NFSv4: include bitmap in nfsv4 get acl data

The NFSv4 bitmap size is unbounded: a server can return an arbitrary
sized bitmap in an FATTR4_WORD0_ACL request.  Replace using the
nfs4_fattr_bitmap_maxsz as a guess to the maximum bitmask returned by a server
with the inclusion of the bitmap (xdr length plus bitmasks) and the acl data
xdr length to the (cached) acl page data.

This is a general solution to commit e5012d1f "NFSv4.1: update
nfs4_fattr_bitmap_maxsz" and fixes hitting a BUG_ON in xdr_shrink_bufhead
when getting ACLs.

Fix a bug in decode_getacl that returned -EINVAL on ACLs > page when getxattr
was called with a NULL buffer, preventing ACL > PAGE_SIZE from being retrieved.

Cc: stable@kernel.org
Signed-off-by: Andy Adamson <andros@netapp.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

1 files changed, 23 insertions, 8 deletions

diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index e6161b213ed1..dcaf69309d8e 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -2517,11 +2517,13 @@ static void nfs4_xdr_enc_getacl(struct rpc_rqst *req, struct xdr_stream *xdr,
         encode_compound_hdr(xdr, req, &hdr);
         encode_sequence(xdr, &args->seq_args, &hdr);
         encode_putfh(xdr, args->fh, &hdr);
-        replen = hdr.replen + op_decode_hdr_maxsz + nfs4_fattr_bitmap_maxsz + 1;
+        replen = hdr.replen + op_decode_hdr_maxsz + 1;
         encode_getattr_two(xdr, FATTR4_WORD0_ACL, 0, &hdr);
 
         xdr_inline_pages(&req->rq_rcv_buf, replen << 2,
                 args->acl_pages, args->acl_pgbase, args->acl_len);
+        xdr_set_scratch_buffer(xdr, page_address(args->acl_scratch), PAGE_SIZE);
+
         encode_nops(&hdr);
 }
 
@@ -4957,17 +4959,18 @@ decode_restorefh(struct xdr_stream *xdr)
 }
 
 static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
-                size_t *acl_len)
+                         struct nfs_getaclres *res)
 {
-        __be32 *savep;
+        __be32 *savep, *bm_p;
         uint32_t attrlen,
                  bitmap[3] = {0};
         struct kvec *iov = req->rq_rcv_buf.head;
         int status;
 
-        *acl_len = 0;
+        res->acl_len = 0;
         if ((status = decode_op_hdr(xdr, OP_GETATTR)) != 0)
                 goto out;
+        bm_p = xdr->p;
         if ((status = decode_attr_bitmap(xdr, bitmap)) != 0)
                 goto out;
         if ((status = decode_attr_length(xdr, &attrlen, &savep)) != 0)
@@ -4979,18 +4982,30 @@ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
                 size_t hdrlen;
                 u32 recvd;
 
+                /* The bitmap (xdr len + bitmaps) and the attr xdr len words
+                 * are stored with the acl data to handle the problem of
+                 * variable length bitmaps.*/
+                xdr->p = bm_p;
+                res->acl_data_offset = be32_to_cpup(bm_p) + 2;
+                res->acl_data_offset <<= 2;
+
                 /* We ignore &savep and don't do consistency checks on
                  * the attr length.  Let userspace figure it out.... */
                 hdrlen = (u8 *)xdr->p - (u8 *)iov->iov_base;
+                attrlen += res->acl_data_offset;
                 recvd = req->rq_rcv_buf.len - hdrlen;
                 if (attrlen > recvd) {
-                        dprintk("NFS: server cheating in getattr"
-                                        " acl reply: attrlen %u > recvd %u\n",
+                        if (res->acl_flags & NFS4_ACL_LEN_REQUEST) {
+                                /* getxattr interface called with a NULL buf */
+                                res->acl_len = attrlen;
+                                goto out;
+                        }
+                        dprintk("NFS: acl reply: attrlen %u > recvd %u\n",
                                         attrlen, recvd);
                         return -EINVAL;
                 }
                 xdr_read_pages(xdr, attrlen);
-                *acl_len = attrlen;
+                res->acl_len = attrlen;
         } else
                 status = -EOPNOTSUPP;
 
@@ -6028,7 +6043,7 @@ nfs4_xdr_dec_getacl(struct rpc_rqst *rqstp, struct xdr_stream *xdr,
         status = decode_putfh(xdr);
         if (status)
                 goto out;
-        status = decode_getacl(xdr, rqstp, &res->acl_len);
+        status = decode_getacl(xdr, rqstp, res);
 
 out:
         return status;