Merge tag 'nfs-for-3.11-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs

Pull NFS client updates from Trond Myklebust:
 "Feature highlights include:
   - Add basic client support for NFSv4.2
   - Add basic client support for Labeled NFS (selinux for NFSv4.2)
   - Fix the use of credentials in NFSv4.1 stateful operations, and add
     support for NFSv4.1 state protection.

  Bugfix highlights:
   - Fix another NFSv4 open state recovery race
   - Fix an NFSv4.1 back channel session regression
   - Various rpc_pipefs races
   - Fix another issue with NFSv3 auth negotiation

  Please note that Labeled NFS does require some additional support from
  the security subsystem.  The relevant changesets have all been
  reviewed and acked by James Morris."

* tag 'nfs-for-3.11-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: (54 commits)
  NFS: Set NFS_CS_MIGRATION for NFSv4 mounts
  NFSv4.1 Refactor nfs4_init_session and nfs4_init_channel_attrs
  nfs: have NFSv3 try server-specified auth flavors in turn
  nfs: have nfs_mount fake up a auth_flavs list when the server didn't provide it
  nfs: move server_authlist into nfs_try_mount_request
  nfs: refactor "need_mount" code out of nfs_try_mount
  SUNRPC: PipeFS MOUNT notification optimization for dying clients
  SUNRPC: split client creation routine into setup and registration
  SUNRPC: fix races on PipeFS UMOUNT notifications
  SUNRPC: fix races on PipeFS MOUNT notifications
  NFSv4.1 use pnfs_device maxcount for the objectlayout gdia_maxcount
  NFSv4.1 use pnfs_device maxcount for the blocklayout gdia_maxcount
  NFSv4.1 Fix gdia_maxcount calculation to fit in ca_maxresponsesize
  NFS: Improve legacy idmapping fallback
  NFSv4.1 end back channel session draining
  NFS: Apply v4.1 capabilities to v4.2
  NFSv4.1: Clean up layout segment comparison helper names
  NFSv4.1: layout segment comparison helpers should take 'const' parameters
  NFSv4: Move the DNS resolver into the NFSv4 module
  rpc_pipefs: only set rpc_dentry_ops if d_op isn't already set
  ...

6 files changed, 125 insertions, 29 deletions

diff --git a/include/linux/nfs4.h b/include/linux/nfs4.h
index 7b8fc73810ad..e36dee52f224 100644
--- a/include/linux/nfs4.h
+++ b/include/linux/nfs4.h
@@ -32,6 +32,15 @@ struct nfs4_acl {
         struct nfs4_ace aces[0];
 };
 
+#define NFS4_MAXLABELLEN        2048
+
+struct nfs4_label {
+        uint32_t        lfs;
+        uint32_t        pi;
+        u32             len;
+        char    *label;
+};
+
 typedef struct { char data[NFS4_VERIFIER_SIZE]; } nfs4_verifier;
 
 struct nfs_stateid4 {
@@ -219,6 +228,14 @@ enum nfsstat4 {
         NFS4ERR_REJECT_DELEG    = 10085,        /* on callback */
         NFS4ERR_RETURNCONFLICT  = 10086,        /* outstanding layoutreturn */
         NFS4ERR_DELEG_REVOKED   = 10087,        /* deleg./layout revoked */
+
+        /* nfs42 */
+        NFS4ERR_PARTNER_NOTSUPP = 10088,
+        NFS4ERR_PARTNER_NO_AUTH = 10089,
+        NFS4ERR_METADATA_NOTSUPP = 10090,
+        NFS4ERR_OFFLOAD_DENIED = 10091,
+        NFS4ERR_WRONG_LFS = 10092,
+        NFS4ERR_BADLABEL = 10093,
 };
 
 static inline bool seqid_mutating_err(u32 err)
@@ -378,6 +395,7 @@ enum lock_type4 {
 #define FATTR4_WORD1_FS_LAYOUT_TYPES    (1UL << 30)
 #define FATTR4_WORD2_LAYOUT_BLKSIZE     (1UL << 1)
 #define FATTR4_WORD2_MDSTHRESHOLD       (1UL << 4)
+#define FATTR4_WORD2_SECURITY_LABEL     (1UL << 17)
 
