Support RENAME_EXCHANGE in tmpfs and overlayfs

renameat2(2) support was added in 2c1c4a5 ("Implement renameat2."), but only for the gofer filesystem; tmpfs and overlayfs still return EINVAL for RENAME_EXCHANGE.

Implement RENAME_EXCHANGE in tmpfs by swapping the two dentries between their parent directories. When the exchanged files differ in type, the parents' link counts (for "..") and the exchanged directory's reference on its parent are transferred.

Implement RENAME_EXCHANGE in overlayfs by copying up the destination file (and its descendants, if it is a directory) in addition to the source, and then exchanging both files on the upper layer. Unlike a regular rename, no whiteout is created at the source location, since both locations remain occupied. Exchanged directories are marked opaque at their new locations to prevent merging with lower layer directories there.

RENAME_EXCHANGE permits the two files to differ in type and does not require a directory being exchanged to be empty, but exchanging a file with an ancestor directory must fail with EINVAL; see Linux's fs/namei.c:__start_renaming(). The gofer filesystem previously required both files to have the same type; lift that restriction, and update parent link counts when files of different types are exchanged across directories.

The RENAME_EXCHANGE syscall tests no longer accept EINVAL (except on FUSE, which does not support the flag), and new tests cover mixed-type exchanges and exchanges with ancestor directories.

Fixes #7895

FUTURE_COPYBARA_INTEGRATE_REVIEW=#14221 from ayushr2:rename 26ca2a3
PiperOrigin-RevId: 970791991

Author: ayushr2

pkg/sentry/fsimpl/gofer/filesystem.go

@@ -1440,6 +1440,7 @@ func (fs *filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldPa
 		// users.
 		return linuxerr.EINVAL
 	}
+	exchange := opts.Flags&linux.RENAME_EXCHANGE != 0
 
 	newName := rp.Component()
 	if newName == "." || newName == ".." {
@@ -1500,7 +1501,7 @@ func (fs *filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldPa
 			}
 		}
 	} else {
-		if opts.MustBeDir || rp.MustBeDir() {
+		if !exchange && (opts.MustBeDir || rp.MustBeDir()) {
 			return linuxerr.ENOTDIR
 		}
 	}
@@ -1528,7 +1529,26 @@ func (fs *filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldPa
 			return err
 		}
 		replacedVFSD = &replaced.vfsd
-		if replaced.isDir() {
+		if exchange {
+			// The exchanged files may differ in type, and a directory being
+			// exchanged may be non-empty; but exchanging a file with an
+			// ancestor directory would disconnect the latter from the tree.
+			if genericIsAncestorDentry(fs, replaced, renamed) {
+				return linuxerr.EINVAL
+			}
+			if rp.MustBeDir() && !replaced.isDir() {
+				return linuxerr.ENOTDIR
+			}
+			if opts.MustBeDir && !renamed.isDir() {
+				return linuxerr.ENOTDIR
+			}
+			if oldParent != newParent && replaced.isDir() {
+				// Writability is needed to change replaced's "..".
+				if err := replaced.checkPermissions(creds, vfs.MayWrite); err != nil {
+					return err
+				}
+			}
+		} else if replaced.isDir() {
 			if !renamed.isDir() {
 				return linuxerr.EISDIR
 			}
@@ -1541,7 +1561,7 @@ func (fs *filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldPa
 			}
 		}
 	} else { // replaced == nil
-		if opts.Flags&linux.RENAME_EXCHANGE != 0 {
+		if exchange {
 			// RENAME_EXCHANGE requires that the target file exist.
 			return linuxerr.ENOENT
 		}
@@ -1562,7 +1582,7 @@ func (fs *filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldPa
 			vfsObj.AbortRenameDentry(&renamed.vfsd, replacedVFSD)
 			return err
 		}
-	} else if replaced != nil && !replaced.inode.isSynthetic() && opts.Flags&linux.RENAME_EXCHANGE == 0 {
+	} else if replaced != nil && !replaced.inode.isSynthetic() && !exchange {
 		// We are replacing an existing real file with a synthetic one, so we
 		// need to unlink the former.
 		flags := uint32(0)
@@ -1583,11 +1603,8 @@ func (fs *filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldPa
 		defer oldParent.childrenMu.Unlock()
 	}
 
