xref: /linux/fs/nfsd/nfs4state.c (revision febbc555cf0fff895546ddb8ba2c9a523692fb55)
1 /*
2 *  Copyright (c) 2001 The Regents of the University of Michigan.
3 *  All rights reserved.
4 *
5 *  Kendrick Smith <kmsmith@umich.edu>
6 *  Andy Adamson <kandros@umich.edu>
7 *
8 *  Redistribution and use in source and binary forms, with or without
9 *  modification, are permitted provided that the following conditions
10 *  are met:
11 *
12 *  1. Redistributions of source code must retain the above copyright
13 *     notice, this list of conditions and the following disclaimer.
14 *  2. Redistributions in binary form must reproduce the above copyright
15 *     notice, this list of conditions and the following disclaimer in the
16 *     documentation and/or other materials provided with the distribution.
17 *  3. Neither the name of the University nor the names of its
18 *     contributors may be used to endorse or promote products derived
19 *     from this software without specific prior written permission.
20 *
21 *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
22 *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
23 *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
24 *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25 *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
26 *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27 *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
28 *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
29 *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
30 *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
31 *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32 *
33 */
34 
35 #include <linux/file.h>
36 #include <linux/fs.h>
37 #include <linux/slab.h>
38 #include <linux/namei.h>
39 #include <linux/swap.h>
40 #include <linux/pagemap.h>
41 #include <linux/ratelimit.h>
42 #include <linux/sunrpc/svcauth_gss.h>
43 #include <linux/sunrpc/addr.h>
44 #include <linux/jhash.h>
45 #include <linux/string_helpers.h>
46 #include <linux/fsnotify.h>
47 #include <linux/rhashtable.h>
48 #include <linux/nfs_ssc.h>
49 
50 #include "xdr4.h"
51 #include "xdr4cb.h"
52 #include "vfs.h"
53 #include "current_stateid.h"
54 
55 #include "netns.h"
56 #include "pnfs.h"
57 #include "filecache.h"
58 #include "trace.h"
59 
60 #define NFSDDBG_FACILITY                NFSDDBG_PROC
61 
62 #define all_ones {{ ~0, ~0}, ~0}
63 static const stateid_t one_stateid = {
64 	.si_generation = ~0,
65 	.si_opaque = all_ones,
66 };
67 static const stateid_t zero_stateid = {
68 	/* all fields zero */
69 };
70 static const stateid_t currentstateid = {
71 	.si_generation = 1,
72 };
73 static const stateid_t close_stateid = {
74 	.si_generation = 0xffffffffU,
75 };
76 
77 static u64 current_sessionid = 1;
78 
79 #define ZERO_STATEID(stateid) (!memcmp((stateid), &zero_stateid, sizeof(stateid_t)))
80 #define ONE_STATEID(stateid)  (!memcmp((stateid), &one_stateid, sizeof(stateid_t)))
81 #define CURRENT_STATEID(stateid) (!memcmp((stateid), &currentstateid, sizeof(stateid_t)))
82 #define CLOSE_STATEID(stateid)  (!memcmp((stateid), &close_stateid, sizeof(stateid_t)))
83 
84 /* forward declarations */
85 static bool check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner);
86 static void nfs4_free_ol_stateid(struct nfs4_stid *stid);
87 void nfsd4_end_grace(struct nfsd_net *nn);
88 static void _free_cpntf_state_locked(struct nfsd_net *nn, struct nfs4_cpntf_state *cps);
89 static void nfsd4_file_hash_remove(struct nfs4_file *fi);
90 static void deleg_reaper(struct nfsd_net *nn);
91 
92 /* Locking: */
93 
94 /*
95  * Currently used for the del_recall_lru and file hash table.  In an
96  * effort to decrease the scope of the client_mutex, this spinlock may
97  * eventually cover more:
98  */
99 static DEFINE_SPINLOCK(state_lock);
100 
101 enum nfsd4_st_mutex_lock_subclass {
102 	OPEN_STATEID_MUTEX = 0,
103 	LOCK_STATEID_MUTEX = 1,
104 };
105 
106 /*
107  * A waitqueue for all in-progress 4.0 CLOSE operations that are waiting for
108  * the refcount on the open stateid to drop.
109  */
110 static DECLARE_WAIT_QUEUE_HEAD(close_wq);
111 
112 /*
113  * A waitqueue where a writer to clients/#/ctl destroying a client can
114  * wait for cl_rpc_users to drop to 0 and then for the client to be
115  * unhashed.
116  */
117 static DECLARE_WAIT_QUEUE_HEAD(expiry_wq);
118 
119 static struct kmem_cache *client_slab;
120 static struct kmem_cache *openowner_slab;
121 static struct kmem_cache *lockowner_slab;
122 static struct kmem_cache *file_slab;
123 static struct kmem_cache *stateid_slab;
124 static struct kmem_cache *deleg_slab;
125 static struct kmem_cache *odstate_slab;
126 
127 static void free_session(struct nfsd4_session *);
128 
129 static const struct nfsd4_callback_ops nfsd4_cb_recall_ops;
130 static const struct nfsd4_callback_ops nfsd4_cb_notify_lock_ops;
131 static const struct nfsd4_callback_ops nfsd4_cb_getattr_ops;
132 
133 static struct workqueue_struct *laundry_wq;
134 
nfsd4_create_laundry_wq(void)135 int nfsd4_create_laundry_wq(void)
136 {
137 	int rc = 0;
138 
139 	laundry_wq = alloc_workqueue("%s", WQ_UNBOUND, 0, "nfsd4");
140 	if (laundry_wq == NULL)
141 		rc = -ENOMEM;
142 	return rc;
143 }
144 
nfsd4_destroy_laundry_wq(void)145 void nfsd4_destroy_laundry_wq(void)
146 {
147 	destroy_workqueue(laundry_wq);
148 }
149 
is_session_dead(struct nfsd4_session * ses)150 static bool is_session_dead(struct nfsd4_session *ses)
151 {
152 	return ses->se_dead;
153 }
154 
mark_session_dead_locked(struct nfsd4_session * ses,int ref_held_by_me)155 static __be32 mark_session_dead_locked(struct nfsd4_session *ses, int ref_held_by_me)
156 {
157 	if (atomic_read(&ses->se_ref) > ref_held_by_me)
158 		return nfserr_jukebox;
159 	ses->se_dead = true;
160 	return nfs_ok;
161 }
162 
is_client_expired(struct nfs4_client * clp)163 static bool is_client_expired(struct nfs4_client *clp)
164 {
165 	return clp->cl_time == 0;
166 }
167 
nfsd4_dec_courtesy_client_count(struct nfsd_net * nn,struct nfs4_client * clp)168 static void nfsd4_dec_courtesy_client_count(struct nfsd_net *nn,
169 					struct nfs4_client *clp)
170 {
171 	if (clp->cl_state != NFSD4_ACTIVE)
172 		atomic_add_unless(&nn->nfsd_courtesy_clients, -1, 0);
173 }
174 
get_client_locked(struct nfs4_client * clp)175 static __be32 get_client_locked(struct nfs4_client *clp)
176 {
177 	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
178 
179 	lockdep_assert_held(&nn->client_lock);
180 
181 	if (is_client_expired(clp))
182 		return nfserr_expired;
183 	atomic_inc(&clp->cl_rpc_users);
184 	nfsd4_dec_courtesy_client_count(nn, clp);
185 	clp->cl_state = NFSD4_ACTIVE;
186 	return nfs_ok;
187 }
188 
189 /* must be called under the client_lock */
190 static inline void
renew_client_locked(struct nfs4_client * clp)191 renew_client_locked(struct nfs4_client *clp)
192 {
193 	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
194 
195 	if (is_client_expired(clp)) {
196 		WARN_ON(1);
197 		printk("%s: client (clientid %08x/%08x) already expired\n",
198 			__func__,
199 			clp->cl_clientid.cl_boot,
200 			clp->cl_clientid.cl_id);
201 		return;
202 	}
203 
204 	list_move_tail(&clp->cl_lru, &nn->client_lru);
205 	clp->cl_time = ktime_get_boottime_seconds();
206 	nfsd4_dec_courtesy_client_count(nn, clp);
207 	clp->cl_state = NFSD4_ACTIVE;
208 }
209 
put_client_renew_locked(struct nfs4_client * clp)210 static void put_client_renew_locked(struct nfs4_client *clp)
211 {
212 	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
213 
214 	lockdep_assert_held(&nn->client_lock);
215 
216 	if (!atomic_dec_and_test(&clp->cl_rpc_users))
217 		return;
218 	if (!is_client_expired(clp))
219 		renew_client_locked(clp);
220 	else
221 		wake_up_all(&expiry_wq);
222 }
223 
put_client_renew(struct nfs4_client * clp)224 static void put_client_renew(struct nfs4_client *clp)
225 {
226 	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
227 
228 	if (!atomic_dec_and_lock(&clp->cl_rpc_users, &nn->client_lock))
229 		return;
230 	if (!is_client_expired(clp))
231 		renew_client_locked(clp);
232 	else
233 		wake_up_all(&expiry_wq);
234 	spin_unlock(&nn->client_lock);
235 }
236 
nfsd4_get_session_locked(struct nfsd4_session * ses)237 static __be32 nfsd4_get_session_locked(struct nfsd4_session *ses)
238 {
239 	__be32 status;
240 
241 	if (is_session_dead(ses))
242 		return nfserr_badsession;
243 	status = get_client_locked(ses->se_client);
244 	if (status)
245 		return status;
246 	atomic_inc(&ses->se_ref);
247 	return nfs_ok;
248 }
249 
nfsd4_put_session_locked(struct nfsd4_session * ses)250 static void nfsd4_put_session_locked(struct nfsd4_session *ses)
251 {
252 	struct nfs4_client *clp = ses->se_client;
253 	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
254 
255 	lockdep_assert_held(&nn->client_lock);
256 
257 	if (atomic_dec_and_test(&ses->se_ref) && is_session_dead(ses))
258 		free_session(ses);
259 	put_client_renew_locked(clp);
260 }
261 
nfsd4_put_session(struct nfsd4_session * ses)262 static void nfsd4_put_session(struct nfsd4_session *ses)
263 {
264 	struct nfs4_client *clp = ses->se_client;
265 	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
266 
267 	spin_lock(&nn->client_lock);
268 	nfsd4_put_session_locked(ses);
269 	spin_unlock(&nn->client_lock);
270 }
271 
272 static struct nfsd4_blocked_lock *
find_blocked_lock(struct nfs4_lockowner * lo,struct knfsd_fh * fh,struct nfsd_net * nn)273 find_blocked_lock(struct nfs4_lockowner *lo, struct knfsd_fh *fh,
274 			struct nfsd_net *nn)
275 {
276 	struct nfsd4_blocked_lock *cur, *found = NULL;
277 
278 	spin_lock(&nn->blocked_locks_lock);
279 	list_for_each_entry(cur, &lo->lo_blocked, nbl_list) {
280 		if (fh_match(fh, &cur->nbl_fh)) {
281 			list_del_init(&cur->nbl_list);
282 			WARN_ON(list_empty(&cur->nbl_lru));
283 			list_del_init(&cur->nbl_lru);
284 			found = cur;
285 			break;
286 		}
287 	}
288 	spin_unlock(&nn->blocked_locks_lock);
289 	if (found)
290 		locks_delete_block(&found->nbl_lock);
291 	return found;
292 }
293 
294 static struct nfsd4_blocked_lock *
find_or_allocate_block(struct nfs4_lockowner * lo,struct knfsd_fh * fh,struct nfsd_net * nn)295 find_or_allocate_block(struct nfs4_lockowner *lo, struct knfsd_fh *fh,
296 			struct nfsd_net *nn)
297 {
298 	struct nfsd4_blocked_lock *nbl;
299 
300 	nbl = find_blocked_lock(lo, fh, nn);
301 	if (!nbl) {
302 		nbl = kmalloc(sizeof(*nbl), GFP_KERNEL);
303 		if (nbl) {
304 			INIT_LIST_HEAD(&nbl->nbl_list);
305 			INIT_LIST_HEAD(&nbl->nbl_lru);
306 			fh_copy_shallow(&nbl->nbl_fh, fh);
307 			locks_init_lock(&nbl->nbl_lock);
308 			kref_init(&nbl->nbl_kref);
309 			nfsd4_init_cb(&nbl->nbl_cb, lo->lo_owner.so_client,
310 					&nfsd4_cb_notify_lock_ops,
311 					NFSPROC4_CLNT_CB_NOTIFY_LOCK);
312 		}
313 	}
314 	return nbl;
315 }
316 
317 static void
free_nbl(struct kref * kref)318 free_nbl(struct kref *kref)
319 {
320 	struct nfsd4_blocked_lock *nbl;
321 
322 	nbl = container_of(kref, struct nfsd4_blocked_lock, nbl_kref);
323 	locks_release_private(&nbl->nbl_lock);
324 	kfree(nbl);
325 }
326 
327 static void
free_blocked_lock(struct nfsd4_blocked_lock * nbl)328 free_blocked_lock(struct nfsd4_blocked_lock *nbl)
329 {
330 	locks_delete_block(&nbl->nbl_lock);
331 	kref_put(&nbl->nbl_kref, free_nbl);
332 }
333 
334 static void
remove_blocked_locks(struct nfs4_lockowner * lo)335 remove_blocked_locks(struct nfs4_lockowner *lo)
336 {
337 	struct nfs4_client *clp = lo->lo_owner.so_client;
338 	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
339 	struct nfsd4_blocked_lock *nbl;
340 	LIST_HEAD(reaplist);
341 
342 	/* Dequeue all blocked locks */
343 	spin_lock(&nn->blocked_locks_lock);
344 	while (!list_empty(&lo->lo_blocked)) {
345 		nbl = list_first_entry(&lo->lo_blocked,
346 					struct nfsd4_blocked_lock,
347 					nbl_list);
348 		list_del_init(&nbl->nbl_list);
349 		WARN_ON(list_empty(&nbl->nbl_lru));
350 		list_move(&nbl->nbl_lru, &reaplist);
351 	}
352 	spin_unlock(&nn->blocked_locks_lock);
353 
354 	/* Now free them */
355 	while (!list_empty(&reaplist)) {
356 		nbl = list_first_entry(&reaplist, struct nfsd4_blocked_lock,
357 					nbl_lru);
358 		list_del_init(&nbl->nbl_lru);
359 		free_blocked_lock(nbl);
360 	}
361 }
362 
363 static void
nfsd4_cb_notify_lock_prepare(struct nfsd4_callback * cb)364 nfsd4_cb_notify_lock_prepare(struct nfsd4_callback *cb)
365 {
366 	struct nfsd4_blocked_lock	*nbl = container_of(cb,
367 						struct nfsd4_blocked_lock, nbl_cb);
368 	locks_delete_block(&nbl->nbl_lock);
369 }
370 
371 static int
nfsd4_cb_notify_lock_done(struct nfsd4_callback * cb,struct rpc_task * task)372 nfsd4_cb_notify_lock_done(struct nfsd4_callback *cb, struct rpc_task *task)
373 {
374 	trace_nfsd_cb_notify_lock_done(&zero_stateid, task);
375 
376 	/*
377 	 * Since this is just an optimization, we don't try very hard if it
378 	 * turns out not to succeed. We'll requeue it on NFS4ERR_DELAY, and
379 	 * just quit trying on anything else.
380 	 */
381 	switch (task->tk_status) {
382 	case -NFS4ERR_DELAY:
383 		rpc_delay(task, 1 * HZ);
384 		return 0;
385 	default:
386 		return 1;
387 	}
388 }
389 
390 static void
nfsd4_cb_notify_lock_release(struct nfsd4_callback * cb)391 nfsd4_cb_notify_lock_release(struct nfsd4_callback *cb)
392 {
393 	struct nfsd4_blocked_lock	*nbl = container_of(cb,
394 						struct nfsd4_blocked_lock, nbl_cb);
395 
396 	free_blocked_lock(nbl);
397 }
398 
399 static const struct nfsd4_callback_ops nfsd4_cb_notify_lock_ops = {
400 	.prepare	= nfsd4_cb_notify_lock_prepare,
401 	.done		= nfsd4_cb_notify_lock_done,
402 	.release	= nfsd4_cb_notify_lock_release,
403 	.opcode		= OP_CB_NOTIFY_LOCK,
404 };
405 
406 /*
407  * We store the NONE, READ, WRITE, and BOTH bits separately in the
408  * st_{access,deny}_bmap field of the stateid, in order to track not
409  * only what share bits are currently in force, but also what
410  * combinations of share bits previous opens have used.  This allows us
411  * to enforce the recommendation in
412  * https://datatracker.ietf.org/doc/html/rfc7530#section-16.19.4 that
413  * the server return an error if the client attempt to downgrade to a
414  * combination of share bits not explicable by closing some of its
415  * previous opens.
416  *
417  * This enforcement is arguably incomplete, since we don't keep
418  * track of access/deny bit combinations; so, e.g., we allow:
419  *
420  *	OPEN allow read, deny write
421  *	OPEN allow both, deny none
422  *	DOWNGRADE allow read, deny none
423  *
424  * which we should reject.
425  *
426  * But you could also argue that our current code is already overkill,
427  * since it only exists to return NFS4ERR_INVAL on incorrect client
428  * behavior.
429  */
430 static unsigned int
bmap_to_share_mode(unsigned long bmap)431 bmap_to_share_mode(unsigned long bmap)
432 {
433 	int i;
434 	unsigned int access = 0;
435 
436 	for (i = 1; i < 4; i++) {
437 		if (test_bit(i, &bmap))
438 			access |= i;
439 	}
440 	return access;
441 }
442 
443 /* set share access for a given stateid */
444 static inline void
set_access(u32 access,struct nfs4_ol_stateid * stp)445 set_access(u32 access, struct nfs4_ol_stateid *stp)
446 {
447 	unsigned char mask = 1 << access;
448 
449 	WARN_ON_ONCE(access > NFS4_SHARE_ACCESS_BOTH);
450 	stp->st_access_bmap |= mask;
451 }
452 
453 /* clear share access for a given stateid */
454 static inline void
clear_access(u32 access,struct nfs4_ol_stateid * stp)455 clear_access(u32 access, struct nfs4_ol_stateid *stp)
456 {
457 	unsigned char mask = 1 << access;
458 
459 	WARN_ON_ONCE(access > NFS4_SHARE_ACCESS_BOTH);
460 	stp->st_access_bmap &= ~mask;
461 }
462 
463 /* test whether a given stateid has access */
464 static inline bool
test_access(u32 access,struct nfs4_ol_stateid * stp)465 test_access(u32 access, struct nfs4_ol_stateid *stp)
466 {
467 	unsigned char mask = 1 << access;
468 
469 	return (bool)(stp->st_access_bmap & mask);
470 }
471 
472 /* set share deny for a given stateid */
473 static inline void
set_deny(u32 deny,struct nfs4_ol_stateid * stp)474 set_deny(u32 deny, struct nfs4_ol_stateid *stp)
475 {
476 	unsigned char mask = 1 << deny;
477 
478 	WARN_ON_ONCE(deny > NFS4_SHARE_DENY_BOTH);
479 	stp->st_deny_bmap |= mask;
480 }
481 
482 /* clear share deny for a given stateid */
483 static inline void
clear_deny(u32 deny,struct nfs4_ol_stateid * stp)484 clear_deny(u32 deny, struct nfs4_ol_stateid *stp)
485 {
486 	unsigned char mask = 1 << deny;
487 
488 	WARN_ON_ONCE(deny > NFS4_SHARE_DENY_BOTH);
489 	stp->st_deny_bmap &= ~mask;
490 }
491 
492 /* test whether a given stateid is denying specific access */
493 static inline bool
test_deny(u32 deny,struct nfs4_ol_stateid * stp)494 test_deny(u32 deny, struct nfs4_ol_stateid *stp)
495 {
496 	unsigned char mask = 1 << deny;
497 
498 	return (bool)(stp->st_deny_bmap & mask);
499 }
500 
nfs4_access_to_omode(u32 access)501 static int nfs4_access_to_omode(u32 access)
502 {
503 	switch (access & NFS4_SHARE_ACCESS_BOTH) {
504 	case NFS4_SHARE_ACCESS_READ:
505 		return O_RDONLY;
506 	case NFS4_SHARE_ACCESS_WRITE:
507 		return O_WRONLY;
508 	case NFS4_SHARE_ACCESS_BOTH:
509 		return O_RDWR;
510 	}
511 	WARN_ON_ONCE(1);
512 	return O_RDONLY;
513 }
514 
515 static inline int
access_permit_read(struct nfs4_ol_stateid * stp)516 access_permit_read(struct nfs4_ol_stateid *stp)
517 {
518 	return test_access(NFS4_SHARE_ACCESS_READ, stp) ||
519 		test_access(NFS4_SHARE_ACCESS_BOTH, stp) ||
520 		test_access(NFS4_SHARE_ACCESS_WRITE, stp);
521 }
522 
523 static inline int
access_permit_write(struct nfs4_ol_stateid * stp)524 access_permit_write(struct nfs4_ol_stateid *stp)
525 {
526 	return test_access(NFS4_SHARE_ACCESS_WRITE, stp) ||
527 		test_access(NFS4_SHARE_ACCESS_BOTH, stp);
528 }
529 
530 static inline struct nfs4_stateowner *
nfs4_get_stateowner(struct nfs4_stateowner * sop)531 nfs4_get_stateowner(struct nfs4_stateowner *sop)
532 {
533 	atomic_inc(&sop->so_count);
534 	return sop;
535 }
536 
537 static int
same_owner_str(struct nfs4_stateowner * sop,struct xdr_netobj * owner)538 same_owner_str(struct nfs4_stateowner *sop, struct xdr_netobj *owner)
539 {
540 	return (sop->so_owner.len == owner->len) &&
541 		0 == memcmp(sop->so_owner.data, owner->data, owner->len);
542 }
543 
544 static struct nfs4_openowner *
find_openstateowner_str(unsigned int hashval,struct nfsd4_open * open,struct nfs4_client * clp)545 find_openstateowner_str(unsigned int hashval, struct nfsd4_open *open,
546 			struct nfs4_client *clp)
547 {
548 	struct nfs4_stateowner *so;
549 
550 	lockdep_assert_held(&clp->cl_lock);
551 
552 	list_for_each_entry(so, &clp->cl_ownerstr_hashtbl[hashval],
553 			    so_strhash) {
554 		if (!so->so_is_open_owner)
555 			continue;
556 		if (same_owner_str(so, &open->op_owner))
557 			return openowner(nfs4_get_stateowner(so));
558 	}
559 	return NULL;
560 }
561 
562 static inline u32
opaque_hashval(const void * ptr,int nbytes)563 opaque_hashval(const void *ptr, int nbytes)
564 {
565 	unsigned char *cptr = (unsigned char *) ptr;
566 
567 	u32 x = 0;
568 	while (nbytes--) {
569 		x *= 37;
570 		x += *cptr++;
571 	}
572 	return x;
573 }
574 
575 void
put_nfs4_file(struct nfs4_file * fi)576 put_nfs4_file(struct nfs4_file *fi)
577 {
578 	if (refcount_dec_and_test(&fi->fi_ref)) {
579 		nfsd4_file_hash_remove(fi);
580 		WARN_ON_ONCE(!list_empty(&fi->fi_clnt_odstate));
581 		WARN_ON_ONCE(!list_empty(&fi->fi_delegations));
582 		kfree_rcu(fi, fi_rcu);
583 	}
584 }
585 
586 static struct nfsd_file *
find_writeable_file_locked(struct nfs4_file * f)587 find_writeable_file_locked(struct nfs4_file *f)
588 {
589 	struct nfsd_file *ret;
590 
591 	lockdep_assert_held(&f->fi_lock);
592 
593 	ret = nfsd_file_get(f->fi_fds[O_WRONLY]);
594 	if (!ret)
595 		ret = nfsd_file_get(f->fi_fds[O_RDWR]);
596 	return ret;
597 }
598 
599 static struct nfsd_file *
find_writeable_file(struct nfs4_file * f)600 find_writeable_file(struct nfs4_file *f)
601 {
602 	struct nfsd_file *ret;
603 
604 	spin_lock(&f->fi_lock);
605 	ret = find_writeable_file_locked(f);
606 	spin_unlock(&f->fi_lock);
607 
608 	return ret;
609 }
610 
611 static struct nfsd_file *
find_readable_file_locked(struct nfs4_file * f)612 find_readable_file_locked(struct nfs4_file *f)
613 {
614 	struct nfsd_file *ret;
615 
616 	lockdep_assert_held(&f->fi_lock);
617 
618 	ret = nfsd_file_get(f->fi_fds[O_RDONLY]);
619 	if (!ret)
620 		ret = nfsd_file_get(f->fi_fds[O_RDWR]);
621 	return ret;
622 }
623 
624 static struct nfsd_file *
find_readable_file(struct nfs4_file * f)625 find_readable_file(struct nfs4_file *f)
626 {
627 	struct nfsd_file *ret;
628 
629 	spin_lock(&f->fi_lock);
630 	ret = find_readable_file_locked(f);
631 	spin_unlock(&f->fi_lock);
632 
633 	return ret;
634 }
635 
636 static struct nfsd_file *
find_rw_file(struct nfs4_file * f)637 find_rw_file(struct nfs4_file *f)
638 {
639 	struct nfsd_file *ret;
640 
641 	spin_lock(&f->fi_lock);
642 	ret = nfsd_file_get(f->fi_fds[O_RDWR]);
643 	spin_unlock(&f->fi_lock);
644 
645 	return ret;
646 }
647 
648 struct nfsd_file *
find_any_file(struct nfs4_file * f)649 find_any_file(struct nfs4_file *f)
650 {
651 	struct nfsd_file *ret;
652 
653 	if (!f)
654 		return NULL;
655 	spin_lock(&f->fi_lock);
656 	ret = nfsd_file_get(f->fi_fds[O_RDWR]);
657 	if (!ret) {
658 		ret = nfsd_file_get(f->fi_fds[O_WRONLY]);
659 		if (!ret)
660 			ret = nfsd_file_get(f->fi_fds[O_RDONLY]);
661 	}
662 	spin_unlock(&f->fi_lock);
663 	return ret;
664 }
665 
find_any_file_locked(struct nfs4_file * f)666 static struct nfsd_file *find_any_file_locked(struct nfs4_file *f)
667 {
668 	lockdep_assert_held(&f->fi_lock);
669 
670 	if (f->fi_fds[O_RDWR])
671 		return f->fi_fds[O_RDWR];
672 	if (f->fi_fds[O_WRONLY])
673 		return f->fi_fds[O_WRONLY];
674 	if (f->fi_fds[O_RDONLY])
675 		return f->fi_fds[O_RDONLY];
676 	return NULL;
677 }
678 
679 static atomic_long_t num_delegations;
680 unsigned long max_delegations;
681 
682 /*
683  * Open owner state (share locks)
684  */
685 
686 /* hash tables for lock and open owners */
687 #define OWNER_HASH_BITS              8
688 #define OWNER_HASH_SIZE             (1 << OWNER_HASH_BITS)
689 #define OWNER_HASH_MASK             (OWNER_HASH_SIZE - 1)
690 
ownerstr_hashval(struct xdr_netobj * ownername)691 static unsigned int ownerstr_hashval(struct xdr_netobj *ownername)
692 {
693 	unsigned int ret;
694 
695 	ret = opaque_hashval(ownername->data, ownername->len);
696 	return ret & OWNER_HASH_MASK;
697 }
698 
699 static struct rhltable nfs4_file_rhltable ____cacheline_aligned_in_smp;
700 
701 static const struct rhashtable_params nfs4_file_rhash_params = {
702 	.key_len		= sizeof_field(struct nfs4_file, fi_inode),
703 	.key_offset		= offsetof(struct nfs4_file, fi_inode),
704 	.head_offset		= offsetof(struct nfs4_file, fi_rlist),
705 
706 	/*
707 	 * Start with a single page hash table to reduce resizing churn
708 	 * on light workloads.
