vfs: Implement a filesystem superblock creation/configuration context

[AV - unfuck kern_mount_data(); we want non-NULL ->mnt_ns on long-living
mounts]
[AV - reordering fs/namespace.c is badly overdue, but let's keep it
separate from that series]
[AV - drop simple_pin_fs() change]
[AV - clean vfs_kern_mount() failure exits up]

Implement a filesystem context concept to be used during superblock
creation for mount and superblock reconfiguration for remount.

The mounting procedure then becomes:

 (1) Allocate new fs_context context.

 (2) Configure the context.

 (3) Create superblock.

 (4) Query the superblock.

 (5) Create a mount for the superblock.

 (6) Destroy the context.

Rather than calling fs_type->mount(), an fs_context struct is created and
fs_type->init_fs_context() is called to set it up.  Pointers exist for the
filesystem and LSM to hang their private data off.

A set of operations has to be set by ->init_fs_context() to provide
freeing, duplication, option parsing, binary data parsing, validation,
mounting and superblock filling.

Legacy filesystems are supported by the provision of a set of legacy
fs_context operations that build up a list of mount options and then invoke
fs_type->mount() from within the fs_context ->get_tree() operation.  This
allows all filesystems to be accessed using fs_context.

It should be noted that, whilst this patch adds a lot of lines of code,
there is quite a bit of duplication with existing code that can be
eliminated should all filesystems be converted over.

Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

5 files changed, 319 insertions, 17 deletions

diff --git a/fs/filesystems.c b/fs/filesystems.c
index b03f57b1105b..9135646e41ac 100644
--- a/fs/filesystems.c
+++ b/fs/filesystems.c
@@ -16,6 +16,7 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/uaccess.h>
+#include <linux/fs_parser.h>
 
 /*
  * Handling of filesystem drivers list.
@@ -73,6 +74,9 @@ int register_filesystem(struct file_system_type * fs)
         int res = 0;
         struct file_system_type ** p;
 
+        if (fs->parameters && !fs_validate_description(fs->parameters))
+                return -EINVAL;
+
         BUG_ON(strchr(fs->name, '.'));
         if (fs->next)
                 return -EBUSY;
diff --git a/fs/fs_context.c b/fs/fs_context.c
index 825d1b2c8807..aa7e0ffb591a 100644
--- a/fs/fs_context.c
+++ b/fs/fs_context.c
@@ -12,6 +12,7 @@
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/fs_context.h>
+#include <linux/fs_parser.h>
 #include <linux/fs.h>
 #include <linux/mount.h>
 #include <linux/nsproxy.h>
@@ -25,13 +26,217 @@
 #include "mount.h"
 #include "internal.h"
 
+enum legacy_fs_param {
+        LEGACY_FS_UNSET_PARAMS,
+        LEGACY_FS_MONOLITHIC_PARAMS,
+        LEGACY_FS_INDIVIDUAL_PARAMS,
+};
+
 struct legacy_fs_context {
         char                    *legacy_data;   /* Data page for legacy filesystems */
         size_t                  data_size;
+        enum legacy_fs_param    param_type;
 };
 
 static int legacy_init_fs_context(struct fs_context *fc);
 