-	if opts.Flags&linux.RENAME_EXCHANGE != 0 {
-		if renamed != nil {
-			vfsObj.CommitRenameExchangeDentry(&renamed.vfsd, replacedVFSD)
-		}
-
+	if exchange {
+		vfsObj.CommitRenameExchangeDentry(&renamed.vfsd, replacedVFSD)
 		if oldParent != newParent {
 			switch {
 			case replaced.inode.isSynthetic() && !renamed.inode.isSynthetic():
@@ -1616,66 +1633,85 @@ func (fs *filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldPa
 			oldParent.clearDirentsLocked()
 			oldParent.touchCMtime()
 		}
-		if oldParent != newParent && newParent.inode.cachedMetadataAuthoritative() {
-			newParent.clearDirentsLocked()
-			newParent.touchCMtime()
+		if oldParent != newParent {
+			if newParent.inode.cachedMetadataAuthoritative() {
+				newParent.clearDirentsLocked()
+				newParent.touchCMtime()
+			}
+			// If exactly one of the exchanged files is a directory, its ".."
+			// entry moves from one parent directory to the other.
+			if renamed.isDir() && !replaced.isDir() {
+				if oldParent.inode.cachedMetadataAuthoritative() {
+					oldParent.decLinks()
+				}
+				if newParent.inode.cachedMetadataAuthoritative() {
+					newParent.incLinks()
+				}
+			} else if !renamed.isDir() && replaced.isDir() {
+				if newParent.inode.cachedMetadataAuthoritative() {
+					newParent.decLinks()
+				}
+				if oldParent.inode.cachedMetadataAuthoritative() {
+					oldParent.incLinks()
+				}
+			}
 		}
 		// Sends notifications for both the renamed and replaced dentries.
 		vfs.InotifyRename(ctx, &renamed.inode.watches, &oldParent.inode.watches, &newParent.inode.watches, oldName, newName, renamed.isDir())
 		vfs.InotifyRename(ctx, &replaced.inode.watches, &newParent.inode.watches, &oldParent.inode.watches, newName, oldName, replaced.isDir())
-	} else {
-		toDecRef = vfsObj.CommitRenameReplaceDentry(ctx, &renamed.vfsd, replacedVFSD)
-		if replaced != nil {
-			replaced.setDeleted()
-			// If an extra reference is held on replaced as described by the
-			// comment for dentry.refs, drop that reference now. We can't race with
-			// fs.unlinkAt() or invalidation since fs.renameMu has been locked for
-			// writing since before we obtained replaced.
-			if replaced.inode.isSynthetic() {
-				newParent.syntheticChildren--
-				replaced.decRefNoCaching()
-			} else if replaced.inode.endpoint != nil {
-				replaced.decRefNoCaching()
-			}
-			ds = appendDentry(ds, replaced)
-			// Remove the replaced entry from its parent's cache.
-			delete(newParent.children, newName)
-		}
-		oldParent.cacheNegativeLookupLocked(oldName) // +checklocksforce: oldParent.childrenMu is held if oldParent != newParent.
-		if renamed.inode.isSynthetic() {
-			oldParent.syntheticChildren--
-			newParent.syntheticChildren++
-		}
-		// We have d.opMu for writing, so no need to check for existence of a
-		// child with the given name. We could not have raced.
-		newParent.cacheNewChildLocked(renamed, newName)
-		oldParent.decRefNoCaching()
-		if oldParent != newParent {
-			ds = appendDentry(ds, newParent)
-			ds = appendDentry(ds, oldParent)
-		}
+		return nil
+	}
+	toDecRef = vfsObj.CommitRenameReplaceDentry(ctx, &renamed.vfsd, replacedVFSD)
+	if replaced != nil {
+		replaced.setDeleted()
+		// If an extra reference is held on replaced as described by the
+		// comment for dentry.refs, drop that reference now. We can't race with
+		// fs.unlinkAt() or invalidation since fs.renameMu has been locked for
+		// writing since before we obtained replaced.
+		if replaced.inode.isSynthetic() {
+			newParent.syntheticChildren--
+			replaced.decRefNoCaching()
+		} else if replaced.inode.endpoint != nil {
+			replaced.decRefNoCaching()
+		}
+		ds = appendDentry(ds, replaced)
+		// Remove the replaced entry from its parent's cache.
+		delete(newParent.children, newName)
+	}
+	oldParent.cacheNegativeLookupLocked(oldName) // +checklocksforce: oldParent.childrenMu is held if oldParent != newParent.
+	if renamed.inode.isSynthetic() {
+		oldParent.syntheticChildren--
+		newParent.syntheticChildren++
+	}
+	// We have d.opMu for writing, so no need to check for existence of a
+	// child with the given name. We could not have raced.
+	newParent.cacheNewChildLocked(renamed, newName)
+	oldParent.decRefNoCaching()
+	if oldParent != newParent {
+		ds = appendDentry(ds, newParent)
+		ds = appendDentry(ds, oldParent)
+	}
 