 /* MDS threshold bitmap bits */
 #define THRESHOLD_RD                    (1UL << 0)
@@ -390,11 +408,15 @@ enum lock_type4 {
 #define NFS4_VERSION 4
 #define NFS4_MINOR_VERSION 0
 
+#if defined(CONFIG_NFS_V4_2)
+#define NFS4_MAX_MINOR_VERSION 2
+#else
 #if defined(CONFIG_NFS_V4_1)
 #define NFS4_MAX_MINOR_VERSION 1
 #else
 #define NFS4_MAX_MINOR_VERSION 0
 #endif /* CONFIG_NFS_V4_1 */
+#endif /* CONFIG_NFS_V4_2 */
 
 #define NFS4_DEBUG 1
 
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index fc01d5cb4cf1..0b176297aaf6 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -207,6 +207,7 @@ struct nfs_inode {
 #define NFS_INO_INVALID_ACL     0x0010          /* cached acls are invalid */
 #define NFS_INO_REVAL_PAGECACHE 0x0020          /* must revalidate pagecache */
 #define NFS_INO_REVAL_FORCED    0x0040          /* force revalidation ignoring a delegation */
+#define NFS_INO_INVALID_LABEL   0x0080          /* cached label is invalid */
 
 /*
  * Bit offsets in flags field
@@ -336,7 +337,7 @@ extern void nfs_zap_mapping(struct inode *inode, struct address_space *mapping);
 extern void nfs_zap_caches(struct inode *);
 extern void nfs_invalidate_atime(struct inode *);
 extern struct inode *nfs_fhget(struct super_block *, struct nfs_fh *,
-                                struct nfs_fattr *);
+                                struct nfs_fattr *, struct nfs4_label *);
 extern int nfs_refresh_inode(struct inode *, struct nfs_fattr *);
 extern int nfs_post_op_update_inode(struct inode *inode, struct nfs_fattr *fattr);
 extern int nfs_post_op_update_inode_force_wcc(struct inode *inode, struct nfs_fattr *fattr);
@@ -352,10 +353,13 @@ extern int __nfs_revalidate_inode(struct nfs_server *, struct inode *);
 extern int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping);
 extern int nfs_setattr(struct dentry *, struct iattr *);
 extern void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr);
+extern void nfs_setsecurity(struct inode *inode, struct nfs_fattr *fattr,
+                                struct nfs4_label *label);
 extern struct nfs_open_context *get_nfs_open_context(struct nfs_open_context *ctx);
 extern void put_nfs_open_context(struct nfs_open_context *ctx);
 extern struct nfs_open_context *nfs_find_open_context(struct inode *inode, struct rpc_cred *cred, fmode_t mode);
 extern struct nfs_open_context *alloc_nfs_open_context(struct dentry *dentry, fmode_t f_mode);
+extern void nfs_inode_attach_open_context(struct nfs_open_context *ctx);
 extern void nfs_file_set_open_context(struct file *filp, struct nfs_open_context *ctx);
 extern struct nfs_lock_context *nfs_get_lock_context(struct nfs_open_context *ctx);
 extern void nfs_put_lock_context(struct nfs_lock_context *l_ctx);
@@ -468,7 +472,8 @@ extern const struct file_operations nfs_dir_operations;
 extern const struct dentry_operations nfs_dentry_operations;
 
 extern void nfs_force_lookup_revalidate(struct inode *dir);
-extern int nfs_instantiate(struct dentry *dentry, struct nfs_fh *fh, struct nfs_fattr *fattr);
+extern int nfs_instantiate(struct dentry *dentry, struct nfs_fh *fh,
+                        struct nfs_fattr *fattr, struct nfs4_label *label);
 extern int nfs_may_open(struct inode *inode, struct rpc_cred *cred, int openflags);
 extern void nfs_access_zap_cache(struct inode *inode);
 
