| Message ID | 20171110150356.31050-1-l.stach@pengutronix.de (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
Am Freitag, den 10.11.2017, 16:03 +0100 schrieb Lucas Stach: > Since bd8b2441742b (NFS: Store the raw NFS access mask in the inode's > access cache) the mask already contains the NFS access bits, so it is > wrong to try to map them from the MAY_* bits to the NFS_MAY_* bits > in _nfs4_proc_access(). This leads to bogus access permissions being > returned from the server. > > Fix this by using the mask directly, but be careful to not ask for > to broad permissions from the calling nfs_do_access(). > > CC: stable@vger.kernel.org #4.13+ > Signed-off-by: Lucas Stach <l.stach@pengutronix.de> > Tested-by: Björn Lässig <b.laessig@pengutronix.de> This patch is incomplete, as it misses the NFSv3 parts. Please ignore this patch. Regards, Lucas > --- > fs/nfs/dir.c | 8 ++++++-- > fs/nfs/nfs4proc.c | 19 +------------------ > 2 files changed, 7 insertions(+), 20 deletions(-) > > diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c > index 5ceaeb1f6fb6..dd3a06353bdc 100644 > --- a/fs/nfs/dir.c > +++ b/fs/nfs/dir.c > @@ -2426,8 +2426,12 @@ static int nfs_do_access(struct inode *inode, > struct rpc_cred *cred, int mask) > goto out; > > /* Be clever: ask server to check for all possible rights */ > - cache.mask = NFS_MAY_LOOKUP | NFS_MAY_EXECUTE > - | NFS_MAY_WRITE | NFS_MAY_READ; > + cache.mask = NFS_MAY_READ; > + if (S_ISDIR(inode->i_mode)) > + cache.mask |= NFS_DIR_MAY_WRITE | NFS_MAY_LOOKUP; > + else > + cache.mask |= NFS_FILE_MAY_WRITE | NFS_MAY_EXECUTE; > + > cache.cred = cred; > status = NFS_PROTO(inode)->access(inode, &cache); > if (status != 0) { > diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c > index 6c61e2b99635..cb7b5aafaef6 100644 > --- a/fs/nfs/nfs4proc.c > +++ b/fs/nfs/nfs4proc.c > @@ -3889,6 +3889,7 @@ static int _nfs4_proc_access(struct inode > *inode, struct nfs_access_entry *entry > struct nfs4_accessargs args = { > .fh = NFS_FH(inode), > .bitmask = server->cache_consistency_bitmask, > + .access = entry->mask, > }; > struct nfs4_accessres res = { > .server = server, > @@ -3899,26 +3900,8 @@ static int _nfs4_proc_access(struct inode > *inode, struct nfs_access_entry *entry > .rpc_resp = &res, > .rpc_cred = entry->cred, > }; > - int mode = entry->mask; > int status = 0; > > - /* > - * Determine which access bits we want to ask for... > - */ > - if (mode & MAY_READ) > - args.access |= NFS4_ACCESS_READ; > - if (S_ISDIR(inode->i_mode)) { > - if (mode & MAY_WRITE) > - args.access |= NFS4_ACCESS_MODIFY | > NFS4_ACCESS_EXTEND | NFS4_ACCESS_DELETE; > - if (mode & MAY_EXEC) > - args.access |= NFS4_ACCESS_LOOKUP; > - } else { > - if (mode & MAY_WRITE) > - args.access |= NFS4_ACCESS_MODIFY | > NFS4_ACCESS_EXTEND; > - if (mode & MAY_EXEC) > - args.access |= NFS4_ACCESS_EXECUTE; > - } > - > res.fattr = nfs_alloc_fattr(); > if (res.fattr == NULL) > return -ENOMEM; -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c index 5ceaeb1f6fb6..dd3a06353bdc 100644 --- a/fs/nfs/dir.c +++ b/fs/nfs/dir.c @@ -2426,8 +2426,12 @@ static int nfs_do_access(struct inode *inode, struct rpc_cred *cred, int mask) goto out; /* Be clever: ask server to check for all possible rights */ - cache.mask = NFS_MAY_LOOKUP | NFS_MAY_EXECUTE - | NFS_MAY_WRITE | NFS_MAY_READ; + cache.mask = NFS_MAY_READ; + if (S_ISDIR(inode->i_mode)) + cache.mask |= NFS_DIR_MAY_WRITE | NFS_MAY_LOOKUP; + else + cache.mask |= NFS_FILE_MAY_WRITE | NFS_MAY_EXECUTE; + cache.cred = cred; status = NFS_PROTO(inode)->access(inode, &cache); if (status != 0) { diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index 6c61e2b99635..cb7b5aafaef6 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -3889,6 +3889,7 @@ static int _nfs4_proc_access(struct inode *inode, struct nfs_access_entry *entry struct nfs4_accessargs args = { .fh = NFS_FH(inode), .bitmask = server->cache_consistency_bitmask, + .access = entry->mask, }; struct nfs4_accessres res = { .server = server, @@ -3899,26 +3900,8 @@ static int _nfs4_proc_access(struct inode *inode, struct nfs_access_entry *entry .rpc_resp = &res, .rpc_cred = entry->cred, }; - int mode = entry->mask; int status = 0; - /* - * Determine which access bits we want to ask for... - */ - if (mode & MAY_READ) - args.access |= NFS4_ACCESS_READ; - if (S_ISDIR(inode->i_mode)) { - if (mode & MAY_WRITE) - args.access |= NFS4_ACCESS_MODIFY | NFS4_ACCESS_EXTEND | NFS4_ACCESS_DELETE; - if (mode & MAY_EXEC) - args.access |= NFS4_ACCESS_LOOKUP; - } else { - if (mode & MAY_WRITE) - args.access |= NFS4_ACCESS_MODIFY | NFS4_ACCESS_EXTEND; - if (mode & MAY_EXEC) - args.access |= NFS4_ACCESS_EXECUTE; - } - res.fattr = nfs_alloc_fattr(); if (res.fattr == NULL) return -ENOMEM;