linux/fs/namespace.c
<<
>>
Prefs
   1/*
   2 *  linux/fs/namespace.c
   3 *
   4 * (C) Copyright Al Viro 2000, 2001
   5 *      Released under GPL v2.
   6 *
   7 * Based on code from fs/super.c, copyright Linus Torvalds and others.
   8 * Heavily rewritten.
   9 */
  10
  11#include <linux/syscalls.h>
  12#include <linux/export.h>
  13#include <linux/capability.h>
  14#include <linux/mnt_namespace.h>
  15#include <linux/user_namespace.h>
  16#include <linux/namei.h>
  17#include <linux/security.h>
  18#include <linux/idr.h>
  19#include <linux/init.h>         /* init_rootfs */
  20#include <linux/fs_struct.h>    /* get_fs_root et.al. */
  21#include <linux/fsnotify.h>     /* fsnotify_vfsmount_delete */
  22#include <linux/uaccess.h>
  23#include <linux/proc_ns.h>
  24#include <linux/magic.h>
  25#include <linux/bootmem.h>
  26#include <linux/task_work.h>
  27#include "pnode.h"
  28#include "internal.h"
  29
  30/* Maximum number of mounts in a mount namespace */
  31unsigned int sysctl_mount_max __read_mostly = 100000;
  32
  33static unsigned int m_hash_mask __read_mostly;
  34static unsigned int m_hash_shift __read_mostly;
  35static unsigned int mp_hash_mask __read_mostly;
  36static unsigned int mp_hash_shift __read_mostly;
  37
  38static __initdata unsigned long mhash_entries;
  39static int __init set_mhash_entries(char *str)
  40{
  41        if (!str)
  42                return 0;
  43        mhash_entries = simple_strtoul(str, &str, 0);
  44        return 1;
  45}
  46__setup("mhash_entries=", set_mhash_entries);
  47
  48static __initdata unsigned long mphash_entries;
  49static int __init set_mphash_entries(char *str)
  50{
  51        if (!str)
  52                return 0;
  53        mphash_entries = simple_strtoul(str, &str, 0);
  54        return 1;
  55}
  56__setup("mphash_entries=", set_mphash_entries);
  57
  58static u64 event;
  59static DEFINE_IDA(mnt_id_ida);
  60static DEFINE_IDA(mnt_group_ida);
  61static DEFINE_SPINLOCK(mnt_id_lock);
  62static int mnt_id_start = 0;
  63static int mnt_group_start = 1;
  64
  65static struct hlist_head *mount_hashtable __read_mostly;
  66static struct hlist_head *mountpoint_hashtable __read_mostly;
  67static struct kmem_cache *mnt_cache __read_mostly;
  68static DECLARE_RWSEM(namespace_sem);
  69
  70/* /sys/fs */
  71struct kobject *fs_kobj;
  72EXPORT_SYMBOL_GPL(fs_kobj);
  73
  74/*
  75 * vfsmount lock may be taken for read to prevent changes to the
  76 * vfsmount hash, ie. during mountpoint lookups or walking back
  77 * up the tree.
  78 *
  79 * It should be taken for write in all cases where the vfsmount
  80 * tree or hash is modified or when a vfsmount structure is modified.
  81 */
  82__cacheline_aligned_in_smp DEFINE_SEQLOCK(mount_lock);
  83
  84static inline struct hlist_head *m_hash(struct vfsmount *mnt, struct dentry *dentry)
  85{
  86        unsigned long tmp = ((unsigned long)mnt / L1_CACHE_BYTES);
  87        tmp += ((unsigned long)dentry / L1_CACHE_BYTES);
  88        tmp = tmp + (tmp >> m_hash_shift);
  89        return &mount_hashtable[tmp & m_hash_mask];
  90}
  91
  92static inline struct hlist_head *mp_hash(struct dentry *dentry)
  93{
  94        unsigned long tmp = ((unsigned long)dentry / L1_CACHE_BYTES);
  95        tmp = tmp + (tmp >> mp_hash_shift);
  96        return &mountpoint_hashtable[tmp & mp_hash_mask];
  97}
  98
  99/*
 100 * allocation is serialized by namespace_sem, but we need the spinlock to
 101 * serialize with freeing.
 102 */
 103static int mnt_alloc_id(struct mount *mnt)
 104{
 105        int res;
 106
 107retry:
 108        ida_pre_get(&mnt_id_ida, GFP_KERNEL);
 109        spin_lock(&mnt_id_lock);
 110        res = ida_get_new_above(&mnt_id_ida, mnt_id_start, &mnt->mnt_id);
 111        if (!res)
 112                mnt_id_start = mnt->mnt_id + 1;
 113        spin_unlock(&mnt_id_lock);
 114        if (res == -EAGAIN)
 115                goto retry;
 116
 117        return res;
 118}
 119
 120static void mnt_free_id(struct mount *mnt)
 121{
 122        int id = mnt->mnt_id;
 123        spin_lock(&mnt_id_lock);
 124        ida_remove(&mnt_id_ida, id);
 125        if (mnt_id_start > id)
 126                mnt_id_start = id;
 127        spin_unlock(&mnt_id_lock);
 128}
 129
 130/*
 131 * Allocate a new peer group ID
 132 *
 133 * mnt_group_ida is protected by namespace_sem
 134 */
 135static int mnt_alloc_group_id(struct mount *mnt)
 136{
 137        int res;
 138
 139        if (!ida_pre_get(&mnt_group_ida, GFP_KERNEL))
 140                return -ENOMEM;
 141
 142        res = ida_get_new_above(&mnt_group_ida,
 143                                mnt_group_start,
 144                                &mnt->mnt_group_id);
 145        if (!res)
 146                mnt_group_start = mnt->mnt_group_id + 1;
 147
 148        return res;
 149}
 150
 151/*
 152 * Release a peer group ID
 153 */
 154void mnt_release_group_id(struct mount *mnt)
 155{
 156        int id = mnt->mnt_group_id;
 157        ida_remove(&mnt_group_ida, id);
 158        if (mnt_group_start > id)
 159                mnt_group_start = id;
 160        mnt->mnt_group_id = 0;
 161}
 162
 163/*
 164 * vfsmount lock must be held for read
 165 */
 166static inline void mnt_add_count(struct mount *mnt, int n)
 167{
 168#ifdef CONFIG_SMP
 169        this_cpu_add(mnt->mnt_pcp->mnt_count, n);
 170#else
 171        preempt_disable();
 172        mnt->mnt_count += n;
 173        preempt_enable();
 174#endif
 175}
 176
 177/*
 178 * vfsmount lock must be held for write
 179 */
 180unsigned int mnt_get_count(struct mount *mnt)
 181{
 182#ifdef CONFIG_SMP
 183        unsigned int count = 0;
 184        int cpu;
 185
 186        for_each_possible_cpu(cpu) {
 187                count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_count;
 188        }
 189
 190        return count;
 191#else
 192        return mnt->mnt_count;
 193#endif
 194}
 195
 196static void drop_mountpoint(struct fs_pin *p)
 197{
 198        struct mount *m = container_of(p, struct mount, mnt_umount);
 199        dput(m->mnt_ex_mountpoint);
 200        pin_remove(p);
 201        mntput(&m->mnt);
 202}
 203
 204static struct mount *alloc_vfsmnt(const char *name)
 205{
 206        struct mount *mnt = kmem_cache_zalloc(mnt_cache, GFP_KERNEL);
 207        if (mnt) {
 208                int err;
 209
 210                err = mnt_alloc_id(mnt);
 211                if (err)
 212                        goto out_free_cache;
 213
 214                if (name) {
 215                        mnt->mnt_devname = kstrdup_const(name, GFP_KERNEL);
 216                        if (!mnt->mnt_devname)
 217                                goto out_free_id;
 218                }
 219
 220#ifdef CONFIG_SMP
 221                mnt->mnt_pcp = alloc_percpu(struct mnt_pcp);
 222                if (!mnt->mnt_pcp)
 223                        goto out_free_devname;
 224
 225                this_cpu_add(mnt->mnt_pcp->mnt_count, 1);
 226#else
 227                mnt->mnt_count = 1;
 228                mnt->mnt_writers = 0;
 229#endif
 230
 231                INIT_HLIST_NODE(&mnt->mnt_hash);
 232                INIT_LIST_HEAD(&mnt->mnt_child);
 233                INIT_LIST_HEAD(&mnt->mnt_mounts);
 234                INIT_LIST_HEAD(&mnt->mnt_list);
 235                INIT_LIST_HEAD(&mnt->mnt_expire);
 236                INIT_LIST_HEAD(&mnt->mnt_share);
 237                INIT_LIST_HEAD(&mnt->mnt_slave_list);
 238                INIT_LIST_HEAD(&mnt->mnt_slave);
 239                INIT_HLIST_NODE(&mnt->mnt_mp_list);
 240#ifdef CONFIG_FSNOTIFY
 241                INIT_HLIST_HEAD(&mnt->mnt_fsnotify_marks);
 242#endif
 243                init_fs_pin(&mnt->mnt_umount, drop_mountpoint);
 244        }
 245        return mnt;
 246
 247#ifdef CONFIG_SMP
 248out_free_devname:
 249        kfree_const(mnt->mnt_devname);
 250#endif
 251out_free_id:
 252        mnt_free_id(mnt);
 253out_free_cache:
 254        kmem_cache_free(mnt_cache, mnt);
 255        return NULL;
 256}
 257
 258/*
 259 * Most r/o checks on a fs are for operations that take
 260 * discrete amounts of time, like a write() or unlink().
 261 * We must keep track of when those operations start
 262 * (for permission checks) and when they end, so that
 263 * we can determine when writes are able to occur to
 264 * a filesystem.
 265 */
 266/*
 267 * __mnt_is_readonly: check whether a mount is read-only
 268 * @mnt: the mount to check for its write status
 269 *
 270 * This shouldn't be used directly ouside of the VFS.
 271 * It does not guarantee that the filesystem will stay
 272 * r/w, just that it is right *now*.  This can not and
 273 * should not be used in place of IS_RDONLY(inode).
 274 * mnt_want/drop_write() will _keep_ the filesystem
 275 * r/w.
 276 */
 277int __mnt_is_readonly(struct vfsmount *mnt)
 278{
 279        if (mnt->mnt_flags & MNT_READONLY)
 280                return 1;
 281        if (mnt->mnt_sb->s_flags & MS_RDONLY)
 282                return 1;
 283        return 0;
 284}
 285EXPORT_SYMBOL_GPL(__mnt_is_readonly);
 286
 287static inline void mnt_inc_writers(struct mount *mnt)
 288{
 289#ifdef CONFIG_SMP
 290        this_cpu_inc(mnt->mnt_pcp->mnt_writers);
 291#else
 292        mnt->mnt_writers++;
 293#endif
 294}
 295
 296static inline void mnt_dec_writers(struct mount *mnt)
 297{
 298#ifdef CONFIG_SMP
 299        this_cpu_dec(mnt->mnt_pcp->mnt_writers);
 300#else
 301        mnt->mnt_writers--;
 302#endif
 303}
 304
 305static unsigned int mnt_get_writers(struct mount *mnt)
 306{
 307#ifdef CONFIG_SMP
 308        unsigned int count = 0;
 309        int cpu;
 310
 311        for_each_possible_cpu(cpu) {
 312                count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_writers;
 313        }
 314
 315        return count;
 316#else
 317        return mnt->mnt_writers;
 318#endif
 319}
 320
 321static int mnt_is_readonly(struct vfsmount *mnt)
 322{
 323        if (mnt->mnt_sb->s_readonly_remount)
 324                return 1;
 325        /* Order wrt setting s_flags/s_readonly_remount in do_remount() */
 326        smp_rmb();
 327        return __mnt_is_readonly(mnt);
 328}
 329
 330/*
 331 * Most r/o & frozen checks on a fs are for operations that take discrete
 332 * amounts of time, like a write() or unlink().  We must keep track of when
 333 * those operations start (for permission checks) and when they end, so that we
 334 * can determine when writes are able to occur to a filesystem.
 335 */
 336/**
 337 * __mnt_want_write - get write access to a mount without freeze protection
 338 * @m: the mount on which to take a write
 339 *
 340 * This tells the low-level filesystem that a write is about to be performed to
 341 * it, and makes sure that writes are allowed (mnt it read-write) before
 342 * returning success. This operation does not protect against filesystem being
 343 * frozen. When the write operation is finished, __mnt_drop_write() must be
 344 * called. This is effectively a refcount.
 345 */
 346int __mnt_want_write(struct vfsmount *m)
 347{
 348        struct mount *mnt = real_mount(m);
 349        int ret = 0;
 350
 351        preempt_disable();
 352        mnt_inc_writers(mnt);
 353        /*
 354         * The store to mnt_inc_writers must be visible before we pass
 355         * MNT_WRITE_HOLD loop below, so that the slowpath can see our
 356         * incremented count after it has set MNT_WRITE_HOLD.
 357         */
 358        smp_mb();
 359        while (ACCESS_ONCE(mnt->mnt.mnt_flags) & MNT_WRITE_HOLD)
 360                cpu_relax();
 361        /*
 362         * After the slowpath clears MNT_WRITE_HOLD, mnt_is_readonly will
 363         * be set to match its requirements. So we must not load that until
 364         * MNT_WRITE_HOLD is cleared.
 365         */
 366        smp_rmb();
 367        if (mnt_is_readonly(m)) {
 368                mnt_dec_writers(mnt);
 369                ret = -EROFS;
 370        }
 371        preempt_enable();
 372
 373        return ret;
 374}
 375
 376/**
 377 * mnt_want_write - get write access to a mount
 378 * @m: the mount on which to take a write
 379 *
 380 * This tells the low-level filesystem that a write is about to be performed to
 381 * it, and makes sure that writes are allowed (mount is read-write, filesystem
 382 * is not frozen) before returning success.  When the write operation is
 383 * finished, mnt_drop_write() must be called.  This is effectively a refcount.
 384 */
 385int mnt_want_write(struct vfsmount *m)
 386{
 387        int ret;
 388
 389        sb_start_write(m->mnt_sb);
 390        ret = __mnt_want_write(m);
 391        if (ret)
 392                sb_end_write(m->mnt_sb);
 393        return ret;
 394}
 395EXPORT_SYMBOL_GPL(mnt_want_write);
 396
 397/**
 398 * mnt_clone_write - get write access to a mount
 399 * @mnt: the mount on which to take a write
 400 *
 401 * This is effectively like mnt_want_write, except
 402 * it must only be used to take an extra write reference
 403 * on a mountpoint that we already know has a write reference
 404 * on it. This allows some optimisation.
 405 *
 406 * After finished, mnt_drop_write must be called as usual to
 407 * drop the reference.