@@ -497,6 +502,24 @@ extern int nfs_mountpoint_expiry_timeout;
 extern void nfs_release_automount_timer(void);
 
 /*
+ * linux/fs/nfs/nfs4proc.c
+ */
+#ifdef CONFIG_NFS_V4_SECURITY_LABEL
+extern struct nfs4_label *nfs4_label_alloc(struct nfs_server *server, gfp_t flags);
+static inline void nfs4_label_free(struct nfs4_label *label)
+{
+        if (label) {
+                kfree(label->label);
+                kfree(label);
+        }
+        return;
+}
+#else
+static inline struct nfs4_label *nfs4_label_alloc(struct nfs_server *server, gfp_t flags) { return NULL; }
+static inline void nfs4_label_free(void *label) {}
+#endif
+
+/*
  * linux/fs/nfs/unlink.c
  */
 extern void nfs_complete_unlink(struct dentry *dentry, struct inode *);
diff --git a/include/linux/nfs_fs_sb.h b/include/linux/nfs_fs_sb.h
index 3b7fa2abecca..d2212432c456 100644
--- a/include/linux/nfs_fs_sb.h
+++ b/include/linux/nfs_fs_sb.h
@@ -146,7 +146,12 @@ struct nfs_server {
         u32                     attr_bitmask[3];/* V4 bitmask representing the set
                                                    of attributes supported on this
                                                    filesystem */
-        u32                     cache_consistency_bitmask[2];
+        u32                     attr_bitmask_nl[3];
+                                                /* V4 bitmask representing the
+                                                   set of attributes supported
+                                                   on this filesystem excluding
+                                                   the label support bit. */
+        u32                     cache_consistency_bitmask[3];
                                                 /* V4 bitmask representing the subset
                                                    of change attribute, size, ctime
                                                    and mtime attributes supported by
@@ -200,5 +205,6 @@ struct nfs_server {
 #define NFS_CAP_UIDGID_NOMAP    (1U << 15)
 #define NFS_CAP_STATEID_NFSV41  (1U << 16)
 #define NFS_CAP_ATOMIC_OPEN_V1  (1U << 17)
+#define NFS_CAP_SECURITY_LABEL  (1U << 18)
 
 #endif
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index 104b62f23ee0..8651574a305b 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -101,6 +101,7 @@ struct nfs_fattr {
 #define NFS_ATTR_FATTR_MOUNTED_ON_FILEID (1U << 22)
 #define NFS_ATTR_FATTR_OWNER_NAME       (1U << 23)
 #define NFS_ATTR_FATTR_GROUP_NAME       (1U << 24)
+#define NFS_ATTR_FATTR_V4_SECURITY_LABEL (1U << 25)
 
 #define NFS_ATTR_FATTR (NFS_ATTR_FATTR_TYPE \
                 | NFS_ATTR_FATTR_MODE \
@@ -120,7 +121,8 @@ struct nfs_fattr {
 #define NFS_ATTR_FATTR_V3 (NFS_ATTR_FATTR \
                 | NFS_ATTR_FATTR_SPACE_USED)
 #define NFS_ATTR_FATTR_V4 (NFS_ATTR_FATTR \
-                | NFS_ATTR_FATTR_SPACE_USED)
+                | NFS_ATTR_FATTR_SPACE_USED \
+                | NFS_ATTR_FATTR_V4_SECURITY_LABEL)
 
 /*
  * Info on the file system
@@ -246,6 +248,7 @@ struct nfs4_layoutget_res {
 struct nfs4_layoutget {
         struct nfs4_layoutget_args args;
         struct nfs4_layoutget_res res;
+        struct rpc_cred *cred;
         gfp_t gfp_flags;
 };
 