709 	 */
710 	.min_size		= 256,
711 	.automatic_shrinking	= true,
712 };
713 
714 /*
715  * Check if courtesy clients have conflicting access and resolve it if possible
716  *
717  * access:  is op_share_access if share_access is true.
718  *	    Check if access mode, op_share_access, would conflict with
719  *	    the current deny mode of the file 'fp'.
720  * access:  is op_share_deny if share_access is false.
721  *	    Check if the deny mode, op_share_deny, would conflict with
722  *	    current access of the file 'fp'.
723  * stp:     skip checking this entry.
724  * new_stp: normal open, not open upgrade.
725  *
726  * Function returns:
727  *	false - access/deny mode conflict with normal client.
728  *	true  - no conflict or conflict with courtesy client(s) is resolved.
729  */
730 static bool
nfs4_resolve_deny_conflicts_locked(struct nfs4_file * fp,bool new_stp,struct nfs4_ol_stateid * stp,u32 access,bool share_access)731 nfs4_resolve_deny_conflicts_locked(struct nfs4_file *fp, bool new_stp,
732 		struct nfs4_ol_stateid *stp, u32 access, bool share_access)
733 {
734 	struct nfs4_ol_stateid *st;
735 	bool resolvable = true;
736 	unsigned char bmap;
737 	struct nfsd_net *nn;
738 	struct nfs4_client *clp;
739 
740 	lockdep_assert_held(&fp->fi_lock);
741 	list_for_each_entry(st, &fp->fi_stateids, st_perfile) {
742 		/* ignore lock stateid */
743 		if (st->st_openstp)
744 			continue;
745 		if (st == stp && new_stp)
746 			continue;
747 		/* check file access against deny mode or vice versa */
748 		bmap = share_access ? st->st_deny_bmap : st->st_access_bmap;
749 		if (!(access & bmap_to_share_mode(bmap)))
750 			continue;
751 		clp = st->st_stid.sc_client;
752 		if (try_to_expire_client(clp))
753 			continue;
754 		resolvable = false;
755 		break;
756 	}
757 	if (resolvable) {
758 		clp = stp->st_stid.sc_client;
759 		nn = net_generic(clp->net, nfsd_net_id);
760 		mod_delayed_work(laundry_wq, &nn->laundromat_work, 0);
761 	}
762 	return resolvable;
763 }
764 
765 static void
__nfs4_file_get_access(struct nfs4_file * fp,u32 access)766 __nfs4_file_get_access(struct nfs4_file *fp, u32 access)
767 {
768 	lockdep_assert_held(&fp->fi_lock);
769 
770 	if (access & NFS4_SHARE_ACCESS_WRITE)
771 		atomic_inc(&fp->fi_access[O_WRONLY]);
772 	if (access & NFS4_SHARE_ACCESS_READ)
773 		atomic_inc(&fp->fi_access[O_RDONLY]);
774 }
775 
776 static __be32
nfs4_file_get_access(struct nfs4_file * fp,u32 access)777 nfs4_file_get_access(struct nfs4_file *fp, u32 access)
778 {
779 	lockdep_assert_held(&fp->fi_lock);
780 
781 	/* Does this access mode make sense? */
782 	if (access & ~NFS4_SHARE_ACCESS_BOTH)
783 		return nfserr_inval;
784 
785 	/* Does it conflict with a deny mode already set? */
786 	if ((access & fp->fi_share_deny) != 0)
787 		return nfserr_share_denied;
788 
789 	__nfs4_file_get_access(fp, access);
790 	return nfs_ok;
791 }
792 
nfs4_file_check_deny(struct nfs4_file * fp,u32 deny)793 static __be32 nfs4_file_check_deny(struct nfs4_file *fp, u32 deny)
794 {
795 	/* Common case is that there is no deny mode. */
796 	if (deny) {
797 		/* Does this deny mode make sense? */
798 		if (deny & ~NFS4_SHARE_DENY_BOTH)
799 			return nfserr_inval;
800 
801 		if ((deny & NFS4_SHARE_DENY_READ) &&
802 		    atomic_read(&fp->fi_access[O_RDONLY]))
803 			return nfserr_share_denied;
804 
805 		if ((deny & NFS4_SHARE_DENY_WRITE) &&
806 		    atomic_read(&fp->fi_access[O_WRONLY]))
807 			return nfserr_share_denied;
808 	}
809 	return nfs_ok;
810 }
811 
__nfs4_file_put_access(struct nfs4_file * fp,int oflag)812 static void __nfs4_file_put_access(struct nfs4_file *fp, int oflag)
813 {
814 	might_lock(&fp->fi_lock);
815 
816 	if (atomic_dec_and_lock(&fp->fi_access[oflag], &fp->fi_lock)) {
817 		struct nfsd_file *f1 = NULL;
818 		struct nfsd_file *f2 = NULL;
819 
820 		swap(f1, fp->fi_fds[oflag]);
821 		if (atomic_read(&fp->fi_access[1 - oflag]) == 0)
822 			swap(f2, fp->fi_fds[O_RDWR]);
823 		spin_unlock(&fp->fi_lock);
824 		if (f1)
825 			nfsd_file_put(f1);
826 		if (f2)
827 			nfsd_file_put(f2);
828 	}
829 }
830 
nfs4_file_put_access(struct nfs4_file * fp,u32 access)831 static void nfs4_file_put_access(struct nfs4_file *fp, u32 access)
832 {
833 	WARN_ON_ONCE(access & ~NFS4_SHARE_ACCESS_BOTH);
834 
835 	if (access & NFS4_SHARE_ACCESS_WRITE)
836 		__nfs4_file_put_access(fp, O_WRONLY);
837 	if (access & NFS4_SHARE_ACCESS_READ)
838 		__nfs4_file_put_access(fp, O_RDONLY);
839 }
840 
841 /*
842  * Allocate a new open/delegation state counter. This is needed for
843  * pNFS for proper return on close semantics.
844  *
845  * Note that we only allocate it for pNFS-enabled exports, otherwise
846  * all pointers to struct nfs4_clnt_odstate are always NULL.
847  */
848 static struct nfs4_clnt_odstate *
alloc_clnt_odstate(struct nfs4_client * clp)849 alloc_clnt_odstate(struct nfs4_client *clp)
850 {
851 	struct nfs4_clnt_odstate *co;
852 
853 	co = kmem_cache_zalloc(odstate_slab, GFP_KERNEL);
854 	if (co) {
855 		co->co_client = clp;
856 		refcount_set(&co->co_odcount, 1);
857 	}
858 	return co;
859 }
860 
861 static void
hash_clnt_odstate_locked(struct nfs4_clnt_odstate * co)862 hash_clnt_odstate_locked(struct nfs4_clnt_odstate *co)
863 {
864 	struct nfs4_file *fp = co->co_file;
865 
866 	lockdep_assert_held(&fp->fi_lock);
867 	list_add(&co->co_perfile, &fp->fi_clnt_odstate);
868 }
869 
870 static inline void
get_clnt_odstate(struct nfs4_clnt_odstate * co)871 get_clnt_odstate(struct nfs4_clnt_odstate *co)
872 {
873 	if (co)
874 		refcount_inc(&co->co_odcount);
875 }
876 
877 static void
put_clnt_odstate(struct nfs4_clnt_odstate * co)878 put_clnt_odstate(struct nfs4_clnt_odstate *co)
879 {
880 	struct nfs4_file *fp;
881 
882 	if (!co)
883 		return;
884 
885 	fp = co->co_file;
886 	if (refcount_dec_and_lock(&co->co_odcount, &fp->fi_lock)) {
887 		list_del(&co->co_perfile);
888 		spin_unlock(&fp->fi_lock);
889 
890 		nfsd4_return_all_file_layouts(co->co_client, fp);
891 		kmem_cache_free(odstate_slab, co);
892 	}
893 }
894 
895 static struct nfs4_clnt_odstate *
find_or_hash_clnt_odstate(struct nfs4_file * fp,struct nfs4_clnt_odstate * new)896 find_or_hash_clnt_odstate(struct nfs4_file *fp, struct nfs4_clnt_odstate *new)
897 {
898 	struct nfs4_clnt_odstate *co;
899 	struct nfs4_client *cl;
900 
901 	if (!new)
902 		return NULL;
903 
904 	cl = new->co_client;
905 
906 	spin_lock(&fp->fi_lock);
907 	list_for_each_entry(co, &fp->fi_clnt_odstate, co_perfile) {
908 		if (co->co_client == cl) {
909 			get_clnt_odstate(co);
910 			goto out;
911 		}
912 	}
913 	co = new;
914 	co->co_file = fp;
915 	hash_clnt_odstate_locked(new);
916 out:
917 	spin_unlock(&fp->fi_lock);
918 	return co;
919 }
920 
nfs4_alloc_stid(struct nfs4_client * cl,struct kmem_cache * slab,void (* sc_free)(struct nfs4_stid *))921 struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab,
922 				  void (*sc_free)(struct nfs4_stid *))
923 {
924 	struct nfs4_stid *stid;
925 	int new_id;
926 
927 	stid = kmem_cache_zalloc(slab, GFP_KERNEL);
928 	if (!stid)
929 		return NULL;
930 
931 	idr_preload(GFP_KERNEL);
932 	spin_lock(&cl->cl_lock);
933 	/* Reserving 0 for start of file in nfsdfs "states" file: */
934 	new_id = idr_alloc_cyclic(&cl->cl_stateids, stid, 1, 0, GFP_NOWAIT);
935 	spin_unlock(&cl->cl_lock);
936 	idr_preload_end();
937 	if (new_id < 0)
938 		goto out_free;
939 
940 	stid->sc_free = sc_free;
941 	stid->sc_client = cl;
942 	stid->sc_stateid.si_opaque.so_id = new_id;
943 	stid->sc_stateid.si_opaque.so_clid = cl->cl_clientid;
944 	/* Will be incremented before return to client: */
945 	refcount_set(&stid->sc_count, 1);
946 	spin_lock_init(&stid->sc_lock);
947 	INIT_LIST_HEAD(&stid->sc_cp_list);
948 
949 	/*
950 	 * It shouldn't be a problem to reuse an opaque stateid value.
951 	 * I don't think it is for 4.1.  But with 4.0 I worry that, for
952 	 * example, a stray write retransmission could be accepted by
953 	 * the server when it should have been rejected.  Therefore,
954 	 * adopt a trick from the sctp code to attempt to maximize the
955 	 * amount of time until an id is reused, by ensuring they always
956 	 * "increase" (mod INT_MAX):
957 	 */
958 	return stid;
959 out_free:
960 	kmem_cache_free(slab, stid);
961 	return NULL;
962 }
963 
964 /*
965  * Create a unique stateid_t to represent each COPY.
966  */
nfs4_init_cp_state(struct nfsd_net * nn,copy_stateid_t * stid,unsigned char cs_type)967 static int nfs4_init_cp_state(struct nfsd_net *nn, copy_stateid_t *stid,
968 			      unsigned char cs_type)
969 {
970 	int new_id;
971 
972 	stid->cs_stid.si_opaque.so_clid.cl_boot = (u32)nn->boot_time;
973 	stid->cs_stid.si_opaque.so_clid.cl_id = nn->s2s_cp_cl_id;
974 
975 	idr_preload(GFP_KERNEL);
976 	spin_lock(&nn->s2s_cp_lock);
977 	new_id = idr_alloc_cyclic(&nn->s2s_cp_stateids, stid, 0, 0, GFP_NOWAIT);
978 	stid->cs_stid.si_opaque.so_id = new_id;
979 	stid->cs_stid.si_generation = 1;
980 	spin_unlock(&nn->s2s_cp_lock);
981 	idr_preload_end();
982 	if (new_id < 0)
983 		return 0;
984 	stid->cs_type = cs_type;
985 	return 1;
986 }
987 
nfs4_init_copy_state(struct nfsd_net * nn,struct nfsd4_copy * copy)988 int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_copy *copy)
989 {
990 	return nfs4_init_cp_state(nn, &copy->cp_stateid, NFS4_COPY_STID);
991 }
992 
nfs4_alloc_init_cpntf_state(struct nfsd_net * nn,struct nfs4_stid * p_stid)993 struct nfs4_cpntf_state *nfs4_alloc_init_cpntf_state(struct nfsd_net *nn,
994 						     struct nfs4_stid *p_stid)
995 {
996 	struct nfs4_cpntf_state *cps;
997 
998 	cps = kzalloc(sizeof(struct nfs4_cpntf_state), GFP_KERNEL);
999 	if (!cps)
1000 		return NULL;
1001 	cps->cpntf_time = ktime_get_boottime_seconds();
1002 	refcount_set(&cps->cp_stateid.cs_count, 1);
1003 	if (!nfs4_init_cp_state(nn, &cps->cp_stateid, NFS4_COPYNOTIFY_STID))
1004 		goto out_free;
1005 	spin_lock(&nn->s2s_cp_lock);
1006 	list_add(&cps->cp_list, &p_stid->sc_cp_list);
1007 	spin_unlock(&nn->s2s_cp_lock);
1008 	return cps;
1009 out_free:
1010 	kfree(cps);
1011 	return NULL;
1012 }
1013 
nfs4_free_copy_state(struct nfsd4_copy * copy)1014 void nfs4_free_copy_state(struct nfsd4_copy *copy)
1015 {
1016 	struct nfsd_net *nn;
1017 
1018 	if (copy->cp_stateid.cs_type != NFS4_COPY_STID)
1019 		return;
1020 	nn = net_generic(copy->cp_clp->net, nfsd_net_id);
1021 	spin_lock(&nn->s2s_cp_lock);
1022 	idr_remove(&nn->s2s_cp_stateids,
1023 		   copy->cp_stateid.cs_stid.si_opaque.so_id);
1024 	spin_unlock(&nn->s2s_cp_lock);
1025 }
1026 
nfs4_free_cpntf_statelist(struct net * net,struct nfs4_stid * stid)1027 static void nfs4_free_cpntf_statelist(struct net *net, struct nfs4_stid *stid)
1028 {
1029 	struct nfs4_cpntf_state *cps;
1030 	struct nfsd_net *nn;
1031 
1032 	nn = net_generic(net, nfsd_net_id);
1033 	spin_lock(&nn->s2s_cp_lock);
1034 	while (!list_empty(&stid->sc_cp_list)) {
1035 		cps = list_first_entry(&stid->sc_cp_list,
1036 				       struct nfs4_cpntf_state, cp_list);
1037 		_free_cpntf_state_locked(nn, cps);
1038 	}
1039 	spin_unlock(&nn->s2s_cp_lock);
1040 }
1041 
nfs4_alloc_open_stateid(struct nfs4_client * clp)1042 static struct nfs4_ol_stateid * nfs4_alloc_open_stateid(struct nfs4_client *clp)
1043 {
1044 	struct nfs4_stid *stid;
1045 
1046 	stid = nfs4_alloc_stid(clp, stateid_slab, nfs4_free_ol_stateid);
1047 	if (!stid)
1048 		return NULL;
1049 
1050 	return openlockstateid(stid);
1051 }
1052 
nfs4_free_deleg(struct nfs4_stid * stid)1053 static void nfs4_free_deleg(struct nfs4_stid *stid)
1054 {
1055 	struct nfs4_delegation *dp = delegstateid(stid);
1056 
1057 	WARN_ON_ONCE(!list_empty(&stid->sc_cp_list));
1058 	WARN_ON_ONCE(!list_empty(&dp->dl_perfile));
1059 	WARN_ON_ONCE(!list_empty(&dp->dl_perclnt));
1060 	WARN_ON_ONCE(!list_empty(&dp->dl_recall_lru));
1061 	kmem_cache_free(deleg_slab, stid);
1062 	atomic_long_dec(&num_delegations);
1063 }
1064 
1065 /*
1066  * When we recall a delegation, we should be careful not to hand it
1067  * out again straight away.
1068  * To ensure this we keep a pair of bloom filters ('new' and 'old')
1069  * in which the filehandles of recalled delegations are "stored".
1070  * If a filehandle appear in either filter, a delegation is blocked.
1071  * When a delegation is recalled, the filehandle is stored in the "new"
1072  * filter.
1073  * Every 30 seconds we swap the filters and clear the "new" one,
1074  * unless both are empty of course.  This results in delegations for a
1075  * given filehandle being blocked for between 30 and 60 seconds.
1076  *
1077  * Each filter is 256 bits.  We hash the filehandle to 32bit and use the
1078  * low 3 bytes as hash-table indices.
1079  *
1080  * 'blocked_delegations_lock', which is always taken in block_delegations(),
1081  * is used to manage concurrent access.  Testing does not need the lock
1082  * except when swapping the two filters.
1083  */
1084 static DEFINE_SPINLOCK(blocked_delegations_lock);
1085 static struct bloom_pair {
1086 	int	entries, old_entries;
1087 	time64_t swap_time;
1088 	int	new; /* index into 'set' */
1089 	DECLARE_BITMAP(set[2], 256);
1090 } blocked_delegations;
1091 
delegation_blocked(struct knfsd_fh * fh)1092 static int delegation_blocked(struct knfsd_fh *fh)
1093 {
1094 	u32 hash;
1095 	struct bloom_pair *bd = &blocked_delegations;
1096 
1097 	if (bd->entries == 0)
1098 		return 0;
1099 	if (ktime_get_seconds() - bd->swap_time > 30) {
1100 		spin_lock(&blocked_delegations_lock);
1101 		if (ktime_get_seconds() - bd->swap_time > 30) {
1102 			bd->entries -= bd->old_entries;
1103 			bd->old_entries = bd->entries;
1104 			bd->new = 1-bd->new;
1105 			memset(bd->set[bd->new], 0,
1106 			       sizeof(bd->set[0]));
1107 			bd->swap_time = ktime_get_seconds();
1108 		}
1109 		spin_unlock(&blocked_delegations_lock);
1110 	}
1111 	hash = jhash(&fh->fh_raw, fh->fh_size, 0);
1112 	if (test_bit(hash&255, bd->set[0]) &&
1113 	    test_bit((hash>>8)&255, bd->set[0]) &&
1114 	    test_bit((hash>>16)&255, bd->set[0]))
1115 		return 1;
1116 
1117 	if (test_bit(hash&255, bd->set[1]) &&
1118 	    test_bit((hash>>8)&255, bd->set[1]) &&
1119 	    test_bit((hash>>16)&255, bd->set[1]))
1120 		return 1;
1121 
1122 	return 0;
1123 }
1124 
block_delegations(struct knfsd_fh * fh)1125 static void block_delegations(struct knfsd_fh *fh)
1126 {
1127 	u32 hash;
1128 	struct bloom_pair *bd = &blocked_delegations;
1129 
1130 	hash = jhash(&fh->fh_raw, fh->fh_size, 0);
1131 
1132 	spin_lock(&blocked_delegations_lock);
1133 	__set_bit(hash&255, bd->set[bd->new]);
1134 	__set_bit((hash>>8)&255, bd->set[bd->new]);
1135 	__set_bit((hash>>16)&255, bd->set[bd->new]);
1136 	if (bd->entries == 0)
1137 		bd->swap_time = ktime_get_seconds();
1138 	bd->entries += 1;
1139 	spin_unlock(&blocked_delegations_lock);
1140 }
1141 
1142 static struct nfs4_delegation *
alloc_init_deleg(struct nfs4_client * clp,struct nfs4_file * fp,struct nfs4_clnt_odstate * odstate,u32 dl_type)1143 alloc_init_deleg(struct nfs4_client *clp, struct nfs4_file *fp,
1144 		 struct nfs4_clnt_odstate *odstate, u32 dl_type)
1145 {
1146 	struct nfs4_delegation *dp;
1147 	struct nfs4_stid *stid;
1148 	long n;
1149 
1150 	dprintk("NFSD alloc_init_deleg\n");
1151 	n = atomic_long_inc_return(&num_delegations);
1152 	if (n < 0 || n > max_delegations)
1153 		goto out_dec;
1154 	if (delegation_blocked(&fp->fi_fhandle))
1155 		goto out_dec;
1156 	stid = nfs4_alloc_stid(clp, deleg_slab, nfs4_free_deleg);
1157 	if (stid == NULL)
1158 		goto out_dec;
1159 	dp = delegstateid(stid);
1160 
1161 	/*
1162 	 * delegation seqid's are never incremented.  The 4.1 special
1163 	 * meaning of seqid 0 isn't meaningful, really, but let's avoid
1164 	 * 0 anyway just for consistency and use 1:
1165 	 */
1166 	dp->dl_stid.sc_stateid.si_generation = 1;
1167 	INIT_LIST_HEAD(&dp->dl_perfile);
1168 	INIT_LIST_HEAD(&dp->dl_perclnt);
1169 	INIT_LIST_HEAD(&dp->dl_recall_lru);
1170 	dp->dl_clnt_odstate = odstate;
1171 	get_clnt_odstate(odstate);
1172 	dp->dl_type = dl_type;
1173 	dp->dl_retries = 1;
1174 	dp->dl_recalled = false;
1175 	nfsd4_init_cb(&dp->dl_recall, dp->dl_stid.sc_client,
1176 		      &nfsd4_cb_recall_ops, NFSPROC4_CLNT_CB_RECALL);
1177 	nfsd4_init_cb(&dp->dl_cb_fattr.ncf_getattr, dp->dl_stid.sc_client,
1178 			&nfsd4_cb_getattr_ops, NFSPROC4_CLNT_CB_GETATTR);
1179 	dp->dl_cb_fattr.ncf_file_modified = false;
1180 	get_nfs4_file(fp);
1181 	dp->dl_stid.sc_file = fp;
1182 	return dp;
1183 out_dec:
1184 	atomic_long_dec(&num_delegations);
1185 	return NULL;
1186 }
1187 
1188 void
nfs4_put_stid(struct nfs4_stid * s)1189 nfs4_put_stid(struct nfs4_stid *s)
1190 {
1191 	struct nfs4_file *fp = s->sc_file;
1192 	struct nfs4_client *clp = s->sc_client;
1193 
1194 	might_lock(&clp->cl_lock);
1195 
1196 	if (!refcount_dec_and_lock(&s->sc_count, &clp->cl_lock)) {
1197 		wake_up_all(&close_wq);
1198 		return;
1199 	}
1200 	idr_remove(&clp->cl_stateids, s->sc_stateid.si_opaque.so_id);
1201 	if (s->sc_status & SC_STATUS_ADMIN_REVOKED)
1202 		atomic_dec(&s->sc_client->cl_admin_revoked);
1203 	nfs4_free_cpntf_statelist(clp->net, s);
1204 	spin_unlock(&clp->cl_lock);
1205 	s->sc_free(s);
1206 	if (fp)
1207 		put_nfs4_file(fp);
1208 }
1209 
1210 void
nfs4_inc_and_copy_stateid(stateid_t * dst,struct nfs4_stid * stid)1211 nfs4_inc_and_copy_stateid(stateid_t *dst, struct nfs4_stid *stid)
1212 {
1213 	stateid_t *src = &stid->sc_stateid;
1214 
1215 	spin_lock(&stid->sc_lock);
1216 	if (unlikely(++src->si_generation == 0))
1217 		src->si_generation = 1;
1218 	memcpy(dst, src, sizeof(*dst));
1219 	spin_unlock(&stid->sc_lock);
1220 }
1221 
put_deleg_file(struct nfs4_file * fp)1222 static void put_deleg_file(struct nfs4_file *fp)
1223 {
1224 	struct nfsd_file *nf = NULL;
1225 
1226 	spin_lock(&fp->fi_lock);
1227 	if (--fp->fi_delegees == 0)
1228 		swap(nf, fp->fi_deleg_file);
1229 	spin_unlock(&fp->fi_lock);
1230 
1231 	if (nf)
1232 		nfsd_file_put(nf);
1233 }
1234 
nfs4_unlock_deleg_lease(struct nfs4_delegation * dp)1235 static void nfs4_unlock_deleg_lease(struct nfs4_delegation *dp)
1236 {
1237 	struct nfs4_file *fp = dp->dl_stid.sc_file;
1238 	struct nfsd_file *nf = fp->fi_deleg_file;
1239 
1240 	WARN_ON_ONCE(!fp->fi_delegees);
1241 
1242 	kernel_setlease(nf->nf_file, F_UNLCK, NULL, (void **)&dp);
1243 	put_deleg_file(fp);
1244 }
1245 
destroy_unhashed_deleg(struct nfs4_delegation * dp)1246 static void destroy_unhashed_deleg(struct nfs4_delegation *dp)
1247 {
1248 	put_clnt_odstate(dp->dl_clnt_odstate);
1249 	nfs4_unlock_deleg_lease(dp);
1250 	nfs4_put_stid(&dp->dl_stid);
1251 }
1252 
1253 /**
1254  * nfs4_delegation_exists - Discover if this delegation already exists
1255  * @clp:     a pointer to the nfs4_client we're granting a delegation to
1256  * @fp:      a pointer to the nfs4_file we're granting a delegation on
1257  *
1258  * Return:
1259  *      On success: true iff an existing delegation is found
1260  */
1261 
1262 static bool
nfs4_delegation_exists(struct nfs4_client * clp,struct nfs4_file * fp)1263 nfs4_delegation_exists(struct nfs4_client *clp, struct nfs4_file *fp)
1264 {
1265 	struct nfs4_delegation *searchdp = NULL;
1266 	struct nfs4_client *searchclp = NULL;
1267 
1268 	lockdep_assert_held(&state_lock);
1269 	lockdep_assert_held(&fp->fi_lock);
1270 
1271 	list_for_each_entry(searchdp, &fp->fi_delegations, dl_perfile) {
1272 		searchclp = searchdp->dl_stid.sc_client;
1273 		if (clp == searchclp) {
1274 			return true;
1275 		}
1276 	}
1277 	return false;
1278 }
1279 
1280 /**
1281  * hash_delegation_locked - Add a delegation to the appropriate lists
1282  * @dp:     a pointer to the nfs4_delegation we are adding.
1283  * @fp:     a pointer to the nfs4_file we're granting a delegation on
1284  *
1285  * Return:
1286  *      On success: NULL if the delegation was successfully hashed.
