1 files changed, 119 insertions, 24 deletions

diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 59ec449b0c7f..3a6dbd70b34b 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -196,9 +196,9 @@ do_open_lookup(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_o
 
                 /*
                  * Note: create modes (UNCHECKED,GUARDED...) are the same
-                 * in NFSv4 as in v3.
+                 * in NFSv4 as in v3 except EXCLUSIVE4_1.
                  */
-                status = nfsd_create_v3(rqstp, current_fh, open->op_fname.data,
+                status = do_nfsd_create(rqstp, current_fh, open->op_fname.data,
                                         open->op_fname.len, &open->op_iattr,
                                         &resfh, open->op_createmode,
                                         (u32 *)open->op_verf.data,
@@ -403,7 +403,7 @@ nfsd4_putfh(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
         cstate->current_fh.fh_handle.fh_size = putfh->pf_fhlen;
         memcpy(&cstate->current_fh.fh_handle.fh_base, putfh->pf_fhval,
                putfh->pf_fhlen);
-        return fh_verify(rqstp, &cstate->current_fh, 0, NFSD_MAY_NOP);
+        return fh_verify(rqstp, &cstate->current_fh, 0, NFSD_MAY_BYPASS_GSS);
 }
 
 static __be32
@@ -604,9 +604,7 @@ nfsd4_link(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
         return status;
 }
 
-static __be32
-nfsd4_lookupp(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
-              void *arg)
+static __be32 nfsd4_do_lookupp(struct svc_rqst *rqstp, struct svc_fh *fh)
 {
         struct svc_fh tmp_fh;
         __be32 ret;
@@ -615,13 +613,19 @@ nfsd4_lookupp(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
         ret = exp_pseudoroot(rqstp, &tmp_fh);
         if (ret)
                 return ret;
-        if (tmp_fh.fh_dentry == cstate->current_fh.fh_dentry) {
+        if (tmp_fh.fh_dentry == fh->fh_dentry) {
                 fh_put(&tmp_fh);
                 return nfserr_noent;
         }
         fh_put(&tmp_fh);
-        return nfsd_lookup(rqstp, &cstate->current_fh,
-                           "..", 2, &cstate->current_fh);
+        return nfsd_lookup(rqstp, fh, "..", 2, fh);
+}
+
+static __be32
+nfsd4_lookupp(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+              void *arg)
+{
+        return nfsd4_do_lookupp(rqstp, &cstate->current_fh);
 }
 
 static __be32
@@ -758,6 +762,9 @@ nfsd4_secinfo(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
         __be32 err;
 
         fh_init(&resfh, NFS4_FHSIZE);
+        err = fh_verify(rqstp, &cstate->current_fh, S_IFDIR, NFSD_MAY_EXEC);
+        if (err)
+                return err;
         err = nfsd_lookup_dentry(rqstp, &cstate->current_fh,
                                     secinfo->si_name, secinfo->si_namelen,
                                     &exp, &dentry);
@@ -769,10 +776,36 @@ nfsd4_secinfo(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
         } else
                 secinfo->si_exp = exp;
         dput(dentry);
+        if (cstate->minorversion)
+                /* See rfc 5661 section 2.6.3.1.1.8 */
+                fh_put(&cstate->current_fh);
         return err;
 }
 
 static __be32
+nfsd4_secinfo_no_name(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+              struct nfsd4_secinfo_no_name *sin)
+{
+        __be32 err;
+
+        switch (sin->sin_style) {
+        case NFS4_SECINFO_STYLE4_CURRENT_FH:
+                break;
+        case NFS4_SECINFO_STYLE4_PARENT:
+                err = nfsd4_do_lookupp(rqstp, &cstate->current_fh);
+                if (err)
+                        return err;
+                break;
+        default:
+                return nfserr_inval;
+        }
+        exp_get(cstate->current_fh.fh_export);
+        sin->sin_exp = cstate->current_fh.fh_export;
+        fh_put(&cstate->current_fh);
+        return nfs_ok;
+}
+
+static __be32
 nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
               struct nfsd4_setattr *setattr)
 {
@@ -954,8 +987,11 @@ typedef __be32(*nfsd4op_func)(struct svc_rqst *, struct nfsd4_compound_state *,
                               void *);
 enum nfsd4_op_flags {
         ALLOWED_WITHOUT_FH = 1 << 0,    /* No current filehandle required */
-        ALLOWED_ON_ABSENT_FS = 2 << 0,  /* ops processed on absent fs */
-        ALLOWED_AS_FIRST_OP = 3 << 0,   /* ops reqired first in compound */
+        ALLOWED_ON_ABSENT_FS = 1 << 1,  /* ops processed on absent fs */
+        ALLOWED_AS_FIRST_OP = 1 << 2,   /* ops reqired first in compound */
+        /* For rfc 5661 section 2.6.3.1.1: */
+        OP_HANDLES_WRONGSEC = 1 << 3,
+        OP_IS_PUTFH_LIKE = 1 << 4,
 };
 
