_fs_switch(fs);	return new_fs;} /* to be mentioned only in INIT_TASK */struct fs_struct init_fs = {	.users		= 1,	.seq		= __SEQLOCK_UNLOCKED(init_fs.seq),	.umask		= 0022,}; struct fs_struct *userspace_init_fs __ro_after_init;EXPORT_SYMBOL_GPL(userspace_init_fs); void __init init_userspace_fs(void){	struct mount *m;	struct path root; 	/* Move PID 1 from nullfs into the initramfs. */	m = topmost_overmount(current->nsproxy->mnt_ns->root);	root.mnt = &m->mnt;	root.dentry = root.mnt->mnt_root; 	VFS_WARN_ON_ONCE(current->pid != 1); 	set_fs_root(current->fs, &root);	set_fs_pwd(current->fs, &root); 	/* Hold a reference for the global pointer. */	read_seqlock_excl(&current->fs->seq);	current->fs->users++;	read_sequnlock_excl(&current->fs->seq); 	userspace_init_fs = current->fs;}