1287  *
1288  *      On error: -EAGAIN if one was previously granted to this
1289  *                 nfs4_client for this nfs4_file. Delegation is not hashed.
1290  *
1291  */
1292 
1293 static int
hash_delegation_locked(struct nfs4_delegation * dp,struct nfs4_file * fp)1294 hash_delegation_locked(struct nfs4_delegation *dp, struct nfs4_file *fp)
1295 {
1296 	struct nfs4_client *clp = dp->dl_stid.sc_client;
1297 
1298 	lockdep_assert_held(&state_lock);
1299 	lockdep_assert_held(&fp->fi_lock);
1300 	lockdep_assert_held(&clp->cl_lock);
1301 
1302 	if (nfs4_delegation_exists(clp, fp))
1303 		return -EAGAIN;
1304 	refcount_inc(&dp->dl_stid.sc_count);
1305 	dp->dl_stid.sc_type = SC_TYPE_DELEG;
1306 	list_add(&dp->dl_perfile, &fp->fi_delegations);
1307 	list_add(&dp->dl_perclnt, &clp->cl_delegations);
1308 	return 0;
1309 }
1310 
delegation_hashed(struct nfs4_delegation * dp)1311 static bool delegation_hashed(struct nfs4_delegation *dp)
1312 {
1313 	return !(list_empty(&dp->dl_perfile));
1314 }
1315 
1316 static bool
unhash_delegation_locked(struct nfs4_delegation * dp,unsigned short statusmask)1317 unhash_delegation_locked(struct nfs4_delegation *dp, unsigned short statusmask)
1318 {
1319 	struct nfs4_file *fp = dp->dl_stid.sc_file;
1320 
1321 	lockdep_assert_held(&state_lock);
1322 
1323 	if (!delegation_hashed(dp))
1324 		return false;
1325 
1326 	if (statusmask == SC_STATUS_REVOKED &&
1327 	    dp->dl_stid.sc_client->cl_minorversion == 0)
1328 		statusmask = SC_STATUS_CLOSED;
1329 	dp->dl_stid.sc_status |= statusmask;
1330 	if (statusmask & SC_STATUS_ADMIN_REVOKED)
1331 		atomic_inc(&dp->dl_stid.sc_client->cl_admin_revoked);
1332 
1333 	/* Ensure that deleg break won't try to requeue it */
1334 	++dp->dl_time;
1335 	spin_lock(&fp->fi_lock);
1336 	list_del_init(&dp->dl_perclnt);
1337 	list_del_init(&dp->dl_recall_lru);
1338 	list_del_init(&dp->dl_perfile);
1339 	spin_unlock(&fp->fi_lock);
1340 	return true;
1341 }
1342 
destroy_delegation(struct nfs4_delegation * dp)1343 static void destroy_delegation(struct nfs4_delegation *dp)
1344 {
1345 	bool unhashed;
1346 
1347 	spin_lock(&state_lock);
1348 	unhashed = unhash_delegation_locked(dp, SC_STATUS_CLOSED);
1349 	spin_unlock(&state_lock);
1350 	if (unhashed)
1351 		destroy_unhashed_deleg(dp);
1352 }
1353 
1354 /**
1355  * revoke_delegation - perform nfs4 delegation structure cleanup
1356  * @dp: pointer to the delegation
1357  *
1358  * This function assumes that it's called either from the administrative
1359  * interface (nfsd4_revoke_states()) that's revoking a specific delegation
1360  * stateid or it's called from a laundromat thread (nfsd4_landromat()) that
1361  * determined that this specific state has expired and needs to be revoked
1362  * (both mark state with the appropriate stid sc_status mode). It is also
1363  * assumed that a reference was taken on the @dp state.
1364  *
1365  * If this function finds that the @dp state is SC_STATUS_FREED it means
1366  * that a FREE_STATEID operation for this stateid has been processed and
1367  * we can proceed to removing it from recalled list. However, if @dp state
1368  * isn't marked SC_STATUS_FREED, it means we need place it on the cl_revoked
1369  * list and wait for the FREE_STATEID to arrive from the client. At the same
1370  * time, we need to mark it as SC_STATUS_FREEABLE to indicate to the
1371  * nfsd4_free_stateid() function that this stateid has already been added
1372  * to the cl_revoked list and that nfsd4_free_stateid() is now responsible
1373  * for removing it from the list. Inspection of where the delegation state
1374  * in the revocation process is protected by the clp->cl_lock.
1375  */
revoke_delegation(struct nfs4_delegation * dp)1376 static void revoke_delegation(struct nfs4_delegation *dp)
1377 {
1378 	struct nfs4_client *clp = dp->dl_stid.sc_client;
1379 
1380 	WARN_ON(!list_empty(&dp->dl_recall_lru));
1381 	WARN_ON_ONCE(!(dp->dl_stid.sc_status &
1382 		     (SC_STATUS_REVOKED | SC_STATUS_ADMIN_REVOKED)));
1383 
1384 	trace_nfsd_stid_revoke(&dp->dl_stid);
1385 
1386 	spin_lock(&clp->cl_lock);
1387 	if (dp->dl_stid.sc_status & SC_STATUS_FREED) {
1388 		list_del_init(&dp->dl_recall_lru);
1389 		goto out;
1390 	}
1391 	list_add(&dp->dl_recall_lru, &clp->cl_revoked);
1392 	dp->dl_stid.sc_status |= SC_STATUS_FREEABLE;
1393 out:
1394 	spin_unlock(&clp->cl_lock);
1395 	destroy_unhashed_deleg(dp);
1396 }
1397 
1398 /*
1399  * SETCLIENTID state
1400  */
1401 
clientid_hashval(u32 id)1402 static unsigned int clientid_hashval(u32 id)
1403 {
1404 	return id & CLIENT_HASH_MASK;
1405 }
1406 
clientstr_hashval(struct xdr_netobj name)1407 static unsigned int clientstr_hashval(struct xdr_netobj name)
1408 {
1409 	return opaque_hashval(name.data, 8) & CLIENT_HASH_MASK;
1410 }
1411 
1412 /*
1413  * A stateid that had a deny mode associated with it is being released
1414  * or downgraded. Recalculate the deny mode on the file.
1415  */
1416 static void
recalculate_deny_mode(struct nfs4_file * fp)1417 recalculate_deny_mode(struct nfs4_file *fp)
1418 {
1419 	struct nfs4_ol_stateid *stp;
1420 	u32 old_deny;
1421 
1422 	spin_lock(&fp->fi_lock);
1423 	old_deny = fp->fi_share_deny;
1424 	fp->fi_share_deny = 0;
1425 	list_for_each_entry(stp, &fp->fi_stateids, st_perfile) {
1426 		fp->fi_share_deny |= bmap_to_share_mode(stp->st_deny_bmap);
1427 		if (fp->fi_share_deny == old_deny)
1428 			break;
1429 	}
1430 	spin_unlock(&fp->fi_lock);
1431 }
1432 
1433 static void
reset_union_bmap_deny(u32 deny,struct nfs4_ol_stateid * stp)1434 reset_union_bmap_deny(u32 deny, struct nfs4_ol_stateid *stp)
1435 {
1436 	int i;
1437 	bool change = false;
1438 
1439 	for (i = 1; i < 4; i++) {
1440 		if ((i & deny) != i) {
1441 			change = true;
1442 			clear_deny(i, stp);
1443 		}
1444 	}
1445 
1446 	/* Recalculate per-file deny mode if there was a change */
1447 	if (change)
1448 		recalculate_deny_mode(stp->st_stid.sc_file);
1449 }
1450 
1451 /* release all access and file references for a given stateid */
1452 static void
release_all_access(struct nfs4_ol_stateid * stp)1453 release_all_access(struct nfs4_ol_stateid *stp)
1454 {
1455 	int i;
1456 	struct nfs4_file *fp = stp->st_stid.sc_file;
1457 
1458 	if (fp && stp->st_deny_bmap != 0)
1459 		recalculate_deny_mode(fp);
1460 
1461 	for (i = 1; i < 4; i++) {
1462 		if (test_access(i, stp))
1463 			nfs4_file_put_access(stp->st_stid.sc_file, i);
1464 		clear_access(i, stp);
1465 	}
1466 }
1467 
nfs4_free_stateowner(struct nfs4_stateowner * sop)1468 static inline void nfs4_free_stateowner(struct nfs4_stateowner *sop)
1469 {
1470 	kfree(sop->so_owner.data);
1471 	sop->so_ops->so_free(sop);
1472 }
1473 
nfs4_put_stateowner(struct nfs4_stateowner * sop)1474 static void nfs4_put_stateowner(struct nfs4_stateowner *sop)
1475 {
1476 	struct nfs4_client *clp = sop->so_client;
1477 
1478 	might_lock(&clp->cl_lock);
1479 
1480 	if (!atomic_dec_and_lock(&sop->so_count, &clp->cl_lock))
1481 		return;
1482 	sop->so_ops->so_unhash(sop);
1483 	spin_unlock(&clp->cl_lock);
1484 	nfs4_free_stateowner(sop);
1485 }
1486 
1487 static bool
nfs4_ol_stateid_unhashed(const struct nfs4_ol_stateid * stp)1488 nfs4_ol_stateid_unhashed(const struct nfs4_ol_stateid *stp)
1489 {
1490 	return list_empty(&stp->st_perfile);
1491 }
1492 
unhash_ol_stateid(struct nfs4_ol_stateid * stp)1493 static bool unhash_ol_stateid(struct nfs4_ol_stateid *stp)
1494 {
1495 	struct nfs4_file *fp = stp->st_stid.sc_file;
1496 
1497 	lockdep_assert_held(&stp->st_stateowner->so_client->cl_lock);
1498 
1499 	if (list_empty(&stp->st_perfile))
1500 		return false;
1501 
1502 	spin_lock(&fp->fi_lock);
1503 	list_del_init(&stp->st_perfile);
1504 	spin_unlock(&fp->fi_lock);
1505 	list_del(&stp->st_perstateowner);
1506 	return true;
1507 }
1508 
nfs4_free_ol_stateid(struct nfs4_stid * stid)1509 static void nfs4_free_ol_stateid(struct nfs4_stid *stid)
1510 {
1511 	struct nfs4_ol_stateid *stp = openlockstateid(stid);
1512 
1513 	put_clnt_odstate(stp->st_clnt_odstate);
1514 	release_all_access(stp);
1515 	if (stp->st_stateowner)
1516 		nfs4_put_stateowner(stp->st_stateowner);
1517 	WARN_ON(!list_empty(&stid->sc_cp_list));
1518 	kmem_cache_free(stateid_slab, stid);
1519 }
1520 
nfs4_free_lock_stateid(struct nfs4_stid * stid)1521 static void nfs4_free_lock_stateid(struct nfs4_stid *stid)
1522 {
1523 	struct nfs4_ol_stateid *stp = openlockstateid(stid);
1524 	struct nfs4_lockowner *lo = lockowner(stp->st_stateowner);
1525 	struct nfsd_file *nf;
1526 
1527 	nf = find_any_file(stp->st_stid.sc_file);
1528 	if (nf) {
1529 		get_file(nf->nf_file);
1530 		filp_close(nf->nf_file, (fl_owner_t)lo);
1531 		nfsd_file_put(nf);
1532 	}
1533 	nfs4_free_ol_stateid(stid);
1534 }
1535 
1536 /*
1537  * Put the persistent reference to an already unhashed generic stateid, while
1538  * holding the cl_lock. If it's the last reference, then put it onto the
1539  * reaplist for later destruction.
1540  */
put_ol_stateid_locked(struct nfs4_ol_stateid * stp,struct list_head * reaplist)1541 static void put_ol_stateid_locked(struct nfs4_ol_stateid *stp,
1542 				       struct list_head *reaplist)
1543 {
1544 	struct nfs4_stid *s = &stp->st_stid;
1545 	struct nfs4_client *clp = s->sc_client;
1546 
1547 	lockdep_assert_held(&clp->cl_lock);
1548 
1549 	WARN_ON_ONCE(!list_empty(&stp->st_locks));
1550 
1551 	if (!refcount_dec_and_test(&s->sc_count)) {
1552 		wake_up_all(&close_wq);
1553 		return;
1554 	}
1555 
1556 	idr_remove(&clp->cl_stateids, s->sc_stateid.si_opaque.so_id);
1557 	if (s->sc_status & SC_STATUS_ADMIN_REVOKED)
1558 		atomic_dec(&s->sc_client->cl_admin_revoked);
1559 	list_add(&stp->st_locks, reaplist);
1560 }
1561 
unhash_lock_stateid(struct nfs4_ol_stateid * stp)1562 static bool unhash_lock_stateid(struct nfs4_ol_stateid *stp)
1563 {
1564 	lockdep_assert_held(&stp->st_stid.sc_client->cl_lock);
1565 
1566 	if (!unhash_ol_stateid(stp))
1567 		return false;
1568 	list_del_init(&stp->st_locks);
1569 	stp->st_stid.sc_status |= SC_STATUS_CLOSED;
1570 	return true;
1571 }
1572 
release_lock_stateid(struct nfs4_ol_stateid * stp)1573 static void release_lock_stateid(struct nfs4_ol_stateid *stp)
1574 {
1575 	struct nfs4_client *clp = stp->st_stid.sc_client;
1576 	bool unhashed;
1577 
1578 	spin_lock(&clp->cl_lock);
1579 	unhashed = unhash_lock_stateid(stp);
1580 	spin_unlock(&clp->cl_lock);
1581 	if (unhashed)
1582 		nfs4_put_stid(&stp->st_stid);
1583 }
1584 
unhash_lockowner_locked(struct nfs4_lockowner * lo)1585 static void unhash_lockowner_locked(struct nfs4_lockowner *lo)
1586 {
1587 	struct nfs4_client *clp = lo->lo_owner.so_client;
1588 
1589 	lockdep_assert_held(&clp->cl_lock);
1590 
1591 	list_del_init(&lo->lo_owner.so_strhash);
1592 }
1593 
1594 /*
1595  * Free a list of generic stateids that were collected earlier after being
1596  * fully unhashed.
1597  */
1598 static void
free_ol_stateid_reaplist(struct list_head * reaplist)1599 free_ol_stateid_reaplist(struct list_head *reaplist)
1600 {
1601 	struct nfs4_ol_stateid *stp;
1602 	struct nfs4_file *fp;
1603 
1604 	might_sleep();
1605 
1606 	while (!list_empty(reaplist)) {
1607 		stp = list_first_entry(reaplist, struct nfs4_ol_stateid,
1608 				       st_locks);
1609 		list_del(&stp->st_locks);
1610 		fp = stp->st_stid.sc_file;
1611 		stp->st_stid.sc_free(&stp->st_stid);
1612 		if (fp)
1613 			put_nfs4_file(fp);
1614 	}
1615 }
1616 
release_open_stateid_locks(struct nfs4_ol_stateid * open_stp,struct list_head * reaplist)1617 static void release_open_stateid_locks(struct nfs4_ol_stateid *open_stp,
1618 				       struct list_head *reaplist)
1619 {
1620 	struct nfs4_ol_stateid *stp;
1621 
1622 	lockdep_assert_held(&open_stp->st_stid.sc_client->cl_lock);
1623 
1624 	while (!list_empty(&open_stp->st_locks)) {
1625 		stp = list_entry(open_stp->st_locks.next,
1626 				struct nfs4_ol_stateid, st_locks);
1627 		unhash_lock_stateid(stp);
1628 		put_ol_stateid_locked(stp, reaplist);
1629 	}
1630 }
1631 
unhash_open_stateid(struct nfs4_ol_stateid * stp,struct list_head * reaplist)1632 static bool unhash_open_stateid(struct nfs4_ol_stateid *stp,
1633 				struct list_head *reaplist)
1634 {
1635 	lockdep_assert_held(&stp->st_stid.sc_client->cl_lock);
1636 
1637 	if (!unhash_ol_stateid(stp))
1638 		return false;
1639 	release_open_stateid_locks(stp, reaplist);
1640 	return true;
1641 }
1642 
release_open_stateid(struct nfs4_ol_stateid * stp)1643 static void release_open_stateid(struct nfs4_ol_stateid *stp)
1644 {
1645 	LIST_HEAD(reaplist);
1646 
1647 	spin_lock(&stp->st_stid.sc_client->cl_lock);
1648 	stp->st_stid.sc_status |= SC_STATUS_CLOSED;
1649 	if (unhash_open_stateid(stp, &reaplist))
1650 		put_ol_stateid_locked(stp, &reaplist);
1651 	spin_unlock(&stp->st_stid.sc_client->cl_lock);
1652 	free_ol_stateid_reaplist(&reaplist);
1653 }
1654 
nfs4_openowner_unhashed(struct nfs4_openowner * oo)1655 static bool nfs4_openowner_unhashed(struct nfs4_openowner *oo)
1656 {
1657 	lockdep_assert_held(&oo->oo_owner.so_client->cl_lock);
1658 
1659 	return list_empty(&oo->oo_owner.so_strhash) &&
1660 		list_empty(&oo->oo_perclient);
1661 }
1662 
unhash_openowner_locked(struct nfs4_openowner * oo)1663 static void unhash_openowner_locked(struct nfs4_openowner *oo)
1664 {
1665 	struct nfs4_client *clp = oo->oo_owner.so_client;
1666 
1667 	lockdep_assert_held(&clp->cl_lock);
1668 
1669 	list_del_init(&oo->oo_owner.so_strhash);
1670 	list_del_init(&oo->oo_perclient);
1671 }
1672 
release_last_closed_stateid(struct nfs4_openowner * oo)1673 static void release_last_closed_stateid(struct nfs4_openowner *oo)
1674 {
1675 	struct nfsd_net *nn = net_generic(oo->oo_owner.so_client->net,
1676 					  nfsd_net_id);
1677 	struct nfs4_ol_stateid *s;
1678 
1679 	spin_lock(&nn->client_lock);
1680 	s = oo->oo_last_closed_stid;
1681 	if (s) {
1682 		list_del_init(&oo->oo_close_lru);
1683 		oo->oo_last_closed_stid = NULL;
1684 	}
1685 	spin_unlock(&nn->client_lock);
1686 	if (s)
1687 		nfs4_put_stid(&s->st_stid);
1688 }
1689 
release_openowner(struct nfs4_openowner * oo)1690 static void release_openowner(struct nfs4_openowner *oo)
1691 {
1692 	struct nfs4_ol_stateid *stp;
1693 	struct nfs4_client *clp = oo->oo_owner.so_client;
1694 	LIST_HEAD(reaplist);
1695 
1696 	spin_lock(&clp->cl_lock);
1697 	unhash_openowner_locked(oo);
1698 	while (!list_empty(&oo->oo_owner.so_stateids)) {
1699 		stp = list_first_entry(&oo->oo_owner.so_stateids,
1700 				struct nfs4_ol_stateid, st_perstateowner);
1701 		if (unhash_open_stateid(stp, &reaplist))
1702 			put_ol_stateid_locked(stp, &reaplist);
1703 	}
1704 	spin_unlock(&clp->cl_lock);
1705 	free_ol_stateid_reaplist(&reaplist);
1706 	release_last_closed_stateid(oo);
1707 	nfs4_put_stateowner(&oo->oo_owner);
1708 }
1709 
find_one_sb_stid(struct nfs4_client * clp,struct super_block * sb,unsigned int sc_types)1710 static struct nfs4_stid *find_one_sb_stid(struct nfs4_client *clp,
1711 					  struct super_block *sb,
1712 					  unsigned int sc_types)
1713 {
1714 	unsigned long id, tmp;
1715 	struct nfs4_stid *stid;
1716 
1717 	spin_lock(&clp->cl_lock);
1718 	idr_for_each_entry_ul(&clp->cl_stateids, stid, tmp, id)
1719 		if ((stid->sc_type & sc_types) &&
1720 		    stid->sc_status == 0 &&
1721 		    stid->sc_file->fi_inode->i_sb == sb) {
1722 			refcount_inc(&stid->sc_count);
1723 			break;
1724 		}
1725 	spin_unlock(&clp->cl_lock);
1726 	return stid;
1727 }
1728 
1729 /**
1730  * nfsd4_revoke_states - revoke all nfsv4 states associated with given filesystem
1731  * @net:  used to identify instance of nfsd (there is one per net namespace)
1732  * @sb:   super_block used to identify target filesystem
1733  *
1734  * All nfs4 states (open, lock, delegation, layout) held by the server instance
1735  * and associated with a file on the given filesystem will be revoked resulting
1736  * in any files being closed and so all references from nfsd to the filesystem
1737  * being released.  Thus nfsd will no longer prevent the filesystem from being
1738  * unmounted.
1739  *
1740  * The clients which own the states will subsequently being notified that the
1741  * states have been "admin-revoked".
1742  */
nfsd4_revoke_states(struct net * net,struct super_block * sb)1743 void nfsd4_revoke_states(struct net *net, struct super_block *sb)
1744 {
1745 	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
1746 	unsigned int idhashval;
1747 	unsigned int sc_types;
1748 
1749 	sc_types = SC_TYPE_OPEN | SC_TYPE_LOCK | SC_TYPE_DELEG | SC_TYPE_LAYOUT;
1750 
1751 	spin_lock(&nn->client_lock);
1752 	for (idhashval = 0; idhashval < CLIENT_HASH_MASK; idhashval++) {
1753 		struct list_head *head = &nn->conf_id_hashtbl[idhashval];
1754 		struct nfs4_client *clp;
1755 	retry:
1756 		list_for_each_entry(clp, head, cl_idhash) {
1757 			struct nfs4_stid *stid = find_one_sb_stid(clp, sb,
1758 								  sc_types);
1759 			if (stid) {
1760 				struct nfs4_ol_stateid *stp;
1761 				struct nfs4_delegation *dp;
1762 				struct nfs4_layout_stateid *ls;
1763 
1764 				spin_unlock(&nn->client_lock);
1765 				switch (stid->sc_type) {
1766 				case SC_TYPE_OPEN:
1767 					stp = openlockstateid(stid);
1768 					mutex_lock_nested(&stp->st_mutex,
1769 							  OPEN_STATEID_MUTEX);
1770 
1771 					spin_lock(&clp->cl_lock);
1772 					if (stid->sc_status == 0) {
1773 						stid->sc_status |=
1774 							SC_STATUS_ADMIN_REVOKED;
1775 						atomic_inc(&clp->cl_admin_revoked);
1776 						spin_unlock(&clp->cl_lock);
1777 						release_all_access(stp);
1778 					} else
1779 						spin_unlock(&clp->cl_lock);
1780 					mutex_unlock(&stp->st_mutex);
1781 					break;
1782 				case SC_TYPE_LOCK:
1783 					stp = openlockstateid(stid);
1784 					mutex_lock_nested(&stp->st_mutex,
1785 							  LOCK_STATEID_MUTEX);
1786 					spin_lock(&clp->cl_lock);
1787 					if (stid->sc_status == 0) {
1788 						struct nfs4_lockowner *lo =
1789 							lockowner(stp->st_stateowner);
1790 						struct nfsd_file *nf;
1791 
1792 						stid->sc_status |=
1793 							SC_STATUS_ADMIN_REVOKED;
1794 						atomic_inc(&clp->cl_admin_revoked);
1795 						spin_unlock(&clp->cl_lock);
1796 						nf = find_any_file(stp->st_stid.sc_file);
1797 						if (nf) {
1798 							get_file(nf->nf_file);
1799 							filp_close(nf->nf_file,
1800 								   (fl_owner_t)lo);
1801 							nfsd_file_put(nf);
1802 						}
1803 						release_all_access(stp);
1804 					} else
1805 						spin_unlock(&clp->cl_lock);
1806 					mutex_unlock(&stp->st_mutex);
1807 					break;
1808 				case SC_TYPE_DELEG:
1809 					refcount_inc(&stid->sc_count);
1810 					dp = delegstateid(stid);
1811 					spin_lock(&state_lock);
1812 					if (!unhash_delegation_locked(
1813 						    dp, SC_STATUS_ADMIN_REVOKED))
1814 						dp = NULL;
1815 					spin_unlock(&state_lock);
1816 					if (dp)
1817 						revoke_delegation(dp);
1818 					break;
1819 				case SC_TYPE_LAYOUT:
1820 					ls = layoutstateid(stid);
1821 					nfsd4_close_layout(ls);
1822 					break;
1823 				}
1824 				nfs4_put_stid(stid);
1825 				spin_lock(&nn->client_lock);
1826 				if (clp->cl_minorversion == 0)
1827 					/* Allow cleanup after a lease period.
1828 					 * store_release ensures cleanup will
1829 					 * see any newly revoked states if it
1830 					 * sees the time updated.
1831 					 */
1832 					nn->nfs40_last_revoke =
1833 						ktime_get_boottime_seconds();
1834 				goto retry;
1835 			}
1836 		}
1837 	}
1838 	spin_unlock(&nn->client_lock);
1839 }
1840 
1841 static inline int
hash_sessionid(struct nfs4_sessionid * sessionid)1842 hash_sessionid(struct nfs4_sessionid *sessionid)
1843 {
1844 	struct nfsd4_sessionid *sid = (struct nfsd4_sessionid *)sessionid;
1845 
1846 	return sid->sequence % SESSION_HASH_SIZE;
1847 }
1848 
1849 #ifdef CONFIG_SUNRPC_DEBUG
1850 static inline void
dump_sessionid(const char * fn,struct nfs4_sessionid * sessionid)1851 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
1852 {
1853 	u32 *ptr = (u32 *)(&sessionid->data[0]);
1854 	dprintk("%s: %u:%u:%u:%u\n", fn, ptr[0], ptr[1], ptr[2], ptr[3]);
1855 }
1856 #else
1857 static inline void
dump_sessionid(const char * fn,struct nfs4_sessionid * sessionid)1858 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
1859 {
1860 }
1861 #endif
1862 
1863 /*
1864  * Bump the seqid on cstate->replay_owner, and clear replay_owner if it
1865  * won't be used for replay.