 408 */
 409int mnt_clone_write(struct vfsmount *mnt)
 410{
 411        /* superblock may be r/o */
 412        if (__mnt_is_readonly(mnt))
 413                return -EROFS;
 414        preempt_disable();
 415        mnt_inc_writers(real_mount(mnt));
 416        preempt_enable();
 417        return 0;
 418}
 419EXPORT_SYMBOL_GPL(mnt_clone_write);
 420
 421/**
 422 * __mnt_want_write_file - get write access to a file's mount
 423 * @file: the file who's mount on which to take a write
 424 *
 425 * This is like __mnt_want_write, but it takes a file and can
 426 * do some optimisations if the file is open for write already
 427 */
 428int __mnt_want_write_file(struct file *file)
 429{
 430        if (!(file->f_mode & FMODE_WRITER))
 431                return __mnt_want_write(file->f_path.mnt);
 432        else
 433                return mnt_clone_write(file->f_path.mnt);
 434}
 435
 436/**
 437 * mnt_want_write_file - get write access to a file's mount
 438 * @file: the file who's mount on which to take a write
 439 *
 440 * This is like mnt_want_write, but it takes a file and can
 441 * do some optimisations if the file is open for write already
 442 */
 443int mnt_want_write_file(struct file *file)
 444{
 445        int ret;
 446
 447        sb_start_write(file->f_path.mnt->mnt_sb);
 448        ret = __mnt_want_write_file(file);
 449        if (ret)
 450                sb_end_write(file->f_path.mnt->mnt_sb);
 451        return ret;
 452}
 453EXPORT_SYMBOL_GPL(mnt_want_write_file);
 454
 455/**
 456 * __mnt_drop_write - give up write access to a mount
 457 * @mnt: the mount on which to give up write access
 458 *
 459 * Tells the low-level filesystem that we are done
 460 * performing writes to it.  Must be matched with
 461 * __mnt_want_write() call above.
 462 */
 463void __mnt_drop_write(struct vfsmount *mnt)
 464{
 465        preempt_disable();
 466        mnt_dec_writers(real_mount(mnt));
 467        preempt_enable();
 468}
 469
 470/**
 471 * mnt_drop_write - give up write access to a mount
 472 * @mnt: the mount on which to give up write access
 473 *
 474 * Tells the low-level filesystem that we are done performing writes to it and
 475 * also allows filesystem to be frozen again.  Must be matched with
 476 * mnt_want_write() call above.
 477 */
 478void mnt_drop_write(struct vfsmount *mnt)
 479{
 480        __mnt_drop_write(mnt);
 481        sb_end_write(mnt->mnt_sb);
 482}
 483EXPORT_SYMBOL_GPL(mnt_drop_write);
 484
 485void __mnt_drop_write_file(struct file *file)
 486{
 487        __mnt_drop_write(file->f_path.mnt);
 488}
 489
 490void mnt_drop_write_file(struct file *file)
 491{
 492        mnt_drop_write(file->f_path.mnt);
 493}
 494EXPORT_SYMBOL(mnt_drop_write_file);
 495
 496static int mnt_make_readonly(struct mount *mnt)
 497{
 498        int ret = 0;
 499
 500        lock_mount_hash();
 501        mnt->mnt.mnt_flags |= MNT_WRITE_HOLD;
 502        /*
 503         * After storing MNT_WRITE_HOLD, we'll read the counters. This store
 504         * should be visible before we do.
 505         */
 506        smp_mb();
 507
 508        /*
 509         * With writers on hold, if this value is zero, then there are
 510         * definitely no active writers (although held writers may subsequently
 511         * increment the count, they'll have to wait, and decrement it after
 512         * seeing MNT_READONLY).
 513         *
 514         * It is OK to have counter incremented on one CPU and decremented on
 515         * another: the sum will add up correctly. The danger would be when we
 516         * sum up each counter, if we read a counter before it is incremented,
 517         * but then read another CPU's count which it has been subsequently
 518         * decremented from -- we would see more decrements than we should.
 519         * MNT_WRITE_HOLD protects against this scenario, because
 520         * mnt_want_write first increments count, then smp_mb, then spins on
 521         * MNT_WRITE_HOLD, so it can't be decremented by another CPU while
 522         * we're counting up here.
 523         */
 524        if (mnt_get_writers(mnt) > 0)
 525                ret = -EBUSY;
 526        else
 527                mnt->mnt.mnt_flags |= MNT_READONLY;
 528        /*
 529         * MNT_READONLY must become visible before ~MNT_WRITE_HOLD, so writers
 530         * that become unheld will see MNT_READONLY.
 531         */
 532        smp_wmb();
 533        mnt->mnt.mnt_flags &= ~MNT_WRITE_HOLD;
 534        unlock_mount_hash();
 535        return ret;
 536}
 537
 538static void __mnt_unmake_readonly(struct mount *mnt)
 539{
 540        lock_mount_hash();
 541        mnt->mnt.mnt_flags &= ~MNT_READONLY;
 542        unlock_mount_hash();
 543}
 544
 545int sb_prepare_remount_readonly(struct super_block *sb)
 546{
 547        struct mount *mnt;
 548        int err = 0;
 549
 550        /* Racy optimization.  Recheck the counter under MNT_WRITE_HOLD */
 551        if (atomic_long_read(&sb->s_remove_count))
 552                return -EBUSY;
 553
 554        lock_mount_hash();
 555        list_for_each_entry(mnt, &sb->s_mounts, mnt_instance) {
 556                if (!(mnt->mnt.mnt_flags & MNT_READONLY)) {
 557                        mnt->mnt.mnt_flags |= MNT_WRITE_HOLD;
 558                        smp_mb();
 559                        if (mnt_get_writers(mnt) > 0) {
 560                                err = -EBUSY;
 561                                break;
 562                        }
 563                }
 564        }
 565        if (!err && atomic_long_read(&sb->s_remove_count))
 566                err = -EBUSY;
 567
 568        if (!err) {
 569                sb->s_readonly_remount = 1;
 570                smp_wmb();
 571        }
 572        list_for_each_entry(mnt, &sb->s_mounts, mnt_instance) {
 573                if (mnt->mnt.mnt_flags & MNT_WRITE_HOLD)
 574                        mnt->mnt.mnt_flags &= ~MNT_WRITE_HOLD;
 575        }
 576        unlock_mount_hash();
 577
 578        return err;
 579}
 580
 581static void free_vfsmnt(struct mount *mnt)
 582{
 583        kfree_const(mnt->mnt_devname);
 584#ifdef CONFIG_SMP
 585        free_percpu(mnt->mnt_pcp);
 586#endif
 587        kmem_cache_free(mnt_cache, mnt);
 588}
 589
 590static void delayed_free_vfsmnt(struct rcu_head *head)
 591{
 592        free_vfsmnt(container_of(head, struct mount, mnt_rcu));
 593}
 594
 595/* call under rcu_read_lock */
 596int __legitimize_mnt(struct vfsmount *bastard, unsigned seq)
 597{
 598        struct mount *mnt;
 599        if (read_seqretry(&mount_lock, seq))
 600                return 1;
 601        if (bastard == NULL)
 602                return 0;
 603        mnt = real_mount(bastard);
 604        mnt_add_count(mnt, 1);
 605        if (likely(!read_seqretry(&mount_lock, seq)))
 606                return 0;
 607        if (bastard->mnt_flags & MNT_SYNC_UMOUNT) {
 608                mnt_add_count(mnt, -1);
 609                return 1;
 610        }
 611        return -1;
 612}
 613
 614/* call under rcu_read_lock */
 615bool legitimize_mnt(struct vfsmount *bastard, unsigned seq)
 616{
 617        int res = __legitimize_mnt(bastard, seq);
 618        if (likely(!res))
 619                return true;
 620        if (unlikely(res < 0)) {
 621                rcu_read_unlock();
 622                mntput(bastard);
 623                rcu_read_lock();
 624        }
 625        return false;
 626}
 627
 628/*
 629 * find the first mount at @dentry on vfsmount @mnt.
 630 * call under rcu_read_lock()
 631 */
 632struct mount *__lookup_mnt(struct vfsmount *mnt, struct dentry *dentry)
 633{
 634        struct hlist_head *head = m_hash(mnt, dentry);
 635        struct mount *p;
 636
 637        hlist_for_each_entry_rcu(p, head, mnt_hash)
 638                if (&p->mnt_parent->mnt == mnt && p->mnt_mountpoint == dentry)
 639                        return p;
 640        return NULL;
 641}
 642
 643/*
 644 * find the last mount at @dentry on vfsmount @mnt.
 645 * mount_lock must be held.
 646 */
 647struct mount *__lookup_mnt_last(struct vfsmount *mnt, struct dentry *dentry)
 648{
 649        struct mount *p, *res = NULL;
 650        p = __lookup_mnt(mnt, dentry);
 651        if (!p)
 652                goto out;
 653        if (!(p->mnt.mnt_flags & MNT_UMOUNT))
 654                res = p;
 655        hlist_for_each_entry_continue(p, mnt_hash) {
 656                if (&p->mnt_parent->mnt != mnt || p->mnt_mountpoint != dentry)
 657                        break;
 658                if (!(p->mnt.mnt_flags & MNT_UMOUNT))
 659                        res = p;
 660        }
 661out:
 662        return res;
 663}
 664
 665/*
 666 * lookup_mnt - Return the first child mount mounted at path
 667 *
 668 * "First" means first mounted chronologically.  If you create the
 669 * following mounts:
 670 *
 671 * mount /dev/sda1 /mnt
 672 * mount /dev/sda2 /mnt
 673 * mount /dev/sda3 /mnt
 674 *
 675 * Then lookup_mnt() on the base /mnt dentry in the root mount will
 676 * return successively the root dentry and vfsmount of /dev/sda1, then
 677 * /dev/sda2, then /dev/sda3, then NULL.
 678 *
 679 * lookup_mnt takes a reference to the found vfsmount.
 680 */
 681struct vfsmount *lookup_mnt(struct path *path)
 682{
 683        struct mount *child_mnt;
 684        struct vfsmount *m;
 685        unsigned seq;
 686
 687        rcu_read_lock();
 688        do {
 689                seq = read_seqbegin(&mount_lock);
 690                child_mnt = __lookup_mnt(path->mnt, path->dentry);
 691                m = child_mnt ? &child_mnt->mnt : NULL;
 692        } while (!legitimize_mnt(m, seq));
 693        rcu_read_unlock();
 694        return m;
 695}
 696
 697/*
 698 * __is_local_mountpoint - Test to see if dentry is a mountpoint in the
 699 *                         current mount namespace.
 700 *
 701 * The common case is dentries are not mountpoints at all and that
 702 * test is handled inline.  For the slow case when we are actually
 703 * dealing with a mountpoint of some kind, walk through all of the
 704 * mounts in the current mount namespace and test to see if the dentry
 705 * is a mountpoint.
 706 *
 707 * The mount_hashtable is not usable in the context because we
 708 * need to identify all mounts that may be in the current mount
 709 * namespace not just a mount that happens to have some specified
 710 * parent mount.
 711 */
 712bool __is_local_mountpoint(struct dentry *dentry)
 713{
 714        struct mnt_namespace *ns = current->nsproxy->mnt_ns;
 715        struct mount *mnt;
 716        bool is_covered = false;
 717
 718        if (!d_mountpoint(dentry))
 719                goto out;
 720
 721        down_read(&namespace_sem);
 722        list_for_each_entry(mnt, &ns->list, mnt_list) {
 723                is_covered = (mnt->mnt_mountpoint == dentry);
 724                if (is_covered)
 725                        break;
 726        }
 727        up_read(&namespace_sem);
 728out:
 729        return is_covered;
 730}
 731
 732static struct mountpoint *lookup_mountpoint(struct dentry *dentry)
 733{
 734        struct hlist_head *chain = mp_hash(dentry);
 735        struct mountpoint *mp;
 736
 737        hlist_for_each_entry(mp, chain, m_hash) {
 738                if (mp->m_dentry == dentry) {
 739                        /* might be worth a WARN_ON() */
 740                        if (d_unlinked(dentry))
 741                                return ERR_PTR(-ENOENT);
 742                        mp->m_count++;
 743                        return mp;
 744                }
 745        }
 746        return NULL;
 747}
 748
 749static struct mountpoint *new_mountpoint(struct dentry *dentry)
 750{
 751        struct hlist_head *chain = mp_hash(dentry);
 752        struct mountpoint *mp;
 753        int ret;
 754
 755        mp = kmalloc(sizeof(struct mountpoint), GFP_KERNEL);
 756        if (!mp)
 757                return ERR_PTR(-ENOMEM);
 758
 759        ret = d_set_mounted(dentry);
 760        if (ret) {
 761                kfree(mp);
 762                return ERR_PTR(ret);
 763        }
 764
 765        mp->m_dentry = dentry;
 766        mp->m_count = 1;
 767        hlist_add_head(&mp->m_hash, chain);
 768        INIT_HLIST_HEAD(&mp->m_list);
 769        return mp;
 770}
 771
 772static void put_mountpoint(struct mountpoint *mp)
 773{
 774        if (!--mp->m_count) {
 775                struct dentry *dentry = mp->m_dentry;
 776                BUG_ON(!hlist_empty(&mp->m_list));
 777                spin_lock(&dentry->d_lock);
 778                dentry->d_flags &= ~DCACHE_MOUNTED;
 779                spin_unlock(&dentry->d_lock);
 780                hlist_del(&mp->m_hash);
 781                kfree(mp);
 782        }
 783}
 784
 785static inline int check_mnt(struct mount *mnt)
 786{
 787        return mnt->mnt_ns == current->nsproxy->mnt_ns;
 788}
 789
 790/*
 791 * vfsmount lock must be held for write
 792 */
 793static void touch_mnt_namespace(struct mnt_namespace *ns)
 794{
 795        if (ns) {
 796                ns->event = ++event;
 797                wake_up_interruptible(&ns->poll);
 798        }
 799}
 800
 801/*
 802 * vfsmount lock must be held for write
 803 */
 804static void __touch_mnt_namespace(struct mnt_namespace *ns)
 805{
 806        if (ns && ns->event != event) {
 807                ns->event = event;
 808                wake_up_interruptible(&ns->poll);
 809        }
 810}
 811
 812/*
 813 * vfsmount lock must be held for write
 814 */
 815static void unhash_mnt(struct mount *mnt)
 816{
 817        mnt->mnt_parent = mnt;
 818        mnt->mnt_mountpoint = mnt->mnt.mnt_root;
 819        list_del_init(&mnt->mnt_child);
 820        hlist_del_init_rcu(&mnt->mnt_hash);
 821        hlist_del_init(&mnt->mnt_mp_list);
 822        put_mountpoint(mnt->mnt_mp);
 823        mnt->mnt_mp = NULL;
 824}
 825
 826/*
 827 * vfsmount lock must be held for write
 828 */
 829static void detach_mnt(struct mount *mnt, struct path *old_path)
 830{
 831        old_path->dentry = mnt->mnt_mountpoint;
 832        old_path->mnt = &mnt->mnt_parent->mnt;
 833        unhash_mnt(mnt);
 834}
 835
 836/*
 837 * vfsmount lock must be held for write
 838 */
 839static void umount_mnt(struct mount *mnt)
 840{
 841        /* old mountpoint will be dropped when we can do that */
 842        mnt->mnt_ex_mountpoint = mnt->mnt_mountpoint;
 843        unhash_mnt(mnt);
 844}
 845
 846/*
 847 * vfsmount lock must be held for write
 848 */
 849void mnt_set_mountpoint(struct mount *mnt,
 850                        struct mountpoint *mp,
 851                        struct mount *child_mnt)
 852{
 853        mp->m_count++;
 854        mnt_add_count(mnt, 1);  /* essentially, that's mntget */
 855        child_mnt->mnt_mountpoint = dget(mp->m_dentry);
 856        child_mnt->mnt_parent = mnt;
 857        child_mnt->mnt_mp = mp;
 858        hlist_add_head(&child_mnt->mnt_mp_list, &mp->m_list);
 859}
 860
 861/*
 862 * vfsmount lock must be held for write
