Merge tag 'nfsd-4.7-2' of git://linux-nfs.org/~bfields/linux

Pull nfsd bugfixes from Bruce Fields:
 "Fix missing server-side permission checks on setting NFS ACLs"

* tag 'nfsd-4.7-2' of git://linux-nfs.org/~bfields/linux:
  nfsd: check permissions when setting ACLs
  posix_acl: Add set_posix_acl

4 files changed, 48 insertions, 46 deletions

diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c
index 1580ea6fd64d..d08cd88155c7 100644
--- a/fs/nfsd/nfs2acl.c
+++ b/fs/nfsd/nfs2acl.c
@@ -104,22 +104,21 @@ static __be32 nfsacld_proc_setacl(struct svc_rqst * rqstp,
                 goto out;
 
         inode = d_inode(fh->fh_dentry);
-        if (!IS_POSIXACL(inode) || !inode->i_op->set_acl) {
-                error = -EOPNOTSUPP;
-                goto out_errno;
-        }
 
         error = fh_want_write(fh);
         if (error)
                 goto out_errno;
 
-        error = inode->i_op->set_acl(inode, argp->acl_access, ACL_TYPE_ACCESS);
+        fh_lock(fh);
+
+        error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access);
         if (error)
-                goto out_drop_write;
-        error = inode->i_op->set_acl(inode, argp->acl_default,
-                                     ACL_TYPE_DEFAULT);
+                goto out_drop_lock;
+        error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default);
         if (error)
-                goto out_drop_write;
+                goto out_drop_lock;
+
+        fh_unlock(fh);
 
         fh_drop_write(fh);
 
@@ -131,7 +130,8 @@ out:
         posix_acl_release(argp->acl_access);
         posix_acl_release(argp->acl_default);
         return nfserr;
-out_drop_write:
+out_drop_lock:
+        fh_unlock(fh);
         fh_drop_write(fh);
 out_errno:
         nfserr = nfserrno(error);
diff --git a/fs/nfsd/nfs3acl.c b/fs/nfsd/nfs3acl.c
index 01df4cd7c753..0c890347cde3 100644
--- a/fs/nfsd/nfs3acl.c
+++ b/fs/nfsd/nfs3acl.c
@@ -95,22 +95,20 @@ static __be32 nfsd3_proc_setacl(struct svc_rqst * rqstp,
                 goto out;
 
         inode = d_inode(fh->fh_dentry);
-        if (!IS_POSIXACL(inode) || !inode->i_op->set_acl) {
-                error = -EOPNOTSUPP;
-                goto out_errno;
-        }
 
         error = fh_want_write(fh);
         if (error)
                 goto out_errno;
 
-        error = inode->i_op->set_acl(inode, argp->acl_access, ACL_TYPE_ACCESS);
+        fh_lock(fh);
+
+        error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access);
         if (error)
-                goto out_drop_write;
-        error = inode->i_op->set_acl(inode, argp->acl_default,
-                                     ACL_TYPE_DEFAULT);
+                goto out_drop_lock;
+        error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default);
 
-out_drop_write:
+out_drop_lock:
+        fh_unlock(fh);
         fh_drop_write(fh);
 out_errno:
         nfserr = nfserrno(error);
diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
index 6adabd6049b7..71292a0d6f09 100644
--- a/fs/nfsd/nfs4acl.c
+++ b/fs/nfsd/nfs4acl.c
@@ -770,9 +770,6 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp,
         dentry = fhp->fh_dentry;
         inode = d_inode(dentry);
 
-        if (!inode->i_op->set_acl || !IS_POSIXACL(inode))
-                return nfserr_attrnotsupp;
-
         if (S_ISDIR(inode->i_mode))
                 flags = NFS4_ACL_DIR;
 
@@ -782,16 +779,19 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp,
         if (host_error < 0)
                 goto out_nfserr;
 
-        host_error = inode->i_op->set_acl(inode, pacl, ACL_TYPE_ACCESS);
+        fh_lock(fhp);
+
+        host_error = set_posix_acl(inode, ACL_TYPE_ACCESS, pacl);
         if (host_error < 0)
-                goto out_release;
+                goto out_drop_lock;
 
         if (S_ISDIR(inode->i_mode)) {
-                host_error = inode->i_op->set_acl(inode, dpacl,
-                                                  ACL_TYPE_DEFAULT);
+                host_error = set_posix_acl(inode, ACL_TYPE_DEFAULT, dpacl);
         }
 
-out_release:
+out_drop_lock:
+        fh_unlock(fhp);
+
         posix_acl_release(pacl);
         posix_acl_release(dpacl);
 out_nfserr:
diff --git a/fs/posix_acl.c b/fs/posix_acl.c
index 8a4a266beff3..edc452c2a563 100644
--- a/fs/posix_acl.c
+++ b/fs/posix_acl.c
@@ -820,39 +820,43 @@ posix_acl_xattr_get(const struct xattr_handler *handler,
         return error;
 }
 
-static int
-posix_acl_xattr_set(const struct xattr_handler *handler,
-                    struct dentry *unused, struct inode *inode,
-                    const char *name, const void *value,
-                    size_t size, int flags)
+int
+set_posix_acl(struct inode *inode, int type, struct posix_acl *acl)
 {
-        struct posix_acl *acl = NULL;
-        int ret;
-
         if (!IS_POSIXACL(inode))
                 return -EOPNOTSUPP;
         if (!inode->i_op->set_acl)
                 return -EOPNOTSUPP;
 
-        if (handler->flags == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode))
-                return value ? -EACCES : 0;
+        if (type == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode))
+                return acl ? -EACCES : 0;
         if (!inode_owner_or_capable(inode))
                 return -EPERM;
 
+        if (acl) {
+                int ret = posix_acl_valid(acl);
+                if (ret)
+                        return ret;
+        }
+        return inode->i_op->set_acl(inode, acl, type);
+}
+EXPORT_SYMBOL(set_posix_acl);
+
+static int
+posix_acl_xattr_set(const struct xattr_handler *handler,
+                    struct dentry *unused, struct inode *inode,
+                    const char *name, const void *value,
+                    size_t size, int flags)
+{
+        struct posix_acl *acl = NULL;
+        int ret;
+
         if (value) {
                 acl = posix_acl_from_xattr(&init_user_ns, value, size);
                 if (IS_ERR(acl))
                         return PTR_ERR(acl);
-
-                if (acl) {
-                        ret = posix_acl_valid(acl);
-                        if (ret)
-                                goto out;
-                }
         }
-
-        ret = inode->i_op->set_acl(inode, acl, handler->flags);
-out:
+        ret = set_posix_acl(inode, handler->flags, acl);
         posix_acl_release(acl);
         return ret;
 }