 struct nfsd4_operation {
@@ -974,8 +1010,8 @@ static const char *nfsd4_op_name(unsigned opnum);
  * Also note, enforced elsewhere:
  *      - SEQUENCE other than as first op results in
  *        NFS4ERR_SEQUENCE_POS. (Enforced in nfsd4_sequence().)
- *      - BIND_CONN_TO_SESSION must be the only op in its compound
- *        (Will be enforced in nfsd4_bind_conn_to_session().)
+ *      - BIND_CONN_TO_SESSION must be the only op in its compound.
+ *        (Enforced in nfsd4_bind_conn_to_session().)
  *      - DESTROY_SESSION must be the final operation in a compound, if
  *        sessionid's in SEQUENCE and DESTROY_SESSION are the same.
  *        (Enforced in nfsd4_destroy_session().)
@@ -1001,6 +1037,44 @@ static __be32 nfs41_check_op_ordering(struct nfsd4_compoundargs *args)
         return nfs_ok;
 }
 
+static inline struct nfsd4_operation *OPDESC(struct nfsd4_op *op)
+{
+        return &nfsd4_ops[op->opnum];
+}
+
+static bool need_wrongsec_check(struct svc_rqst *rqstp)
+{
+        struct nfsd4_compoundres *resp = rqstp->rq_resp;
+        struct nfsd4_compoundargs *argp = rqstp->rq_argp;
+        struct nfsd4_op *this = &argp->ops[resp->opcnt - 1];
+        struct nfsd4_op *next = &argp->ops[resp->opcnt];
+        struct nfsd4_operation *thisd;
+        struct nfsd4_operation *nextd;
+
+        thisd = OPDESC(this);
+        /*
+         * Most ops check wronsec on our own; only the putfh-like ops
+         * have special rules.
+         */
+        if (!(thisd->op_flags & OP_IS_PUTFH_LIKE))
+                return false;
+        /*
+         * rfc 5661 2.6.3.1.1.6: don't bother erroring out a
+         * put-filehandle operation if we're not going to use the
+         * result:
+         */
+        if (argp->opcnt == resp->opcnt)
+                return false;
+
+        nextd = OPDESC(next);
+        /*
+         * Rest of 2.6.3.1.1: certain operations will return WRONGSEC
+         * errors themselves as necessary; others should check for them
+         * now:
+         */
+        return !(nextd->op_flags & OP_HANDLES_WRONGSEC);
+}
+
 /*
  * COMPOUND call.
  */
@@ -1031,8 +1105,11 @@ nfsd4_proc_compound(struct svc_rqst *rqstp,
         resp->cstate.session = NULL;
         fh_init(&resp->cstate.current_fh, NFS4_FHSIZE);
         fh_init(&resp->cstate.save_fh, NFS4_FHSIZE);
-        /* Use the deferral mechanism only for NFSv4.0 compounds */
-        rqstp->rq_usedeferral = (args->minorversion == 0);
+        /*
+         * Don't use the deferral mechanism for NFSv4; compounds make it
+         * too hard to avoid non-idempotency problems.
+         */
+        rqstp->rq_usedeferral = 0;
 
         /*
          * According to RFC3010, this takes precedence over all other errors.
@@ -1075,7 +1152,7 @@ nfsd4_proc_compound(struct svc_rqst *rqstp,
                         goto encode_op;
                 }
 
-                opdesc = &nfsd4_ops[op->opnum];
+                opdesc = OPDESC(op);
 
                 if (!cstate->current_fh.fh_dentry) {
                         if (!(opdesc->op_flags & ALLOWED_WITHOUT_FH)) {
@@ -1093,6 +1170,9 @@ nfsd4_proc_compound(struct svc_rqst *rqstp,
                 else
                         BUG_ON(op->status == nfs_ok);
 
+                if (!op->status && need_wrongsec_check(rqstp))
+                        op->status = check_nfsd_access(cstate->current_fh.fh_export, rqstp);
+
 encode_op:
                 /* Only from SEQUENCE */
                 if (resp->cstate.status == nfserr_replay_cache) {
@@ -1123,10 +1203,6 @@ encode_op:
 
                 nfsd4_increment_op_stats(op->opnum);
         }
-        if (!rqstp->rq_usedeferral && status == nfserr_dropit) {
-                dprintk("%s Dropit - send NFS4ERR_DELAY\n", __func__);
-                status = nfserr_jukebox;
-        }
 