-		// Update metadata.
-		if renamed.inode.cachedMetadataAuthoritative() {
-			renamed.touchCtime()
-		}
-		if oldParent.inode.cachedMetadataAuthoritative() {
-			oldParent.clearDirentsLocked()
-			oldParent.touchCMtime()
-			if renamed.isDir() {
-				oldParent.decLinks()
-			}
+	// Update metadata.
+	if renamed.inode.cachedMetadataAuthoritative() {
+		renamed.touchCtime()
+	}
+	if oldParent.inode.cachedMetadataAuthoritative() {
+		oldParent.clearDirentsLocked()
+		oldParent.touchCMtime()
+		if renamed.isDir() {
+			oldParent.decLinks()
 		}
-		if newParent.inode.cachedMetadataAuthoritative() {
-			newParent.clearDirentsLocked()
-			newParent.touchCMtime()
-			if renamed.isDir() && (replaced == nil || !replaced.isDir()) {
-				// Increase the link count if we did not replace another directory.
-				newParent.incLinks()
-			}
+	}
+	if newParent.inode.cachedMetadataAuthoritative() {
+		newParent.clearDirentsLocked()
+		newParent.touchCMtime()
+		if renamed.isDir() && (replaced == nil || !replaced.isDir()) {
+			// Increase the link count if we did not replace another directory.
+			newParent.incLinks()
 		}
-		vfs.InotifyRename(ctx, &renamed.inode.watches, &oldParent.inode.watches, &newParent.inode.watches, oldName, newName, renamed.isDir())
 	}
+	vfs.InotifyRename(ctx, &renamed.inode.watches, &oldParent.inode.watches, &newParent.inode.watches, oldName, newName, renamed.isDir())
 	return nil
 }
 

pkg/sentry/fsimpl/overlay/filesystem.go

@@ -1090,9 +1090,13 @@ func (fs *filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldPa
 		return err
 	}
 
-	if opts.Flags&^linux.RENAME_NOREPLACE != 0 {
+	if opts.Flags&^(linux.RENAME_NOREPLACE|linux.RENAME_EXCHANGE) != 0 {
 		return linuxerr.EINVAL
 	}
+	if opts.Flags&(linux.RENAME_NOREPLACE|linux.RENAME_EXCHANGE) == linux.RENAME_NOREPLACE|linux.RENAME_EXCHANGE {
+		return linuxerr.EINVAL
+	}
+	exchange := opts.Flags&linux.RENAME_EXCHANGE != 0
 
 	newName := rp.Component()
 	if newName == "." || newName == ".." {
@@ -1142,7 +1146,7 @@ func (fs *filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldPa
 			}
 		}
 	} else {
-		if opts.MustBeDir || rp.MustBeDir() {
+		if !exchange && (opts.MustBeDir || rp.MustBeDir()) {
 			return linuxerr.ENOTDIR
 		}
 	}
@@ -1175,7 +1179,26 @@ func (fs *filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldPa
 			return err
 		}
 		replacedVFSD = &replaced.vfsd
-		if replaced.isDir() {
+		if exchange {
+			// The exchanged files may differ in type, and a directory being
+			// exchanged may be non-empty; but exchanging a file with an
+			// ancestor directory would disconnect the latter from the tree.
+			if genericIsAncestorDentry(fs, replaced, renamed) {
+				return linuxerr.EINVAL
+			}
+			if rp.MustBeDir() && !replaced.isDir() {
+				return linuxerr.ENOTDIR
+			}
+			if opts.MustBeDir && !renamed.isDir() {
+				return linuxerr.ENOTDIR
+			}
+			if oldParent != newParent && replaced.isDir() {
+				// Writability is needed to change replaced's "..".
+				if err := replaced.checkPermissions(creds, vfs.MayWrite); err != nil {
+					return err
+				}
+			}
+		} else if replaced.isDir() {
 			if !renamed.isDir() {
 				return linuxerr.EISDIR
 			}
@@ -1193,6 +1216,9 @@ func (fs *filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldPa
 				return linuxerr.ENOTDIR
 			}
 		}
+	} else if exchange {
+		// RENAME_EXCHANGE requires that the target file exist.
+		return linuxerr.ENOENT
 	}
 