@@ -347,6 +350,7 @@ struct nfs_openargs {
         const u32 *             open_bitmap;
         __u32                   claim;
         enum createmode4        createmode;
+        const struct nfs4_label *label;
 };
 
 struct nfs_openres {
@@ -356,6 +360,7 @@ struct nfs_openres {
         struct nfs4_change_info cinfo;
         __u32                   rflags;
         struct nfs_fattr *      f_attr;
+        struct nfs4_label       *f_label;
         struct nfs_seqid *      seqid;
         const struct nfs_server *server;
         fmode_t                 delegation_type;
@@ -598,6 +603,7 @@ struct nfs_entry {
         int                     eof;
         struct nfs_fh *         fh;
         struct nfs_fattr *      fattr;
+        struct nfs4_label  *label;
         unsigned char           d_type;
         struct nfs_server *     server;
 };
@@ -630,6 +636,7 @@ struct nfs_setattrargs {
         struct iattr *                  iap;
         const struct nfs_server *       server; /* Needed for name mapping */
         const u32 *                     bitmask;
+        const struct nfs4_label         *label;
 };
 
 struct nfs_setaclargs {
@@ -665,6 +672,7 @@ struct nfs_getaclres {
 struct nfs_setattrres {
         struct nfs4_sequence_res        seq_res;
         struct nfs_fattr *              fattr;
+        struct nfs4_label               *label;
         const struct nfs_server *       server;
 };
 
@@ -862,6 +870,7 @@ struct nfs4_create_arg {
         const struct iattr *            attrs;
         const struct nfs_fh *           dir_fh;
         const u32 *                     bitmask;
+        const struct nfs4_label         *label;
 };
 
 struct nfs4_create_res {
@@ -869,6 +878,7 @@ struct nfs4_create_res {
         const struct nfs_server *       server;
         struct nfs_fh *                 fh;
         struct nfs_fattr *              fattr;
+        struct nfs4_label               *label;
         struct nfs4_change_info         dir_cinfo;
 };
 
@@ -893,6 +903,7 @@ struct nfs4_getattr_res {
         struct nfs4_sequence_res        seq_res;
         const struct nfs_server *       server;
         struct nfs_fattr *              fattr;
+        struct nfs4_label               *label;
 };
 
 struct nfs4_link_arg {
@@ -907,6 +918,7 @@ struct nfs4_link_res {
         struct nfs4_sequence_res        seq_res;
         const struct nfs_server *       server;
         struct nfs_fattr *              fattr;
+        struct nfs4_label               *label;
         struct nfs4_change_info         cinfo;
         struct nfs_fattr *              dir_attr;
 };
@@ -924,6 +936,7 @@ struct nfs4_lookup_res {
         const struct nfs_server *       server;
         struct nfs_fattr *              fattr;
         struct nfs_fh *                 fh;
+        struct nfs4_label               *label;
 };
 
 struct nfs4_lookup_root_arg {
@@ -1366,11 +1379,12 @@ struct nfs_rpc_ops {
         struct dentry *(*try_mount) (int, const char *, struct nfs_mount_info *,
                                      struct nfs_subversion *);
         int     (*getattr) (struct nfs_server *, struct nfs_fh *,
-                            struct nfs_fattr *);
+                            struct nfs_fattr *, struct nfs4_label *);
         int     (*setattr) (struct dentry *, struct nfs_fattr *,
                             struct iattr *);
         int     (*lookup)  (struct inode *, struct qstr *,
-                            struct nfs_fh *, struct nfs_fattr *);
+                            struct nfs_fh *, struct nfs_fattr *,
+                            struct nfs4_label *);
         int     (*access)  (struct inode *, struct nfs_access_entry *);
         int     (*readlink)(struct inode *, struct page *, unsigned int,
                             unsigned int);
diff --git a/include/linux/security.h b/include/linux/security.h
index 40560f41e3d5..7ce53ae1266b 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -26,6 +26,7 @@
 #include <linux/capability.h>
 #include <linux/slab.h>
 #include <linux/err.h>
+#include <linux/string.h>
 
 struct linux_binprm;
 struct cred;
@@ -60,6 +61,9 @@ struct mm_struct;
 #define SECURITY_CAP_NOAUDIT 0
 #define SECURITY_CAP_AUDIT 1
 