+static const struct constant_table common_set_sb_flag[] = {
+        { "dirsync",    SB_DIRSYNC },
+        { "lazytime",   SB_LAZYTIME },
+        { "mand",       SB_MANDLOCK },
+        { "posixacl",   SB_POSIXACL },
+        { "ro",         SB_RDONLY },
+        { "sync",       SB_SYNCHRONOUS },
+};
+
+static const struct constant_table common_clear_sb_flag[] = {
+        { "async",      SB_SYNCHRONOUS },
+        { "nolazytime", SB_LAZYTIME },
+        { "nomand",     SB_MANDLOCK },
+        { "rw",         SB_RDONLY },
+        { "silent",     SB_SILENT },
+};
+
+static const char *const forbidden_sb_flag[] = {
+        "bind",
+        "dev",
+        "exec",
+        "move",
+        "noatime",
+        "nodev",
+        "nodiratime",
+        "noexec",
+        "norelatime",
+        "nostrictatime",
+        "nosuid",
+        "private",
+        "rec",
+        "relatime",
+        "remount",
+        "shared",
+        "slave",
+        "strictatime",
+        "suid",
+        "unbindable",
+};
+
+/*
+ * Check for a common mount option that manipulates s_flags.
+ */
+static int vfs_parse_sb_flag(struct fs_context *fc, const char *key)
+{
+        unsigned int token;
+        unsigned int i;
+
+        for (i = 0; i < ARRAY_SIZE(forbidden_sb_flag); i++)
+                if (strcmp(key, forbidden_sb_flag[i]) == 0)
+                        return -EINVAL;
+
+        token = lookup_constant(common_set_sb_flag, key, 0);
+        if (token) {
+                fc->sb_flags |= token;
+                fc->sb_flags_mask |= token;
+                return 0;
+        }
+
+        token = lookup_constant(common_clear_sb_flag, key, 0);
+        if (token) {
+                fc->sb_flags &= ~token;
+                fc->sb_flags_mask |= token;
+                return 0;
+        }
+
+        return -ENOPARAM;
+}
+
+/**
+ * vfs_parse_fs_param - Add a single parameter to a superblock config
+ * @fc: The filesystem context to modify
+ * @param: The parameter
+ *
+ * A single mount option in string form is applied to the filesystem context
+ * being set up.  Certain standard options (for example "ro") are translated
+ * into flag bits without going to the filesystem.  The active security module
+ * is allowed to observe and poach options.  Any other options are passed over
+ * to the filesystem to parse.
+ *
+ * This may be called multiple times for a context.
+ *
+ * Returns 0 on success and a negative error code on failure.  In the event of
+ * failure, supplementary error information may have been set.
+ */
+int vfs_parse_fs_param(struct fs_context *fc, struct fs_parameter *param)
+{
+        int ret;
+
+        if (!param->key)
+                return invalf(fc, "Unnamed parameter\n");
+
+        ret = vfs_parse_sb_flag(fc, param->key);
+        if (ret != -ENOPARAM)
+                return ret;
+
+        ret = security_fs_context_parse_param(fc, param);
+        if (ret != -ENOPARAM)
+                /* Param belongs to the LSM or is disallowed by the LSM; so
+                 * don't pass to the FS.
+                 */
+                return ret;
+
+        if (fc->ops->parse_param) {
+                ret = fc->ops->parse_param(fc, param);
+                if (ret != -ENOPARAM)
+                        return ret;
+        }
+
+        /* If the filesystem doesn't take any arguments, give it the
+         * default handling of source.
+         */
+        if (strcmp(param->key, "source") == 0) {
+                if (param->type != fs_value_is_string)
+                        return invalf(fc, "VFS: Non-string source");
+                if (fc->source)
+                        return invalf(fc, "VFS: Multiple sources");
+                fc->source = param->string;
+                param->string = NULL;
+                return 0;
+        }
+
+        return invalf(fc, "%s: Unknown parameter '%s'",
+                      fc->fs_type->name, param->key);
+}
+EXPORT_SYMBOL(vfs_parse_fs_param);
+
+/**
+ * vfs_parse_fs_string - Convenience function to just parse a string.
+ */
+int vfs_parse_fs_string(struct fs_context *fc, const char *key,
+                        const char *value, size_t v_size)
+{
+        int ret;
+
+        struct fs_parameter param = {
+                .key    = key,
+                .type   = fs_value_is_string,
+                .size   = v_size,
+        };
+
+        if (v_size > 0) {
+                param.string = kmemdup_nul(value, v_size, GFP_KERNEL);
+                if (!param.string)
+                        return -ENOMEM;
+        }
+
+        ret = vfs_parse_fs_param(fc, &param);
+        kfree(param.string);
+        return ret;
+}
+EXPORT_SYMBOL(vfs_parse_fs_string);
+
+/**
+ * generic_pa