 	if oldParent == newParent && oldName == newName {
@@ -1216,10 +1242,24 @@ func (fs *filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldPa
 	if err := newParent.copyUpLocked(ctx); err != nil {
 		return err
 	}
-	// If replaced exists, it doesn't need to be copied-up, but we do need to
-	// serialize with copy-up. Holding renameMu for writing should be
-	// sufficient, but out of an abundance of caution...
-	if replaced != nil {
+	if exchange {
+		// replaced is also renamed on the upper layer, so it (and all of its
+		// descendants if it's a directory) must be copied-up too.
+		if err := replaced.copyUpLocked(ctx); err != nil {
+			return err
+		}
+		if replaced.isDir() {
+			replaced.dirMu.NestedLock(dirLockReplaced)
+			err := replaced.copyUpDescendantsLocked(ctx, &ds)
+			replaced.dirMu.NestedUnlock(dirLockReplaced)
+			if err != nil {
+				return err
+			}
+		}
+	} else if replaced != nil {
+		// replaced doesn't need to be copied-up, but we do need to serialize
+		// with copy-up. Holding renameMu for writing should be sufficient, but
+		// out of an abundance of caution...
 		replaced.copyMu.RLock()
 		defer replaced.copyMu.RUnlock()
 	}
@@ -1255,7 +1295,7 @@ func (fs *filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldPa
 			}
 		}
 	}
-	if renamed.isDir() {
+	if !exchange && renamed.isDir() {
 		if replacedLayer == lookupLayerUpper {
 			// Remove whiteouts from the directory being replaced.
 			needRecreateWhiteouts = true
@@ -1303,6 +1343,44 @@ func (fs *filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldPa
 		return err
 	}
 
+	if exchange {
+		// Below this point, renamed is at newpop and replaced is at oldpop.
+		// Commit the exchange, update the overlay filesystem tree, and abandon
+		// attempts to recover from errors.
+		vfsObj.CommitRenameExchangeDentry(&renamed.vfsd, &replaced.vfsd)
+		genericSetParentAndName(fs, renamed, newParent, newName)
+		genericSetParentAndName(fs, replaced, oldParent, oldName)
+		// References held by renamed and replaced on their parents are
+		// exchanged as well; the counts on each parent are unchanged.
+		oldParent.children[oldName] = replaced
+		newParent.children[newName] = renamed
+		oldParent.dirents = nil
+		newParent.dirents = nil
+
+		// An exchanged directory's contents can no longer be merged with
+		// lower layer directories at its new location.
+		if renamed.isDir() {
+			if err := vfsObj.SetXattrAt(ctx, fs.creds, &newpop, &vfs.SetXattrOptions{
+				Name:  fs.xattrOpaque,
+				Value: "y",
+			}); err != nil {
+				panic(fmt.Sprintf("unrecoverable overlayfs inconsistency: failed to make exchanged directory opaque: %v", err))
+			}
+		}
+		if replaced.isDir() {
+			if err := vfsObj.SetXattrAt(ctx, fs.creds, &oldpop, &vfs.SetXattrOptions{
+				Name:  fs.xattrOpaque,
+				Value: "y",
+			}); err != nil {
+				panic(fmt.Sprintf("unrecoverable overlayfs inconsistency: failed to make exchanged directory opaque: %v", err))
+			}
+		}
+
+		vfs.InotifyRename(ctx, &renamed.watches, &oldParent.watches, &newParent.watches, oldName, newName, renamed.isDir())
+		vfs.InotifyRename(ctx, &replaced.watches, &newParent.watches, &oldParent.watches, newName, oldName, replaced.isDir())
+		return nil
+	}
+
 	// Below this point, the renamed dentry is now at newpop, and anything we
 	// replaced is gone forever. Commit the rename, update the overlay
 	// filesystem tree, and abandon attempts to recover from errors.