+/* LSM Agnostic defines for sb_set_mnt_opts */
+#define SECURITY_LSM_NATIVE_LABELS      1
+
 struct ctl_table;
 struct audit_krule;
 struct user_namespace;
@@ -306,6 +310,15 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *      Parse a string of security data filling in the opts structure
  *      @options string containing all mount options known by the LSM
  *      @opts binary data structure usable by the LSM
+ * @dentry_init_security:
+ *      Compute a context for a dentry as the inode is not yet available
+ *      since NFSv4 has no label backed by an EA anyway.
+ *      @dentry dentry to use in calculating the context.
+ *      @mode mode used to determine resource type.
+ *      @name name of the last path component used to create file
+ *      @ctx pointer to place the pointer to the resulting context in.
+ *      @ctxlen point to place the length of the resulting context.
+ *
  *
  * Security hooks for inode operations.
  *
@@ -1313,6 +1326,13 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *      @pages contains the number of pages.
  *      Return 0 if permission is granted.
  *
+ * @ismaclabel:
+ *      Check if the extended attribute specified by @name
+ *      represents a MAC label. Returns 1 if name is a MAC
+ *      attribute otherwise returns 0.
+ *      @name full extended attribute name to check against
+ *      LSM as a MAC label.
+ *
  * @secid_to_secctx:
  *      Convert secid to security context.  If secdata is NULL the length of
  *      the result will be returned in seclen, but no secdata will be returned.
@@ -1440,10 +1460,16 @@ struct security_operations {
         int (*sb_pivotroot) (struct path *old_path,
                              struct path *new_path);
         int (*sb_set_mnt_opts) (struct super_block *sb,
-                                struct security_mnt_opts *opts);
+                                struct security_mnt_opts *opts,
+                                unsigned long kern_flags,
+                                unsigned long *set_kern_flags);
         int (*sb_clone_mnt_opts) (const struct super_block *oldsb,
                                    struct super_block *newsb);
         int (*sb_parse_opts_str) (char *options, struct security_mnt_opts *opts);
+        int (*dentry_init_security) (struct dentry *dentry, int mode,
+                                        struct qstr *name, void **ctx,
+                                        u32 *ctxlen);
+
 
 #ifdef CONFIG_SECURITY_PATH
         int (*path_unlink) (struct path *dir, struct dentry *dentry);
@@ -1591,6 +1617,7 @@ struct security_operations {
 
         int (*getprocattr) (struct task_struct *p, char *name, char **value);
         int (*setprocattr) (struct task_struct *p, char *name, void *value, size_t size);
+        int (*ismaclabel) (const char *name);
         int (*secid_to_secctx) (u32 secid, char **secdata, u32 *seclen);
         int (*secctx_to_secid) (const char *secdata, u32 seclen, u32 *secid);
         void (*release_secctx) (char *secdata, u32 seclen);
@@ -1726,10 +1753,16 @@ int security_sb_mount(const char *dev_name, struct path *path,
                       const char *type, unsigned long flags, void *data);
 int security_sb_umount(struct vfsmount *mnt, int flags);
 int security_sb_pivotroot(struct path *old_path, struct path *new_path);
-int security_sb_set_mnt_opts(struct super_block *sb, struct security_mnt_opts *opts);
+int security_sb_set_mnt_opts(struct super_block *sb,
+                                struct security_mnt_opts *opts,
+                                unsigned long kern_flags,
+                                unsigned long *set_kern_flags);
 int security_sb_clone_mnt_opts(const struct super_block *oldsb,
                                 struct super_block *newsb);
 int security_sb_parse_opts_str(char *options, struct security_mnt_opts *opts);
+int security_dentry_init_security(struct dentry *dentry, int mode,
+                                        struct qstr *name, void **ctx,
+                                        u32 *ctxlen);
 