1866  */
nfsd4_bump_seqid(struct nfsd4_compound_state * cstate,__be32 nfserr)1867 void nfsd4_bump_seqid(struct nfsd4_compound_state *cstate, __be32 nfserr)
1868 {
1869 	struct nfs4_stateowner *so = cstate->replay_owner;
1870 
1871 	if (nfserr == nfserr_replay_me)
1872 		return;
1873 
1874 	if (!seqid_mutating_err(ntohl(nfserr))) {
1875 		nfsd4_cstate_clear_replay(cstate);
1876 		return;
1877 	}
1878 	if (!so)
1879 		return;
1880 	if (so->so_is_open_owner)
1881 		release_last_closed_stateid(openowner(so));
1882 	so->so_seqid++;
1883 	return;
1884 }
1885 
1886 static void
gen_sessionid(struct nfsd4_session * ses)1887 gen_sessionid(struct nfsd4_session *ses)
1888 {
1889 	struct nfs4_client *clp = ses->se_client;
1890 	struct nfsd4_sessionid *sid;
1891 
1892 	sid = (struct nfsd4_sessionid *)ses->se_sessionid.data;
1893 	sid->clientid = clp->cl_clientid;
1894 	sid->sequence = current_sessionid++;
1895 	sid->reserved = 0;
1896 }
1897 
1898 /*
1899  * The protocol defines ca_maxresponssize_cached to include the size of
1900  * the rpc header, but all we need to cache is the data starting after
1901  * the end of the initial SEQUENCE operation--the rest we regenerate
1902  * each time.  Therefore we can advertise a ca_maxresponssize_cached
1903  * value that is the number of bytes in our cache plus a few additional
1904  * bytes.  In order to stay on the safe side, and not promise more than
1905  * we can cache, those additional bytes must be the minimum possible: 24
1906  * bytes of rpc header (xid through accept state, with AUTH_NULL
1907  * verifier), 12 for the compound header (with zero-length tag), and 44
1908  * for the SEQUENCE op response:
1909  */
1910 #define NFSD_MIN_HDR_SEQ_SZ  (24 + 12 + 44)
1911 
1912 static struct shrinker *nfsd_slot_shrinker;
1913 static DEFINE_SPINLOCK(nfsd_session_list_lock);
1914 static LIST_HEAD(nfsd_session_list);
1915 /* The sum of "target_slots-1" on every session.  The shrinker can push this
1916  * down, though it can take a little while for the memory to actually
1917  * be freed.  The "-1" is because we can never free slot 0 while the
1918  * session is active.
1919  */
1920 static atomic_t nfsd_total_target_slots = ATOMIC_INIT(0);
1921 
1922 static void
free_session_slots(struct nfsd4_session * ses,int from)1923 free_session_slots(struct nfsd4_session *ses, int from)
1924 {
1925 	int i;
1926 
1927 	if (from >= ses->se_fchannel.maxreqs)
1928 		return;
1929 
1930 	for (i = from; i < ses->se_fchannel.maxreqs; i++) {
1931 		struct nfsd4_slot *slot = xa_load(&ses->se_slots, i);
1932 
1933 		/*
1934 		 * Save the seqid in case we reactivate this slot.
1935 		 * This will never require a memory allocation so GFP
1936 		 * flag is irrelevant
1937 		 */
1938 		xa_store(&ses->se_slots, i, xa_mk_value(slot->sl_seqid), 0);
1939 		free_svc_cred(&slot->sl_cred);
1940 		kfree(slot);
1941 	}
1942 	ses->se_fchannel.maxreqs = from;
1943 	if (ses->se_target_maxslots > from) {
1944 		int new_target = from ?: 1;
1945 		atomic_sub(ses->se_target_maxslots - new_target, &nfsd_total_target_slots);
1946 		ses->se_target_maxslots = new_target;
1947 	}
1948 }
1949 
1950 /**
1951  * reduce_session_slots - reduce the target max-slots of a session if possible
1952  * @ses:  The session to affect
1953  * @dec:  how much to decrease the target by
1954  *
1955  * This interface can be used by a shrinker to reduce the target max-slots
1956  * for a session so that some slots can eventually be freed.
1957  * It uses spin_trylock() as it may be called in a context where another
1958  * spinlock is held that has a dependency on client_lock.  As shrinkers are
1959  * best-effort, skiping a session is client_lock is already held has no
1960  * great coast
1961  *
1962  * Return value:
1963  *   The number of slots that the target was reduced by.
1964  */
1965 static int
reduce_session_slots(struct nfsd4_session * ses,int dec)1966 reduce_session_slots(struct nfsd4_session *ses, int dec)
1967 {
1968 	struct nfsd_net *nn = net_generic(ses->se_client->net,
1969 					  nfsd_net_id);
1970 	int ret = 0;
1971 
1972 	if (ses->se_target_maxslots <= 1)
1973 		return ret;
1974 	if (!spin_trylock(&nn->client_lock))
1975 		return ret;
1976 	ret = min(dec, ses->se_target_maxslots-1);
1977 	ses->se_target_maxslots -= ret;
1978 	atomic_sub(ret, &nfsd_total_target_slots);
1979 	ses->se_slot_gen += 1;
1980 	if (ses->se_slot_gen == 0) {
1981 		int i;
1982 		ses->se_slot_gen = 1;
1983 		for (i = 0; i < ses->se_fchannel.maxreqs; i++) {
1984 			struct nfsd4_slot *slot = xa_load(&ses->se_slots, i);
1985 			slot->sl_generation = 0;
1986 		}
1987 	}
1988 	spin_unlock(&nn->client_lock);
1989 	return ret;
1990 }
1991 
1992 /*
1993  * We don't actually need to cache the rpc and session headers, so we
1994  * can allocate a little less for each slot:
1995  */
slot_bytes(struct nfsd4_channel_attrs * ca)1996 static inline u32 slot_bytes(struct nfsd4_channel_attrs *ca)
1997 {
1998 	u32 size;
1999 
2000 	if (ca->maxresp_cached < NFSD_MIN_HDR_SEQ_SZ)
2001 		size = 0;
2002 	else
2003 		size = ca->maxresp_cached - NFSD_MIN_HDR_SEQ_SZ;
2004 	return size + sizeof(struct nfsd4_slot);
2005 }
2006 
alloc_session(struct nfsd4_channel_attrs * fattrs,struct nfsd4_channel_attrs * battrs)2007 static struct nfsd4_session *alloc_session(struct nfsd4_channel_attrs *fattrs,
2008 					   struct nfsd4_channel_attrs *battrs)
2009 {
2010 	int numslots = fattrs->maxreqs;
2011 	int slotsize = slot_bytes(fattrs);
2012 	struct nfsd4_session *new;
2013 	struct nfsd4_slot *slot;
2014 	int i;
2015 
2016 	new = kzalloc(sizeof(*new), GFP_KERNEL);
2017 	if (!new)
2018 		return NULL;
2019 	xa_init(&new->se_slots);
2020 	/* allocate each struct nfsd4_slot and data cache in one piece */
2021 	slot = kzalloc(slotsize, GFP_KERNEL);
2022 	if (!slot || xa_is_err(xa_store(&new->se_slots, 0, slot, GFP_KERNEL)))
2023 		goto out_free;
2024 
2025 	for (i = 1; i < numslots; i++) {
2026 		const gfp_t gfp = GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN;
2027 		slot = kzalloc(slotsize, gfp);
2028 		if (!slot)
2029 			break;
2030 		if (xa_is_err(xa_store(&new->se_slots, i, slot, gfp))) {
2031 			kfree(slot);
2032 			break;
2033 		}
2034 	}
2035 	fattrs->maxreqs = i;
2036 	memcpy(&new->se_fchannel, fattrs, sizeof(struct nfsd4_channel_attrs));
2037 	new->se_target_maxslots = i;
2038 	atomic_add(i - 1, &nfsd_total_target_slots);
2039 	new->se_cb_slot_avail = ~0U;
2040 	new->se_cb_highest_slot = min(battrs->maxreqs - 1,
2041 				      NFSD_BC_SLOT_TABLE_SIZE - 1);
2042 	spin_lock_init(&new->se_lock);
2043 	return new;
2044 out_free:
2045 	kfree(slot);
2046 	xa_destroy(&new->se_slots);
2047 	kfree(new);
2048 	return NULL;
2049 }
2050 
free_conn(struct nfsd4_conn * c)2051 static void free_conn(struct nfsd4_conn *c)
2052 {
2053 	svc_xprt_put(c->cn_xprt);
2054 	kfree(c);
2055 }
2056 
nfsd4_conn_lost(struct svc_xpt_user * u)2057 static void nfsd4_conn_lost(struct svc_xpt_user *u)
2058 {
2059 	struct nfsd4_conn *c = container_of(u, struct nfsd4_conn, cn_xpt_user);
2060 	struct nfs4_client *clp = c->cn_session->se_client;
2061 
2062 	trace_nfsd_cb_lost(clp);
2063 
2064 	spin_lock(&clp->cl_lock);
2065 	if (!list_empty(&c->cn_persession)) {
2066 		list_del(&c->cn_persession);
2067 		free_conn(c);
2068 	}
2069 	nfsd4_probe_callback(clp);
2070 	spin_unlock(&clp->cl_lock);
2071 }
2072 
alloc_conn(struct svc_rqst * rqstp,u32 flags)2073 static struct nfsd4_conn *alloc_conn(struct svc_rqst *rqstp, u32 flags)
2074 {
2075 	struct nfsd4_conn *conn;
2076 
2077 	conn = kmalloc(sizeof(struct nfsd4_conn), GFP_KERNEL);
2078 	if (!conn)
2079 		return NULL;
2080 	svc_xprt_get(rqstp->rq_xprt);
2081 	conn->cn_xprt = rqstp->rq_xprt;
2082 	conn->cn_flags = flags;
2083 	INIT_LIST_HEAD(&conn->cn_xpt_user.list);
2084 	return conn;
2085 }
2086 
__nfsd4_hash_conn(struct nfsd4_conn * conn,struct nfsd4_session * ses)2087 static void __nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
2088 {
2089 	conn->cn_session = ses;
2090 	list_add(&conn->cn_persession, &ses->se_conns);
2091 }
2092 
nfsd4_hash_conn(struct nfsd4_conn * conn,struct nfsd4_session * ses)2093 static void nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
2094 {
2095 	struct nfs4_client *clp = ses->se_client;
2096 
2097 	spin_lock(&clp->cl_lock);
2098 	__nfsd4_hash_conn(conn, ses);
2099 	spin_unlock(&clp->cl_lock);
2100 }
2101 
nfsd4_register_conn(struct nfsd4_conn * conn)2102 static int nfsd4_register_conn(struct nfsd4_conn *conn)
2103 {
2104 	conn->cn_xpt_user.callback = nfsd4_conn_lost;
2105 	return register_xpt_user(conn->cn_xprt, &conn->cn_xpt_user);
2106 }
2107 
nfsd4_init_conn(struct svc_rqst * rqstp,struct nfsd4_conn * conn,struct nfsd4_session * ses)2108 static void nfsd4_init_conn(struct svc_rqst *rqstp, struct nfsd4_conn *conn, struct nfsd4_session *ses)
2109 {
2110 	int ret;
2111 
2112 	nfsd4_hash_conn(conn, ses);
2113 	ret = nfsd4_register_conn(conn);
2114 	if (ret)
2115 		/* oops; xprt is already down: */
2116 		nfsd4_conn_lost(&conn->cn_xpt_user);
2117 	/* We may have gained or lost a callback channel: */
2118 	nfsd4_probe_callback_sync(ses->se_client);
2119 }
2120 
alloc_conn_from_crses(struct svc_rqst * rqstp,struct nfsd4_create_session * cses)2121 static struct nfsd4_conn *alloc_conn_from_crses(struct svc_rqst *rqstp, struct nfsd4_create_session *cses)
2122 {
2123 	u32 dir = NFS4_CDFC4_FORE;
2124 
2125 	if (cses->flags & SESSION4_BACK_CHAN)
2126 		dir |= NFS4_CDFC4_BACK;
2127 	return alloc_conn(rqstp, dir);
2128 }
2129 
2130 /* must be called under client_lock */
nfsd4_del_conns(struct nfsd4_session * s)2131 static void nfsd4_del_conns(struct nfsd4_session *s)
2132 {
2133 	struct nfs4_client *clp = s->se_client;
2134 	struct nfsd4_conn *c;
2135 
2136 	spin_lock(&clp->cl_lock);
2137 	while (!list_empty(&s->se_conns)) {
2138 		c = list_first_entry(&s->se_conns, struct nfsd4_conn, cn_persession);
2139 		list_del_init(&c->cn_persession);
2140 		spin_unlock(&clp->cl_lock);
2141 
2142 		unregister_xpt_user(c->cn_xprt, &c->cn_xpt_user);
2143 		free_conn(c);
2144 
2145 		spin_lock(&clp->cl_lock);
2146 	}
2147 	spin_unlock(&clp->cl_lock);
2148 }
2149 
__free_session(struct nfsd4_session * ses)2150 static void __free_session(struct nfsd4_session *ses)
2151 {
2152 	free_session_slots(ses, 0);
2153 	xa_destroy(&ses->se_slots);
2154 	kfree(ses);
2155 }
2156 
free_session(struct nfsd4_session * ses)2157 static void free_session(struct nfsd4_session *ses)
2158 {
2159 	nfsd4_del_conns(ses);
2160 	__free_session(ses);
2161 }
2162 
2163 static unsigned long
nfsd_slot_count(struct shrinker * s,struct shrink_control * sc)2164 nfsd_slot_count(struct shrinker *s, struct shrink_control *sc)
2165 {
2166 	unsigned long cnt = atomic_read(&nfsd_total_target_slots);
2167 
2168 	return cnt ? cnt : SHRINK_EMPTY;
2169 }
2170 
2171 static unsigned long
nfsd_slot_scan(struct shrinker * s,struct shrink_control * sc)2172 nfsd_slot_scan(struct shrinker *s, struct shrink_control *sc)
2173 {
2174 	struct nfsd4_session *ses;
2175 	unsigned long scanned = 0;
2176 	unsigned long freed = 0;
2177 
2178 	spin_lock(&nfsd_session_list_lock);
2179 	list_for_each_entry(ses, &nfsd_session_list, se_all_sessions) {
2180 		freed += reduce_session_slots(ses, 1);
2181 		scanned += 1;
2182 		if (scanned >= sc->nr_to_scan) {
2183 			/* Move starting point for next scan */
2184 			list_move(&nfsd_session_list, &ses->se_all_sessions);
2185 			break;
2186 		}
2187 	}
2188 	spin_unlock(&nfsd_session_list_lock);
2189 	sc->nr_scanned = scanned;
2190 	return freed;
2191 }
2192 
init_session(struct svc_rqst * rqstp,struct nfsd4_session * new,struct nfs4_client * clp,struct nfsd4_create_session * cses)2193 static void init_session(struct svc_rqst *rqstp, struct nfsd4_session *new, struct nfs4_client *clp, struct nfsd4_create_session *cses)
2194 {
2195 	int idx;
2196 	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2197 
2198 	new->se_client = clp;
2199 	gen_sessionid(new);
2200 
2201 	INIT_LIST_HEAD(&new->se_conns);
2202 
2203 	atomic_set(&new->se_ref, 0);
2204 	new->se_dead = false;
2205 	new->se_cb_prog = cses->callback_prog;
2206 	new->se_cb_sec = cses->cb_sec;
2207 
2208 	for (idx = 0; idx < NFSD_BC_SLOT_TABLE_SIZE; ++idx)
2209 		new->se_cb_seq_nr[idx] = 1;
2210 
2211 	idx = hash_sessionid(&new->se_sessionid);
2212 	list_add(&new->se_hash, &nn->sessionid_hashtbl[idx]);
2213 	spin_lock(&clp->cl_lock);
2214 	list_add(&new->se_perclnt, &clp->cl_sessions);
2215 	spin_unlock(&clp->cl_lock);
2216 
2217 	spin_lock(&nfsd_session_list_lock);
2218 	list_add_tail(&new->se_all_sessions, &nfsd_session_list);
2219 	spin_unlock(&nfsd_session_list_lock);
2220 
2221 	{
2222 		struct sockaddr *sa = svc_addr(rqstp);
2223 		/*
2224 		 * This is a little silly; with sessions there's no real
2225 		 * use for the callback address.  Use the peer address
2226 		 * as a reasonable default for now, but consider fixing
2227 		 * the rpc client not to require an address in the
2228 		 * future:
2229 		 */
2230 		rpc_copy_addr((struct sockaddr *)&clp->cl_cb_conn.cb_addr, sa);
2231 		clp->cl_cb_conn.cb_addrlen = svc_addr_len(sa);
2232 	}
2233 }
2234 
2235 /* caller must hold client_lock */
2236 static struct nfsd4_session *
__find_in_sessionid_hashtbl(struct nfs4_sessionid * sessionid,struct net * net)2237 __find_in_sessionid_hashtbl(struct nfs4_sessionid *sessionid, struct net *net)
2238 {
2239 	struct nfsd4_session *elem;
2240 	int idx;
2241 	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
2242 
2243 	lockdep_assert_held(&nn->client_lock);
2244 
2245 	dump_sessionid(__func__, sessionid);
2246 	idx = hash_sessionid(sessionid);
2247 	/* Search in the appropriate list */
2248 	list_for_each_entry(elem, &nn->sessionid_hashtbl[idx], se_hash) {
2249 		if (!memcmp(elem->se_sessionid.data, sessionid->data,
2250 			    NFS4_MAX_SESSIONID_LEN)) {
2251 			return elem;
2252 		}
2253 	}
2254 
2255 	dprintk("%s: session not found\n", __func__);
2256 	return NULL;
2257 }
2258 
2259 static struct nfsd4_session *
find_in_sessionid_hashtbl(struct nfs4_sessionid * sessionid,struct net * net,__be32 * ret)2260 find_in_sessionid_hashtbl(struct nfs4_sessionid *sessionid, struct net *net,
2261 		__be32 *ret)
2262 {
2263 	struct nfsd4_session *session;
2264 	__be32 status = nfserr_badsession;
2265 
2266 	session = __find_in_sessionid_hashtbl(sessionid, net);
2267 	if (!session)
2268 		goto out;
2269 	status = nfsd4_get_session_locked(session);
2270 	if (status)
2271 		session = NULL;
2272 out:
2273 	*ret = status;
2274 	return session;
2275 }
2276 
2277 /* caller must hold client_lock */
2278 static void
unhash_session(struct nfsd4_session * ses)2279 unhash_session(struct nfsd4_session *ses)
2280 {
2281 	struct nfs4_client *clp = ses->se_client;
2282 	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2283 
2284 	lockdep_assert_held(&nn->client_lock);
2285 
2286 	list_del(&ses->se_hash);
2287 	spin_lock(&ses->se_client->cl_lock);
2288 	list_del(&ses->se_perclnt);
2289 	spin_unlock(&ses->se_client->cl_lock);
2290 	spin_lock(&nfsd_session_list_lock);
2291 	list_del(&ses->se_all_sessions);
2292 	spin_unlock(&nfsd_session_list_lock);
2293 }
2294 
2295 /* SETCLIENTID and SETCLIENTID_CONFIRM Helper functions */
2296 static int
STALE_CLIENTID(clientid_t * clid,struct nfsd_net * nn)2297 STALE_CLIENTID(clientid_t *clid, struct nfsd_net *nn)
2298 {
2299 	/*
2300 	 * We're assuming the clid was not given out from a boot
2301 	 * precisely 2^32 (about 136 years) before this one.  That seems
2302 	 * a safe assumption:
2303 	 */
2304 	if (clid->cl_boot == (u32)nn->boot_time)
2305 		return 0;
2306 	trace_nfsd_clid_stale(clid);
2307 	return 1;
2308 }
2309 
alloc_client(struct xdr_netobj name,struct nfsd_net * nn)2310 static struct nfs4_client *alloc_client(struct xdr_netobj name,
2311 				struct nfsd_net *nn)
2312 {
2313 	struct nfs4_client *clp;
2314 	int i;
2315 
2316 	if (atomic_read(&nn->nfs4_client_count) >= nn->nfs4_max_clients &&
2317 	    atomic_read(&nn->nfsd_courtesy_clients) > 0)
2318 		mod_delayed_work(laundry_wq, &nn->laundromat_work, 0);
2319 
2320 	clp = kmem_cache_zalloc(client_slab, GFP_KERNEL);
2321 	if (clp == NULL)
2322 		return NULL;
2323 	xdr_netobj_dup(&clp->cl_name, &name, GFP_KERNEL);
2324 	if (clp->cl_name.data == NULL)
2325 		goto err_no_name;
2326 	clp->cl_ownerstr_hashtbl = kmalloc_array(OWNER_HASH_SIZE,
2327 						 sizeof(struct list_head),
2328 						 GFP_KERNEL);
2329 	if (!clp->cl_ownerstr_hashtbl)
2330 		goto err_no_hashtbl;
2331 	clp->cl_callback_wq = alloc_ordered_workqueue("nfsd4_callbacks", 0);
2332 	if (!clp->cl_callback_wq)
2333 		goto err_no_callback_wq;
2334 
2335 	for (i = 0; i < OWNER_HASH_SIZE; i++)
2336 		INIT_LIST_HEAD(&clp->cl_ownerstr_hashtbl[i]);
2337 	INIT_LIST_HEAD(&clp->cl_sessions);
2338 	idr_init(&clp->cl_stateids);
2339 	atomic_set(&clp->cl_rpc_users, 0);
2340 	clp->cl_cb_state = NFSD4_CB_UNKNOWN;
2341 	clp->cl_state = NFSD4_ACTIVE;
2342 	atomic_inc(&nn->nfs4_client_count);
2343 	atomic_set(&clp->cl_delegs_in_recall, 0);
2344 	INIT_LIST_HEAD(&clp->cl_idhash);
2345 	INIT_LIST_HEAD(&clp->cl_openowners);
2346 	INIT_LIST_HEAD(&clp->cl_delegations);
2347 	INIT_LIST_HEAD(&clp->cl_lru);
2348 	INIT_LIST_HEAD(&clp->cl_revoked);
2349 #ifdef CONFIG_NFSD_PNFS
2350 	INIT_LIST_HEAD(&clp->cl_lo_states);
2351 #endif
2352 	INIT_LIST_HEAD(&clp->async_copies);
2353 	spin_lock_init(&clp->async_lock);
2354 	spin_lock_init(&clp->cl_lock);
2355 	rpc_init_wait_queue(&clp->cl_cb_waitq, "Backchannel slot table");
2356 	return clp;
2357 err_no_callback_wq:
2358 	kfree(clp->cl_ownerstr_hashtbl);
2359 err_no_hashtbl:
2360 	kfree(clp->cl_name.data);
2361 err_no_name:
2362 	kmem_cache_free(client_slab, clp);
2363 	return NULL;
2364 }
2365 
__free_client(struct kref * k)2366 static void __free_client(struct kref *k)
2367 {
2368 	struct nfsdfs_client *c = container_of(k, struct nfsdfs_client, cl_ref);
2369 	struct nfs4_client *clp = container_of(c, struct nfs4_client, cl_nfsdfs);
2370 
2371 	free_svc_cred(&clp->cl_cred);
2372 	destroy_workqueue(clp->cl_callback_wq);
2373 	kfree(clp->cl_ownerstr_hashtbl);
2374 	kfree(clp->cl_name.data);
2375 	kfree(clp->cl_nii_domain.data);
2376 	kfree(clp->cl_nii_name.data);
2377 	idr_destroy(&clp->cl_stateids);
2378 	kfree(clp->cl_ra);
2379 	kmem_cache_free(client_slab, clp);
2380 }
2381 
drop_client(struct nfs4_client * clp)2382 static void drop_client(struct nfs4_client *clp)
2383 {
2384 	kref_put(&clp->cl_nfsdfs.cl_ref, __free_client);
2385 }
2386 
2387 static void
free_client(struct nfs4_client * clp)2388 free_client(struct nfs4_client *clp)
2389 {
2390 	while (!list_empty(&clp->cl_sessions)) {
2391 		struct nfsd4_session *ses;
2392 		ses = list_entry(clp->cl_sessions.next, struct nfsd4_session,
2393 				se_perclnt);
2394 		list_del(&ses->se_perclnt);
2395 		WARN_ON_ONCE(atomic_read(&ses->se_ref));
2396 		free_session(ses);
2397 	}
2398 	rpc_destroy_wait_queue(&clp->cl_cb_waitq);
2399 	if (clp->cl_nfsd_dentry) {
2400 		nfsd_client_rmdir(clp->cl_nfsd_dentry);
2401 		clp->cl_nfsd_dentry = NULL;
2402 		wake_up_all(&expiry_wq);
2403 	}
2404 	drop_client(clp);
2405 }
2406 
2407 /* must be called under the client_lock */
2408 static void
unhash_client_locked(struct nfs4_client * clp)2409 unhash_client_locked(struct nfs4_client *clp)
2410 {
2411 	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2412 	struct nfsd4_session *ses;
2413 
2414 	lockdep_assert_held(&nn->client_lock);
2415 
2416 	/* Mark the client as expired! */
2417 	clp->cl_time = 0;
2418 	/* Make it invisible */
2419 	if (!list_empty(&clp->cl_idhash)) {
2420 		list_del_init(&clp->cl_idhash);
2421 		if (test_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags))
2422 			rb_erase(&clp->cl_namenode, &nn->conf_name_tree);
2423 		else
2424 			rb_erase(&clp->cl_namenode, &nn->unconf_name_tree);
2425 	}
2426 	list_del_init(&clp->cl_lru);
2427 	spin_lock(&clp->cl_lock);
2428 	spin_lock(&nfsd_session_list_lock);
2429 	list_for_each_entry(ses, &clp->cl_sessions, se_perclnt) {
2430 		list_del_init(&ses->se_hash);
2431 		list_del_init(&ses->se_all_sessions);
2432 	}
2433 	spin_unlock(&nfsd_session_list_lock);
2434 	spin_unlock(&clp->cl_lock);
2435 }
2436 
2437 static void
unhash_client(struct nfs4_client * clp)2438 unhash_client(struct nfs4_client *clp)
2439 {
2440 	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2441 
2442 	spin_lock(&nn->client_lock);
2443 	unhash_client_locked(clp);
2444 	spin_unlock(&nn->client_lock);
2445 }
2446 
mark_client_expired_locked(struct nfs4_client * clp)2447 static __be32 mark_client_expired_locked(struct nfs4_client *clp)
2448 {
2449 	int users = atomic_read(&clp->cl_rpc_users);
2450 
2451 	trace_nfsd_mark_client_expired(clp, users);
2452 
2453 	if (users)
2454 		return nfserr_jukebox;
2455 	unhash_client_locked(clp);
2456 	return nfs_ok;
2457 }
2458 
2459 static void
__destroy_client(struct nfs4_client * clp)2460 __destroy_client(struct nfs4_client *clp)
2461 {
2462 	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2463 	int i;
2464 	struct nfs4_openowner *oo;
2465 	struct nfs4_delegation *dp;
2466 	LIST_HEAD(reaplist);
2467 
2468 	spin_lock(&state_lock);
2469 	while (!list_empty(&clp->cl_delegations)) {
2470 		dp = list_entry(clp->cl_delegations.next, struct nfs4_delegation, dl_perclnt);
2471 		unhash_delegation_locked(dp, SC_STATUS_CLOSED);
2472 		list_add(&dp->dl_recall_lru, &reaplist);
2473 	}
2474 	spin_unlock(&state_lock);
2475 	while (!list_empty(&reaplist)) {
2476 		dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
2477 		list_del_init(&dp->dl_recall_lru);
2478 		destroy_unhashed_deleg(dp);
2479 	}
2480 	while (!list_empty(&clp->cl_revoked)) {
2481 		dp = list_entry(clp->cl_revoked.next, struct nfs4_delegation, dl_recall_lru);
2482 		list_del_init(&dp->dl_recall_lru);
2483 		nfs4_put_stid(&dp->dl_stid);
2484 	}
2485 	while (!list_empty(&clp->cl_openowners)) {
2486 		oo = list_entry(clp->cl_openowners.next, struct nfs4_openowner, oo_perclient);
2487 		nfs4_get_stateowner(&oo->oo_owner);
2488 		release_openowner(oo);
2489 	}
2490 	for (i = 0; i < OWNER_HASH_SIZE; i++) {
2491 		struct nfs4_stateowner *so, *tmp;
2492 
2493 		list_for_each_entry_safe(so, tmp, &clp->cl_ownerstr_hashtbl[i],
2494 					 so_strhash) {
2495 			/* Should be no openowners at this point */
2496 			WARN_ON_ONCE(so->so_is_open_owner);
2497 			remove_blocked_locks(lockowner(so));
2498 		}
2499 	}
2500 	nfsd4_return_all_client_layouts(clp);
2501 	nfsd4_shutdown_copy(clp);
2502 	nfsd4_shutdown_callback(clp);
2503 	if (clp->cl_cb_conn.cb_xprt)
2504 		svc_xprt_put(clp->cl_cb_conn.cb_xprt);
2505 	atomic_add_unless(&nn->nfs4_client_count, -1, 0);
2506 	nfsd4_dec_courtesy_client_count(nn, clp);
2507 	free_client(clp);
2508 	wake_up_all(&expiry_wq);
2509 }
2510 
2511 static void
destroy_client(struct nfs4_client * clp)2512 destroy_client(struct nfs4_client *clp)
2513 {
2514 	unhash_client(clp);
2515 	__destroy_client(clp);
2516 }
2517 
inc_reclaim_complete(struct nfs4_client * clp)2518 static void inc_reclaim_complete(struct nfs4_client *clp)
2519 {
2520 	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2521 
2522 	if (!nn->track_reclaim_completes)
2523 		return;
2524 	if (!nfsd4_find_reclaim_client(clp->cl_name, nn))
2525 		return;
2526 	if (atomic_inc_return(&nn->nr_reclaim_complete) ==
2527 			nn->reclaim_str_hashtbl_size) {
2528 		printk(KERN_INFO "NFSD: all clients done reclaiming, ending NFSv4 grace period (net %x)\n",
2529 				clp->net->ns.inum);
2530 		nfsd4_end_grace(nn);
2531 	}
2532 }
2533 
expire_client(struct nfs4_client * clp)2534 static void expire_client(struct nfs4_client *clp)
2535 {
2536 	unhash_client(clp);
2537 	nfsd4_client_record_remove(clp);
2538 	__destroy_client(clp);
2539 }
2540 
copy_verf(struct nfs4_client * target,nfs4_verifier * source)2541 static void copy_verf(struct nfs4_client *target, nfs4_verifier *source)
2542 {
2543 	memcpy(target->cl_verifier.data, source->data,
2544 			sizeof(target->cl_verifier.data));
2545 }
2546 
copy_clid(struct nfs4_client * target,struct nfs4_client * source)2547 static void copy_clid(struct nfs4_client *target, struct nfs4_client *source)
2548 {
2549 	target->cl_clientid.cl_boot = source->cl_clientid.cl_boot;
2550 	target->cl_clientid.cl_id = source->cl_clientid.cl_id;
2551 }
2552 
copy_cred(struct svc_cred * target,struct svc_cred * source)2553 static int copy_cred(struct svc_cred *target, struct svc_cred *source)
2554 {
2555 	target->cr_principal = kstrdup(source->cr_principal, GFP_KERNEL);
2556 	target->cr_raw_principal = kstrdup(source->cr_raw_principal,
2557 								GFP_KERNEL);
2558 	target->cr_targ_princ = kstrdup(source->cr_targ_princ, GFP_KERNEL);
2559 	if ((source->cr_principal && !target->cr_principal) ||
2560 	    (source->cr_raw_principal && !target->cr_raw_principal) ||
2561 	    (source->cr_targ_princ && !target->cr_targ_princ))
2562 		return -ENOMEM;
2563 
2564 	target->cr_flavor = source->cr_flavor;
2565 	target->cr_uid = source->cr_uid;
2566 	target->cr_gid = source->cr_gid;
2567 	target->cr_group_info = source->cr_group_info;
2568 	get_group_info(target->cr_group_info);
2569 	target->cr_gss_mech = source->cr_gss_mech;
2570 	if (source->cr_gss_mech)
2571 		gss_mech_get(source->cr_gss_mech);
2572 	return 0;
2573 }
2574 
2575 static int
compare_blob(const struct xdr_netobj * o1,const struct xdr_netobj * o2)2576 compare_blob(const struct xdr_netobj *o1, const struct xdr_netobj *o2)
2577 {
2578 	if (o1->len < o2->len)
2579 		return -1;
2580 	if (o1->len > o2->len)
2581 		return 1;
2582 	return memcmp(o1->data, o2->data, o1->len);
2583 }
2584 
2585 static int
same_verf(nfs4_verifier * v1,nfs4_verifier * v2)2586 same_verf(nfs4_verifier *v1, nfs4_verifier *v2)
2587 {
2588 	return 0 == memcmp(v1->data, v2->data, sizeof(v1->data));
2589 }
2590 
2591 static int
same_clid(clientid_t * cl1,clientid_t * cl2)2592 same_clid(clientid_t *cl1, clientid_t *cl2)
2593 {
2594 	return (cl1->cl_boot == cl2->cl_boot) && (cl1->cl_id == cl2->cl_id);
2595 }
2596 
groups_equal(struct group_info * g1,struct group_info * g2)2597 static bool groups_equal(struct group_info *g1, struct group_info *g2)
2598 {
2599 	int i;
2600 
2601 	if (g1->ngroups != g2->ngroups)
2602 		return false;
2603 	for (i=0; i<g1->ngroups; i++)
2604 		if (!gid_eq(g1->gid[i], g2->gid[i]))
2605 			return false;
2606 	return true;
2607 }
2608 
2609 /*
2610  * RFC 3530 language requires clid_inuse be returned when the
2611  * "principal" associated with a requests differs from that previously
2612  * used.  We use uid, gid's, and gss principal string as our best
2613  * approximation.  We also don't want to allow non-gss use of a client
2614  * established using gss: in theory cr_principal should catch that
2615  * change, but in practice cr_principal can be null even in the gss case
2616  * since gssd doesn't always pass down a principal string.