 863 */
 864static void attach_mnt(struct mount *mnt,
 865                        struct mount *parent,
 866                        struct mountpoint *mp)
 867{
 868        mnt_set_mountpoint(parent, mp, mnt);
 869        hlist_add_head_rcu(&mnt->mnt_hash, m_hash(&parent->mnt, mp->m_dentry));
 870        list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
 871}
 872
 873static void attach_shadowed(struct mount *mnt,
 874                        struct mount *parent,
 875                        struct mount *shadows)
 876{
 877        if (shadows) {
 878                hlist_add_behind_rcu(&mnt->mnt_hash, &shadows->mnt_hash);
 879                list_add(&mnt->mnt_child, &shadows->mnt_child);
 880        } else {
 881                hlist_add_head_rcu(&mnt->mnt_hash,
 882                                m_hash(&parent->mnt, mnt->mnt_mountpoint));
 883                list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
 884        }
 885}
 886
 887/*
 888 * vfsmount lock must be held for write
 889 */
 890static void commit_tree(struct mount *mnt, struct mount *shadows)
 891{
 892        struct mount *parent = mnt->mnt_parent;
 893        struct mount *m;
 894        LIST_HEAD(head);
 895        struct mnt_namespace *n = parent->mnt_ns;
 896
 897        BUG_ON(parent == mnt);
 898
 899        list_add_tail(&head, &mnt->mnt_list);
 900        list_for_each_entry(m, &head, mnt_list)
 901                m->mnt_ns = n;
 902
 903        list_splice(&head, n->list.prev);
 904
 905        n->mounts += n->pending_mounts;
 906        n->pending_mounts = 0;
 907
 908        attach_shadowed(mnt, parent, shadows);
 909        touch_mnt_namespace(n);
 910}
 911
 912static struct mount *next_mnt(struct mount *p, struct mount *root)
 913{
 914        struct list_head *next = p->mnt_mounts.next;
 915        if (next == &p->mnt_mounts) {
 916                while (1) {
 917                        if (p == root)
 918                                return NULL;
 919                        next = p->mnt_child.next;
 920                        if (next != &p->mnt_parent->mnt_mounts)
 921                                break;
 922                        p = p->mnt_parent;
 923                }
 924        }
 925        return list_entry(next, struct mount, mnt_child);
 926}
 927
 928static struct mount *skip_mnt_tree(struct mount *p)
 929{
 930        struct list_head *prev = p->mnt_mounts.prev;
 931        while (prev != &p->mnt_mounts) {
 932                p = list_entry(prev, struct mount, mnt_child);
 933                prev = p->mnt_mounts.prev;
 934        }
 935        return p;
 936}
 937
 938struct vfsmount *
 939vfs_kern_mount(struct file_system_type *type, int flags, const char *name, void *data)
 940{
 941        struct mount *mnt;
 942        struct dentry *root;
 943
 944        if (!type)
 945                return ERR_PTR(-ENODEV);
 946
 947        mnt = alloc_vfsmnt(name);
 948        if (!mnt)
 949                return ERR_PTR(-ENOMEM);
 950
 951        if (flags & MS_KERNMOUNT)
 952                mnt->mnt.mnt_flags = MNT_INTERNAL;
 953
 954        root = mount_fs(type, flags, name, data);
 955        if (IS_ERR(root)) {
 956                mnt_free_id(mnt);
 957                free_vfsmnt(mnt);
 958                return ERR_CAST(root);
 959        }
 960
 961        mnt->mnt.mnt_root = root;
 962        mnt->mnt.mnt_sb = root->d_sb;
 963        mnt->mnt_mountpoint = mnt->mnt.mnt_root;
 964        mnt->mnt_parent = mnt;
 965        lock_mount_hash();
 966        list_add_tail(&mnt->mnt_instance, &root->d_sb->s_mounts);
 967        unlock_mount_hash();
 968        return &mnt->mnt;
 969}
 970EXPORT_SYMBOL_GPL(vfs_kern_mount);
 971
 972static struct mount *clone_mnt(struct mount *old, struct dentry *root,
 973                                        int flag)
 974{
 975        struct super_block *sb = old->mnt.mnt_sb;
 976        struct mount *mnt;
 977        int err;
 978
 979        mnt = alloc_vfsmnt(old->mnt_devname);
 980        if (!mnt)
 981                return ERR_PTR(-ENOMEM);
 982
 983        if (flag & (CL_SLAVE | CL_PRIVATE | CL_SHARED_TO_SLAVE))
 984                mnt->mnt_group_id = 0; /* not a peer of original */
 985        else
 986                mnt->mnt_group_id = old->mnt_group_id;
 987
 988        if ((flag & CL_MAKE_SHARED) && !mnt->mnt_group_id) {
 989                err = mnt_alloc_group_id(mnt);
 990                if (err)
 991                        goto out_free;
 992        }
 993
 994        mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~(MNT_WRITE_HOLD|MNT_MARKED);
 995        /* Don't allow unprivileged users to change mount flags */
 996        if (flag & CL_UNPRIVILEGED) {
 997                mnt->mnt.mnt_flags |= MNT_LOCK_ATIME;
 998
 999                if (mnt->mnt.mnt_flags & MNT_READONLY)
1000                        mnt->mnt.mnt_flags |= MNT_LOCK_READONLY;
1001
1002                if (mnt->mnt.mnt_flags & MNT_NODEV)
1003                        mnt->mnt.mnt_flags |= MNT_LOCK_NODEV;
1004
1005                if (mnt->mnt.mnt_flags & MNT_NOSUID)
1006                        mnt->mnt.mnt_flags |= MNT_LOCK_NOSUID;
1007
1008                if (mnt->mnt.mnt_flags & MNT_NOEXEC)
1009                        mnt->mnt.mnt_flags |= MNT_LOCK_NOEXEC;
1010        }
1011
1012        /* Don't allow unprivileged users to reveal what is under a mount */
1013        if ((flag & CL_UNPRIVILEGED) &&
1014            (!(flag & CL_EXPIRE) || list_empty(&old->mnt_expire)))
1015                mnt->mnt.mnt_flags |= MNT_LOCKED;
1016
1017        atomic_inc(&sb->s_active);
1018        mnt->mnt.mnt_sb = sb;
1019        mnt->mnt.mnt_root = dget(root);
1020        mnt->mnt_mountpoint = mnt->mnt.mnt_root;
1021        mnt->mnt_parent = mnt;
1022        lock_mount_hash();
1023        list_add_tail(&mnt->mnt_instance, &sb->s_mounts);
1024        unlock_mount_hash();
1025
1026        if ((flag & CL_SLAVE) ||
1027            ((flag & CL_SHARED_TO_SLAVE) && IS_MNT_SHARED(old))) {
1028                list_add(&mnt->mnt_slave, &old->mnt_slave_list);
1029                mnt->mnt_master = old;
1030                CLEAR_MNT_SHARED(mnt);
1031        } else if (!(flag & CL_PRIVATE)) {
1032                if ((flag & CL_MAKE_SHARED) || IS_MNT_SHARED(old))
1033                        list_add(&mnt->mnt_share, &old->mnt_share);
1034                if (IS_MNT_SLAVE(old))
1035                        list_add(&mnt->mnt_slave, &old->mnt_slave);
1036                mnt->mnt_master = old->mnt_master;
1037        }
1038        if (flag & CL_MAKE_SHARED)
1039                set_mnt_shared(mnt);
1040
1041        /* stick the duplicate mount on the same expiry list
1042         * as the original if that was on one */
1043        if (flag & CL_EXPIRE) {
1044                if (!list_empty(&old->mnt_expire))
1045                        list_add(&mnt->mnt_expire, &old->mnt_expire);
1046        }
1047
1048        return mnt;
1049
1050 out_free:
1051        mnt_free_id(mnt);
1052        free_vfsmnt(mnt);
1053        return ERR_PTR(err);
1054}
1055
1056static void cleanup_mnt(struct mount *mnt)
1057{
1058        /*
1059         * This probably indicates that somebody messed
1060         * up a mnt_want/drop_write() pair.  If this
1061         * happens, the filesystem was probably unable
1062         * to make r/w->r/o transitions.
1063         */
1064        /*
1065         * The locking used to deal with mnt_count decrement provides barriers,
1066         * so mnt_get_writers() below is safe.
1067         */
1068        WARN_ON(mnt_get_writers(mnt));
1069        if (unlikely(mnt->mnt_pins.first))
1070                mnt_pin_kill(mnt);
1071        fsnotify_vfsmount_delete(&mnt->mnt);
1072        dput(mnt->mnt.mnt_root);
1073        deactivate_super(mnt->mnt.mnt_sb);
1074        mnt_free_id(mnt);
1075        call_rcu(&mnt->mnt_rcu, delayed_free_vfsmnt);
1076}
1077
1078static void __cleanup_mnt(struct rcu_head *head)
1079{
1080        cleanup_mnt(container_of(head, struct mount, mnt_rcu));
1081}
1082
1083static LLIST_HEAD(delayed_mntput_list);
1084static void delayed_mntput(struct work_struct *unused)
1085{
1086        struct llist_node *node = llist_del_all(&delayed_mntput_list);
1087        struct llist_node *next;
1088
1089        for (; node; node = next) {
1090                next = llist_next(node);
1091                cleanup_mnt(llist_entry(node, struct mount, mnt_llist));
1092        }
1093}
1094static DECLARE_DELAYED_WORK(delayed_mntput_work, delayed_mntput);
1095
1096static void mntput_no_expire(struct mount *mnt)
1097{
1098        rcu_read_lock();
1099        mnt_add_count(mnt, -1);
1100        if (likely(mnt->mnt_ns)) { /* shouldn't be the last one */
1101                rcu_read_unlock();
1102                return;
1103        }
1104        lock_mount_hash();
1105        if (mnt_get_count(mnt)) {
1106                rcu_read_unlock();
1107                unlock_mount_hash();
1108                return;
1109        }
1110        if (unlikely(mnt->mnt.mnt_flags & MNT_DOOMED)) {
1111                rcu_read_unlock();
1112                unlock_mount_hash();
1113                return;
1114        }
1115        mnt->mnt.mnt_flags |= MNT_DOOMED;
1116        rcu_read_unlock();
1117
1118        list_del(&mnt->mnt_instance);
1119
1120        if (unlikely(!list_empty(&mnt->mnt_mounts))) {
1121                struct mount *p, *tmp;
1122                list_for_each_entry_safe(p, tmp, &mnt->mnt_mounts,  mnt_child) {
1123                        umount_mnt(p);
1124                }
1125        }
1126        unlock_mount_hash();
1127
1128        if (likely(!(mnt->mnt.mnt_flags & MNT_INTERNAL))) {
1129                struct task_struct *task = current;
1130                if (likely(!(task->flags & PF_KTHREAD))) {
1131                        init_task_work(&mnt->mnt_rcu, __cleanup_mnt);
1132                        if (!task_work_add(task, &mnt->mnt_rcu, true))
1133                                return;
1134                }
1135                if (llist_add(&mnt->mnt_llist, &delayed_mntput_list))
1136                        schedule_delayed_work(&delayed_mntput_work, 1);
1137                return;
1138        }
1139        cleanup_mnt(mnt);
1140}
1141
1142void mntput(struct vfsmount *mnt)
1143{
1144        if (mnt) {
1145                struct mount *m = real_mount(mnt);
1146                /* avoid cacheline pingpong, hope gcc doesn't get "smart" */
1147                if (unlikely(m->mnt_expiry_mark))
1148                        m->mnt_expiry_mark = 0;
1149                mntput_no_expire(m);
1150        }
1151}
1152EXPORT_SYMBOL(mntput);
1153
1154struct vfsmount *mntget(struct vfsmount *mnt)
1155{
1156        if (mnt)
1157                mnt_add_count(real_mount(mnt), 1);
1158        return mnt;
1159}
1160EXPORT_SYMBOL(mntget);
1161
1162struct vfsmount *mnt_clone_internal(struct path *path)
1163{
1164        struct mount *p;
1165        p = clone_mnt(real_mount(path->mnt), path->dentry, CL_PRIVATE);
1166        if (IS_ERR(p))
1167                return ERR_CAST(p);
1168        p->mnt.mnt_flags |= MNT_INTERNAL;
1169        return &p->mnt;
1170}
1171
1172static inline void mangle(struct seq_file *m, const char *s)
1173{
1174        seq_escape(m, s, " \t\n\\");
1175}
1176
1177/*
1178 * Simple .show_options callback for filesystems which don't want to
1179 * implement more complex mount option showing.
1180 *
1181 * See also save_mount_options().
1182 */
1183int generic_show_options(struct seq_file *m, struct dentry *root)
1184{
1185        const char *options;
1186
1187        rcu_read_lock();
1188        options = rcu_dereference(root->d_sb->s_options);
1189
1190        if (options != NULL && options[0]) {
1191                seq_putc(m, ',');
1192                mangle(m, options);
1193        }
1194        rcu_read_unlock();
1195
1196        return 0;
1197}
1198EXPORT_SYMBOL(generic_show_options);
1199
1200/*
1201 * If filesystem uses generic_show_options(), this function should be
1202 * called from the fill_super() callback.
1203 *
1204 * The .remount_fs callback usually needs to be handled in a special
1205 * way, to make sure, that previous options are not overwritten if the
1206 * remount fails.
1207 *
1208 * Also note, that if the filesystem's .remount_fs function doesn't
1209 * reset all options to their default value, but changes only newly
1210 * given options, then the displayed options will not reflect reality
1211 * any more.
1212 */
1213void save_mount_options(struct super_block *sb, char *options)
1214{
1215        BUG_ON(sb->s_options);
1216        rcu_assign_pointer(sb->s_options, kstrdup(options, GFP_KERNEL));
1217}
1218EXPORT_SYMBOL(save_mount_options);
1219
1220void replace_mount_options(struct super_block *sb, char *options)
1221{
1222        char *old = sb->s_options;
1223        rcu_assign_pointer(sb->s_options, options);
1224        if (old) {
1225                synchronize_rcu();
1226                kfree(old);
1227        }
1228}
1229EXPORT_SYMBOL(replace_mount_options);
1230
1231#ifdef CONFIG_PROC_FS
1232/* iterator; we want it to have access to namespace_sem, thus here... */
1233static void *m_start(struct seq_file *m, loff_t *pos)
1234{
1235        struct proc_mounts *p = m->private;
1236
1237        down_read(&namespace_sem);
1238        if (p->cached_event == p->ns->event) {
1239                void *v = p->cached_mount;
1240                if (*pos == p->cached_index)
1241                        return v;
1242                if (*pos == p->cached_index + 1) {
1243                        v = seq_list_next(v, &p->ns->list, &p->cached_index);
1244                        return p->cached_mount = v;
1245                }
1246        }
1247
1248        p->cached_event = p->ns->event;
1249        p->cached_mount = seq_list_start(&p->ns->list, *pos);
1250        p->cached_index = *pos;
1251        return p->cached_mount;
1252}
1253
1254static void *m_next(struct seq_file *m, void *v, loff_t *pos)
1255{
1256        struct proc_mounts *p = m->private;
1257
1258        p->cached_mount = seq_list_next(v, &p->ns->list, pos);
1259        p->cached_index = *pos;
1260        return p->cached_mount;
1261}
1262
1263static void m_stop(struct seq_file *m, void *v)
1264{
1265        up_read(&namespace_sem);
1266}
1267
1268static int m_show(struct seq_file *m, void *v)
1269{
1270        struct proc_mounts *p = m->private;
1271        struct mount *r = list_entry(v, struct mount, mnt_list);
1272        return p->show(m, &r->mnt);
1273}
1274
1275const struct seq_operations mounts_op = {
1276        .start  = m_start,
1277        .next   = m_next,
1278        .stop   = m_stop,
1279        .show   = m_show,
1280};
1281#endif  /* CONFIG_PROC_FS */
1282
1283/**
1284 * may_umount_tree - check if a mount tree is busy
1285 * @mnt: root of mount tree
1286 *
1287 * This is called to check if a tree of mounts has any
1288 * open files, pwds, chroots or sub mounts that are
1289 * busy.
