2 files changed, 16 insertions, 5 deletions

diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 3fdcca53212a..db208dd8fdca 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -910,6 +910,7 @@ nfsd4_proc_compound(struct svc_rqst *rqstp,
         resp->tag = args->tag;
         resp->opcnt = 0;
         resp->rqstp = rqstp;
+        resp->cstate.minorversion = args->minorversion;
         resp->cstate.replay_owner = NULL;
         fh_init(&resp->cstate.current_fh, NFS4_FHSIZE);
         fh_init(&resp->cstate.save_fh, NFS4_FHSIZE);
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index d227f85b5ed2..374aaf3808e8 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1943,11 +1943,21 @@ find_file(struct inode *ino)
         return NULL;
 }
 
-static inline int access_valid(u32 x)
+static inline int access_valid(u32 x, u32 minorversion)
 {
-        if (x < NFS4_SHARE_ACCESS_READ)
+        if ((x & NFS4_SHARE_ACCESS_MASK) < NFS4_SHARE_ACCESS_READ)
                 return 0;
-        if (x > NFS4_SHARE_ACCESS_BOTH)
+        if ((x & NFS4_SHARE_ACCESS_MASK) > NFS4_SHARE_ACCESS_BOTH)
+                return 0;
+        x &= ~NFS4_SHARE_ACCESS_MASK;
+        if (minorversion && x) {
+                if ((x & NFS4_SHARE_WANT_MASK) > NFS4_SHARE_WANT_CANCEL)
+                        return 0;
+                if ((x & NFS4_SHARE_WHEN_MASK) > NFS4_SHARE_PUSH_DELEG_WHEN_UNCONTENDED)
+                        return 0;
+                x &= ~(NFS4_SHARE_WANT_MASK | NFS4_SHARE_WHEN_MASK);
+        }
+        if (x)
                 return 0;
         return 1;
 }
@@ -2495,7 +2505,7 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf
         __be32 status;
 
         status = nfserr_inval;
-        if (!access_valid(open->op_share_access)
+        if (!access_valid(open->op_share_access, resp->cstate.minorversion)
                         || !deny_valid(open->op_share_deny))
                 goto out;
         /*
@@ -3104,7 +3114,7 @@ nfsd4_open_downgrade(struct svc_rqst *rqstp,
                         (int)cstate->current_fh.fh_dentry->d_name.len,
                         cstate->current_fh.fh_dentry->d_name.name);
 
-        if (!access_valid(od->od_share_access)
+        if (!access_valid(od->od_share_access, cstate->minorversion)
                         || !deny_valid(od->od_share_deny))
                 return nfserr_inval;