2617  */
is_gss_cred(struct svc_cred * cr)2618 static bool is_gss_cred(struct svc_cred *cr)
2619 {
2620 	/* Is cr_flavor one of the gss "pseudoflavors"?: */
2621 	return (cr->cr_flavor > RPC_AUTH_MAXFLAVOR);
2622 }
2623 
2624 
2625 static bool
same_creds(struct svc_cred * cr1,struct svc_cred * cr2)2626 same_creds(struct svc_cred *cr1, struct svc_cred *cr2)
2627 {
2628 	if ((is_gss_cred(cr1) != is_gss_cred(cr2))
2629 		|| (!uid_eq(cr1->cr_uid, cr2->cr_uid))
2630 		|| (!gid_eq(cr1->cr_gid, cr2->cr_gid))
2631 		|| !groups_equal(cr1->cr_group_info, cr2->cr_group_info))
2632 		return false;
2633 	/* XXX: check that cr_targ_princ fields match ? */
2634 	if (cr1->cr_principal == cr2->cr_principal)
2635 		return true;
2636 	if (!cr1->cr_principal || !cr2->cr_principal)
2637 		return false;
2638 	return 0 == strcmp(cr1->cr_principal, cr2->cr_principal);
2639 }
2640 
svc_rqst_integrity_protected(struct svc_rqst * rqstp)2641 static bool svc_rqst_integrity_protected(struct svc_rqst *rqstp)
2642 {
2643 	struct svc_cred *cr = &rqstp->rq_cred;
2644 	u32 service;
2645 
2646 	if (!cr->cr_gss_mech)
2647 		return false;
2648 	service = gss_pseudoflavor_to_service(cr->cr_gss_mech, cr->cr_flavor);
2649 	return service == RPC_GSS_SVC_INTEGRITY ||
2650 	       service == RPC_GSS_SVC_PRIVACY;
2651 }
2652 
nfsd4_mach_creds_match(struct nfs4_client * cl,struct svc_rqst * rqstp)2653 bool nfsd4_mach_creds_match(struct nfs4_client *cl, struct svc_rqst *rqstp)
2654 {
2655 	struct svc_cred *cr = &rqstp->rq_cred;
2656 
2657 	if (!cl->cl_mach_cred)
2658 		return true;
2659 	if (cl->cl_cred.cr_gss_mech != cr->cr_gss_mech)
2660 		return false;
2661 	if (!svc_rqst_integrity_protected(rqstp))
2662 		return false;
2663 	if (cl->cl_cred.cr_raw_principal)
2664 		return 0 == strcmp(cl->cl_cred.cr_raw_principal,
2665 						cr->cr_raw_principal);
2666 	if (!cr->cr_principal)
2667 		return false;
2668 	return 0 == strcmp(cl->cl_cred.cr_principal, cr->cr_principal);
2669 }
2670 
gen_confirm(struct nfs4_client * clp,struct nfsd_net * nn)2671 static void gen_confirm(struct nfs4_client *clp, struct nfsd_net *nn)
2672 {
2673 	__be32 verf[2];
2674 
2675 	/*
2676 	 * This is opaque to client, so no need to byte-swap. Use
2677 	 * __force to keep sparse happy
2678 	 */
2679 	verf[0] = (__force __be32)(u32)ktime_get_real_seconds();
2680 	verf[1] = (__force __be32)nn->clverifier_counter++;
2681 	memcpy(clp->cl_confirm.data, verf, sizeof(clp->cl_confirm.data));
2682 }
2683 
gen_clid(struct nfs4_client * clp,struct nfsd_net * nn)2684 static void gen_clid(struct nfs4_client *clp, struct nfsd_net *nn)
2685 {
2686 	clp->cl_clientid.cl_boot = (u32)nn->boot_time;
2687 	clp->cl_clientid.cl_id = nn->clientid_counter++;
2688 	gen_confirm(clp, nn);
2689 }
2690 
2691 static struct nfs4_stid *
find_stateid_locked(struct nfs4_client * cl,stateid_t * t)2692 find_stateid_locked(struct nfs4_client *cl, stateid_t *t)
2693 {
2694 	struct nfs4_stid *ret;
2695 
2696 	ret = idr_find(&cl->cl_stateids, t->si_opaque.so_id);
2697 	if (!ret || !ret->sc_type)
2698 		return NULL;
2699 	return ret;
2700 }
2701 
2702 static struct nfs4_stid *
find_stateid_by_type(struct nfs4_client * cl,stateid_t * t,unsigned short typemask,unsigned short ok_states)2703 find_stateid_by_type(struct nfs4_client *cl, stateid_t *t,
2704 		     unsigned short typemask, unsigned short ok_states)
2705 {
2706 	struct nfs4_stid *s;
2707 
2708 	spin_lock(&cl->cl_lock);
2709 	s = find_stateid_locked(cl, t);
2710 	if (s != NULL) {
2711 		if ((s->sc_status & ~ok_states) == 0 &&
2712 		    (typemask & s->sc_type))
2713 			refcount_inc(&s->sc_count);
2714 		else
2715 			s = NULL;
2716 	}
2717 	spin_unlock(&cl->cl_lock);
2718 	return s;
2719 }
2720 
get_nfsdfs_clp(struct inode * inode)2721 static struct nfs4_client *get_nfsdfs_clp(struct inode *inode)
2722 {
2723 	struct nfsdfs_client *nc;
2724 	nc = get_nfsdfs_client(inode);
2725 	if (!nc)
2726 		return NULL;
2727 	return container_of(nc, struct nfs4_client, cl_nfsdfs);
2728 }
2729 
seq_quote_mem(struct seq_file * m,char * data,int len)2730 static void seq_quote_mem(struct seq_file *m, char *data, int len)
2731 {
2732 	seq_puts(m, "\"");
2733 	seq_escape_mem(m, data, len, ESCAPE_HEX | ESCAPE_NAP | ESCAPE_APPEND, "\"\\");
2734 	seq_puts(m, "\"");
2735 }
2736 
cb_state2str(int state)2737 static const char *cb_state2str(int state)
2738 {
2739 	switch (state) {
2740 	case NFSD4_CB_UP:
2741 		return "UP";
2742 	case NFSD4_CB_UNKNOWN:
2743 		return "UNKNOWN";
2744 	case NFSD4_CB_DOWN:
2745 		return "DOWN";
2746 	case NFSD4_CB_FAULT:
2747 		return "FAULT";
2748 	}
2749 	return "UNDEFINED";
2750 }
2751 
client_info_show(struct seq_file * m,void * v)2752 static int client_info_show(struct seq_file *m, void *v)
2753 {
2754 	struct inode *inode = file_inode(m->file);
2755 	struct nfsd4_session *ses;
2756 	struct nfs4_client *clp;
2757 	u64 clid;
2758 
2759 	clp = get_nfsdfs_clp(inode);
2760 	if (!clp)
2761 		return -ENXIO;
2762 	memcpy(&clid, &clp->cl_clientid, sizeof(clid));
2763 	seq_printf(m, "clientid: 0x%llx\n", clid);
2764 	seq_printf(m, "address: \"%pISpc\"\n", (struct sockaddr *)&clp->cl_addr);
2765 
2766 	if (clp->cl_state == NFSD4_COURTESY)
2767 		seq_puts(m, "status: courtesy\n");
2768 	else if (clp->cl_state == NFSD4_EXPIRABLE)
2769 		seq_puts(m, "status: expirable\n");
2770 	else if (test_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags))
2771 		seq_puts(m, "status: confirmed\n");
2772 	else
2773 		seq_puts(m, "status: unconfirmed\n");
2774 	seq_printf(m, "seconds from last renew: %lld\n",
2775 		ktime_get_boottime_seconds() - clp->cl_time);
2776 	seq_puts(m, "name: ");
2777 	seq_quote_mem(m, clp->cl_name.data, clp->cl_name.len);
2778 	seq_printf(m, "\nminor version: %d\n", clp->cl_minorversion);
2779 	if (clp->cl_nii_domain.data) {
2780 		seq_puts(m, "Implementation domain: ");
2781 		seq_quote_mem(m, clp->cl_nii_domain.data,
2782 					clp->cl_nii_domain.len);
2783 		seq_puts(m, "\nImplementation name: ");
2784 		seq_quote_mem(m, clp->cl_nii_name.data, clp->cl_nii_name.len);
2785 		seq_printf(m, "\nImplementation time: [%lld, %ld]\n",
2786 			clp->cl_nii_time.tv_sec, clp->cl_nii_time.tv_nsec);
2787 	}
2788 	seq_printf(m, "callback state: %s\n", cb_state2str(clp->cl_cb_state));
2789 	seq_printf(m, "callback address: \"%pISpc\"\n", &clp->cl_cb_conn.cb_addr);
2790 	seq_printf(m, "admin-revoked states: %d\n",
2791 		   atomic_read(&clp->cl_admin_revoked));
2792 	spin_lock(&clp->cl_lock);
2793 	seq_printf(m, "session slots:");
2794 	list_for_each_entry(ses, &clp->cl_sessions, se_perclnt)
2795 		seq_printf(m, " %u", ses->se_fchannel.maxreqs);
2796 	seq_printf(m, "\nsession target slots:");
2797 	list_for_each_entry(ses, &clp->cl_sessions, se_perclnt)
2798 		seq_printf(m, " %u", ses->se_target_maxslots);
2799 	spin_unlock(&clp->cl_lock);
2800 	seq_puts(m, "\n");
2801 
2802 	drop_client(clp);
2803 
2804 	return 0;
2805 }
2806 
2807 DEFINE_SHOW_ATTRIBUTE(client_info);
2808 
states_start(struct seq_file * s,loff_t * pos)2809 static void *states_start(struct seq_file *s, loff_t *pos)
2810 	__acquires(&clp->cl_lock)
2811 {
2812 	struct nfs4_client *clp = s->private;
2813 	unsigned long id = *pos;
2814 	void *ret;
2815 
2816 	spin_lock(&clp->cl_lock);
2817 	ret = idr_get_next_ul(&clp->cl_stateids, &id);
2818 	*pos = id;
2819 	return ret;
2820 }
2821 
states_next(struct seq_file * s,void * v,loff_t * pos)2822 static void *states_next(struct seq_file *s, void *v, loff_t *pos)
2823 {
2824 	struct nfs4_client *clp = s->private;
2825 	unsigned long id = *pos;
2826 	void *ret;
2827 
2828 	id = *pos;
2829 	id++;
2830 	ret = idr_get_next_ul(&clp->cl_stateids, &id);
2831 	*pos = id;
2832 	return ret;
2833 }
2834 
states_stop(struct seq_file * s,void * v)2835 static void states_stop(struct seq_file *s, void *v)
2836 	__releases(&clp->cl_lock)
2837 {
2838 	struct nfs4_client *clp = s->private;
2839 
2840 	spin_unlock(&clp->cl_lock);
2841 }
2842 
nfs4_show_fname(struct seq_file * s,struct nfsd_file * f)2843 static void nfs4_show_fname(struct seq_file *s, struct nfsd_file *f)
2844 {
2845          seq_printf(s, "filename: \"%pD2\"", f->nf_file);
2846 }
2847 
nfs4_show_superblock(struct seq_file * s,struct nfsd_file * f)2848 static void nfs4_show_superblock(struct seq_file *s, struct nfsd_file *f)
2849 {
2850 	struct inode *inode = file_inode(f->nf_file);
2851 
2852 	seq_printf(s, "superblock: \"%02x:%02x:%ld\"",
2853 					MAJOR(inode->i_sb->s_dev),
2854 					 MINOR(inode->i_sb->s_dev),
2855 					 inode->i_ino);
2856 }
2857 
nfs4_show_owner(struct seq_file * s,struct nfs4_stateowner * oo)2858 static void nfs4_show_owner(struct seq_file *s, struct nfs4_stateowner *oo)
2859 {
2860 	seq_puts(s, "owner: ");
2861 	seq_quote_mem(s, oo->so_owner.data, oo->so_owner.len);
2862 }
2863 
nfs4_show_stateid(struct seq_file * s,stateid_t * stid)2864 static void nfs4_show_stateid(struct seq_file *s, stateid_t *stid)
2865 {
2866 	seq_printf(s, "0x%.8x", stid->si_generation);
2867 	seq_printf(s, "%12phN", &stid->si_opaque);
2868 }
2869 
nfs4_show_open(struct seq_file * s,struct nfs4_stid * st)2870 static int nfs4_show_open(struct seq_file *s, struct nfs4_stid *st)
2871 {
2872 	struct nfs4_ol_stateid *ols;
2873 	struct nfs4_file *nf;
2874 	struct nfsd_file *file;
2875 	struct nfs4_stateowner *oo;
2876 	unsigned int access, deny;
2877 
2878 	ols = openlockstateid(st);
2879 	oo = ols->st_stateowner;
2880 	nf = st->sc_file;
2881 
2882 	seq_puts(s, "- ");
2883 	nfs4_show_stateid(s, &st->sc_stateid);
2884 	seq_puts(s, ": { type: open, ");
2885 
2886 	access = bmap_to_share_mode(ols->st_access_bmap);
2887 	deny   = bmap_to_share_mode(ols->st_deny_bmap);
2888 
2889 	seq_printf(s, "access: %s%s, ",
2890 		access & NFS4_SHARE_ACCESS_READ ? "r" : "-",
2891 		access & NFS4_SHARE_ACCESS_WRITE ? "w" : "-");
2892 	seq_printf(s, "deny: %s%s, ",
2893 		deny & NFS4_SHARE_ACCESS_READ ? "r" : "-",
2894 		deny & NFS4_SHARE_ACCESS_WRITE ? "w" : "-");
2895 
2896 	if (nf) {
2897 		spin_lock(&nf->fi_lock);
2898 		file = find_any_file_locked(nf);
2899 		if (file) {
2900 			nfs4_show_superblock(s, file);
2901 			seq_puts(s, ", ");
2902 			nfs4_show_fname(s, file);
2903 			seq_puts(s, ", ");
2904 		}
2905 		spin_unlock(&nf->fi_lock);
2906 	} else
2907 		seq_puts(s, "closed, ");
2908 	nfs4_show_owner(s, oo);
2909 	if (st->sc_status & SC_STATUS_ADMIN_REVOKED)
2910 		seq_puts(s, ", admin-revoked");
2911 	seq_puts(s, " }\n");
2912 	return 0;
2913 }
2914 
nfs4_show_lock(struct seq_file * s,struct nfs4_stid * st)2915 static int nfs4_show_lock(struct seq_file *s, struct nfs4_stid *st)
2916 {
2917 	struct nfs4_ol_stateid *ols;
2918 	struct nfs4_file *nf;
2919 	struct nfsd_file *file;
2920 	struct nfs4_stateowner *oo;
2921 
2922 	ols = openlockstateid(st);
2923 	oo = ols->st_stateowner;
2924 	nf = st->sc_file;
2925 
2926 	seq_puts(s, "- ");
2927 	nfs4_show_stateid(s, &st->sc_stateid);
2928 	seq_puts(s, ": { type: lock, ");
2929 
2930 	spin_lock(&nf->fi_lock);
2931 	file = find_any_file_locked(nf);
2932 	if (file) {
2933 		/*
2934 		 * Note: a lock stateid isn't really the same thing as a lock,
2935 		 * it's the locking state held by one owner on a file, and there
2936 		 * may be multiple (or no) lock ranges associated with it.
2937 		 * (Same for the matter is true of open stateids.)