1290 */
1291int may_umount_tree(struct vfsmount *m)
1292{
1293        struct mount *mnt = real_mount(m);
1294        int actual_refs = 0;
1295        int minimum_refs = 0;
1296        struct mount *p;
1297        BUG_ON(!m);
1298
1299        /* write lock needed for mnt_get_count */
1300        lock_mount_hash();
1301        for (p = mnt; p; p = next_mnt(p, mnt)) {
1302                actual_refs += mnt_get_count(p);
1303                minimum_refs += 2;
1304        }
1305        unlock_mount_hash();
1306
1307        if (actual_refs > minimum_refs)
1308                return 0;
1309
1310        return 1;
1311}
1312
1313EXPORT_SYMBOL(may_umount_tree);
1314
1315/**
1316 * may_umount - check if a mount point is busy
1317 * @mnt: root of mount
1318 *
1319 * This is called to check if a mount point has any
1320 * open files, pwds, chroots or sub mounts. If the
1321 * mount has sub mounts this will return busy
1322 * regardless of whether the sub mounts are busy.
1323 *
1324 * Doesn't take quota and stuff into account. IOW, in some cases it will
1325 * give false negatives. The main reason why it's here is that we need
1326 * a non-destructive way to look for easily umountable filesystems.
1327 */
1328int may_umount(struct vfsmount *mnt)
1329{
1330        int ret = 1;
1331        down_read(&namespace_sem);
1332        lock_mount_hash();
1333        if (propagate_mount_busy(real_mount(mnt), 2))
1334                ret = 0;
1335        unlock_mount_hash();
1336        up_read(&namespace_sem);
1337        return ret;
1338}
1339
1340EXPORT_SYMBOL(may_umount);
1341
1342static HLIST_HEAD(unmounted);   /* protected by namespace_sem */
1343
1344static void namespace_unlock(void)
1345{
1346        struct hlist_head head;
1347
1348        hlist_move_list(&unmounted, &head);
1349
1350        up_write(&namespace_sem);
1351
1352        if (likely(hlist_empty(&head)))
1353                return;
1354
1355        synchronize_rcu();
1356
1357        group_pin_kill(&head);
1358}
1359
1360static inline void namespace_lock(void)
1361{
1362        down_write(&namespace_sem);
1363}
1364
1365enum umount_tree_flags {
1366        UMOUNT_SYNC = 1,
1367        UMOUNT_PROPAGATE = 2,
1368        UMOUNT_CONNECTED = 4,
1369};
1370
1371static bool disconnect_mount(struct mount *mnt, enum umount_tree_flags how)
1372{
1373        /* Leaving mounts connected is only valid for lazy umounts */
1374        if (how & UMOUNT_SYNC)
1375                return true;
1376
1377        /* A mount without a parent has nothing to be connected to */
1378        if (!mnt_has_parent(mnt))
1379                return true;
1380
1381        /* Because the reference counting rules change when mounts are
1382         * unmounted and connected, umounted mounts may not be
1383         * connected to mounted mounts.
1384         */
1385        if (!(mnt->mnt_parent->mnt.mnt_flags & MNT_UMOUNT))
1386                return true;
1387
1388        /* Has it been requested that the mount remain connected? */
1389        if (how & UMOUNT_CONNECTED)
1390                return false;
1391
1392        /* Is the mount locked such that it needs to remain connected? */
1393        if (IS_MNT_LOCKED(mnt))
1394                return false;
1395
1396        /* By default disconnect the mount */
1397        return true;
1398}
1399
1400/*
1401 * mount_lock must be held
1402 * namespace_sem must be held for write
1403 */
1404static void umount_tree(struct mount *mnt, enum umount_tree_flags how)
1405{
1406        LIST_HEAD(tmp_list);
1407        struct mount *p;
1408
1409        if (how & UMOUNT_PROPAGATE)
1410                propagate_mount_unlock(mnt);
1411
1412        /* Gather the mounts to umount */
1413        for (p = mnt; p; p = next_mnt(p, mnt)) {
1414                p->mnt.mnt_flags |= MNT_UMOUNT;
1415                list_move(&p->mnt_list, &tmp_list);
1416        }
1417
1418        /* Hide the mounts from mnt_mounts */
1419        list_for_each_entry(p, &tmp_list, mnt_list) {
1420                list_del_init(&p->mnt_child);
1421        }
1422
1423        /* Add propogated mounts to the tmp_list */
1424        if (how & UMOUNT_PROPAGATE)
1425                propagate_umount(&tmp_list);
1426
1427        while (!list_empty(&tmp_list)) {
1428                struct mnt_namespace *ns;
1429                bool disconnect;
1430                p = list_first_entry(&tmp_list, struct mount, mnt_list);
1431                list_del_init(&p->mnt_expire);
1432                list_del_init(&p->mnt_list);
1433                ns = p->mnt_ns;
1434                if (ns) {
1435                        ns->mounts--;
1436                        __touch_mnt_namespace(ns);
1437                }
1438                p->mnt_ns = NULL;
1439                if (how & UMOUNT_SYNC)
1440                        p->mnt.mnt_flags |= MNT_SYNC_UMOUNT;
1441
1442                disconnect = disconnect_mount(p, how);
1443
1444                pin_insert_group(&p->mnt_umount, &p->mnt_parent->mnt,
1445                                 disconnect ? &unmounted : NULL);
1446                if (mnt_has_parent(p)) {
1447                        mnt_add_count(p->mnt_parent, -1);
1448                        if (!disconnect) {
1449                                /* Don't forget about p */
1450                                list_add_tail(&p->mnt_child, &p->mnt_parent->mnt_mounts);
1451                        } else {
1452                                umount_mnt(p);
1453                        }
1454                }
1455                change_mnt_propagation(p, MS_PRIVATE);
1456        }
1457}
1458
1459static void shrink_submounts(struct mount *mnt);
1460
1461static int do_umount(struct mount *mnt, int flags)
1462{
1463        struct super_block *sb = mnt->mnt.mnt_sb;
1464        int retval;
1465
1466        retval = security_sb_umount(&mnt->mnt, flags);
1467        if (retval)
1468                return retval;
1469
1470        /*
1471         * Allow userspace to request a mountpoint be expired rather than
1472         * unmounting unconditionally. Unmount only happens if:
1473         *  (1) the mark is already set (the mark is cleared by mntput())
1474         *  (2) the usage count == 1 [parent vfsmount] + 1 [sys_umount]
1475         */
1476        if (flags & MNT_EXPIRE) {
1477                if (&mnt->mnt == current->fs->root.mnt ||
1478                    flags & (MNT_FORCE | MNT_DETACH))
1479                        return -EINVAL;
1480
1481                /*
1482                 * probably don't strictly need the lock here if we examined
1483                 * all race cases, but it's a slowpath.
1484                 */
1485                lock_mount_hash();
1486                if (mnt_get_count(mnt) != 2) {
1487                        unlock_mount_hash();
1488                        return -EBUSY;
1489                }
1490                unlock_mount_hash();
1491
1492                if (!xchg(&mnt->mnt_expiry_mark, 1))
1493                        return -EAGAIN;
1494        }
1495
1496        /*
1497         * If we may have to abort operations to get out of this
1498         * mount, and they will themselves hold resources we must
1499         * allow the fs to do things. In the Unix tradition of
1500         * 'Gee thats tricky lets do it in userspace' the umount_begin
1501         * might fail to complete on the first run through as other tasks
1502         * must return, and the like. Thats for the mount program to worry
1503         * about for the moment.
1504         */
1505
1506        if (flags & MNT_FORCE && sb->s_op->umount_begin) {
1507                sb->s_op->umount_begin(sb);
1508        }
1509
1510        /*
1511         * No sense to grab the lock for this test, but test itself looks
1512         * somewhat bogus. Suggestions for better replacement?
1513         * Ho-hum... In principle, we might treat that as umount + switch
1514         * to rootfs. GC would eventually take care of the old vfsmount.
1515         * Actually it makes sense, especially if rootfs would contain a
1516         * /reboot - static binary that would close all descriptors and
1517         * call reboot(9). Then init(8) could umount root and exec /reboot.
1518         */
1519        if (&mnt->mnt == current->fs->root.mnt && !(flags & MNT_DETACH)) {
1520                /*
1521                 * Special case for "unmounting" root ...
1522                 * we just try to remount it readonly.
1523                 */
1524                if (!capable(CAP_SYS_ADMIN))
1525                        return -EPERM;
1526                down_write(&sb->s_umount);
1527                if (!(sb->s_flags & MS_RDONLY))
1528                        retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
1529                up_write(&sb->s_umount);
1530                return retval;
1531        }
1532
1533        namespace_lock();
1534        lock_mount_hash();
1535        event++;
1536
1537        if (flags & MNT_DETACH) {
1538                if (!list_empty(&mnt->mnt_list))
1539                        umount_tree(mnt, UMOUNT_PROPAGATE);
1540                retval = 0;
1541        } else {
1542                shrink_submounts(mnt);
1543                retval = -EBUSY;
1544                if (!propagate_mount_busy(mnt, 2)) {
1545                        if (!list_empty(&mnt->mnt_list))
1546                                umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC);
1547                        retval = 0;
1548                }
1549        }
1550        unlock_mount_hash();
1551        namespace_unlock();
1552        return retval;
1553}
1554
1555/*
1556 * __detach_mounts - lazily unmount all mounts on the specified dentry
1557 *
1558 * During unlink, rmdir, and d_drop it is possible to loose the path
1559 * to an existing mountpoint, and wind up leaking the mount.
1560 * detach_mounts allows lazily unmounting those mounts instead of
1561 * leaking them.
1562 *
1563 * The caller may hold dentry->d_inode->i_mutex.
1564 */
1565void __detach_mounts(struct dentry *dentry)
1566{
1567        struct mountpoint *mp;
1568        struct mount *mnt;
1569
1570        namespace_lock();
1571        mp = lookup_mountpoint(dentry);
1572        if (IS_ERR_OR_NULL(mp))
1573                goto out_unlock;
1574
1575        lock_mount_hash();
1576        event++;
1577        while (!hlist_empty(&mp->m_list)) {
1578                mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list);
1579                if (mnt->mnt.mnt_flags & MNT_UMOUNT) {
1580                        hlist_add_head(&mnt->mnt_umount.s_list, &unmounted);
1581                        umount_mnt(mnt);
1582                }
1583                else umount_tree(mnt, UMOUNT_CONNECTED);
1584        }
1585        unlock_mount_hash();
1586        put_mountpoint(mp);
1587out_unlock:
1588        namespace_unlock();
1589}
1590
1591/* 
1592 * Is the caller allowed to modify his namespace?
1593 */
1594static inline bool may_mount(void)
1595{
1596        return ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN);
1597}
1598
1599static inline bool may_mandlock(void)
1600{
1601#ifndef CONFIG_MANDATORY_FILE_LOCKING
1602        return false;
1603#endif
1604        return capable(CAP_SYS_ADMIN);
1605}
1606
1607/*
1608 * Now umount can handle mount points as well as block devices.
1609 * This is important for filesystems which use unnamed block devices.
1610 *
1611 * We now support a flag for forced unmount like the other 'big iron'
1612 * unixes. Our API is identical to OSF/1 to avoid making a mess of AMD
1613 */
1614
1615SYSCALL_DEFINE2(umount, char __user *, name, int, flags)
1616{
1617        struct path path;
1618        struct mount *mnt;
1619        int retval;
1620        int lookup_flags = 0;
1621
1622        if (flags & ~(MNT_FORCE | MNT_DETACH | MNT_EXPIRE | UMOUNT_NOFOLLOW))
1623                return -EINVAL;
1624
1625        if (!may_mount())
1626                return -EPERM;
1627
1628        if (!(flags & UMOUNT_NOFOLLOW))
1629                lookup_flags |= LOOKUP_FOLLOW;
1630
1631        retval = user_path_mountpoint_at(AT_FDCWD, name, lookup_flags, &path);
1632        if (retval)
1633                goto out;
1634        mnt = real_mount(path.mnt);
1635        retval = -EINVAL;
1636        if (path.dentry != path.mnt->mnt_root)
1637                goto dput_and_out;
1638        if (!check_mnt(mnt))
1639                goto dput_and_out;
1640        if (mnt->mnt.mnt_flags & MNT_LOCKED)
1641                goto dput_and_out;
1642        retval = -EPERM;
1643        if (flags & MNT_FORCE && !capable(CAP_SYS_ADMIN))
1644                goto dput_and_out;
1645
1646        retval = do_umount(mnt, flags);
1647dput_and_out:
1648        /* we mustn't call path_put() as that would clear mnt_expiry_mark */
1649        dput(path.dentry);
1650        mntput_no_expire(mnt);
1651out:
1652        return retval;
1653}
1654
1655#ifdef __ARCH_WANT_SYS_OLDUMOUNT
1656
1657/*
1658 *      The 2.0 compatible umount. No flags.
1659 */
1660SYSCALL_DEFINE1(oldumount, char __user *, name)
1661{
1662        return sys_umount(name, 0);
1663}
1664
1665#endif
1666
1667static bool is_mnt_ns_file(struct dentry *dentry)
1668{
1669        /* Is this a proxy for a mount namespace? */
1670        return dentry->d_op == &ns_dentry_operations &&
1671               dentry->d_fsdata == &mntns_operations;
1672}
1673
1674struct mnt_namespace *to_mnt_ns(struct ns_common *ns)
1675{
1676        return container_of(ns, struct mnt_namespace, ns);
1677}
1678
1679static bool mnt_ns_loop(struct dentry *dentry)
1680{
1681        /* Could bind mounting the mount namespace inode cause a
1682         * mount namespace loop?
