1 files changed, 26 insertions, 5 deletions

diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index fd0acca5370a..7a2e442623c8 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -168,6 +168,8 @@ int nfsd_mountpoint(struct dentry *dentry, struct svc_export *exp)
 {
         if (d_mountpoint(dentry))
                 return 1;
+        if (nfsd4_is_junction(dentry))
+                return 1;
         if (!(exp->ex_flags & NFSEXP_V4ROOT))
                 return 0;
         return dentry->d_inode != NULL;
@@ -502,7 +504,7 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp,
         unsigned int flags = 0;
 
         /* Get inode */
-        error = fh_verify(rqstp, fhp, 0 /* S_IFREG */, NFSD_MAY_SATTR);
+        error = fh_verify(rqstp, fhp, 0, NFSD_MAY_SATTR);
         if (error)
                 return error;
 
@@ -592,6 +594,22 @@ nfsd4_get_nfs4_acl(struct svc_rqst *rqstp, struct dentry *dentry, struct nfs4_ac
         return error;
 }
 
+#define NFSD_XATTR_JUNCTION_PREFIX XATTR_TRUSTED_PREFIX "junction."
+#define NFSD_XATTR_JUNCTION_TYPE NFSD_XATTR_JUNCTION_PREFIX "type"
+int nfsd4_is_junction(struct dentry *dentry)
+{
+        struct inode *inode = dentry->d_inode;
+
+        if (inode == NULL)
+                return 0;
+        if (inode->i_mode & S_IXUGO)
+                return 0;
+        if (!(inode->i_mode & S_ISVTX))
+                return 0;
+        if (vfs_getxattr(dentry, NFSD_XATTR_JUNCTION_TYPE, NULL, 0) <= 0)
+                return 0;
+        return 1;
+}
 #endif /* defined(CONFIG_NFSD_V4) */
 
 #ifdef CONFIG_NFSD_V3
@@ -1352,7 +1370,7 @@ __be32
 do_nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
                 char *fname, int flen, struct iattr *iap,
                 struct svc_fh *resfhp, int createmode, u32 *verifier,
-                int *truncp, int *created)
+                bool *truncp, bool *created)
 {
         struct dentry   *dentry, *dchild = NULL;
         struct inode    *dirp;
@@ -1632,10 +1650,12 @@ nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp,
         err = fh_verify(rqstp, ffhp, S_IFDIR, NFSD_MAY_CREATE);
         if (err)
                 goto out;
-        err = fh_verify(rqstp, tfhp, -S_IFDIR, NFSD_MAY_NOP);
+        err = fh_verify(rqstp, tfhp, 0, NFSD_MAY_NOP);
         if (err)
                 goto out;
-
+        err = nfserr_isdir;
+        if (S_ISDIR(tfhp->fh_dentry->d_inode->i_mode))
+                goto out;
         err = nfserr_perm;
         if (!len)
                 goto out;
@@ -2114,7 +2134,8 @@ nfsd_permission(struct svc_rqst *rqstp, struct svc_export *exp,
 
         /* Allow read access to binaries even when mode 111 */
         if (err == -EACCES && S_ISREG(inode->i_mode) &&
-            acc == (NFSD_MAY_READ | NFSD_MAY_OWNER_OVERRIDE))
+             (acc == (NFSD_MAY_READ | NFSD_MAY_OWNER_OVERRIDE) ||
+              acc == (NFSD_MAY_READ | NFSD_MAY_READ_IF_EXEC)))
                 err = inode_permission(inode, MAY_EXEC);
 
         return err? nfserrno(err) : 0;