2938 		 */
2939 
2940 		nfs4_show_superblock(s, file);
2941 		/* XXX: open stateid? */
2942 		seq_puts(s, ", ");
2943 		nfs4_show_fname(s, file);
2944 		seq_puts(s, ", ");
2945 	}
2946 	nfs4_show_owner(s, oo);
2947 	if (st->sc_status & SC_STATUS_ADMIN_REVOKED)
2948 		seq_puts(s, ", admin-revoked");
2949 	seq_puts(s, " }\n");
2950 	spin_unlock(&nf->fi_lock);
2951 	return 0;
2952 }
2953 
nfs4_show_deleg_type(u32 dl_type)2954 static char *nfs4_show_deleg_type(u32 dl_type)
2955 {
2956 	switch (dl_type) {
2957 	case OPEN_DELEGATE_READ:
2958 		return "r";
2959 	case OPEN_DELEGATE_WRITE:
2960 		return "w";
2961 	case OPEN_DELEGATE_READ_ATTRS_DELEG:
2962 		return "ra";
2963 	case OPEN_DELEGATE_WRITE_ATTRS_DELEG:
2964 		return "wa";
2965 	}
2966 	return "?";
2967 }
2968 
nfs4_show_deleg(struct seq_file * s,struct nfs4_stid * st)2969 static int nfs4_show_deleg(struct seq_file *s, struct nfs4_stid *st)
2970 {
2971 	struct nfs4_delegation *ds;
2972 	struct nfs4_file *nf;
2973 	struct nfsd_file *file;
2974 
2975 	ds = delegstateid(st);
2976 	nf = st->sc_file;
2977 
2978 	seq_puts(s, "- ");
2979 	nfs4_show_stateid(s, &st->sc_stateid);
2980 	seq_puts(s, ": { type: deleg, ");
2981 
2982 	seq_printf(s, "access: %s", nfs4_show_deleg_type(ds->dl_type));
2983 
2984 	/* XXX: lease time, whether it's being recalled. */
2985 
2986 	spin_lock(&nf->fi_lock);
2987 	file = nf->fi_deleg_file;
2988 	if (file) {
2989 		seq_puts(s, ", ");
2990 		nfs4_show_superblock(s, file);
2991 		seq_puts(s, ", ");
2992 		nfs4_show_fname(s, file);
2993 	}
2994 	spin_unlock(&nf->fi_lock);
2995 	if (st->sc_status & SC_STATUS_ADMIN_REVOKED)
2996 		seq_puts(s, ", admin-revoked");
2997 	seq_puts(s, " }\n");
2998 	return 0;
2999 }
3000 
nfs4_show_layout(struct seq_file * s,struct nfs4_stid * st)3001 static int nfs4_show_layout(struct seq_file *s, struct nfs4_stid *st)
3002 {
3003 	struct nfs4_layout_stateid *ls;
3004 	struct nfsd_file *file;
3005 
3006 	ls = container_of(st, struct nfs4_layout_stateid, ls_stid);
3007 
3008 	seq_puts(s, "- ");
3009 	nfs4_show_stateid(s, &st->sc_stateid);
3010 	seq_puts(s, ": { type: layout");
3011 
3012 	/* XXX: What else would be useful? */
3013 
3014 	spin_lock(&ls->ls_stid.sc_file->fi_lock);
3015 	file = ls->ls_file;
3016 	if (file) {
3017 		seq_puts(s, ", ");
3018 		nfs4_show_superblock(s, file);
3019 		seq_puts(s, ", ");
3020 		nfs4_show_fname(s, file);
3021 	}
3022 	spin_unlock(&ls->ls_stid.sc_file->fi_lock);
3023 	if (st->sc_status & SC_STATUS_ADMIN_REVOKED)
3024 		seq_puts(s, ", admin-revoked");
3025 	seq_puts(s, " }\n");
3026 
3027 	return 0;
3028 }
3029 
states_show(struct seq_file * s,void * v)3030 static int states_show(struct seq_file *s, void *v)
3031 {
3032 	struct nfs4_stid *st = v;
3033 
3034 	switch (st->sc_type) {
3035 	case SC_TYPE_OPEN:
3036 		return nfs4_show_open(s, st);
3037 	case SC_TYPE_LOCK:
3038 		return nfs4_show_lock(s, st);
3039 	case SC_TYPE_DELEG:
3040 		return nfs4_show_deleg(s, st);
3041 	case SC_TYPE_LAYOUT:
3042 		return nfs4_show_layout(s, st);
3043 	default:
3044 		return 0; /* XXX: or SEQ_SKIP? */
3045 	}
3046 	/* XXX: copy stateids? */
3047 }
3048 
3049 static struct seq_operations states_seq_ops = {
3050 	.start = states_start,
3051 	.next = states_next,
3052 	.stop = states_stop,
3053 	.show = states_show
3054 };
3055 
client_states_open(struct inode * inode,struct file * file)3056 static int client_states_open(struct inode *inode, struct file *file)
3057 {
3058 	struct seq_file *s;
3059 	struct nfs4_client *clp;
3060 	int ret;
3061 
3062 	clp = get_nfsdfs_clp(inode);
3063 	if (!clp)
3064 		return -ENXIO;
3065 
3066 	ret = seq_open(file, &states_seq_ops);
3067 	if (ret)
3068 		return ret;
3069 	s = file->private_data;
3070 	s->private = clp;
3071 	return 0;
3072 }
3073 
client_opens_release(struct inode * inode,struct file * file)3074 static int client_opens_release(struct inode *inode, struct file *file)
3075 {
3076 	struct seq_file *m = file->private_data;
3077 	struct nfs4_client *clp = m->private;
3078 
3079 	/* XXX: alternatively, we could get/drop in seq start/stop */
3080 	drop_client(clp);
3081 	return seq_release(inode, file);
3082 }
3083 
3084 static const struct file_operations client_states_fops = {
3085 	.open		= client_states_open,
3086 	.read		= seq_read,
3087 	.llseek		= seq_lseek,
3088 	.release	= client_opens_release,
3089 };
3090 
3091 /*
3092  * Normally we refuse to destroy clients that are in use, but here the
3093  * administrator is telling us to just do it.  We also want to wait
3094  * so the caller has a guarantee that the client's locks are gone by
3095  * the time the write returns:
3096  */
force_expire_client(struct nfs4_client * clp)3097 static void force_expire_client(struct nfs4_client *clp)
3098 {
3099 	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
3100 	bool already_expired;
3101 
3102 	trace_nfsd_clid_admin_expired(&clp->cl_clientid);
3103 
3104 	spin_lock(&nn->client_lock);
3105 	clp->cl_time = 0;
3106 	spin_unlock(&nn->client_lock);
3107 
3108 	wait_event(expiry_wq, atomic_read(&clp->cl_rpc_users) == 0);
3109 	spin_lock(&nn->client_lock);
3110 	already_expired = list_empty(&clp->cl_lru);
3111 	if (!already_expired)
3112 		unhash_client_locked(clp);
3113 	spin_unlock(&nn->client_lock);
3114 
3115 	if (!already_expired)
3116 		expire_client(clp);
3117 	else
3118 		wait_event(expiry_wq, clp->cl_nfsd_dentry == NULL);
3119 }
3120 
client_ctl_write(struct file * file,const char __user * buf,size_t size,loff_t * pos)3121 static ssize_t client_ctl_write(struct file *file, const char __user *buf,
3122 				   size_t size, loff_t *pos)
3123 {
3124 	char *data;
3125 	struct nfs4_client *clp;
3126 
3127 	data = simple_transaction_get(file, buf, size);
3128 	if (IS_ERR(data))
3129 		return PTR_ERR(data);
3130 	if (size != 7 || 0 != memcmp(data, "expire\n", 7))
3131 		return -EINVAL;
3132 	clp = get_nfsdfs_clp(file_inode(file));
3133 	if (!clp)
3134 		return -ENXIO;
3135 	force_expire_client(clp);
3136 	drop_client(clp);
3137 	return 7;
3138 }
3139 
3140 static const struct file_operations client_ctl_fops = {
3141 	.write		= client_ctl_write,
3142 	.release	= simple_transaction_release,
3143 };
3144 
3145 static const struct tree_descr client_files[] = {
3146 	[0] = {"info", &client_info_fops, S_IRUSR},
3147 	[1] = {"states", &client_states_fops, S_IRUSR},
3148 	[2] = {"ctl", &client_ctl_fops, S_IWUSR},
3149 	[3] = {""},
3150 };
3151 
3152 static int
nfsd4_cb_recall_any_done(struct nfsd4_callback * cb,struct rpc_task * task)3153 nfsd4_cb_recall_any_done(struct nfsd4_callback *cb,
3154 				struct rpc_task *task)
3155 {
3156 	trace_nfsd_cb_recall_any_done(cb, task);
3157 	switch (task->tk_status) {
3158 	case -NFS4ERR_DELAY:
3159 		rpc_delay(task, 2 * HZ);
3160 		return 0;
3161 	default:
3162 		return 1;
3163 	}
3164 }
3165 
3166 static void
nfsd4_cb_recall_any_release(struct nfsd4_callback * cb)3167 nfsd4_cb_recall_any_release(struct nfsd4_callback *cb)
3168 {
3169 	struct nfs4_client *clp = cb->cb_clp;
3170 
3171 	clear_bit(NFSD4_CLIENT_CB_RECALL_ANY, &clp->cl_flags);
3172 	drop_client(clp);
3173 }
3174 
3175 static int
nfsd4_cb_getattr_done(struct nfsd4_callback * cb,struct rpc_task * task)3176 nfsd4_cb_getattr_done(struct nfsd4_callback *cb, struct rpc_task *task)
3177 {
3178 	struct nfs4_cb_fattr *ncf =
3179 			container_of(cb, struct nfs4_cb_fattr, ncf_getattr);
3180 	struct nfs4_delegation *dp =
3181 			container_of(ncf, struct nfs4_delegation, dl_cb_fattr);
3182 
3183 	trace_nfsd_cb_getattr_done(&dp->dl_stid.sc_stateid, task);
3184 	ncf->ncf_cb_status = task->tk_status;
3185 	switch (task->tk_status) {
3186 	case -NFS4ERR_DELAY:
3187 		rpc_delay(task, 2 * HZ);
3188 		return 0;
3189 	default:
3190 		return 1;
3191 	}
3192 }
3193 
3194 static void
nfsd4_cb_getattr_release(struct nfsd4_callback * cb)3195 nfsd4_cb_getattr_release(struct nfsd4_callback *cb)
3196 {
3197 	struct nfs4_cb_fattr *ncf =
3198 			container_of(cb, struct nfs4_cb_fattr, ncf_getattr);
3199 	struct nfs4_delegation *dp =
3200 			container_of(ncf, struct nfs4_delegation, dl_cb_fattr);
3201 
3202 	clear_and_wake_up_bit(CB_GETATTR_BUSY, &ncf->ncf_cb_flags);
3203 	nfs4_put_stid(&dp->dl_stid);
3204 }
3205 
3206 static const struct nfsd4_callback_ops nfsd4_cb_recall_any_ops = {
3207 	.done		= nfsd4_cb_recall_any_done,
3208 	.release	= nfsd4_cb_recall_any_release,
3209 	.opcode		= OP_CB_RECALL_ANY,
3210 };
3211 
3212 static const struct nfsd4_callback_ops nfsd4_cb_getattr_ops = {
3213 	.done		= nfsd4_cb_getattr_done,
3214 	.release	= nfsd4_cb_getattr_release,
3215 	.opcode		= OP_CB_GETATTR,
3216 };
3217 
nfs4_cb_getattr(struct nfs4_cb_fattr * ncf)3218 static void nfs4_cb_getattr(struct nfs4_cb_fattr *ncf)
3219 {
3220 	struct nfs4_delegation *dp =
3221 			container_of(ncf, struct nfs4_delegation, dl_cb_fattr);
3222 
3223 	if (test_and_set_bit(CB_GETATTR_BUSY, &ncf->ncf_cb_flags))
3224 		return;
3225 	/* set to proper status when nfsd4_cb_getattr_done runs */
3226 	ncf->ncf_cb_status = NFS4ERR_IO;
3227 
3228 	refcount_inc(&dp->dl_stid.sc_count);
3229 	nfsd4_run_cb(&ncf->ncf_getattr);
3230 }
3231 
create_client(struct xdr_netobj name,struct svc_rqst * rqstp,nfs4_verifier * verf)3232 static struct nfs4_client *create_client(struct xdr_netobj name,
3233 		struct svc_rqst *rqstp, nfs4_verifier *verf)
3234 {
3235 	struct nfs4_client *clp;
3236 	struct sockaddr *sa = svc_addr(rqstp);
3237 	int ret;
3238 	struct net *net = SVC_NET(rqstp);
3239 	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
3240 	struct dentry *dentries[ARRAY_SIZE(client_files)];
3241 
3242 	clp = alloc_client(name, nn);
3243 	if (clp == NULL)
3244 		return NULL;
3245 
3246 	ret = copy_cred(&clp->cl_cred, &rqstp->rq_cred);
3247 	if (ret) {
3248 		free_client(clp);
3249 		return NULL;
3250 	}
3251 	gen_clid(clp, nn);
3252 	kref_init(&clp->cl_nfsdfs.cl_ref);
3253 	nfsd4_init_cb(&clp->cl_cb_null, clp, NULL, NFSPROC4_CLNT_CB_NULL);
3254 	clp->cl_time = ktime_get_boottime_seconds();
3255 	copy_verf(clp, verf);
3256 	memcpy(&clp->cl_addr, sa, sizeof(struct sockaddr_storage));
3257 	clp->cl_cb_session = NULL;
3258 	clp->net = net;
3259 	clp->cl_nfsd_dentry = nfsd_client_mkdir(
3260 		nn, &clp->cl_nfsdfs,
3261 		clp->cl_clientid.cl_id - nn->clientid_base,
3262 		client_files, dentries);
3263 	clp->cl_nfsd_info_dentry = dentries[0];
3264 	if (!clp->cl_nfsd_dentry) {
3265 		free_client(clp);
3266 		return NULL;
3267 	}
3268 	clp->cl_ra = kzalloc(sizeof(*clp->cl_ra), GFP_KERNEL);
3269 	if (!clp->cl_ra) {
3270 		free_client(clp);
3271 		return NULL;
3272 	}
3273 	clp->cl_ra_time = 0;
3274 	nfsd4_init_cb(&clp->cl_ra->ra_cb, clp, &nfsd4_cb_recall_any_ops,
3275 			NFSPROC4_CLNT_CB_RECALL_ANY);
3276 	return clp;
3277 }
3278 
3279 static void
add_clp_to_name_tree(struct nfs4_client * new_clp,struct rb_root * root)3280 add_clp_to_name_tree(struct nfs4_client *new_clp, struct rb_root *root)
3281 {
3282 	struct rb_node **new = &(root->rb_node), *parent = NULL;
3283 	struct nfs4_client *clp;
3284 
3285 	while (*new) {
3286 		clp = rb_entry(*new, struct nfs4_client, cl_namenode);
3287 		parent = *new;
3288 
3289 		if (compare_blob(&clp->cl_name, &new_clp->cl_name) > 0)
3290 			new = &((*new)->rb_left);
3291 		else
3292 			new = &((*new)->rb_right);
3293 	}
3294 
3295 	rb_link_node(&new_clp->cl_namenode, parent, new);
3296 	rb_insert_color(&new_clp->cl_namenode, root);
3297 }
3298 
3299 static struct nfs4_client *
find_clp_in_name_tree(struct xdr_netobj * name,struct rb_root * root)3300 find_clp_in_name_tree(struct xdr_netobj *name, struct rb_root *root)
3301 {
3302 	int cmp;
3303 	struct rb_node *node = root->rb_node;
3304 	struct nfs4_client *clp;
3305 
3306 	while (node) {
3307 		clp = rb_entry(node, struct nfs4_client, cl_namenode);
3308 		cmp = compare_blob(&clp->cl_name, name);
3309 		if (cmp > 0)
3310 			node = node->rb_left;
3311 		else if (cmp < 0)
3312 			node = node->rb_right;
3313 		else
3314 			return clp;
3315 	}
3316 	return NULL;
3317 }
3318 
3319 static void
add_to_unconfirmed(struct nfs4_client * clp)3320 add_to_unconfirmed(struct nfs4_client *clp)
3321 {
3322 	unsigned int idhashval;
3323 	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
3324 
3325 	lockdep_assert_held(&nn->client_lock);
3326 
3327 	clear_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags);
3328 	add_clp_to_name_tree(clp, &nn->unconf_name_tree);
3329 	idhashval = clientid_hashval(clp->cl_clientid.cl_id);
3330 	list_add(&clp->cl_idhash, &nn->unconf_id_hashtbl[idhashval]);
3331 	renew_client_locked(clp);
3332 }
3333 
3334 static void
move_to_confirmed(struct nfs4_client * clp)3335 move_to_confirmed(struct nfs4_client *clp)
3336 {
3337 	unsigned int idhashval = clientid_hashval(clp->cl_clientid.cl_id);
3338 	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
3339 
3340 	lockdep_assert_held(&nn->client_lock);
3341 
3342 	list_move(&clp->cl_idhash, &nn->conf_id_hashtbl[idhashval]);
3343 	rb_erase(&clp->cl_namenode, &nn->unconf_name_tree);
3344 	add_clp_to_name_tree(clp, &nn->conf_name_tree);
3345 	set_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags);
3346 	trace_nfsd_clid_confirmed(&clp->cl_clientid);
3347 	renew_client_locked(clp);
3348 }
3349 
3350 static struct nfs4_client *
find_client_in_id_table(struct list_head * tbl,clientid_t * clid,bool sessions)3351 find_client_in_id_table(struct list_head *tbl, clientid_t *clid, bool sessions)
3352 {
3353 	struct nfs4_client *clp;
3354 	unsigned int idhashval = clientid_hashval(clid->cl_id);
3355 
3356 	list_for_each_entry(clp, &tbl[idhashval], cl_idhash) {
3357 		if (same_clid(&clp->cl_clientid, clid)) {
3358 			if ((bool)clp->cl_minorversion != sessions)
3359 				return NULL;
3360 			renew_client_locked(clp);
3361 			return clp;
3362 		}
3363 	}
3364 	return NULL;
3365 }
3366 
3367 static struct nfs4_client *
find_confirmed_client(clientid_t * clid,bool sessions,struct nfsd_net * nn)3368 find_confirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
3369 {
3370 	struct list_head *tbl = nn->conf_id_hashtbl;
3371 
3372 	lockdep_assert_held(&nn->client_lock);
3373 	return find_client_in_id_table(tbl, clid, sessions);
3374 }
3375 
3376 static struct nfs4_client *
find_unconfirmed_client(clientid_t * clid,bool sessions,struct nfsd_net * nn)3377 find_unconfirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
3378 {
3379 	struct list_head *tbl = nn->unconf_id_hashtbl;
3380 
3381 	lockdep_assert_held(&nn->client_lock);
3382 	return find_client_in_id_table(tbl, clid, sessions);
3383 }
3384 
clp_used_exchangeid(struct nfs4_client * clp)3385 static bool clp_used_exchangeid(struct nfs4_client *clp)
3386 {
3387 	return clp->cl_exchange_flags != 0;
3388 }
3389 
3390 static struct nfs4_client *
find_confirmed_client_by_name(struct xdr_netobj * name,struct nfsd_net * nn)3391 find_confirmed_client_by_name(struct xdr_netobj *name, struct nfsd_net *nn)
3392 {
3393 	lockdep_assert_held(&nn->client_lock);
3394 	return find_clp_in_name_tree(name, &nn->conf_name_tree);
3395 }
3396 
3397 static struct nfs4_client *
find_unconfirmed_client_by_name(struct xdr_netobj * name,struct nfsd_net * nn)3398 find_unconfirmed_client_by_name(struct xdr_netobj *name, struct nfsd_net *nn)
3399 {
3400 	lockdep_assert_held(&nn->client_lock);
3401 	return find_clp_in_name_tree(name, &nn->unconf_name_tree);
3402 }
3403 
3404 static void
gen_callback(struct nfs4_client * clp,struct nfsd4_setclientid * se,struct svc_rqst * rqstp)3405 gen_callback(struct nfs4_client *clp, struct nfsd4_setclientid *se, struct svc_rqst *rqstp)
3406 {
3407 	struct nfs4_cb_conn *conn = &clp->cl_cb_conn;
3408 	struct sockaddr	*sa = svc_addr(rqstp);
3409 	u32 scopeid = rpc_get_scope_id(sa);
3410 	unsigned short expected_family;
3411 
3412 	/* Currently, we only support tcp and tcp6 for the callback channel */
3413 	if (se->se_callback_netid_len == 3 &&
3414 	    !memcmp(se->se_callback_netid_val, "tcp", 3))
3415 		expected_family = AF_INET;
3416 	else if (se->se_callback_netid_len == 4 &&
3417 		 !memcmp(se->se_callback_netid_val, "tcp6", 4))
3418 		expected_family = AF_INET6;
3419 	else
3420 		goto out_err;
3421 
3422 	conn->cb_addrlen = rpc_uaddr2sockaddr(clp->net, se->se_callback_addr_val,
3423 					    se->se_callback_addr_len,
3424 					    (struct sockaddr *)&conn->cb_addr,
3425 					    sizeof(conn->cb_addr));
3426 
3427 	if (!conn->cb_addrlen || conn->cb_addr.ss_family != expected_family)
3428 		goto out_err;
3429 
3430 	if (conn->cb_addr.ss_family == AF_INET6)
3431 		((struct sockaddr_in6 *)&conn->cb_addr)->sin6_scope_id = scopeid;
3432 
3433 	conn->cb_prog = se->se_callback_prog;
3434 	conn->cb_ident = se->se_callback_ident;
3435 	memcpy(&conn->cb_saddr, &rqstp->rq_daddr, rqstp->rq_daddrlen);
3436 	trace_nfsd_cb_args(clp, conn);
3437 	return;
3438 out_err:
3439 	conn->cb_addr.ss_family = AF_UNSPEC;
3440 	conn->cb_addrlen = 0;
3441 	trace_nfsd_cb_nodelegs(clp);
3442 	return;
3443 }
3444 
3445 /*
3446  * Cache a reply. nfsd4_check_resp_size() has bounded the cache size.
3447  */
3448 static void
nfsd4_store_cache_entry(struct nfsd4_compoundres * resp)3449 nfsd4_store_cache_entry(struct nfsd4_compoundres *resp)
3450 {
3451 	struct xdr_buf *buf = resp->xdr->buf;
3452 	struct nfsd4_slot *slot = resp->cstate.slot;
3453 	unsigned int base;
3454 
3455 	dprintk("--> %s slot %p\n", __func__, slot);
3456 
3457 	slot->sl_flags |= NFSD4_SLOT_INITIALIZED;
3458 	slot->sl_opcnt = resp->opcnt;
3459 	slot->sl_status = resp->cstate.status;
3460 	free_svc_cred(&slot->sl_cred);
3461 	copy_cred(&slot->sl_cred, &resp->rqstp->rq_cred);
3462 
3463 	if (!nfsd4_cache_this(resp)) {
3464 		slot->sl_flags &= ~NFSD4_SLOT_CACHED;
3465 		return;
3466 	}
3467 	slot->sl_flags |= NFSD4_SLOT_CACHED;
3468 
3469 	base = resp->cstate.data_offset;
3470 	slot->sl_datalen = buf->len - base;
3471 	if (read_bytes_from_xdr_buf(buf, base, slot->sl_data, slot->sl_datalen))
3472 		WARN(1, "%s: sessions DRC could not cache compound\n",
3473 		     __func__);
3474 	return;
3475 }
3476 
3477 /*
3478  * Encode the replay sequence operation from the slot values.
3479  * If cachethis is FALSE encode the uncached rep error on the next
3480  * operation which sets resp->p and increments resp->opcnt for
3481  * nfs4svc_encode_compoundres.
3482  *
3483  */
3484 static __be32
nfsd4_enc_sequence_replay(struct nfsd4_compoundargs * args,struct nfsd4_compoundres * resp)3485 nfsd4_enc_sequence_replay(struct nfsd4_compoundargs *args,
3486 			  struct nfsd4_compoundres *resp)
3487 {
3488 	struct nfsd4_op *op;
3489 	struct nfsd4_slot *slot = resp->cstate.slot;
3490 
3491 	/* Encode the replayed sequence operation */
3492 	op = &args->ops[resp->opcnt - 1];
3493 	nfsd4_encode_operation(resp, op);
3494 
3495 	if (slot->sl_flags & NFSD4_SLOT_CACHED)
3496 		return op->status;
3497 	if (args->opcnt == 1) {
3498 		/*
3499 		 * The original operation wasn't a solo sequence--we
3500 		 * always cache those--so this retry must not match the
3501 		 * original:
3502 		 */
3503 		op->status = nfserr_seq_false_retry;
3504 	} else {
3505 		op = &args->ops[resp->opcnt++];
3506 		op->status = nfserr_retry_uncached_rep;
3507 		nfsd4_encode_operation(resp, op);
3508 	}
3509 	return op->status;
3510 }
3511 
3512 /*
3513  * The sequence operation is not cached because we can use the slot and
3514  * session values.
3515  */
3516 static __be32
nfsd4_replay_cache_entry(struct nfsd4_compoundres * resp,struct nfsd4_sequence * seq)3517 nfsd4_replay_cache_entry(struct nfsd4_compoundres *resp,
3518 			 struct nfsd4_sequence *seq)
3519 {
3520 	struct nfsd4_slot *slot = resp->cstate.slot;
3521 	struct xdr_stream *xdr = resp->xdr;
3522 	__be32 *p;
3523 	__be32 status;
3524 
3525 	dprintk("--> %s slot %p\n", __func__, slot);
3526 
3527 	status = nfsd4_enc_sequence_replay(resp->rqstp->rq_argp, resp);
3528 	if (status)
3529 		return status;
3530 
3531 	p = xdr_reserve_space(xdr, slot->sl_datalen);
3532 	if (!p) {
3533 		WARN_ON_ONCE(1);
3534 		return nfserr_serverfault;
3535 	}
3536 	xdr_encode_opaque_fixed(p, slot->sl_data, slot->sl_datalen);
3537 	xdr_commit_encode(xdr);
3538 
3539 	resp->opcnt = slot->sl_opcnt;
3540 	return slot->sl_status;
3541 }
3542 
3543 /*
3544  * Set the exchange_id flags returned by the server.
3545  */
3546 static void
nfsd4_set_ex_flags(struct nfs4_client * new,struct nfsd4_exchange_id * clid)3547 nfsd4_set_ex_flags(struct nfs4_client *new, struct nfsd4_exchange_id *clid)
3548 {
3549 #ifdef CONFIG_NFSD_PNFS
3550 	new->cl_exchange_flags |= EXCHGID4_FLAG_USE_PNFS_MDS;
3551 #else
3552 	new->cl_exchange_flags |= EXCHGID4_FLAG_USE_NON_PNFS;
3553 #endif
3554 
3555 	/* Referrals are supported, Migration is not. */
3556 	new->cl_exchange_flags |= EXCHGID4_FLAG_SUPP_MOVED_REFER;
3557 
3558 	/* set the wire flags to return to client. */
3559 	clid->flags = new->cl_exchange_flags;
3560 }
3561 
client_has_openowners(struct nfs4_client * clp)3562 static bool client_has_openowners(struct nfs4_client *clp)
3563 {
3564 	struct nfs4_openowner *oo;
3565 
3566 	list_for_each_entry(oo, &clp->cl_openowners, oo_perclient) {
3567 		if (!list_empty(&oo->oo_owner.so_stateids))
3568 			return true;
3569 	}
3570 	return false;
3571 }
3572 
client_has_state(struct nfs4_client * clp)3573 static bool client_has_state(struct nfs4_client *clp)
3574 {
3575 	return client_has_openowners(clp)
3576 #ifdef CONFIG_NFSD_PNFS
3577 		|| !list_empty(&clp->cl_lo_states)
3578 #endif
3579 		|| !list_empty(&clp->cl_delegations)
3580 		|| !list_empty(&clp->cl_sessions)
3581 		|| nfsd4_has_active_async_copies(clp);
3582 }
3583 
copy_impl_id(struct nfs4_client * clp,struct nfsd4_exchange_id * exid)3584 static __be32 copy_impl_id(struct nfs4_client *clp,
3585 				struct nfsd4_exchange_id *exid)
3586 {
3587 	if (!exid->nii_domain.data)
3588 		return 0;
3589 	xdr_netobj_dup(&clp->cl_nii_domain, &exid->nii_domain, GFP_KERNEL);
3590 	if (!clp->cl_nii_domain.data)
3591 		return nfserr_jukebox;
3592 	xdr_netobj_dup(&clp->cl_nii_name, &exid->nii_name, GFP_KERNEL);
3593 	if (!clp->cl_nii_name.data)
3594 		return nfserr_jukebox;
3595 	clp->cl_nii_time = exid->nii_time;
3596 	return 0;
3597 }
3598 
3599 __be32
nfsd4_exchange_id(struct svc_rqst * rqstp,struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)3600 nfsd4_exchange_id(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3601 		union nfsd4_op_u *u)
3602 {
3603 	struct nfsd4_exchange_id *exid = &u->exchange_id;
3604 	struct nfs4_client *conf, *new;
3605 	struct nfs4_client *unconf = NULL;
3606 	__be32 status;
3607 	char			addr_str[INET6_ADDRSTRLEN];
3608 	nfs4_verifier		verf = exid->verifier;
3609 	struct sockaddr		*sa = svc_addr(rqstp);
3610 	bool	update = exid->flags & EXCHGID4_FLAG_UPD_CONFIRMED_REC_A;
3611 	struct nfsd_net		*nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
3612 
3613 	rpc_ntop(sa, addr_str, sizeof(addr_str));
3614 	dprintk("%s rqstp=%p exid=%p clname.len=%u clname.data=%p "
3615 		"ip_addr=%s flags %x, spa_how %u\n",
3616 		__func__, rqstp, exid, exid->clname.len, exid->clname.data,
3617 		addr_str, exid->flags, exid->spa_how);
3618 
3619 	exid->server_impl_name = kasprintf(GFP_KERNEL, "%s %s %s %s",
3620 					   utsname()->sysname, utsname()->release,
3621 					   utsname()->version, utsname()->machine);
3622 	if (!exid->server_impl_name)
3623 		return nfserr_jukebox;
3624 
3625 	if (exid->flags & ~EXCHGID4_FLAG_MASK_A)
3626 		return nfserr_inval;
3627 
3628 	new = create_client(exid->clname, rqstp, &verf);
3629 	if (new == NULL)
3630 		return nfserr_jukebox;
3631 	status = copy_impl_id(new, exid);
3632 	if (status)
3633 		goto out_nolock;
3634 
3635 	switch (exid->spa_how) {
3636 	case SP4_MACH_CRED:
3637 		exid->spo_must_enforce[0] = 0;
3638 		exid->spo_must_enforce[1] = (
3639 			1 << (OP_BIND_CONN_TO_SESSION - 32) |
3640 			1 << (OP_EXCHANGE_ID - 32) |
3641 			1 << (OP_CREATE_SESSION - 32) |
3642 			1 << (OP_DESTROY_SESSION - 32) |
3643 			1 << (OP_DESTROY_CLIENTID - 32));
3644 
3645 		exid->spo_must_allow[0] &= (1 << (OP_CLOSE) |
3646 					1 << (OP_OPEN_DOWNGRADE) |
3647 					1 << (OP_LOCKU) |
3648 					1 << (OP_DELEGRETURN));
3649 
3650 		exid->spo_must_allow[1] &= (
3651 					1 << (OP_TEST_STATEID - 32) |
3652 					1 << (OP_FREE_STATEID - 32));
3653 		if (!svc_rqst_integrity_protected(rqstp)) {
3654 			status = nfserr_inval;
3655 			goto out_nolock;
3656 		}
3657 		/*
3658 		 * Sometimes userspace doesn't give us a principal.