1683         */
1684        struct mnt_namespace *mnt_ns;
1685        if (!is_mnt_ns_file(dentry))
1686                return false;
1687
1688        mnt_ns = to_mnt_ns(get_proc_ns(dentry->d_inode));
1689        return current->nsproxy->mnt_ns->seq >= mnt_ns->seq;
1690}
1691
1692struct mount *copy_tree(struct mount *mnt, struct dentry *dentry,
1693                                        int flag)
1694{
1695        struct mount *res, *p, *q, *r, *parent;
1696
1697        if (!(flag & CL_COPY_UNBINDABLE) && IS_MNT_UNBINDABLE(mnt))
1698                return ERR_PTR(-EINVAL);
1699
1700        if (!(flag & CL_COPY_MNT_NS_FILE) && is_mnt_ns_file(dentry))
1701                return ERR_PTR(-EINVAL);
1702
1703        res = q = clone_mnt(mnt, dentry, flag);
1704        if (IS_ERR(q))
1705                return q;
1706
1707        q->mnt_mountpoint = mnt->mnt_mountpoint;
1708
1709        p = mnt;
1710        list_for_each_entry(r, &mnt->mnt_mounts, mnt_child) {
1711                struct mount *s;
1712                if (!is_subdir(r->mnt_mountpoint, dentry))
1713                        continue;
1714
1715                for (s = r; s; s = next_mnt(s, r)) {
1716                        struct mount *t = NULL;
1717                        if (!(flag & CL_COPY_UNBINDABLE) &&
1718                            IS_MNT_UNBINDABLE(s)) {
1719                                s = skip_mnt_tree(s);
1720                                continue;
1721                        }
1722                        if (!(flag & CL_COPY_MNT_NS_FILE) &&
1723                            is_mnt_ns_file(s->mnt.mnt_root)) {
1724                                s = skip_mnt_tree(s);
1725                                continue;
1726                        }
1727                        while (p != s->mnt_parent) {
1728                                p = p->mnt_parent;
1729                                q = q->mnt_parent;
1730                        }
1731                        p = s;
1732                        parent = q;
1733                        q = clone_mnt(p, p->mnt.mnt_root, flag);
1734                        if (IS_ERR(q))
1735                                goto out;
1736                        lock_mount_hash();
1737                        list_add_tail(&q->mnt_list, &res->mnt_list);
1738                        mnt_set_mountpoint(parent, p->mnt_mp, q);
1739                        if (!list_empty(&parent->mnt_mounts)) {
1740                                t = list_last_entry(&parent->mnt_mounts,
1741                                        struct mount, mnt_child);
1742                                if (t->mnt_mp != p->mnt_mp)
1743                                        t = NULL;
1744                        }
1745                        attach_shadowed(q, parent, t);
1746                        unlock_mount_hash();
1747                }
1748        }
1749        return res;
1750out:
1751        if (res) {
1752                lock_mount_hash();
1753                umount_tree(res, UMOUNT_SYNC);
1754                unlock_mount_hash();
1755        }
1756        return q;
1757}
1758
1759/* Caller should check returned pointer for errors */
1760
1761struct vfsmount *collect_mounts(struct path *path)
1762{
1763        struct mount *tree;
1764        namespace_lock();
1765        if (!check_mnt(real_mount(path->mnt)))
1766                tree = ERR_PTR(-EINVAL);
1767        else
1768                tree = copy_tree(real_mount(path->mnt), path->dentry,
1769                                 CL_COPY_ALL | CL_PRIVATE);
1770        namespace_unlock();
1771        if (IS_ERR(tree))
1772                return ERR_CAST(tree);
1773        return &tree->mnt;
1774}
1775
1776void drop_collected_mounts(struct vfsmount *mnt)
1777{
1778        namespace_lock();
1779        lock_mount_hash();
1780        umount_tree(real_mount(mnt), UMOUNT_SYNC);
1781        unlock_mount_hash();
1782        namespace_unlock();
1783}
1784
1785/**
1786 * clone_private_mount - create a private clone of a path
1787 *
1788 * This creates a new vfsmount, which will be the clone of @path.  The new will
1789 * not be attached anywhere in the namespace and will be private (i.e. changes
1790 * to the originating mount won't be propagated into this).
1791 *
1792 * Release with mntput().
1793 */
1794struct vfsmount *clone_private_mount(struct path *path)
1795{
1796        struct mount *old_mnt = real_mount(path->mnt);
1797        struct mount *new_mnt;
1798
1799        if (IS_MNT_UNBINDABLE(old_mnt))
1800                return ERR_PTR(-EINVAL);
1801
1802        down_read(&namespace_sem);
1803        new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE);
1804        up_read(&namespace_sem);
1805        if (IS_ERR(new_mnt))
1806                return ERR_CAST(new_mnt);
1807
1808        return &new_mnt->mnt;
1809}
1810EXPORT_SYMBOL_GPL(clone_private_mount);
1811
1812int iterate_mounts(int (*f)(struct vfsmount *, void *), void *arg,
1813                   struct vfsmount *root)
1814{
1815        struct mount *mnt;
1816        int res = f(root, arg);
1817        if (res)
1818                return res;
1819        list_for_each_entry(mnt, &real_mount(root)->mnt_list, mnt_list) {
1820                res = f(&mnt->mnt, arg);
1821                if (res)
1822                        return res;
1823        }
1824        return 0;
1825}
1826
1827static void cleanup_group_ids(struct mount *mnt, struct mount *end)
1828{
1829        struct mount *p;
1830
1831        for (p = mnt; p != end; p = next_mnt(p, mnt)) {
1832                if (p->mnt_group_id && !IS_MNT_SHARED(p))
1833                        mnt_release_group_id(p);
1834        }
1835}
1836
1837static int invent_group_ids(struct mount *mnt, bool recurse)
1838{
1839        struct mount *p;
1840
1841        for (p = mnt; p; p = recurse ? next_mnt(p, mnt) : NULL) {
1842                if (!p->mnt_group_id && !IS_MNT_SHARED(p)) {
1843                        int err = mnt_alloc_group_id(p);
1844                        if (err) {
1845                                cleanup_group_ids(mnt, p);
1846                                return err;
1847                        }
1848                }
1849        }
1850
1851        return 0;
1852}
1853
1854int count_mounts(struct mnt_namespace *ns, struct mount *mnt)
1855{
1856        unsigned int max = READ_ONCE(sysctl_mount_max);
1857        unsigned int mounts = 0, old, pending, sum;
1858        struct mount *p;
1859
1860        for (p = mnt; p; p = next_mnt(p, mnt))
1861                mounts++;
1862
1863        old = ns->mounts;
1864        pending = ns->pending_mounts;
1865        sum = old + pending;
1866        if ((old > sum) ||
1867            (pending > sum) ||
1868            (max < sum) ||
1869            (mounts > (max - sum)))
1870                return -ENOSPC;
1871
1872        ns->pending_mounts = pending + mounts;
1873        return 0;
1874}
1875
1876/*
1877 *  @source_mnt : mount tree to be attached
1878 *  @nd         : place the mount tree @source_mnt is attached
1879 *  @parent_nd  : if non-null, detach the source_mnt from its parent and
1880 *                 store the parent mount and mountpoint dentry.
1881 *                 (done when source_mnt is moved)
1882 *
1883 *  NOTE: in the table below explains the semantics when a source mount
1884 *  of a given type is attached to a destination mount of a given type.
1885 * ---------------------------------------------------------------------------
1886 * |         BIND MOUNT OPERATION                                            |
1887 * |**************************************************************************
1888 * | source-->| shared        |       private  |       slave    | unbindable |
1889 * | dest     |               |                |                |            |
1890 * |   |      |               |                |                |            |
1891 * |   v      |               |                |                |            |
1892 * |**************************************************************************
1893 * |  shared  | shared (++)   |     shared (+) |     shared(+++)|  invalid   |
1894 * |          |               |                |                |            |
1895 * |non-shared| shared (+)    |      private   |      slave (*) |  invalid   |
1896 * ***************************************************************************
1897 * A bind operation clones the source mount and mounts the clone on the
1898 * destination mount.
1899 *
1900 * (++)  the cloned mount is propagated to all the mounts in the propagation
1901 *       tree of the destination mount and the cloned mount is added to
1902 *       the peer group of the source mount.
1903 * (+)   the cloned mount is created under the destination mount and is marked
1904 *       as shared. The cloned mount is added to the peer group of the source
1905 *       mount.
1906 * (+++) the mount is propagated to all the mounts in the propagation tree
1907 *       of the destination mount and the cloned mount is made slave
1908 *       of the same master as that of the source mount. The cloned mount
1909 *       is marked as 'shared and slave'.
1910 * (*)   the cloned mount is made a slave of the same master as that of the
1911 *       source mount.
1912 *
1913 * ---------------------------------------------------------------------------
1914 * |                    MOVE MOUNT OPERATION                                 |
1915 * |**************************************************************************
1916 * | source-->| shared        |       private  |       slave    | unbindable |
1917 * | dest     |               |                |                |            |
1918 * |   |      |               |                |                |            |
1919 * |   v      |               |                |                |            |
1920 * |**************************************************************************
1921 * |  shared  | shared (+)    |     shared (+) |    shared(+++) |  invalid   |
1922 * |          |               |                |                |            |
1923 * |non-shared| shared (+*)   |      private   |    slave (*)   | unbindable |
1924 * ***************************************************************************
1925 *
1926 * (+)  the mount is moved to the destination. And is then propagated to
1927 *      all the mounts in the propagation tree of the destination mount.
1928 * (+*)  the mount is moved to the destination.
1929 * (+++)  the mount is moved to the destination and is then propagated to
1930 *      all the mounts belonging to the destination mount's propagation tree.
1931 *      the mount is marked as 'shared and slave'.
1932 * (*)  the mount continues to be a slave at the new location.
1933 *
1934 * if the source mount is a tree, the operations explained above is
1935 * applied to each mount in the tree.
1936 * Must be called without spinlocks held, since this function can sleep
1937 * in allocations.
1938 */
1939static int attach_recursive_mnt(struct mount *source_mnt,
1940                        struct mount *dest_mnt,
1941                        struct mountpoint *dest_mp,
1942                        struct path *parent_path)
1943{
1944        HLIST_HEAD(tree_list);
1945        struct mnt_namespace *ns = dest_mnt->mnt_ns;
1946        struct mount *child, *p;
1947        struct hlist_node *n;
1948        int err;
1949
1950        /* Is there space to add these mounts to the mount namespace? */
1951        if (!parent_path) {
1952                err = count_mounts(ns, source_mnt);
1953                if (err)
1954                        goto out;
1955        }
1956
1957        if (IS_MNT_SHARED(dest_mnt)) {
1958                err = invent_group_ids(source_mnt, true);
1959                if (err)
1960                        goto out;
1961                err = propagate_mnt(dest_mnt, dest_mp, source_mnt, &tree_list);
1962                lock_mount_hash();
1963                if (err)
1964                        goto out_cleanup_ids;
1965                for (p = source_mnt; p; p = next_mnt(p, source_mnt))
1966                        set_mnt_shared(p);
1967        } else {
1968                lock_mount_hash();
1969        }
1970        if (parent_path) {
1971                detach_mnt(source_mnt, parent_path);
1972                attach_mnt(source_mnt, dest_mnt, dest_mp);
1973                touch_mnt_namespace(source_mnt->mnt_ns);
1974        } else {
1975                mnt_set_mountpoint(dest_mnt, dest_mp, source_mnt);
1976                commit_tree(source_mnt, NULL);
1977        }
1978
1979        hlist_for_each_entry_safe(child, n, &tree_list, mnt_hash) {
1980                struct mount *q;
1981                hlist_del_init(&child->mnt_hash);
1982                q = __lookup_mnt_last(&child->mnt_parent->mnt,
1983                                      child->mnt_mountpoint);
1984                commit_tree(child, q);
1985        }
1986        unlock_mount_hash();
1987
1988        return 0;
1989
1990 out_cleanup_ids:
1991        while (!hlist_empty(&tree_list)) {
1992                child = hlist_entry(tree_list.first, struct mount, mnt_hash);
1993                child->mnt_parent->mnt_ns->pending_mounts = 0;
1994                umount_tree(child, UMOUNT_SYNC);
1995        }
1996        unlock_mount_hash();
1997        cleanup_group_ids(source_mnt, NULL);
1998 out:
1999        ns->pending_mounts = 0;
2000        return err;
2001}
2002
2003static struct mountpoint *lock_mount(struct path *path)
2004{
2005        struct vfsmount *mnt;
2006        struct dentry *dentry = path->dentry;
2007retry:
2008        inode_lock(dentry->d_inode);
2009        if (unlikely(cant_mount(dentry))) {
2010                inode_unlock(dentry->d_inode);
2011                return ERR_PTR(-ENOENT);
2012        }
2013        namespace_lock();
2014        mnt = lookup_mnt(path);
2015        if (likely(!mnt)) {
2016                struct mountpoint *mp = lookup_mountpoint(dentry);
2017                if (!mp)
2018                        mp = new_mountpoint(dentry);
2019                if (IS_ERR(mp)) {
2020                        namespace_unlock();
2021                        inode_unlock(dentry->d_inode);
2022                        return mp;
2023                }
2024                return mp;
2025        }
2026        namespace_unlock();
2027        inode_unlock(path->dentry->d_inode);
2028        path_put(path);
2029        path->mnt = mnt;
2030        dentry = path->dentry = dget(mnt->mnt_root);
2031        goto retry;
2032}
2033
2034static void unlock_mount(struct mountpoint *where)
2035{
2036        struct dentry *dentry = where->m_dentry;
2037        put_mountpoint(where);
2038        namespace_unlock();
2039        inode_unlock(dentry->d_inode);
2040}
2041
2042static int graft_tree(struct mount *mnt, struct mount *p, struct mountpoint *mp)
2043{
2044        if (mnt->mnt.mnt_sb->s_flags & MS_NOUSER)
2045                return -EINVAL;
2046
2047        if (d_is_dir(mp->m_dentry) !=
2048              d_is_dir(mnt->mnt.mnt_root))
2049                return -ENOTDIR;
2050
2051        return attach_recursive_mnt(mnt, p, mp, NULL);
2052}
2053
2054/*
2055 * Sanity check the flags to change_mnt_propagation.
2056 */
2057
2058static int flags_to_propagation_type(int flags)
2059{
2060        int type = flags & ~(MS_REC | MS_SILENT);
2061
2062        /* Fail if any non-propagation flags are set */
2063        if (type & ~(MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
2064                return 0;
2065        /* Only one propagation flag should be set */
2066        if (!is_power_of_2(type))
2067                return 0;
2068        return type;
2069}
2070
2071/*
2072 * recursively change the type of the mountpoint.
2073 */
2074static int do_change_type(struct path *path, int flag)
2075{
2076        struct mount *m;
2077        struct mount *mnt = real_mount(path->mnt);
2078        int recurse = flag & MS_REC;
2079        int type;
2080        int err = 0;
2081
2082        if (path->dentry != path->mnt->mnt_root)
2083                return -EINVAL;
2084
2085        type = flags_to_propagation_type(flag);
2086        if (!type)
2087                return -EINVAL;
2088
2089        namespace_lock();
2090        if (type == MS_SHARED) {
2091                err = invent_group_ids(mnt, recurse);
2092                if (err)
2093                        goto out_unlock;
2094        }
2095
2096        lock_mount_hash();
2097        for (m = mnt; m; m = (recurse ? next_mnt(m, mnt) : NULL))
2098                change_mnt_propagation(m, type);
2099        unlock_mount_hash();
2100
2101 out_unlock:
2102        namespace_unlock();
2103        return err;
2104}
2105
2106static bool has_locked_children(struct mount *mnt, struct dentry *dentry)
2107{
2108        struct mount *child;
2109        list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
2110                if (!is_subdir(child->mnt_mountpoint, dentry))
2111                        continue;
2112
2113                if (child->mnt.mnt_flags & MNT_LOCKED)
2114                        return true;
2115        }
2116        return false;
2117}
2118
2119/*
2120 * do loopback mount.