 int security_inode_alloc(struct inode *inode);
 void security_inode_free(struct inode *inode);
@@ -1841,6 +1874,7 @@ void security_d_instantiate(struct dentry *dentry, struct inode *inode);
 int security_getprocattr(struct task_struct *p, char *name, char **value);
 int security_setprocattr(struct task_struct *p, char *name, void *value, size_t size);
 int security_netlink_send(struct sock *sk, struct sk_buff *skb);
+int security_ismaclabel(const char *name);
 int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);
 int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);
 void security_release_secctx(char *secdata, u32 seclen);
@@ -2012,7 +2046,9 @@ static inline int security_sb_pivotroot(struct path *old_path,
 }
 
 static inline int security_sb_set_mnt_opts(struct super_block *sb,
-                                           struct security_mnt_opts *opts)
+                                           struct security_mnt_opts *opts,
+                                           unsigned long kern_flags,
+                                           unsigned long *set_kern_flags)
 {
         return 0;
 }
@@ -2036,6 +2072,16 @@ static inline int security_inode_alloc(struct inode *inode)
 static inline void security_inode_free(struct inode *inode)
 { }
 
+static inline int security_dentry_init_security(struct dentry *dentry,
+                                                 int mode,
+                                                 struct qstr *name,
+                                                 void **ctx,
+                                                 u32 *ctxlen)
+{
+        return -EOPNOTSUPP;
+}
+
+
 static inline int security_inode_init_security(struct inode *inode,
                                                 struct inode *dir,
                                                 const struct qstr *qstr,
@@ -2521,6 +2567,11 @@ static inline int security_netlink_send(struct sock *sk, struct sk_buff *skb)
         return cap_netlink_send(sk, skb);
 }
 
+static inline int security_ismaclabel(const char *name)
+{
+        return 0;
+}
+
 static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
 {
         return -EOPNOTSUPP;
diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
index 84ca436b76c2..6d870353674a 100644
--- a/include/linux/sunrpc/sched.h
+++ b/include/linux/sunrpc/sched.h
@@ -88,15 +88,6 @@ struct rpc_task {
                                 tk_rebind_retry : 2;
 };
 
-/* support walking a list of tasks on a wait queue */
-#define task_for_each(task, pos, head) \
-        list_for_each(pos, head) \
-                if ((task=list_entry(pos, struct rpc_task, u.tk_wait.list)),1)
-
-#define task_for_first(task, head) \
-        if (!list_empty(head) &&  \
-            ((task=list_entry((head)->next, struct rpc_task, u.tk_wait.list)),1))
-
 typedef void                    (*rpc_action)(struct rpc_task *);
 
 struct rpc_call_ops {
@@ -238,7 +229,6 @@ struct rpc_task *rpc_wake_up_first(struct rpc_wait_queue *,
                                         bool (*)(struct rpc_task *, void *),
                                         void *);
 void            rpc_wake_up_status(struct rpc_wait_queue *, int);
-int             rpc_queue_empty(struct rpc_wait_queue *);
 void            rpc_delay(struct rpc_task *, unsigned long);
 void *          rpc_malloc(struct rpc_task *, size_t);
 void            rpc_free(void *);
@@ -259,16 +249,6 @@ static inline int rpc_wait_for_completion_task(struct rpc_task *task)
         return __rpc_wait_for_completion_task(task, NULL);
 }
 
-static inline void rpc_task_set_priority(struct rpc_task *task, unsigned char prio)
-{
-        task->tk_priority = prio - RPC_PRIORITY_LOW;
-}
-
-static inline int rpc_task_has_priority(struct rpc_task *task, unsigned char prio)
-{
-        return (task->tk_priority + RPC_PRIORITY_LOW == prio);
-}
-
 #if defined(RPC_DEBUG) || defined (RPC_TRACEPOINTS)
 static inline const char * rpc_qname(const struct rpc_wait_queue *q)
 {