3659 		 * Which is a bug, really.  Anyway, we can't enforce
3660 		 * MACH_CRED in that case, better to give up now:
3661 		 */
3662 		if (!new->cl_cred.cr_principal &&
3663 					!new->cl_cred.cr_raw_principal) {
3664 			status = nfserr_serverfault;
3665 			goto out_nolock;
3666 		}
3667 		new->cl_mach_cred = true;
3668 		break;
3669 	case SP4_NONE:
3670 		break;
3671 	default:				/* checked by xdr code */
3672 		WARN_ON_ONCE(1);
3673 		fallthrough;
3674 	case SP4_SSV:
3675 		status = nfserr_encr_alg_unsupp;
3676 		goto out_nolock;
3677 	}
3678 
3679 	/* Cases below refer to rfc 5661 section 18.35.4: */
3680 	spin_lock(&nn->client_lock);
3681 	conf = find_confirmed_client_by_name(&exid->clname, nn);
3682 	if (conf) {
3683 		bool creds_match = same_creds(&conf->cl_cred, &rqstp->rq_cred);
3684 		bool verfs_match = same_verf(&verf, &conf->cl_verifier);
3685 
3686 		if (update) {
3687 			if (!clp_used_exchangeid(conf)) { /* buggy client */
3688 				status = nfserr_inval;
3689 				goto out;
3690 			}
3691 			if (!nfsd4_mach_creds_match(conf, rqstp)) {
3692 				status = nfserr_wrong_cred;
3693 				goto out;
3694 			}
3695 			if (!creds_match) { /* case 9 */
3696 				status = nfserr_perm;
3697 				goto out;
3698 			}
3699 			if (!verfs_match) { /* case 8 */
3700 				status = nfserr_not_same;
3701 				goto out;
3702 			}
3703 			/* case 6 */
3704 			exid->flags |= EXCHGID4_FLAG_CONFIRMED_R;
3705 			trace_nfsd_clid_confirmed_r(conf);
3706 			goto out_copy;
3707 		}
3708 		if (!creds_match) { /* case 3 */
3709 			if (client_has_state(conf)) {
3710 				status = nfserr_clid_inuse;
3711 				trace_nfsd_clid_cred_mismatch(conf, rqstp);
3712 				goto out;
3713 			}
3714 			goto out_new;
3715 		}
3716 		if (verfs_match) { /* case 2 */
3717 			conf->cl_exchange_flags |= EXCHGID4_FLAG_CONFIRMED_R;
3718 			trace_nfsd_clid_confirmed_r(conf);
3719 			goto out_copy;
3720 		}
3721 		/* case 5, client reboot */
3722 		trace_nfsd_clid_verf_mismatch(conf, rqstp, &verf);
3723 		conf = NULL;
3724 		goto out_new;
3725 	}
3726 
3727 	if (update) { /* case 7 */
3728 		status = nfserr_noent;
3729 		goto out;
3730 	}
3731 
3732 	unconf = find_unconfirmed_client_by_name(&exid->clname, nn);
3733 	if (unconf) /* case 4, possible retry or client restart */
3734 		unhash_client_locked(unconf);
3735 
3736 	/* case 1, new owner ID */
3737 	trace_nfsd_clid_fresh(new);
3738 
3739 out_new:
3740 	if (conf) {
3741 		status = mark_client_expired_locked(conf);
3742 		if (status)
3743 			goto out;
3744 		trace_nfsd_clid_replaced(&conf->cl_clientid);
3745 	}
3746 	new->cl_minorversion = cstate->minorversion;
3747 	new->cl_spo_must_allow.u.words[0] = exid->spo_must_allow[0];
3748 	new->cl_spo_must_allow.u.words[1] = exid->spo_must_allow[1];
3749 
3750 	/* Contrived initial CREATE_SESSION response */
3751 	new->cl_cs_slot.sl_status = nfserr_seq_misordered;
3752 
3753 	add_to_unconfirmed(new);
3754 	swap(new, conf);
3755 out_copy:
3756 	exid->clientid.cl_boot = conf->cl_clientid.cl_boot;
3757 	exid->clientid.cl_id = conf->cl_clientid.cl_id;
3758 
3759 	exid->seqid = conf->cl_cs_slot.sl_seqid + 1;
3760 	nfsd4_set_ex_flags(conf, exid);
3761 
3762 	exid->nii_domain.len = sizeof("kernel.org") - 1;
3763 	exid->nii_domain.data = "kernel.org";
3764 
3765 	/*
3766 	 * Note that RFC 8881 places no length limit on
3767 	 * nii_name, but this implementation permits no
3768 	 * more than NFS4_OPAQUE_LIMIT bytes.
3769 	 */
3770 	exid->nii_name.len = strlen(exid->server_impl_name);
3771 	if (exid->nii_name.len > NFS4_OPAQUE_LIMIT)
3772 		exid->nii_name.len = NFS4_OPAQUE_LIMIT;
3773 	exid->nii_name.data = exid->server_impl_name;
3774 
3775 	/* just send zeros - the date is in nii_name */
3776 	exid->nii_time.tv_sec = 0;
3777 	exid->nii_time.tv_nsec = 0;
3778 
3779 	dprintk("nfsd4_exchange_id seqid %d flags %x\n",
3780 		conf->cl_cs_slot.sl_seqid, conf->cl_exchange_flags);
3781 	status = nfs_ok;
3782 
3783 out:
3784 	spin_unlock(&nn->client_lock);
3785 out_nolock:
3786 	if (new)
3787 		expire_client(new);
3788 	if (unconf) {
3789 		trace_nfsd_clid_expire_unconf(&unconf->cl_clientid);
3790 		expire_client(unconf);
3791 	}
3792 	return status;
3793 }
3794 
3795 void
nfsd4_exchange_id_release(union nfsd4_op_u * u)3796 nfsd4_exchange_id_release(union nfsd4_op_u *u)
3797 {
3798 	struct nfsd4_exchange_id *exid = &u->exchange_id;
3799 
3800 	kfree(exid->server_impl_name);
3801 }
3802 
check_slot_seqid(u32 seqid,u32 slot_seqid,u8 flags)3803 static __be32 check_slot_seqid(u32 seqid, u32 slot_seqid, u8 flags)
3804 {
3805 	/* The slot is in use, and no response has been sent. */
3806 	if (flags & NFSD4_SLOT_INUSE) {
3807 		if (seqid == slot_seqid)
3808 			return nfserr_jukebox;
3809 		else
3810 			return nfserr_seq_misordered;
3811 	}
3812 	/* Note unsigned 32-bit arithmetic handles wraparound: */
3813 	if (likely(seqid == slot_seqid + 1))
3814 		return nfs_ok;
3815 	if ((flags & NFSD4_SLOT_REUSED) && seqid == 1)
3816 		return nfs_ok;
3817 	if (seqid == slot_seqid)
3818 		return nfserr_replay_cache;
3819 	return nfserr_seq_misordered;
3820 }
3821 
3822 /*
3823  * Cache the create session result into the create session single DRC
3824  * slot cache by saving the xdr structure. sl_seqid has been set.
3825  * Do this for solo or embedded create session operations.
3826  */
3827 static void
nfsd4_cache_create_session(struct nfsd4_create_session * cr_ses,struct nfsd4_clid_slot * slot,__be32 nfserr)3828 nfsd4_cache_create_session(struct nfsd4_create_session *cr_ses,
3829 			   struct nfsd4_clid_slot *slot, __be32 nfserr)
3830 {
3831 	slot->sl_status = nfserr;
3832 	memcpy(&slot->sl_cr_ses, cr_ses, sizeof(*cr_ses));
3833 }
3834 
3835 static __be32
nfsd4_replay_create_session(struct nfsd4_create_session * cr_ses,struct nfsd4_clid_slot * slot)3836 nfsd4_replay_create_session(struct nfsd4_create_session *cr_ses,
3837 			    struct nfsd4_clid_slot *slot)
3838 {
3839 	memcpy(cr_ses, &slot->sl_cr_ses, sizeof(*cr_ses));
3840 	return slot->sl_status;
3841 }
3842 
3843 #define NFSD_MIN_REQ_HDR_SEQ_SZ	((\
3844 			2 * 2 + /* credential,verifier: AUTH_NULL, length 0 */ \
3845 			1 +	/* MIN tag is length with zero, only length */ \
3846 			3 +	/* version, opcount, opcode */ \
3847 			XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + \
3848 				/* seqid, slotID, slotID, cache */ \
3849 			4 ) * sizeof(__be32))
3850 
3851 #define NFSD_MIN_RESP_HDR_SEQ_SZ ((\
3852 			2 +	/* verifier: AUTH_NULL, length 0 */\
3853 			1 +	/* status */ \
3854 			1 +	/* MIN tag is length with zero, only length */ \
3855 			3 +	/* opcount, opcode, opstatus*/ \
3856 			XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + \
3857 				/* seqid, slotID, slotID, slotID, status */ \
3858 			5 ) * sizeof(__be32))
3859 
check_forechannel_attrs(struct nfsd4_channel_attrs * ca,struct nfsd_net * nn)3860 static __be32 check_forechannel_attrs(struct nfsd4_channel_attrs *ca, struct nfsd_net *nn)
3861 {
3862 	u32 maxrpc = nn->nfsd_serv->sv_max_mesg;
3863 
3864 	if (ca->maxreq_sz < NFSD_MIN_REQ_HDR_SEQ_SZ)
3865 		return nfserr_toosmall;
3866 	if (ca->maxresp_sz < NFSD_MIN_RESP_HDR_SEQ_SZ)
3867 		return nfserr_toosmall;
3868 	ca->headerpadsz = 0;
3869 	ca->maxreq_sz = min_t(u32, ca->maxreq_sz, maxrpc);
3870 	ca->maxresp_sz = min_t(u32, ca->maxresp_sz, maxrpc);
3871 	ca->maxops = min_t(u32, ca->maxops, NFSD_MAX_OPS_PER_COMPOUND);
3872 	ca->maxresp_cached = min_t(u32, ca->maxresp_cached,
3873 			NFSD_SLOT_CACHE_SIZE + NFSD_MIN_HDR_SEQ_SZ);
3874 	ca->maxreqs = min_t(u32, ca->maxreqs, NFSD_MAX_SLOTS_PER_SESSION);
3875 
3876 	return nfs_ok;
3877 }
3878 
3879 /*
3880  * Server's NFSv4.1 backchannel support is AUTH_SYS-only for now.
3881  * These are based on similar macros in linux/sunrpc/msg_prot.h .
3882  */
3883 #define RPC_MAX_HEADER_WITH_AUTH_SYS \
3884 	(RPC_CALLHDRSIZE + 2 * (2 + UNX_CALLSLACK))
3885 
3886 #define RPC_MAX_REPHEADER_WITH_AUTH_SYS \
3887 	(RPC_REPHDRSIZE + (2 + NUL_REPLYSLACK))
3888 
3889 #define NFSD_CB_MAX_REQ_SZ	((NFS4_enc_cb_recall_sz + \
3890 				 RPC_MAX_HEADER_WITH_AUTH_SYS) * sizeof(__be32))
3891 #define NFSD_CB_MAX_RESP_SZ	((NFS4_dec_cb_recall_sz + \
3892 				 RPC_MAX_REPHEADER_WITH_AUTH_SYS) * \
3893 				 sizeof(__be32))
3894 
check_backchannel_attrs(struct nfsd4_channel_attrs * ca)3895 static __be32 check_backchannel_attrs(struct nfsd4_channel_attrs *ca)
3896 {
3897 	ca->headerpadsz = 0;
3898 
3899 	if (ca->maxreq_sz < NFSD_CB_MAX_REQ_SZ)
3900 		return nfserr_toosmall;
3901 	if (ca->maxresp_sz < NFSD_CB_MAX_RESP_SZ)
3902 		return nfserr_toosmall;
3903 	ca->maxresp_cached = 0;
3904 	if (ca->maxops < 2)
3905 		return nfserr_toosmall;
3906 
3907 	return nfs_ok;
3908 }
3909 
nfsd4_check_cb_sec(struct nfsd4_cb_sec * cbs)3910 static __be32 nfsd4_check_cb_sec(struct nfsd4_cb_sec *cbs)
3911 {
3912 	switch (cbs->flavor) {
3913 	case RPC_AUTH_NULL:
3914 	case RPC_AUTH_UNIX:
3915 		return nfs_ok;
3916 	default:
3917 		/*
3918 		 * GSS case: the spec doesn't allow us to return this
3919 		 * error.  But it also doesn't allow us not to support
3920 		 * GSS.
3921 		 * I'd rather this fail hard than return some error the
3922 		 * client might think it can already handle:
3923 		 */
3924 		return nfserr_encr_alg_unsupp;
3925 	}
3926 }
3927 
3928 __be32
nfsd4_create_session(struct svc_rqst * rqstp,struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)3929 nfsd4_create_session(struct svc_rqst *rqstp,
3930 		struct nfsd4_compound_state *cstate, union nfsd4_op_u *u)
3931 {
3932 	struct nfsd4_create_session *cr_ses = &u->create_session;
3933 	struct sockaddr *sa = svc_addr(rqstp);
3934 	struct nfs4_client *conf, *unconf;
3935 	struct nfsd4_clid_slot *cs_slot;
3936 	struct nfs4_client *old = NULL;
3937 	struct nfsd4_session *new;
3938 	struct nfsd4_conn *conn;
3939 	__be32 status = 0;
3940 	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
3941 
3942 	if (cr_ses->flags & ~SESSION4_FLAG_MASK_A)
3943 		return nfserr_inval;
3944 	status = nfsd4_check_cb_sec(&cr_ses->cb_sec);
3945 	if (status)
3946 		return status;
3947 	status = check_forechannel_attrs(&cr_ses->fore_channel, nn);
3948 	if (status)
3949 		return status;
3950 	status = check_backchannel_attrs(&cr_ses->back_channel);
3951 	if (status)
3952 		goto out_err;
3953 	status = nfserr_jukebox;
3954 	new = alloc_session(&cr_ses->fore_channel, &cr_ses->back_channel);
3955 	if (!new)
3956 		goto out_err;
3957 	conn = alloc_conn_from_crses(rqstp, cr_ses);
3958 	if (!conn)
3959 		goto out_free_session;
3960 
3961 	spin_lock(&nn->client_lock);
3962 
3963 	/* RFC 8881 Section 18.36.4 Phase 1: Client record look-up. */
3964 	unconf = find_unconfirmed_client(&cr_ses->clientid, true, nn);
3965 	conf = find_confirmed_client(&cr_ses->clientid, true, nn);
3966 	if (!conf && !unconf) {
3967 		status = nfserr_stale_clientid;
3968 		goto out_free_conn;
3969 	}
3970 
3971 	/* RFC 8881 Section 18.36.4 Phase 2: Sequence ID processing. */
3972 	if (conf) {
3973 		cs_slot = &conf->cl_cs_slot;
3974 		trace_nfsd_slot_seqid_conf(conf, cr_ses);
3975 	} else {
3976 		cs_slot = &unconf->cl_cs_slot;
3977 		trace_nfsd_slot_seqid_unconf(unconf, cr_ses);
3978 	}
3979 	status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
3980 	switch (status) {
3981 	case nfs_ok:
3982 		cs_slot->sl_seqid++;
3983 		cr_ses->seqid = cs_slot->sl_seqid;
3984 		break;
3985 	case nfserr_replay_cache:
3986 		status = nfsd4_replay_create_session(cr_ses, cs_slot);
3987 		fallthrough;
3988 	case nfserr_jukebox:
3989 		/* The server MUST NOT cache NFS4ERR_DELAY */
3990 		goto out_free_conn;
3991 	default:
3992 		goto out_cache_error;
3993 	}
3994 
3995 	/* RFC 8881 Section 18.36.4 Phase 3: Client ID confirmation. */
3996 	if (conf) {
3997 		status = nfserr_wrong_cred;
3998 		if (!nfsd4_mach_creds_match(conf, rqstp))
3999 			goto out_cache_error;
4000 	} else {
4001 		status = nfserr_clid_inuse;
4002 		if (!same_creds(&unconf->cl_cred, &rqstp->rq_cred) ||
4003 		    !rpc_cmp_addr(sa, (struct sockaddr *) &unconf->cl_addr)) {
4004 			trace_nfsd_clid_cred_mismatch(unconf, rqstp);
4005 			goto out_cache_error;
4006 		}
4007 		status = nfserr_wrong_cred;
4008 		if (!nfsd4_mach_creds_match(unconf, rqstp))
4009 			goto out_cache_error;
4010 		old = find_confirmed_client_by_name(&unconf->cl_name, nn);
4011 		if (old) {
4012 			status = mark_client_expired_locked(old);
4013 			if (status)
4014 				goto out_expired_error;
4015 			trace_nfsd_clid_replaced(&old->cl_clientid);
4016 		}
4017 		move_to_confirmed(unconf);
4018 		conf = unconf;
4019 	}
4020 
4021 	/* RFC 8881 Section 18.36.4 Phase 4: Session creation. */
4022 	status = nfs_ok;
4023 	/* Persistent sessions are not supported */
4024 	cr_ses->flags &= ~SESSION4_PERSIST;
4025 	/* Upshifting from TCP to RDMA is not supported */
4026 	cr_ses->flags &= ~SESSION4_RDMA;
4027 	/* Report the correct number of backchannel slots */
4028 	cr_ses->back_channel.maxreqs = new->se_cb_highest_slot + 1;
4029 
4030 	init_session(rqstp, new, conf, cr_ses);
4031 	nfsd4_get_session_locked(new);
4032 
4033 	memcpy(cr_ses->sessionid.data, new->se_sessionid.data,
4034 	       NFS4_MAX_SESSIONID_LEN);
4035 
4036 	/* cache solo and embedded create sessions under the client_lock */
4037 	nfsd4_cache_create_session(cr_ses, cs_slot, status);
4038 	spin_unlock(&nn->client_lock);
4039 	if (conf == unconf)
4040 		fsnotify_dentry(conf->cl_nfsd_info_dentry, FS_MODIFY);
4041 	/* init connection and backchannel */
4042 	nfsd4_init_conn(rqstp, conn, new);
4043 	nfsd4_put_session(new);
4044 	if (old)
4045 		expire_client(old);
4046 	return status;
4047 
4048 out_expired_error:
4049 	/*
4050 	 * Revert the slot seq_nr change so the server will process
4051 	 * the client's resend instead of returning a cached response.
4052 	 */
4053 	if (status == nfserr_jukebox) {
4054 		cs_slot->sl_seqid--;
4055 		cr_ses->seqid = cs_slot->sl_seqid;
4056 		goto out_free_conn;
4057 	}
4058 out_cache_error:
4059 	nfsd4_cache_create_session(cr_ses, cs_slot, status);
4060 out_free_conn:
4061 	spin_unlock(&nn->client_lock);
4062 	free_conn(conn);
4063 out_free_session:
4064 	__free_session(new);
4065 out_err:
4066 	return status;
4067 }
4068 
nfsd4_map_bcts_dir(u32 * dir)4069 static __be32 nfsd4_map_bcts_dir(u32 *dir)
4070 {
4071 	switch (*dir) {
4072 	case NFS4_CDFC4_FORE:
4073 	case NFS4_CDFC4_BACK:
4074 		return nfs_ok;
4075 	case NFS4_CDFC4_FORE_OR_BOTH:
4076 	case NFS4_CDFC4_BACK_OR_BOTH:
4077 		*dir = NFS4_CDFC4_BOTH;
4078 		return nfs_ok;
4079 	}
4080 	return nfserr_inval;
4081 }
4082 
nfsd4_backchannel_ctl(struct svc_rqst * rqstp,struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)4083 __be32 nfsd4_backchannel_ctl(struct svc_rqst *rqstp,
4084 		struct nfsd4_compound_state *cstate,
4085 		union nfsd4_op_u *u)
4086 {
4087 	struct nfsd4_backchannel_ctl *bc = &u->backchannel_ctl;
4088 	struct nfsd4_session *session = cstate->session;
4089 	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4090 	__be32 status;
4091 
4092 	status = nfsd4_check_cb_sec(&bc->bc_cb_sec);
4093 	if (status)
4094 		return status;
4095 	spin_lock(&nn->client_lock);
4096 	session->se_cb_prog = bc->bc_cb_program;
4097 	session->se_cb_sec = bc->bc_cb_sec;
4098 	spin_unlock(&nn->client_lock);
4099 
4100 	nfsd4_probe_callback(session->se_client);
4101 
4102 	return nfs_ok;
4103 }
4104 
__nfsd4_find_conn(struct svc_xprt * xpt,struct nfsd4_session * s)4105 static struct nfsd4_conn *__nfsd4_find_conn(struct svc_xprt *xpt, struct nfsd4_session *s)
4106 {
4107 	struct nfsd4_conn *c;
4108 
4109 	list_for_each_entry(c, &s->se_conns, cn_persession) {
4110 		if (c->cn_xprt == xpt) {
4111 			return c;
4112 		}
4113 	}
4114 	return NULL;
4115 }
4116 
nfsd4_match_existing_connection(struct svc_rqst * rqst,struct nfsd4_session * session,u32 req,struct nfsd4_conn ** conn)4117 static __be32 nfsd4_match_existing_connection(struct svc_rqst *rqst,
4118 		struct nfsd4_session *session, u32 req, struct nfsd4_conn **conn)
4119 {
4120 	struct nfs4_client *clp = session->se_client;
4121 	struct svc_xprt *xpt = rqst->rq_xprt;
4122 	struct nfsd4_conn *c;
4123 	__be32 status;
4124 
4125 	/* Following the last paragraph of RFC 5661 Section 18.34.3: */
4126 	spin_lock(&clp->cl_lock);
4127 	c = __nfsd4_find_conn(xpt, session);
4128 	if (!c)
4129 		status = nfserr_noent;
4130 	else if (req == c->cn_flags)
4131 		status = nfs_ok;
4132 	else if (req == NFS4_CDFC4_FORE_OR_BOTH &&
4133 				c->cn_flags != NFS4_CDFC4_BACK)
4134 		status = nfs_ok;
4135 	else if (req == NFS4_CDFC4_BACK_OR_BOTH &&
4136 				c->cn_flags != NFS4_CDFC4_FORE)
4137 		status = nfs_ok;
4138 	else
4139 		status = nfserr_inval;
4140 	spin_unlock(&clp->cl_lock);
4141 	if (status == nfs_ok && conn)
4142 		*conn = c;
4143 	return status;
4144 }
4145 
nfsd4_bind_conn_to_session(struct svc_rqst * rqstp,struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)4146 __be32 nfsd4_bind_conn_to_session(struct svc_rqst *rqstp,
4147 		     struct nfsd4_compound_state *cstate,
4148 		     union nfsd4_op_u *u)
4149 {
4150 	struct nfsd4_bind_conn_to_session *bcts = &u->bind_conn_to_session;
4151 	__be32 status;
4152 	struct nfsd4_conn *conn;
4153 	struct nfsd4_session *session;
4154 	struct net *net = SVC_NET(rqstp);
4155 	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
4156 
4157 	if (!nfsd4_last_compound_op(rqstp))
4158 		return nfserr_not_only_op;
4159 	spin_lock(&nn->client_lock);
4160 	session = find_in_sessionid_hashtbl(&bcts->sessionid, net, &status);
4161 	spin_unlock(&nn->client_lock);
4162 	if (!session)
4163 		goto out_no_session;
4164 	status = nfserr_wrong_cred;
4165 	if (!nfsd4_mach_creds_match(session->se_client, rqstp))
4166 		goto out;
4167 	status = nfsd4_match_existing_connection(rqstp, session,
4168 			bcts->dir, &conn);
4169 	if (status == nfs_ok) {
4170 		if (bcts->dir == NFS4_CDFC4_FORE_OR_BOTH ||
4171 				bcts->dir == NFS4_CDFC4_BACK)
4172 			conn->cn_flags |= NFS4_CDFC4_BACK;
4173 		nfsd4_probe_callback(session->se_client);
4174 		goto out;
4175 	}
4176 	if (status == nfserr_inval)
4177 		goto out;
4178 	status = nfsd4_map_bcts_dir(&bcts->dir);
4179 	if (status)
4180 		goto out;
4181 	conn = alloc_conn(rqstp, bcts->dir);
4182 	status = nfserr_jukebox;
4183 	if (!conn)
4184 		goto out;
4185 	nfsd4_init_conn(rqstp, conn, session);
4186 	status = nfs_ok;
4187 out:
4188 	nfsd4_put_session(session);
4189 out_no_session:
4190 	return status;
4191 }
4192 
nfsd4_compound_in_session(struct nfsd4_compound_state * cstate,struct nfs4_sessionid * sid)4193 static bool nfsd4_compound_in_session(struct nfsd4_compound_state *cstate, struct nfs4_sessionid *sid)
4194 {
4195 	if (!cstate->session)
4196 		return false;
4197 	return !memcmp(sid, &cstate->session->se_sessionid, sizeof(*sid));
4198 }
4199 
4200 __be32
nfsd4_destroy_session(struct svc_rqst * r,struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)4201 nfsd4_destroy_session(struct svc_rqst *r, struct nfsd4_compound_state *cstate,
4202 		union nfsd4_op_u *u)
4203 {
4204 	struct nfs4_sessionid *sessionid = &u->destroy_session.sessionid;
4205 	struct nfsd4_session *ses;
4206 	__be32 status;
4207 	int ref_held_by_me = 0;
4208 	struct net *net = SVC_NET(r);
4209 	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
4210 
4211 	status = nfserr_not_only_op;
4212 	if (nfsd4_compound_in_session(cstate, sessionid)) {
4213 		if (!nfsd4_last_compound_op(r))
4214 			goto out;
4215 		ref_held_by_me++;
4216 	}
4217 	dump_sessionid(__func__, sessionid);
4218 	spin_lock(&nn->client_lock);
4219 	ses = find_in_sessionid_hashtbl(sessionid, net, &status);
4220 	if (!ses)
4221 		goto out_client_lock;
4222 	status = nfserr_wrong_cred;
4223 	if (!nfsd4_mach_creds_match(ses->se_client, r))
4224 		goto out_put_session;
4225 	status = mark_session_dead_locked(ses, 1 + ref_held_by_me);
4226 	if (status)
4227 		goto out_put_session;
4228 	unhash_session(ses);
4229 	spin_unlock(&nn->client_lock);
4230 
4231 	nfsd4_probe_callback_sync(ses->se_client);
4232 
4233 	spin_lock(&nn->client_lock);
4234 	status = nfs_ok;
4235 out_put_session:
4236 	nfsd4_put_session_locked(ses);
4237 out_client_lock:
4238 	spin_unlock(&nn->client_lock);
4239 out:
4240 	return status;
4241 }
4242 
nfsd4_sequence_check_conn(struct nfsd4_conn * new,struct nfsd4_session * ses)4243 static __be32 nfsd4_sequence_check_conn(struct nfsd4_conn *new, struct nfsd4_session *ses)
4244 {
4245 	struct nfs4_client *clp = ses->se_client;
4246 	struct nfsd4_conn *c;
4247 	__be32 status = nfs_ok;
4248 	int ret;
4249 
4250 	spin_lock(&clp->cl_lock);
4251 	c = __nfsd4_find_conn(new->cn_xprt, ses);
4252 	if (c)
4253 		goto out_free;
4254 	status = nfserr_conn_not_bound_to_session;
4255 	if (clp->cl_mach_cred)
4256 		goto out_free;
4257 	__nfsd4_hash_conn(new, ses);
4258 	spin_unlock(&clp->cl_lock);
4259 	ret = nfsd4_register_conn(new);
4260 	if (ret)
4261 		/* oops; xprt is already down: */
4262 		nfsd4_conn_lost(&new->cn_xpt_user);
4263 	return nfs_ok;
4264 out_free:
4265 	spin_unlock(&clp->cl_lock);
4266 	free_conn(new);
4267 	return status;
4268 }
4269 
nfsd4_session_too_many_ops(struct svc_rqst * rqstp,struct nfsd4_session * session)4270 static bool nfsd4_session_too_many_ops(struct svc_rqst *rqstp, struct nfsd4_session *session)
4271 {
4272 	struct nfsd4_compoundargs *args = rqstp->rq_argp;
4273 
4274 	return args->opcnt > session->se_fchannel.maxops;
4275 }
4276 
nfsd4_request_too_big(struct svc_rqst * rqstp,struct nfsd4_session * session)4277 static bool nfsd4_request_too_big(struct svc_rqst *rqstp,
4278 				  struct nfsd4_session *session)
4279 {
4280 	struct xdr_buf *xb = &rqstp->rq_arg;
4281 
4282 	return xb->len > session->se_fchannel.maxreq_sz;
4283 }
4284 
replay_matches_cache(struct svc_rqst * rqstp,struct nfsd4_sequence * seq,struct nfsd4_slot * slot)4285 static bool replay_matches_cache(struct svc_rqst *rqstp,
4286 		 struct nfsd4_sequence *seq, struct nfsd4_slot *slot)
4287 {
4288 	struct nfsd4_compoundargs *argp = rqstp->rq_argp;
4289 
4290 	if ((bool)(slot->sl_flags & NFSD4_SLOT_CACHETHIS) !=
4291 	    (bool)seq->cachethis)
4292 		return false;
4293 	/*
4294 	 * If there's an error then the reply can have fewer ops than
4295 	 * the call.