2121 */
2122static int do_loopback(struct path *path, const char *old_name,
2123                                int recurse)
2124{
2125        struct path old_path;
2126        struct mount *mnt = NULL, *old, *parent;
2127        struct mountpoint *mp;
2128        int err;
2129        if (!old_name || !*old_name)
2130                return -EINVAL;
2131        err = kern_path(old_name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &old_path);
2132        if (err)
2133                return err;
2134
2135        err = -EINVAL;
2136        if (mnt_ns_loop(old_path.dentry))
2137                goto out; 
2138
2139        mp = lock_mount(path);
2140        err = PTR_ERR(mp);
2141        if (IS_ERR(mp))
2142                goto out;
2143
2144        old = real_mount(old_path.mnt);
2145        parent = real_mount(path->mnt);
2146
2147        err = -EINVAL;
2148        if (IS_MNT_UNBINDABLE(old))
2149                goto out2;
2150
2151        if (!check_mnt(parent))
2152                goto out2;
2153
2154        if (!check_mnt(old) && old_path.dentry->d_op != &ns_dentry_operations)
2155                goto out2;
2156
2157        if (!recurse && has_locked_children(old, old_path.dentry))
2158                goto out2;
2159
2160        if (recurse)
2161                mnt = copy_tree(old, old_path.dentry, CL_COPY_MNT_NS_FILE);
2162        else
2163                mnt = clone_mnt(old, old_path.dentry, 0);
2164
2165        if (IS_ERR(mnt)) {
2166                err = PTR_ERR(mnt);
2167                goto out2;
2168        }
2169
2170        mnt->mnt.mnt_flags &= ~MNT_LOCKED;
2171
2172        err = graft_tree(mnt, parent, mp);
2173        if (err) {
2174                lock_mount_hash();
2175                umount_tree(mnt, UMOUNT_SYNC);
2176                unlock_mount_hash();
2177        }
2178out2:
2179        unlock_mount(mp);
2180out:
2181        path_put(&old_path);
2182        return err;
2183}
2184
2185static int change_mount_flags(struct vfsmount *mnt, int ms_flags)
2186{
2187        int error = 0;
2188        int readonly_request = 0;
2189
2190        if (ms_flags & MS_RDONLY)
2191                readonly_request = 1;
2192        if (readonly_request == __mnt_is_readonly(mnt))
2193                return 0;
2194
2195        if (readonly_request)
2196                error = mnt_make_readonly(real_mount(mnt));
2197        else
2198                __mnt_unmake_readonly(real_mount(mnt));
2199        return error;
2200}
2201
2202/*
2203 * change filesystem flags. dir should be a physical root of filesystem.
2204 * If you've mounted a non-root directory somewhere and want to do remount
2205 * on it - tough luck.
2206 */
2207static int do_remount(struct path *path, int flags, int mnt_flags,
2208                      void *data)
2209{
2210        int err;
2211        struct super_block *sb = path->mnt->mnt_sb;
2212        struct mount *mnt = real_mount(path->mnt);
2213
2214        if (!check_mnt(mnt))
2215                return -EINVAL;
2216
2217        if (path->dentry != path->mnt->mnt_root)
2218                return -EINVAL;
2219
2220        /* Don't allow changing of locked mnt flags.
2221         *
2222         * No locks need to be held here while testing the various
2223         * MNT_LOCK flags because those flags can never be cleared
2224         * once they are set.
2225         */
2226        if ((mnt->mnt.mnt_flags & MNT_LOCK_READONLY) &&
2227            !(mnt_flags & MNT_READONLY)) {
2228                return -EPERM;
2229        }
2230        if ((mnt->mnt.mnt_flags & MNT_LOCK_NODEV) &&
2231            !(mnt_flags & MNT_NODEV)) {
2232                return -EPERM;
2233        }
2234        if ((mnt->mnt.mnt_flags & MNT_LOCK_NOSUID) &&
2235            !(mnt_flags & MNT_NOSUID)) {
2236                return -EPERM;
2237        }
2238        if ((mnt->mnt.mnt_flags & MNT_LOCK_NOEXEC) &&
2239            !(mnt_flags & MNT_NOEXEC)) {
2240                return -EPERM;
2241        }
2242        if ((mnt->mnt.mnt_flags & MNT_LOCK_ATIME) &&
2243            ((mnt->mnt.mnt_flags & MNT_ATIME_MASK) != (mnt_flags & MNT_ATIME_MASK))) {
2244                return -EPERM;
2245        }
2246
2247        err = security_sb_remount(sb, data);
2248        if (err)
2249                return err;
2250
2251        down_write(&sb->s_umount);
2252        if (flags & MS_BIND)
2253                err = change_mount_flags(path->mnt, flags);
2254        else if (!capable(CAP_SYS_ADMIN))
2255                err = -EPERM;
2256        else
2257                err = do_remount_sb(sb, flags, data, 0);
2258        if (!err) {
2259                lock_mount_hash();
2260                mnt_flags |= mnt->mnt.mnt_flags & ~MNT_USER_SETTABLE_MASK;
2261                mnt->mnt.mnt_flags = mnt_flags;
2262                touch_mnt_namespace(mnt->mnt_ns);
2263                unlock_mount_hash();
2264        }
2265        up_write(&sb->s_umount);
2266        return err;
2267}
2268
2269static inline int tree_contains_unbindable(struct mount *mnt)
2270{
2271        struct mount *p;
2272        for (p = mnt; p; p = next_mnt(p, mnt)) {
2273                if (IS_MNT_UNBINDABLE(p))
2274                        return 1;
2275        }
2276        return 0;
2277}
2278
2279static int do_move_mount(struct path *path, const char *old_name)
2280{
2281        struct path old_path, parent_path;
2282        struct mount *p;
2283        struct mount *old;
2284        struct mountpoint *mp;
2285        int err;
2286        if (!old_name || !*old_name)
2287                return -EINVAL;
2288        err = kern_path(old_name, LOOKUP_FOLLOW, &old_path);
2289        if (err)
2290                return err;
2291
2292        mp = lock_mount(path);
2293        err = PTR_ERR(mp);
2294        if (IS_ERR(mp))
2295                goto out;
2296
2297        old = real_mount(old_path.mnt);
2298        p = real_mount(path->mnt);
2299
2300        err = -EINVAL;
2301        if (!check_mnt(p) || !check_mnt(old))
2302                goto out1;
2303
2304        if (old->mnt.mnt_flags & MNT_LOCKED)
2305                goto out1;
2306
2307        err = -EINVAL;
2308        if (old_path.dentry != old_path.mnt->mnt_root)
2309                goto out1;
2310
2311        if (!mnt_has_parent(old))
2312                goto out1;
2313
2314        if (d_is_dir(path->dentry) !=
2315              d_is_dir(old_path.dentry))
2316                goto out1;
2317        /*
2318         * Don't move a mount residing in a shared parent.
2319         */
2320        if (IS_MNT_SHARED(old->mnt_parent))
2321                goto out1;
2322        /*
2323         * Don't move a mount tree containing unbindable mounts to a destination
2324         * mount which is shared.
2325         */
2326        if (IS_MNT_SHARED(p) && tree_contains_unbindable(old))
2327                goto out1;
2328        err = -ELOOP;
2329        for (; mnt_has_parent(p); p = p->mnt_parent)
2330                if (p == old)
2331                        goto out1;
2332
2333        err = attach_recursive_mnt(old, real_mount(path->mnt), mp, &parent_path);
2334        if (err)
2335                goto out1;
2336
2337        /* if the mount is moved, it should no longer be expire
2338         * automatically */
2339        list_del_init(&old->mnt_expire);
2340out1:
2341        unlock_mount(mp);
2342out:
2343        if (!err)
2344                path_put(&parent_path);
2345        path_put(&old_path);
2346        return err;
2347}
2348
2349static struct vfsmount *fs_set_subtype(struct vfsmount *mnt, const char *fstype)
2350{
2351        int err;
2352        const char *subtype = strchr(fstype, '.');
2353        if (subtype) {
2354                subtype++;
2355                err = -EINVAL;
2356                if (!subtype[0])
2357                        goto err;
2358        } else
2359                subtype = "";
2360
2361        mnt->mnt_sb->s_subtype = kstrdup(subtype, GFP_KERNEL);
2362        err = -ENOMEM;
2363        if (!mnt->mnt_sb->s_subtype)
2364                goto err;
2365        return mnt;
2366
2367 err:
2368        mntput(mnt);
2369        return ERR_PTR(err);
2370}
2371
2372/*
2373 * add a mount into a namespace's mount tree
2374 */
2375static int do_add_mount(struct mount *newmnt, struct path *path, int mnt_flags)
2376{
2377        struct mountpoint *mp;
2378        struct mount *parent;
2379        int err;
2380
2381        mnt_flags &= ~MNT_INTERNAL_FLAGS;
2382
2383        mp = lock_mount(path);
2384        if (IS_ERR(mp))
2385                return PTR_ERR(mp);
2386
2387        parent = real_mount(path->mnt);
2388        err = -EINVAL;
2389        if (unlikely(!check_mnt(parent))) {
2390                /* that's acceptable only for automounts done in private ns */
2391                if (!(mnt_flags & MNT_SHRINKABLE))
2392                        goto unlock;
2393                /* ... and for those we'd better have mountpoint still alive */
2394                if (!parent->mnt_ns)
2395                        goto unlock;
2396        }
2397
2398        /* Refuse the same filesystem on the same mount point */
2399        err = -EBUSY;
2400        if (path->mnt->mnt_sb == newmnt->mnt.mnt_sb &&
2401            path->mnt->mnt_root == path->dentry)
2402                goto unlock;
2403
2404        err = -EINVAL;
2405        if (d_is_symlink(newmnt->mnt.mnt_root))
2406                goto unlock;
2407
2408        newmnt->mnt.mnt_flags = mnt_flags;
2409        err = graft_tree(newmnt, parent, mp);
2410
2411unlock:
2412        unlock_mount(mp);
2413        return err;
2414}
2415
2416static bool mount_too_revealing(struct vfsmount *mnt, int *new_mnt_flags);
2417
2418/*
2419 * create a new mount for userspace and request it to be added into the
2420 * namespace's tree
2421 */
2422static int do_new_mount(struct path *path, const char *fstype, int flags,
2423                        int mnt_flags, const char *name, void *data)
2424{
2425        struct file_system_type *type;
2426        struct vfsmount *mnt;
2427        int err;
2428
2429        if (!fstype)
2430                return -EINVAL;
2431
2432        type = get_fs_type(fstype);
2433        if (!type)
2434                return -ENODEV;
2435
2436        mnt = vfs_kern_mount(type, flags, name, data);
2437        if (!IS_ERR(mnt) && (type->fs_flags & FS_HAS_SUBTYPE) &&
2438            !mnt->mnt_sb->s_subtype)
2439                mnt = fs_set_subtype(mnt, fstype);
2440
2441        put_filesystem(type);
2442        if (IS_ERR(mnt))
2443                return PTR_ERR(mnt);
2444
2445        if (mount_too_revealing(mnt, &mnt_flags)) {
2446                mntput(mnt);
2447                return -EPERM;
2448        }
2449
2450        err = do_add_mount(real_mount(mnt), path, mnt_flags);
2451        if (err)
2452                mntput(mnt);
2453        return err;
2454}
2455
2456int finish_automount(struct vfsmount *m, struct path *path)
2457{
2458        struct mount *mnt = real_mount(m);
2459        int err;
2460        /* The new mount record should have at least 2 refs to prevent it being
2461         * expired before we get a chance to add it
2462         */
2463        BUG_ON(mnt_get_count(mnt) < 2);
2464
2465        if (m->mnt_sb == path->mnt->mnt_sb &&
2466            m->mnt_root == path->dentry) {
2467                err = -ELOOP;
2468                goto fail;
2469        }
2470
2471        err = do_add_mount(mnt, path, path->mnt->mnt_flags | MNT_SHRINKABLE);
2472        if (!err)
2473                return 0;
2474fail:
2475        /* remove m from any expiration list it may be on */
2476        if (!list_empty(&mnt->mnt_expire)) {
2477                namespace_lock();
2478                list_del_init(&mnt->mnt_expire);
2479                namespace_unlock();
2480        }
2481        mntput(m);
2482        mntput(m);
2483        return err;
2484}
2485
2486/**
2487 * mnt_set_expiry - Put a mount on an expiration list
2488 * @mnt: The mount to list.
2489 * @expiry_list: The list to add the mount to.
2490 */
2491void mnt_set_expiry(struct vfsmount *mnt, struct list_head *expiry_list)
2492{
2493        namespace_lock();
2494
2495        list_add_tail(&real_mount(mnt)->mnt_expire, expiry_list);
2496
2497        namespace_unlock();
2498}
2499EXPORT_SYMBOL(mnt_set_expiry);
2500
2501/*
2502 * process a list of expirable mountpoints with the intent of discarding any
2503 * mountpoints that aren't in use and haven't been touched since last we came
2504 * here
2505 */
2506void mark_mounts_for_expiry(struct list_head *mounts)
2507{
2508        struct mount *mnt, *next;
2509        LIST_HEAD(graveyard);
2510
2511        if (list_empty(mounts))
2512                return;
2513
2514        namespace_lock();
2515        lock_mount_hash();
2516
2517        /* extract from the expiration list every vfsmount that matches the
2518         * following criteria:
2519         * - only referenced by its parent vfsmount
2520         * - still marked for expiry (marked on the last call here; marks are
2521         *   cleared by mntput())
2522         */
2523        list_for_each_entry_safe(mnt, next, mounts, mnt_expire) {
2524                if (!xchg(&mnt->mnt_expiry_mark, 1) ||
2525                        propagate_mount_busy(mnt, 1))
2526                        continue;
2527                list_move(&mnt->mnt_expire, &graveyard);
2528        }
2529        while (!list_empty(&graveyard)) {
2530                mnt = list_first_entry(&graveyard, struct mount, mnt_expire);
2531                touch_mnt_namespace(mnt->mnt_ns);
2532                umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC);
2533        }
2534        unlock_mount_hash();
2535        namespace_unlock();
2536}
2537
2538EXPORT_SYMBOL_GPL(mark_mounts_for_expiry);
2539
2540/*
2541 * Ripoff of 'select_parent()'
2542 *
2543 * search the list of submounts for a given mountpoint, and move any
2544 * shrinkable submounts to the 'graveyard' list.
2545 */
2546static int select_submounts(struct mount *parent, struct list_head *graveyard)
2547{
2548        struct mount *this_parent = parent;
2549        struct list_head *next;
2550        int found = 0;
2551
2552repeat:
2553        next = this_parent->mnt_mounts.next;
2554resume:
2555        while (next != &this_parent->mnt_mounts) {
2556                struct list_head *tmp = next;
2557                struct mount *mnt = list_entry(tmp, struct mount, mnt_child);
2558
2559                next = tmp->next;
2560                if (!(mnt->mnt.mnt_flags & MNT_SHRINKABLE))
2561                        continue;
2562                /*
2563                 * Descend a level if the d_mounts list is non-empty.
2564                 */
2565                if (!list_empty(&mnt->mnt_mounts)) {
2566                        this_parent = mnt;
2567                        goto repeat;
2568                }
2569
2570                if (!propagate_mount_busy(mnt, 1)) {
2571                        list_move_tail(&mnt->mnt_expire, graveyard);
2572                        found++;
2573                }
2574        }
2575        /*
2576         * All done at this level ... ascend and resume the search
2577         */
2578        if (this_parent != parent) {
2579                next = this_parent->mnt_child.next;
2580                this_parent = this_parent->mnt_parent;
2581                goto resume;
2582        }
2583        return found;
2584}
2585
2586/*
2587 * process a list of expirable mountpoints with the intent of discarding any
2588 * submounts of a specific parent mountpoint
2589 *
2590 * mount_lock must be held for write
2591 */
2592static void shrink_submounts(struct mount *mnt)
2593{
2594        LIST_HEAD(graveyard);
2595        struct mount *m;
2596
2597        /* extract submounts of 'mountpoint' from the expiration list */
2598        while (select_submounts(mnt, &graveyard)) {
2599                while (!list_empty(&graveyard)) {
2600                        m = list_first_entry(&graveyard, struct mount,
2601                                                mnt_expire);
2602                        touch_mnt_namespace(m->mnt_ns);
2603                        umount_tree(m, UMOUNT_PROPAGATE|UMOUNT_SYNC);
2604                }
2605        }
2606}
2607
2608/*
2609 * Some copy_from_user() implementations do not return the exact number of
2610 * bytes remaining to copy on a fault.  But copy_mount_options() requires that.