         resp->cstate.status = status;
         fh_put(&resp->cstate.current_fh);
@@ -1188,10 +1264,12 @@ static struct nfsd4_operation nfsd4_ops[] = {
         },
         [OP_LOOKUP] = {
                 .op_func = (nfsd4op_func)nfsd4_lookup,
+                .op_flags = OP_HANDLES_WRONGSEC,
                 .op_name = "OP_LOOKUP",
         },
         [OP_LOOKUPP] = {
                 .op_func = (nfsd4op_func)nfsd4_lookupp,
+                .op_flags = OP_HANDLES_WRONGSEC,
                 .op_name = "OP_LOOKUPP",
         },
         [OP_NVERIFY] = {
@@ -1200,6 +1278,7 @@ static struct nfsd4_operation nfsd4_ops[] = {
         },
         [OP_OPEN] = {
                 .op_func = (nfsd4op_func)nfsd4_open,
+                .op_flags = OP_HANDLES_WRONGSEC,
                 .op_name = "OP_OPEN",
         },
         [OP_OPEN_CONFIRM] = {
@@ -1212,17 +1291,20 @@ static struct nfsd4_operation nfsd4_ops[] = {
         },
         [OP_PUTFH] = {
                 .op_func = (nfsd4op_func)nfsd4_putfh,
-                .op_flags = ALLOWED_WITHOUT_FH | ALLOWED_ON_ABSENT_FS,
+                .op_flags = ALLOWED_WITHOUT_FH | ALLOWED_ON_ABSENT_FS
+                                | OP_IS_PUTFH_LIKE,
                 .op_name = "OP_PUTFH",
         },
         [OP_PUTPUBFH] = {
                 .op_func = (nfsd4op_func)nfsd4_putrootfh,
-                .op_flags = ALLOWED_WITHOUT_FH | ALLOWED_ON_ABSENT_FS,
+                .op_flags = ALLOWED_WITHOUT_FH | ALLOWED_ON_ABSENT_FS
+                                | OP_IS_PUTFH_LIKE,
                 .op_name = "OP_PUTPUBFH",
         },
         [OP_PUTROOTFH] = {
                 .op_func = (nfsd4op_func)nfsd4_putrootfh,
-                .op_flags = ALLOWED_WITHOUT_FH | ALLOWED_ON_ABSENT_FS,
+                .op_flags = ALLOWED_WITHOUT_FH | ALLOWED_ON_ABSENT_FS
+                                | OP_IS_PUTFH_LIKE,
                 .op_name = "OP_PUTROOTFH",
         },
         [OP_READ] = {
@@ -1252,15 +1334,18 @@ static struct nfsd4_operation nfsd4_ops[] = {
         },
         [OP_RESTOREFH] = {
                 .op_func = (nfsd4op_func)nfsd4_restorefh,
-                .op_flags = ALLOWED_WITHOUT_FH | ALLOWED_ON_ABSENT_FS,
+                .op_flags = ALLOWED_WITHOUT_FH | ALLOWED_ON_ABSENT_FS
+                                | OP_IS_PUTFH_LIKE,
                 .op_name = "OP_RESTOREFH",
         },
         [OP_SAVEFH] = {
                 .op_func = (nfsd4op_func)nfsd4_savefh,
+                .op_flags = OP_HANDLES_WRONGSEC,
                 .op_name = "OP_SAVEFH",
         },
         [OP_SECINFO] = {
                 .op_func = (nfsd4op_func)nfsd4_secinfo,
+                .op_flags = OP_HANDLES_WRONGSEC,
                 .op_name = "OP_SECINFO",
         },
         [OP_SETATTR] = {
@@ -1297,6 +1382,11 @@ static struct nfsd4_operation nfsd4_ops[] = {
                 .op_flags = ALLOWED_WITHOUT_FH | ALLOWED_AS_FIRST_OP,
                 .op_name = "OP_EXCHANGE_ID",
         },
+        [OP_BIND_CONN_TO_SESSION] = {
+                .op_func = (nfsd4op_func)nfsd4_bind_conn_to_session,
+                .op_flags = ALLOWED_WITHOUT_FH | ALLOWED_AS_FIRST_OP,
+                .op_name = "OP_BIND_CONN_TO_SESSION",
+        },
         [OP_CREATE_SESSION] = {
                 .op_func = (nfsd4op_func)nfsd4_create_session,
                 .op_flags = ALLOWED_WITHOUT_FH | ALLOWED_AS_FIRST_OP,
@@ -1317,6 +1407,11 @@ static struct nfsd4_operation nfsd4_ops[] = {
                 .op_flags = ALLOWED_WITHOUT_FH,
                 .op_name = "OP_RECLAIM_COMPLETE",
         },
+        [OP_SECINFO_NO_NAME] = {
+                .op_func = (nfsd4op_func)nfsd4_secinfo_no_name,
+                .op_flags = OP_HANDLES_WRONGSEC,
+                .op_name = "OP_SECINFO_NO_NAME",
+        },
 };
 
 static const char *nfsd4_op_name(unsigned opnum)