2611 * Note that this function differs from copy_from_user() in that it will oops
2612 * on bad values of `to', rather than returning a short copy.
2613 */
2614static long exact_copy_from_user(void *to, const void __user * from,
2615                                 unsigned long n)
2616{
2617        char *t = to;
2618        const char __user *f = from;
2619        char c;
2620
2621        if (!access_ok(VERIFY_READ, from, n))
2622                return n;
2623
2624        while (n) {
2625                if (__get_user(c, f)) {
2626                        memset(t, 0, n);
2627                        break;
2628                }
2629                *t++ = c;
2630                f++;
2631                n--;
2632        }
2633        return n;
2634}
2635
2636void *copy_mount_options(const void __user * data)
2637{
2638        int i;
2639        unsigned long size;
2640        char *copy;
2641
2642        if (!data)
2643                return NULL;
2644
2645        copy = kmalloc(PAGE_SIZE, GFP_KERNEL);
2646        if (!copy)
2647                return ERR_PTR(-ENOMEM);
2648
2649        /* We only care that *some* data at the address the user
2650         * gave us is valid.  Just in case, we'll zero
2651         * the remainder of the page.
2652         */
2653        /* copy_from_user cannot cross TASK_SIZE ! */
2654        size = TASK_SIZE - (unsigned long)data;
2655        if (size > PAGE_SIZE)
2656                size = PAGE_SIZE;
2657
2658        i = size - exact_copy_from_user(copy, data, size);
2659        if (!i) {
2660                kfree(copy);
2661                return ERR_PTR(-EFAULT);
2662        }
2663        if (i != PAGE_SIZE)
2664                memset(copy + i, 0, PAGE_SIZE - i);
2665        return copy;
2666}
2667
2668char *copy_mount_string(const void __user *data)
2669{
2670        return data ? strndup_user(data, PAGE_SIZE) : NULL;
2671}
2672
2673/*
2674 * Flags is a 32-bit value that allows up to 31 non-fs dependent flags to
2675 * be given to the mount() call (ie: read-only, no-dev, no-suid etc).
2676 *
2677 * data is a (void *) that can point to any structure up to
2678 * PAGE_SIZE-1 bytes, which can contain arbitrary fs-dependent
2679 * information (or be NULL).
2680 *
2681 * Pre-0.97 versions of mount() didn't have a flags word.
2682 * When the flags word was introduced its top half was required
2683 * to have the magic value 0xC0ED, and this remained so until 2.4.0-test9.
2684 * Therefore, if this magic number is present, it carries no information
2685 * and must be discarded.
2686 */
2687long do_mount(const char *dev_name, const char __user *dir_name,
2688                const char *type_page, unsigned long flags, void *data_page)
2689{
2690        struct path path;
2691        int retval = 0;
2692        int mnt_flags = 0;
2693
2694        /* Discard magic */
2695        if ((flags & MS_MGC_MSK) == MS_MGC_VAL)
2696                flags &= ~MS_MGC_MSK;
2697
2698        /* Basic sanity checks */
2699        if (data_page)
2700                ((char *)data_page)[PAGE_SIZE - 1] = 0;
2701
2702        /* ... and get the mountpoint */
2703        retval = user_path(dir_name, &path);
2704        if (retval)
2705                return retval;
2706
2707        retval = security_sb_mount(dev_name, &path,
2708                                   type_page, flags, data_page);
2709        if (!retval && !may_mount())
2710                retval = -EPERM;
2711        if (!retval && (flags & MS_MANDLOCK) && !may_mandlock())
2712                retval = -EPERM;
2713        if (retval)
2714                goto dput_out;
2715
2716        /* Default to relatime unless overriden */
2717        if (!(flags & MS_NOATIME))
2718                mnt_flags |= MNT_RELATIME;
2719
2720        /* Separate the per-mountpoint flags */
2721        if (flags & MS_NOSUID)
2722                mnt_flags |= MNT_NOSUID;
2723        if (flags & MS_NODEV)
2724                mnt_flags |= MNT_NODEV;
2725        if (flags & MS_NOEXEC)
2726                mnt_flags |= MNT_NOEXEC;
2727        if (flags & MS_NOATIME)
2728                mnt_flags |= MNT_NOATIME;
2729        if (flags & MS_NODIRATIME)
2730                mnt_flags |= MNT_NODIRATIME;
2731        if (flags & MS_STRICTATIME)
2732                mnt_flags &= ~(MNT_RELATIME | MNT_NOATIME);
2733        if (flags & MS_RDONLY)
2734                mnt_flags |= MNT_READONLY;
2735
2736        /* The default atime for remount is preservation */
2737        if ((flags & MS_REMOUNT) &&
2738            ((flags & (MS_NOATIME | MS_NODIRATIME | MS_RELATIME |
2739                       MS_STRICTATIME)) == 0)) {
2740                mnt_flags &= ~MNT_ATIME_MASK;
2741                mnt_flags |= path.mnt->mnt_flags & MNT_ATIME_MASK;
2742        }
2743
2744        flags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE | MS_BORN |
2745                   MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
2746                   MS_STRICTATIME | MS_NOREMOTELOCK);
2747
2748        if (flags & MS_REMOUNT)
2749                retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
2750                                    data_page);
2751        else if (flags & MS_BIND)
2752                retval = do_loopback(&path, dev_name, flags & MS_REC);
2753        else if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
2754                retval = do_change_type(&path, flags);
2755        else if (flags & MS_MOVE)
2756                retval = do_move_mount(&path, dev_name);
2757        else
2758                retval = do_new_mount(&path, type_page, flags, mnt_flags,
2759                                      dev_name, data_page);
2760dput_out:
2761        path_put(&path);
2762        return retval;
2763}
2764
2765static struct ucounts *inc_mnt_namespaces(struct user_namespace *ns)
2766{
2767        return inc_ucount(ns, current_euid(), UCOUNT_MNT_NAMESPACES);
2768}
2769
2770static void dec_mnt_namespaces(struct ucounts *ucounts)
2771{
2772        dec_ucount(ucounts, UCOUNT_MNT_NAMESPACES);
2773}
2774
2775static void free_mnt_ns(struct mnt_namespace *ns)
2776{
2777        ns_free_inum(&ns->ns);
2778        dec_mnt_namespaces(ns->ucounts);
2779        put_user_ns(ns->user_ns);
2780        kfree(ns);
2781}
2782
2783/*
2784 * Assign a sequence number so we can detect when we attempt to bind
2785 * mount a reference to an older mount namespace into the current
2786 * mount namespace, preventing reference counting loops.  A 64bit
2787 * number incrementing at 10Ghz will take 12,427 years to wrap which
2788 * is effectively never, so we can ignore the possibility.
2789 */
2790static atomic64_t mnt_ns_seq = ATOMIC64_INIT(1);
2791
2792static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns)
2793{
2794        struct mnt_namespace *new_ns;
2795        struct ucounts *ucounts;
2796        int ret;
2797
2798        ucounts = inc_mnt_namespaces(user_ns);
2799        if (!ucounts)
2800                return ERR_PTR(-ENOSPC);
2801
2802        new_ns = kmalloc(sizeof(struct mnt_namespace), GFP_KERNEL);
2803        if (!new_ns) {
2804                dec_mnt_namespaces(ucounts);
2805                return ERR_PTR(-ENOMEM);
2806        }
2807        ret = ns_alloc_inum(&new_ns->ns);
2808        if (ret) {
2809                kfree(new_ns);
2810                dec_mnt_namespaces(ucounts);
2811                return ERR_PTR(ret);
2812        }
2813        new_ns->ns.ops = &mntns_operations;
2814        new_ns->seq = atomic64_add_return(1, &mnt_ns_seq);
2815        atomic_set(&new_ns->count, 1);
2816        new_ns->root = NULL;
2817        INIT_LIST_HEAD(&new_ns->list);
2818        init_waitqueue_head(&new_ns->poll);
2819        new_ns->event = 0;
2820        new_ns->user_ns = get_user_ns(user_ns);
2821        new_ns->ucounts = ucounts;
2822        new_ns->mounts = 0;
2823        new_ns->pending_mounts = 0;
2824        return new_ns;
2825}
2826
2827__latent_entropy
2828struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns,
2829                struct user_namespace *user_ns, struct fs_struct *new_fs)
2830{
2831        struct mnt_namespace *new_ns;
2832        struct vfsmount *rootmnt = NULL, *pwdmnt = NULL;
2833        struct mount *p, *q;
2834        struct mount *old;
2835        struct mount *new;
2836        int copy_flags;
2837
2838        BUG_ON(!ns);
2839
2840        if (likely(!(flags & CLONE_NEWNS))) {
2841                get_mnt_ns(ns);
2842                return ns;
2843        }
2844
2845        old = ns->root;
2846
2847        new_ns = alloc_mnt_ns(user_ns);
2848        if (IS_ERR(new_ns))
2849                return new_ns;
2850
2851        namespace_lock();
2852        /* First pass: copy the tree topology */
2853        copy_flags = CL_COPY_UNBINDABLE | CL_EXPIRE;
2854        if (user_ns != ns->user_ns)
2855                copy_flags |= CL_SHARED_TO_SLAVE | CL_UNPRIVILEGED;
2856        new = copy_tree(old, old->mnt.mnt_root, copy_flags);
2857        if (IS_ERR(new)) {
2858                namespace_unlock();
2859                free_mnt_ns(new_ns);
2860                return ERR_CAST(new);
2861        }
2862        new_ns->root = new;
2863        list_add_tail(&new_ns->list, &new->mnt_list);
2864
2865        /*
2866         * Second pass: switch the tsk->fs->* elements and mark new vfsmounts
2867         * as belonging to new namespace.  We have already acquired a private
2868         * fs_struct, so tsk->fs->lock is not needed.
2869         */
2870        p = old;
2871        q = new;
2872        while (p) {
2873                q->mnt_ns = new_ns;
2874                new_ns->mounts++;
2875                if (new_fs) {
2876                        if (&p->mnt == new_fs->root.mnt) {
2877                                new_fs->root.mnt = mntget(&q->mnt);
2878                                rootmnt = &p->mnt;
2879                        }
2880                        if (&p->mnt == new_fs->pwd.mnt) {
2881                                new_fs->pwd.mnt = mntget(&q->mnt);
2882                                pwdmnt = &p->mnt;
2883                        }
2884                }
2885                p = next_mnt(p, old);
2886                q = next_mnt(q, new);
2887                if (!q)
2888                        break;
2889                while (p->mnt.mnt_root != q->mnt.mnt_root)
2890                        p = next_mnt(p, old);
2891        }
2892        namespace_unlock();
2893
2894        if (rootmnt)
2895                mntput(rootmnt);
2896        if (pwdmnt)
2897                mntput(pwdmnt);
2898
2899        return new_ns;
2900}
2901
2902/**
2903 * create_mnt_ns - creates a private namespace and adds a root filesystem
2904 * @mnt: pointer to the new root filesystem mountpoint
2905 */
2906static struct mnt_namespace *create_mnt_ns(struct vfsmount *m)
2907{
2908        struct mnt_namespace *new_ns = alloc_mnt_ns(&init_user_ns);
2909        if (!IS_ERR(new_ns)) {
2910                struct mount *mnt = real_mount(m);
2911                mnt->mnt_ns = new_ns;
2912                new_ns->root = mnt;
2913                new_ns->mounts++;
2914                list_add(&mnt->mnt_list, &new_ns->list);
2915        } else {
2916                mntput(m);
2917        }
2918        return new_ns;
2919}
2920
2921struct dentry *mount_subtree(struct vfsmount *mnt, const char *name)
2922{
2923        struct mnt_namespace *ns;
2924        struct super_block *s;
2925        struct path path;
2926        int err;
2927
2928        ns = create_mnt_ns(mnt);
2929        if (IS_ERR(ns))
2930                return ERR_CAST(ns);
2931
2932        err = vfs_path_lookup(mnt->mnt_root, mnt,
2933                        name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &path);
2934
2935        put_mnt_ns(ns);
2936
2937        if (err)
2938                return ERR_PTR(err);
2939
2940        /* trade a vfsmount reference for active sb one */
2941        s = path.mnt->mnt_sb;
2942        atomic_inc(&s->s_active);
2943        mntput(path.mnt);
2944        /* lock the sucker */
2945        down_write(&s->s_umount);
2946        /* ... and return the root of (sub)tree on it */
2947        return path.dentry;
2948}
2949EXPORT_SYMBOL(mount_subtree);
2950
2951SYSCALL_DEFINE5(mount, char __user *, dev_name, char __user *, dir_name,
2952                char __user *, type, unsigned long, flags, void __user *, data)
2953{
2954        int ret;
2955        char *kernel_type;
2956        char *kernel_dev;
2957        void *options;
2958
2959        kernel_type = copy_mount_string(type);
2960        ret = PTR_ERR(kernel_type);
2961        if (IS_ERR(kernel_type))
2962                goto out_type;
2963
2964        kernel_dev = copy_mount_string(dev_name);
2965        ret = PTR_ERR(kernel_dev);
2966        if (IS_ERR(kernel_dev))
2967                goto out_dev;
2968
2969        options = copy_mount_options(data);
2970        ret = PTR_ERR(options);
2971        if (IS_ERR(options))
2972                goto out_data;
2973
2974        ret = do_mount(kernel_dev, dir_name, kernel_type, flags, options);
2975
2976        kfree(options);
2977out_data:
2978        kfree(kernel_dev);
2979out_dev:
2980        kfree(kernel_type);
2981out_type:
2982        return ret;
2983}
2984
2985/*
2986 * Return true if path is reachable from root
2987 *
2988 * namespace_sem or mount_lock is held
2989 */
2990bool is_path_reachable(struct mount *mnt, struct dentry *dentry,
2991                         const struct path *root)
2992{
2993        while (&mnt->mnt != root->mnt && mnt_has_parent(mnt)) {
2994                dentry = mnt->mnt_mountpoint;
2995                mnt = mnt->mnt_parent;
2996        }
2997        return &mnt->mnt == root->mnt && is_subdir(dentry, root->dentry);
2998}
2999
3000bool path_is_under(struct path *path1, struct path *path2)
3001{
3002        bool res;
3003        read_seqlock_excl(&mount_lock);
3004        res = is_path_reachable(real_mount(path1->mnt), path1->dentry, path2);
3005        read_sequnlock_excl(&mount_lock);
3006        return res;
3007}
3008EXPORT_SYMBOL(path_is_under);
3009
3010/*
3011 * pivot_root Semantics:
3012 * Moves the root file system of the current process to the directory put_old,
3013 * makes new_root as the new root file system of the current process, and sets
3014 * root/cwd of all processes which had them on the current root to new_root.
3015 *
3016 * Restrictions:
3017 * The new_root and put_old must be directories, and  must not be on the
3018 * same file  system as the current process root. The put_old  must  be
3019 * underneath new_root,  i.e. adding a non-zero number of /.. to the string
3020 * pointed to by put_old must yield the same directory as new_root. No other
3021 * file system may be mounted on put_old. After all, new_root is a mountpoint.
3022 *
3023 * Also, the current root cannot be on the 'rootfs' (initial ramfs) filesystem.
3024 * See Documentation/filesystems/ramfs-rootfs-initramfs.txt for alternatives
3025 * in this situation.
3026 *
3027 * Notes:
3028 *  - we don't move root/cwd if they are not at the root (reason: if something
3029 *    cared enough to change them, it's probably wrong to force them elsewhere)
3030 *  - it's okay to pick a root that isn't the root of a file system, e.g.
3031 *    /nfs/my_root where /nfs is the mount point. It must be a mountpoint,
3032 *    though, so you may need to say mount --bind /nfs/my_root /nfs/my_root
3033 *    first.
3034 */
3035SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
3036                const char __user *, put_old)
3037{
3038        struct path new, old, parent_path, root_parent, root;
3039        struct mount *new_mnt, *root_mnt, *old_mnt;
3040        struct mountpoint *old_mp, *root_mp;
3041        int error;
3042
3043        if (!may_mount())
3044                return -EPERM;
3045
3046        error = user_path_dir(new_root, &new);
3047        if (error)
3048                goto out0;
3049
3050        error = user_path_dir(put_old, &old);
3051        if (error)
3052                goto out1;
3053
3054        error = security_sb_pivotroot(&old, &new);
3055        if (error)
3056                goto out2;
3057
3058        get_fs_root(current->fs, &root);
3059        old_mp = lock_mount(&old);
3060        error = PTR_ERR(old_mp);
3061        if (IS_ERR(old_mp))
3062                goto out3;
3063
3064        error = -EINVAL;
3065        new_mnt = real_mount(new.mnt);
3066        root_mnt = real_mount(root.mnt);
3067        old_mnt = real_mount(old.mnt);
3068        if (IS_MNT_SHARED(old_mnt) ||
3069                IS_MNT_SHARED(new_mnt->mnt_parent) ||
3070                IS_MNT_SHARED(root_mnt->mnt_parent))
3071                goto out4;
3072        if (!check_mnt(root_mnt) || !check_mnt(new_mnt))
3073                goto out4;
3074        if (new_mnt->mnt.mnt_flags & MNT_LOCKED)
3075                goto out4;
3076        error = -ENOENT;
3077        if (d_unlinked(new.dentry))
3078                goto out4;
3079        error = -EBUSY;
3080        if (new_mnt == root_mnt || old_mnt == root_mnt)
3081                goto out4; /* loop, on the same file system  */
3082        error = -EINVAL;
3083        if (root.mnt->mnt_root != root.dentry)
3084                goto out4; /* not a mountpoint */
3085        if (!mnt_has_parent(root_mnt))
3086                goto out4; /* not attached */
3087        root_mp = root_mnt->mnt_mp;
3088        if (new.mnt->mnt_root != new.dentry)
3089                goto out4; /* not a mountpoint */
3090        if (!mnt_has_parent(new_mnt))
3091                goto out4; /* not attached */
3092        /* make sure we can reach put_old from new_root */
3093        if (!is_path_reachable(old_mnt, old.dentry, &new))
3094                goto out4;
3095        /* make certain new is below the root */
3096        if (!is_path_reachable(new_mnt, new.dentry, &root))
3097                goto out4;
3098        root_mp->m_count++; /* pin it so it won't go away */
3099        lock_mount_hash();
3100        detach_mnt(new_mnt, &parent_path);
3101        detach_mnt(root_mnt, &root_parent);
3102        if (root_mnt->mnt.mnt_flags & MNT_LOCKED) {
3103                new_mnt->mnt.mnt_flags |= MNT_LOCKED;
3104                root_mnt->mnt.mnt_flags &= ~MNT_LOCKED;
3105        }
3106        /* mount old root on put_old */
3107        attach_mnt(root_mnt, old_mnt, old_mp);
3108        /* mount new_root on / */
3109        attach_mnt(new_mnt, real_mount(root_parent.mnt), root_mp);
3110        touch_mnt_namespace(current->nsproxy->mnt_ns);
3111        /* A moved mount should not expire automatically */
3112        list_del_init(&new_mnt->mnt_expire);
3113        unlock_mount_hash();
3114        chroot_fs_refs(&root, &new);
3115        put_mountpoint(root_mp);
3116        error = 0;
3117out4:
3118        unlock_mount(old_mp);
3119        if (!error) {
3120                path_put(&root_parent);
3121                path_put(&parent_path);
3122        }
3123out3:
3124        path_put(&root);
3125out2:
3126        path_put(&old);
3127out1:
3128        path_put(&new);
3129out0:
3130        return error;
3131}
3132
3133static void __init init_mount_tree(void)
3134{
3135        struct vfsmount *mnt;
3136        struct mnt_namespace *ns;
3137        struct path root;
3138        struct file_system_type *type;
3139
3140        type = get_fs_type("rootfs");
3141        if (!type)
3142                panic("Can't find rootfs type");
3143        mnt = vfs_kern_mount(type, 0, "rootfs", NULL);
3144        put_filesystem(type);
3145        if (IS_ERR(mnt))
3146                panic("Can't create rootfs");
3147
3148        ns = create_mnt_ns(mnt);
3149        if (IS_ERR(ns))
3150                panic("Can't allocate initial namespace");
3151
3152        init_task.nsproxy->mnt_ns = ns;
3153        get_mnt_ns(ns);
3154
3155        root.mnt = mnt;
3156        root.dentry = mnt->mnt_root;
3157        mnt->mnt_flags |= MNT_LOCKED;
3158
3159        set_fs_pwd(current->fs, &root);
3160        set_fs_root(current->fs, &root);
3161}
3162
3163void __init mnt_init(void)
3164{
3165        unsigned u;
3166        int err;
3167
3168        mnt_cache = kmem_cache_create("mnt_cache", sizeof(struct mount),
3169                        0, SLAB_HWCACHE_ALIGN | SLAB_PANIC, NULL);
3170
3171        mount_hashtable = alloc_large_system_hash("Mount-cache",
3172                                sizeof(struct hlist_head),
3173                                mhash_entries, 19,
3174                                0,
3175                                &m_hash_shift, &m_hash_mask, 0, 0);
3176        mountpoint_hashtable = alloc_large_system_hash("Mountpoint-cache",
3177                                sizeof(struct hlist_head),
3178                                mphash_entries, 19,
3179                                0,
3180                                &mp_hash_shift, &mp_hash_mask, 0, 0);
3181
3182        if (!mount_hashtable || !mountpoint_hashtable)
3183                panic("Failed to allocate mount hash table\n");
3184
3185        for (u = 0; u <= m_hash_mask; u++)
3186                INIT_HLIST_HEAD(&mount_hashtable[u]);
3187        for (u = 0; u <= mp_hash_mask; u++)
3188                INIT_HLIST_HEAD(&mountpoint_hashtable[u]);
3189
3190        kernfs_init();
3191
3192        err = sysfs_init();
3193        if (err)
3194                printk(KERN_WARNING "%s: sysfs_init error: %d\n",
3195                        __func__, err);
3196        fs_kobj = kobject_create_and_add("fs", NULL);
3197        if (!fs_kobj)
3198                printk(KERN_WARNING "%s: kobj create error\n", __func__);
3199        init_rootfs();
3200        init_mount_tree();
3201}
3202
3203void put_mnt_ns(struct mnt_namespace *ns)
3204{
3205        if (!atomic_dec_and_test(&ns->count))
3206                return;
3207        drop_collected_mounts(&ns->root->mnt);
3208        free_mnt_ns(ns);
3209}
3210
3211struct vfsmount *kern_mount_data(struct file_system_type *type, void *data)
3212{
3213        struct vfsmount *mnt;
3214        mnt = vfs_kern_mount(type, MS_KERNMOUNT, type->name, data);
3215        if (!IS_ERR(mnt)) {
3216                /*
3217                 * it is a longterm mount, don't release mnt until
3218                 * we unmount before file sys is unregistered
3219                */
3220                real_mount(mnt)->mnt_ns = MNT_NS_INTERNAL;
3221        }
3222        return mnt;
3223}
3224EXPORT_SYMBOL_GPL(kern_mount_data);
3225
3226void kern_unmount(struct vfsmount *mnt)
3227{
3228        /* release long term mount so mount point can be released */
3229        if (!IS_ERR_OR_NULL(mnt)) {
3230                real_mount(mnt)->mnt_ns = NULL;
3231                synchronize_rcu();      /* yecchhh... */
3232                mntput(mnt);
3233        }
3234}
3235EXPORT_SYMBOL(kern_unmount);
3236
3237bool our_mnt(struct vfsmount *mnt)
3238{
3239        return check_mnt(real_mount(mnt));
3240}
3241
3242bool current_chrooted(void)
3243{
3244        /* Does the current process have a non-standard root */
3245        struct path ns_root;
3246        struct path fs_root;
3247        bool chrooted;
3248
3249        /* Find the namespace root */
3250        ns_root.mnt = &current->nsproxy->mnt_ns->root->mnt;
3251        ns_root.dentry = ns_root.mnt->mnt_root;
3252        path_get(&ns_root);
3253        while (d_mountpoint(ns_root.dentry) && follow_down_one(&ns_root))
3254                ;
3255
3256        get_fs_root(current->fs, &fs_root);
3257
3258        chrooted = !path_equal(&fs_root, &ns_root);
3259
3260        path_put(&fs_root);
3261        path_put(&ns_root);
3262
3263        return chrooted;
3264}
3265
3266static bool mnt_already_visible(struct mnt_namespace *ns, struct vfsmount *new,
3267                                int *new_mnt_flags)
3268{
3269        int new_flags = *new_mnt_flags;
3270        struct mount *mnt;
3271        bool visible = false;
3272
3273        down_read(&namespace_sem);
3274        list_for_each_entry(mnt, &ns->list, mnt_list) {
3275                struct mount *child;
3276                int mnt_flags;
3277
3278                if (mnt->mnt.mnt_sb->s_type != new->mnt_sb->s_type)
3279                        continue;
3280
3281                /* This mount is not fully visible if it's root directory
3282                 * is not the root directory of the filesystem.
3283                 */
3284                if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root)
3285                        continue;
3286
3287                /* A local view of the mount flags */
3288                mnt_flags = mnt->mnt.mnt_flags;
3289
3290                /* Don't miss readonly hidden in the superblock flags */
3291                if (mnt->mnt.mnt_sb->s_flags & MS_RDONLY)
3292                        mnt_flags |= MNT_LOCK_READONLY;
3293
3294                /* Verify the mount flags are equal to or more permissive
3295                 * than the proposed new mount.
3296                 */
3297                if ((mnt_flags & MNT_LOCK_READONLY) &&
3298                    !(new_flags & MNT_READONLY))
3299                        continue;
3300                if ((mnt_flags & MNT_LOCK_ATIME) &&
3301                    ((mnt_flags & MNT_ATIME_MASK) != (new_flags & MNT_ATIME_MASK)))
3302                        continue;
3303
3304                /* This mount is not fully visible if there are any
3305                 * locked child mounts that cover anything except for
3306                 * empty directories.
3307                 */
3308                list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
3309                        struct inode *inode = child->mnt_mountpoint->d_inode;
3310                        /* Only worry about locked mounts */
3311                        if (!(child->mnt.mnt_flags & MNT_LOCKED))
3312                                continue;
3313                        /* Is the directory permanetly empty? */
3314                        if (!is_empty_dir_inode(inode))
3315                                goto next;
3316                }
3317                /* Preserve the locked attributes */
3318                *new_mnt_flags |= mnt_flags & (MNT_LOCK_READONLY | \
3319                                               MNT_LOCK_ATIME);
3320                visible = true;
3321                goto found;
3322        next:   ;
3323        }
3324found:
3325        up_read(&namespace_sem);
3326        return visible;
3327}
3328
3329static bool mount_too_revealing(struct vfsmount *mnt, int *new_mnt_flags)
3330{
3331        const unsigned long required_iflags = SB_I_NOEXEC | SB_I_NODEV;
3332        struct mnt_namespace *ns = current->nsproxy->mnt_ns;
3333        unsigned long s_iflags;
3334
3335        if (ns->user_ns == &init_user_ns)
3336                return false;
3337
3338        /* Can this filesystem be too revealing? */
3339        s_iflags = mnt->mnt_sb->s_iflags;
3340        if (!(s_iflags & SB_I_USERNS_VISIBLE))
3341                return false;
3342
3343        if ((s_iflags & required_iflags) != required_iflags) {
3344                WARN_ONCE(1, "Expected s_iflags to contain 0x%lx\n",
3345                          required_iflags);
3346                return true;
3347        }
3348
3349        return !mnt_already_visible(ns, mnt, new_mnt_flags);
3350}
3351
3352bool mnt_may_suid(struct vfsmount *mnt)
3353{
3354        /*
3355         * Foreign mounts (accessed via fchdir or through /proc
3356         * symlinks) are always treated as if they are nosuid.  This
3357         * prevents namespaces from trusting potentially unsafe
3358         * suid/sgid bits, file caps, or security labels that originate
3359         * in other namespaces.
3360         */
3361        return !(mnt->mnt_flags & MNT_NOSUID) && check_mnt(real_mount(mnt)) &&
3362               current_in_userns(mnt->mnt_sb->s_user_ns);
3363}
3364
3365static struct ns_common *mntns_get(struct task_struct *task)
3366{
3367        struct ns_common *ns = NULL;
3368        struct nsproxy *nsproxy;
3369
3370        task_lock(task);
3371        nsproxy = task->nsproxy;
3372        if (nsproxy) {
3373                ns = &nsproxy->mnt_ns->ns;
3374                get_mnt_ns(to_mnt_ns(ns));
3375        }
3376        task_unlock(task);
3377
3378        return ns;
3379}
3380
3381static void mntns_put(struct ns_common *ns)
3382{
3383        put_mnt_ns(to_mnt_ns(ns));
3384}
3385
3386static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns)
3387{
3388        struct fs_struct *fs = current->fs;
3389        struct mnt_namespace *mnt_ns = to_mnt_ns(ns);
3390        struct path root;
3391
3392        if (!ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN) ||
3393            !ns_capable(current_user_ns(), CAP_SYS_CHROOT) ||
3394            !ns_capable(current_user_ns(), CAP_SYS_ADMIN))
3395                return -EPERM;
3396
3397        if (fs->users != 1)
3398                return -EINVAL;
3399
3400        get_mnt_ns(mnt_ns);
3401        put_mnt_ns(nsproxy->mnt_ns);
3402        nsproxy->mnt_ns = mnt_ns;
3403
3404        /* Find the root */
3405        root.mnt    = &mnt_ns->root->mnt;
3406        root.dentry = mnt_ns->root->mnt.mnt_root;
3407        path_get(&root);
3408        while(d_mountpoint(root.dentry) && follow_down_one(&root))
3409                ;
3410
3411        /* Update the pwd and root */
3412        set_fs_pwd(fs, &root);
3413        set_fs_root(fs, &root);
3414
3415        path_put(&root);
3416        return 0;
3417}
3418
3419static struct user_namespace *mntns_owner(struct ns_common *ns)
3420{
3421        return to_mnt_ns(ns)->user_ns;
3422}
3423
3424const struct proc_ns_operations mntns_operations = {
3425        .name           = "mnt",
3426        .type           = CLONE_NEWNS,
3427        .get            = mntns_get,
3428        .put            = mntns_put,
3429        .install        = mntns_install,
3430        .owner          = mntns_owner,
3431};
3432