4296 	 */
4297 	if (slot->sl_opcnt < argp->opcnt && !slot->sl_status)
4298 		return false;
4299 	/*
4300 	 * But if we cached a reply with *more* ops than the call you're
4301 	 * sending us now, then this new call is clearly not really a
4302 	 * replay of the old one:
4303 	 */
4304 	if (slot->sl_opcnt > argp->opcnt)
4305 		return false;
4306 	/* This is the only check explicitly called by spec: */
4307 	if (!same_creds(&rqstp->rq_cred, &slot->sl_cred))
4308 		return false;
4309 	/*
4310 	 * There may be more comparisons we could actually do, but the
4311 	 * spec doesn't require us to catch every case where the calls
4312 	 * don't match (that would require caching the call as well as
4313 	 * the reply), so we don't bother.
4314 	 */
4315 	return true;
4316 }
4317 
4318 __be32
nfsd4_sequence(struct svc_rqst * rqstp,struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)4319 nfsd4_sequence(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4320 		union nfsd4_op_u *u)
4321 {
4322 	struct nfsd4_sequence *seq = &u->sequence;
4323 	struct nfsd4_compoundres *resp = rqstp->rq_resp;
4324 	struct xdr_stream *xdr = resp->xdr;
4325 	struct nfsd4_session *session;
4326 	struct nfs4_client *clp;
4327 	struct nfsd4_slot *slot;
4328 	struct nfsd4_conn *conn;
4329 	__be32 status;
4330 	int buflen;
4331 	struct net *net = SVC_NET(rqstp);
4332 	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
4333 
4334 	if (resp->opcnt != 1)
4335 		return nfserr_sequence_pos;
4336 
4337 	/*
4338 	 * Will be either used or freed by nfsd4_sequence_check_conn
4339 	 * below.
4340 	 */
4341 	conn = alloc_conn(rqstp, NFS4_CDFC4_FORE);
4342 	if (!conn)
4343 		return nfserr_jukebox;
4344 
4345 	spin_lock(&nn->client_lock);
4346 	session = find_in_sessionid_hashtbl(&seq->sessionid, net, &status);
4347 	if (!session)
4348 		goto out_no_session;
4349 	clp = session->se_client;
4350 
4351 	status = nfserr_too_many_ops;
4352 	if (nfsd4_session_too_many_ops(rqstp, session))
4353 		goto out_put_session;
4354 
4355 	status = nfserr_req_too_big;
4356 	if (nfsd4_request_too_big(rqstp, session))
4357 		goto out_put_session;
4358 
4359 	status = nfserr_badslot;
4360 	if (seq->slotid >= session->se_fchannel.maxreqs)
4361 		goto out_put_session;
4362 
4363 	slot = xa_load(&session->se_slots, seq->slotid);
4364 	dprintk("%s: slotid %d\n", __func__, seq->slotid);
4365 
4366 	trace_nfsd_slot_seqid_sequence(clp, seq, slot);
4367 	status = check_slot_seqid(seq->seqid, slot->sl_seqid, slot->sl_flags);
4368 	if (status == nfserr_replay_cache) {
4369 		status = nfserr_seq_misordered;
4370 		if (!(slot->sl_flags & NFSD4_SLOT_INITIALIZED))
4371 			goto out_put_session;
4372 		status = nfserr_seq_false_retry;
4373 		if (!replay_matches_cache(rqstp, seq, slot))
4374 			goto out_put_session;
4375 		cstate->slot = slot;
4376 		cstate->session = session;
4377 		cstate->clp = clp;
4378 		/* Return the cached reply status and set cstate->status
4379 		 * for nfsd4_proc_compound processing */
4380 		status = nfsd4_replay_cache_entry(resp, seq);
4381 		cstate->status = nfserr_replay_cache;
4382 		goto out;
4383 	}
4384 	if (status)
4385 		goto out_put_session;
4386 
4387 	status = nfsd4_sequence_check_conn(conn, session);
4388 	conn = NULL;
4389 	if (status)
4390 		goto out_put_session;
4391 
4392 	if (session->se_target_maxslots < session->se_fchannel.maxreqs &&
4393 	    slot->sl_generation == session->se_slot_gen &&
4394 	    seq->maxslots <= session->se_target_maxslots)
4395 		/* Client acknowledged our reduce maxreqs */
4396 		free_session_slots(session, session->se_target_maxslots);
4397 
4398 	buflen = (seq->cachethis) ?
4399 			session->se_fchannel.maxresp_cached :
4400 			session->se_fchannel.maxresp_sz;
4401 	status = (seq->cachethis) ? nfserr_rep_too_big_to_cache :
4402 				    nfserr_rep_too_big;
4403 	if (xdr_restrict_buflen(xdr, buflen - rqstp->rq_auth_slack))
4404 		goto out_put_session;
4405 	svc_reserve(rqstp, buflen);
4406 
4407 	status = nfs_ok;
4408 	/* Success! accept new slot seqid */
4409 	slot->sl_seqid = seq->seqid;
4410 	slot->sl_flags &= ~NFSD4_SLOT_REUSED;
4411 	slot->sl_flags |= NFSD4_SLOT_INUSE;
4412 	slot->sl_generation = session->se_slot_gen;
4413 	if (seq->cachethis)
4414 		slot->sl_flags |= NFSD4_SLOT_CACHETHIS;
4415 	else
4416 		slot->sl_flags &= ~NFSD4_SLOT_CACHETHIS;
4417 
4418 	cstate->slot = slot;
4419 	cstate->session = session;
4420 	cstate->clp = clp;
4421 
4422 	/*
4423 	 * If the client ever uses the highest available slot,
4424 	 * gently try to allocate another 20%.  This allows
4425 	 * fairly quick growth without grossly over-shooting what
4426 	 * the client might use.
4427 	 */
4428 	if (seq->slotid == session->se_fchannel.maxreqs - 1 &&
4429 	    session->se_target_maxslots >= session->se_fchannel.maxreqs &&
4430 	    session->se_fchannel.maxreqs < NFSD_MAX_SLOTS_PER_SESSION) {
4431 		int s = session->se_fchannel.maxreqs;
4432 		int cnt = DIV_ROUND_UP(s, 5);
4433 		void *prev_slot;
4434 
4435 		do {
4436 			/*
4437 			 * GFP_NOWAIT both allows allocation under a
4438 			 * spinlock, and only succeeds if there is
4439 			 * plenty of memory.
4440 			 */
4441 			slot = kzalloc(slot_bytes(&session->se_fchannel),
4442 				       GFP_NOWAIT);
4443 			prev_slot = xa_load(&session->se_slots, s);
4444 			if (xa_is_value(prev_slot) && slot) {
4445 				slot->sl_seqid = xa_to_value(prev_slot);
4446 				slot->sl_flags |= NFSD4_SLOT_REUSED;
4447 			}
4448 			if (slot &&
4449 			    !xa_is_err(xa_store(&session->se_slots, s, slot,
4450 						GFP_NOWAIT))) {
4451 				s += 1;
4452 				session->se_fchannel.maxreqs = s;
4453 				atomic_add(s - session->se_target_maxslots,
4454 					   &nfsd_total_target_slots);
4455 				session->se_target_maxslots = s;
4456 			} else {
4457 				kfree(slot);
4458 				slot = NULL;
4459 			}
4460 		} while (slot && --cnt > 0);
4461 	}
4462 
4463 out:
4464 	seq->maxslots = max(session->se_target_maxslots, seq->maxslots);
4465 	seq->target_maxslots = session->se_target_maxslots;
4466 
4467 	switch (clp->cl_cb_state) {
4468 	case NFSD4_CB_DOWN:
4469 		seq->status_flags = SEQ4_STATUS_CB_PATH_DOWN;
4470 		break;
4471 	case NFSD4_CB_FAULT:
4472 		seq->status_flags = SEQ4_STATUS_BACKCHANNEL_FAULT;
4473 		break;
4474 	default:
4475 		seq->status_flags = 0;
4476 	}
4477 	if (!list_empty(&clp->cl_revoked))
4478 		seq->status_flags |= SEQ4_STATUS_RECALLABLE_STATE_REVOKED;
4479 	if (atomic_read(&clp->cl_admin_revoked))
4480 		seq->status_flags |= SEQ4_STATUS_ADMIN_STATE_REVOKED;
4481 	trace_nfsd_seq4_status(rqstp, seq);
4482 out_no_session:
4483 	if (conn)
4484 		free_conn(conn);
4485 	spin_unlock(&nn->client_lock);
4486 	return status;
4487 out_put_session:
4488 	nfsd4_put_session_locked(session);
4489 	goto out_no_session;
4490 }
4491 
4492 void
nfsd4_sequence_done(struct nfsd4_compoundres * resp)4493 nfsd4_sequence_done(struct nfsd4_compoundres *resp)
4494 {
4495 	struct nfsd4_compound_state *cs = &resp->cstate;
4496 
4497 	if (nfsd4_has_session(cs)) {
4498 		if (cs->status != nfserr_replay_cache) {
4499 			nfsd4_store_cache_entry(resp);
4500 			cs->slot->sl_flags &= ~NFSD4_SLOT_INUSE;
4501 		}
4502 		/* Drop session reference that was taken in nfsd4_sequence() */
4503 		nfsd4_put_session(cs->session);
4504 	} else if (cs->clp)
4505 		put_client_renew(cs->clp);
4506 }
4507 
4508 __be32
nfsd4_destroy_clientid(struct svc_rqst * rqstp,struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)4509 nfsd4_destroy_clientid(struct svc_rqst *rqstp,
4510 		struct nfsd4_compound_state *cstate,
4511 		union nfsd4_op_u *u)
4512 {
4513 	struct nfsd4_destroy_clientid *dc = &u->destroy_clientid;
4514 	struct nfs4_client *conf, *unconf;
4515 	struct nfs4_client *clp = NULL;
4516 	__be32 status = 0;
4517 	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4518 
4519 	spin_lock(&nn->client_lock);
4520 	unconf = find_unconfirmed_client(&dc->clientid, true, nn);
4521 	conf = find_confirmed_client(&dc->clientid, true, nn);
4522 	WARN_ON_ONCE(conf && unconf);
4523 
4524 	if (conf) {
4525 		if (client_has_state(conf)) {
4526 			status = nfserr_clientid_busy;
4527 			goto out;
4528 		}
4529 		status = mark_client_expired_locked(conf);
4530 		if (status)
4531 			goto out;
4532 		clp = conf;
4533 	} else if (unconf)
4534 		clp = unconf;
4535 	else {
4536 		status = nfserr_stale_clientid;
4537 		goto out;
4538 	}
4539 	if (!nfsd4_mach_creds_match(clp, rqstp)) {
4540 		clp = NULL;
4541 		status = nfserr_wrong_cred;
4542 		goto out;
4543 	}
4544 	trace_nfsd_clid_destroyed(&clp->cl_clientid);
4545 	unhash_client_locked(clp);
4546 out:
4547 	spin_unlock(&nn->client_lock);
4548 	if (clp)
4549 		expire_client(clp);
4550 	return status;
4551 }
4552 
4553 __be32
nfsd4_reclaim_complete(struct svc_rqst * rqstp,struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)4554 nfsd4_reclaim_complete(struct svc_rqst *rqstp,
4555 		struct nfsd4_compound_state *cstate, union nfsd4_op_u *u)
4556 {
4557 	struct nfsd4_reclaim_complete *rc = &u->reclaim_complete;
4558 	struct nfs4_client *clp = cstate->clp;
4559 	__be32 status = 0;
4560 
4561 	if (rc->rca_one_fs) {
4562 		if (!cstate->current_fh.fh_dentry)
4563 			return nfserr_nofilehandle;
4564 		/*
4565 		 * We don't take advantage of the rca_one_fs case.
4566 		 * That's OK, it's optional, we can safely ignore it.
4567 		 */
4568 		return nfs_ok;
4569 	}
4570 
4571 	status = nfserr_complete_already;
4572 	if (test_and_set_bit(NFSD4_CLIENT_RECLAIM_COMPLETE, &clp->cl_flags))
4573 		goto out;
4574 
4575 	status = nfserr_stale_clientid;
4576 	if (is_client_expired(clp))
4577 		/*
4578 		 * The following error isn't really legal.
4579 		 * But we only get here if the client just explicitly
4580 		 * destroyed the client.  Surely it no longer cares what
4581 		 * error it gets back on an operation for the dead
4582 		 * client.
4583 		 */
4584 		goto out;
4585 
4586 	status = nfs_ok;
4587 	trace_nfsd_clid_reclaim_complete(&clp->cl_clientid);
4588 	nfsd4_client_record_create(clp);
4589 	inc_reclaim_complete(clp);
4590 out:
4591 	return status;
4592 }
4593 
4594 __be32
nfsd4_setclientid(struct svc_rqst * rqstp,struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)4595 nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4596 		  union nfsd4_op_u *u)
4597 {
4598 	struct nfsd4_setclientid *setclid = &u->setclientid;
4599 	struct xdr_netobj 	clname = setclid->se_name;
4600 	nfs4_verifier		clverifier = setclid->se_verf;
4601 	struct nfs4_client	*conf, *new;
4602 	struct nfs4_client	*unconf = NULL;
4603 	__be32 			status;
4604 	struct nfsd_net		*nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4605 
4606 	new = create_client(clname, rqstp, &clverifier);
4607 	if (new == NULL)
4608 		return nfserr_jukebox;
4609 	spin_lock(&nn->client_lock);
4610 	conf = find_confirmed_client_by_name(&clname, nn);
4611 	if (conf && client_has_state(conf)) {
4612 		status = nfserr_clid_inuse;
4613 		if (clp_used_exchangeid(conf))
4614 			goto out;
4615 		if (!same_creds(&conf->cl_cred, &rqstp->rq_cred)) {
4616 			trace_nfsd_clid_cred_mismatch(conf, rqstp);
4617 			goto out;
4618 		}
4619 	}
4620 	unconf = find_unconfirmed_client_by_name(&clname, nn);
4621 	if (unconf)
4622 		unhash_client_locked(unconf);
4623 	if (conf) {
4624 		if (same_verf(&conf->cl_verifier, &clverifier)) {
4625 			copy_clid(new, conf);
4626 			gen_confirm(new, nn);
4627 		} else
4628 			trace_nfsd_clid_verf_mismatch(conf, rqstp,
4629 						      &clverifier);
4630 	} else
4631 		trace_nfsd_clid_fresh(new);
4632 	new->cl_minorversion = 0;
4633 	gen_callback(new, setclid, rqstp);
4634 	add_to_unconfirmed(new);
4635 	setclid->se_clientid.cl_boot = new->cl_clientid.cl_boot;
4636 	setclid->se_clientid.cl_id = new->cl_clientid.cl_id;
4637 	memcpy(setclid->se_confirm.data, new->cl_confirm.data, sizeof(setclid->se_confirm.data));
4638 	new = NULL;
4639 	status = nfs_ok;
4640 out:
4641 	spin_unlock(&nn->client_lock);
4642 	if (new)
4643 		free_client(new);
4644 	if (unconf) {
4645 		trace_nfsd_clid_expire_unconf(&unconf->cl_clientid);
4646 		expire_client(unconf);
4647 	}
4648 	return status;
4649 }
4650 
4651 __be32
nfsd4_setclientid_confirm(struct svc_rqst * rqstp,struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)4652 nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
4653 			struct nfsd4_compound_state *cstate,
4654 			union nfsd4_op_u *u)
4655 {
4656 	struct nfsd4_setclientid_confirm *setclientid_confirm =
4657 			&u->setclientid_confirm;
4658 	struct nfs4_client *conf, *unconf;
4659 	struct nfs4_client *old = NULL;
4660 	nfs4_verifier confirm = setclientid_confirm->sc_confirm;
4661 	clientid_t * clid = &setclientid_confirm->sc_clientid;
4662 	__be32 status;
4663 	struct nfsd_net	*nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4664 
4665 	if (STALE_CLIENTID(clid, nn))
4666 		return nfserr_stale_clientid;
4667 
4668 	spin_lock(&nn->client_lock);
4669 	conf = find_confirmed_client(clid, false, nn);
4670 	unconf = find_unconfirmed_client(clid, false, nn);
4671 	/*
4672 	 * We try hard to give out unique clientid's, so if we get an
4673 	 * attempt to confirm the same clientid with a different cred,
4674 	 * the client may be buggy; this should never happen.
4675 	 *
4676 	 * Nevertheless, RFC 7530 recommends INUSE for this case:
4677 	 */
4678 	status = nfserr_clid_inuse;
4679 	if (unconf && !same_creds(&unconf->cl_cred, &rqstp->rq_cred)) {
4680 		trace_nfsd_clid_cred_mismatch(unconf, rqstp);
4681 		goto out;
4682 	}
4683 	if (conf && !same_creds(&conf->cl_cred, &rqstp->rq_cred)) {
4684 		trace_nfsd_clid_cred_mismatch(conf, rqstp);
4685 		goto out;
4686 	}
4687 	if (!unconf || !same_verf(&confirm, &unconf->cl_confirm)) {
4688 		if (conf && same_verf(&confirm, &conf->cl_confirm)) {
4689 			status = nfs_ok;
4690 		} else
4691 			status = nfserr_stale_clientid;
4692 		goto out;
4693 	}
4694 	status = nfs_ok;
4695 	if (conf) {
4696 		old = unconf;
4697 		unhash_client_locked(old);
4698 		nfsd4_change_callback(conf, &unconf->cl_cb_conn);
4699 	} else {
4700 		old = find_confirmed_client_by_name(&unconf->cl_name, nn);
4701 		if (old) {
4702 			status = nfserr_clid_inuse;
4703 			if (client_has_state(old)
4704 					&& !same_creds(&unconf->cl_cred,
4705 							&old->cl_cred)) {
4706 				old = NULL;
4707 				goto out;
4708 			}
4709 			status = mark_client_expired_locked(old);
4710 			if (status) {
4711 				old = NULL;
4712 				goto out;
4713 			}
4714 			trace_nfsd_clid_replaced(&old->cl_clientid);
4715 		}
4716 		move_to_confirmed(unconf);
4717 		conf = unconf;
4718 	}
4719 	get_client_locked(conf);
4720 	spin_unlock(&nn->client_lock);
4721 	if (conf == unconf)
4722 		fsnotify_dentry(conf->cl_nfsd_info_dentry, FS_MODIFY);
4723 	nfsd4_probe_callback(conf);
4724 	spin_lock(&nn->client_lock);
4725 	put_client_renew_locked(conf);
4726 out:
4727 	spin_unlock(&nn->client_lock);
4728 	if (old)
4729 		expire_client(old);
4730 	return status;
4731 }
4732 
nfsd4_alloc_file(void)4733 static struct nfs4_file *nfsd4_alloc_file(void)
4734 {
4735 	return kmem_cache_alloc(file_slab, GFP_KERNEL);
4736 }
4737 
4738 /* OPEN Share state helper functions */
4739 
nfsd4_file_init(const struct svc_fh * fh,struct nfs4_file * fp)4740 static void nfsd4_file_init(const struct svc_fh *fh, struct nfs4_file *fp)
4741 {
4742 	refcount_set(&fp->fi_ref, 1);
4743 	spin_lock_init(&fp->fi_lock);
4744 	INIT_LIST_HEAD(&fp->fi_stateids);
4745 	INIT_LIST_HEAD(&fp->fi_delegations);
4746 	INIT_LIST_HEAD(&fp->fi_clnt_odstate);
4747 	fh_copy_shallow(&fp->fi_fhandle, &fh->fh_handle);
4748 	fp->fi_deleg_file = NULL;
4749 	fp->fi_had_conflict = false;
4750 	fp->fi_share_deny = 0;
4751 	memset(fp->fi_fds, 0, sizeof(fp->fi_fds));
4752 	memset(fp->fi_access, 0, sizeof(fp->fi_access));
4753 	fp->fi_aliased = false;
4754 	fp->fi_inode = d_inode(fh->fh_dentry);
4755 #ifdef CONFIG_NFSD_PNFS
4756 	INIT_LIST_HEAD(&fp->fi_lo_states);
4757 	atomic_set(&fp->fi_lo_recalls, 0);
4758 #endif
4759 }
4760 
4761 void
nfsd4_free_slabs(void)4762 nfsd4_free_slabs(void)
4763 {
4764 	kmem_cache_destroy(client_slab);
4765 	kmem_cache_destroy(openowner_slab);
4766 	kmem_cache_destroy(lockowner_slab);
4767 	kmem_cache_destroy(file_slab);
4768 	kmem_cache_destroy(stateid_slab);
4769 	kmem_cache_destroy(deleg_slab);
4770 	kmem_cache_destroy(odstate_slab);
4771 }
4772 
4773 int
nfsd4_init_slabs(void)4774 nfsd4_init_slabs(void)
4775 {
4776 	client_slab = KMEM_CACHE(nfs4_client, 0);
4777 	if (client_slab == NULL)
4778 		goto out;
4779 	openowner_slab = KMEM_CACHE(nfs4_openowner, 0);
4780 	if (openowner_slab == NULL)
4781 		goto out_free_client_slab;
4782 	lockowner_slab = KMEM_CACHE(nfs4_lockowner, 0);
4783 	if (lockowner_slab == NULL)
4784 		goto out_free_openowner_slab;
4785 	file_slab = KMEM_CACHE(nfs4_file, 0);
4786 	if (file_slab == NULL)
4787 		goto out_free_lockowner_slab;
4788 	stateid_slab = KMEM_CACHE(nfs4_ol_stateid, 0);
4789 	if (stateid_slab == NULL)
4790 		goto out_free_file_slab;
4791 	deleg_slab = KMEM_CACHE(nfs4_delegation, 0);
4792 	if (deleg_slab == NULL)
4793 		goto out_free_stateid_slab;
4794 	odstate_slab = KMEM_CACHE(nfs4_clnt_odstate, 0);
4795 	if (odstate_slab == NULL)
4796 		goto out_free_deleg_slab;
4797 	return 0;
4798 
4799 out_free_deleg_slab:
4800 	kmem_cache_destroy(deleg_slab);
4801 out_free_stateid_slab:
4802 	kmem_cache_destroy(stateid_slab);
4803 out_free_file_slab:
4804 	kmem_cache_destroy(file_slab);
4805 out_free_lockowner_slab:
4806 	kmem_cache_destroy(lockowner_slab);
4807 out_free_openowner_slab:
4808 	kmem_cache_destroy(openowner_slab);
4809 out_free_client_slab:
4810 	kmem_cache_destroy(client_slab);
4811 out:
4812 	return -ENOMEM;
4813 }
4814 
4815 static unsigned long
nfsd4_state_shrinker_count(struct shrinker * shrink,struct shrink_control * sc)4816 nfsd4_state_shrinker_count(struct shrinker *shrink, struct shrink_control *sc)
4817 {
4818 	int count;
4819 	struct nfsd_net *nn = shrink->private_data;
4820 
4821 	count = atomic_read(&nn->nfsd_courtesy_clients);
4822 	if (!count)
4823 		count = atomic_long_read(&num_delegations);
4824 	if (count)
4825 		queue_work(laundry_wq, &nn->nfsd_shrinker_work);
4826 	return (unsigned long)count;
4827 }
4828 
4829 static unsigned long
nfsd4_state_shrinker_scan(struct shrinker * shrink,struct shrink_control * sc)4830 nfsd4_state_shrinker_scan(struct shrinker *shrink, struct shrink_control *sc)
4831 {
4832 	return SHRINK_STOP;
4833 }
4834 
4835 void
nfsd4_init_leases_net(struct nfsd_net * nn)4836 nfsd4_init_leases_net(struct nfsd_net *nn)
4837 {
4838 	struct sysinfo si;
4839 	u64 max_clients;
4840 
4841 	nn->nfsd4_lease = 90;	/* default lease time */
4842 	nn->nfsd4_grace = 90;
4843 	nn->somebody_reclaimed = false;
4844 	nn->track_reclaim_completes = false;
4845 	nn->clverifier_counter = get_random_u32();
4846 	nn->clientid_base = get_random_u32();
4847 	nn->clientid_counter = nn->clientid_base + 1;
4848 	nn->s2s_cp_cl_id = nn->clientid_counter++;
4849 
4850 	atomic_set(&nn->nfs4_client_count, 0);
4851 	si_meminfo(&si);
4852 	max_clients = (u64)si.totalram * si.mem_unit / (1024 * 1024 * 1024);
4853 	max_clients *= NFS4_CLIENTS_PER_GB;
4854 	nn->nfs4_max_clients = max_t(int, max_clients, NFS4_CLIENTS_PER_GB);
4855 
4856 	atomic_set(&nn->nfsd_courtesy_clients, 0);
4857 }
4858 
4859 enum rp_lock {
4860 	RP_UNLOCKED,
4861 	RP_LOCKED,
4862 	RP_UNHASHED,
4863 };
4864 
init_nfs4_replay(struct nfs4_replay * rp)4865 static void init_nfs4_replay(struct nfs4_replay *rp)
4866 {
4867 	rp->rp_status = nfserr_serverfault;
4868 	rp->rp_buflen = 0;
4869 	rp->rp_buf = rp->rp_ibuf;
4870 	rp->rp_locked = RP_UNLOCKED;
4871 }
4872 
nfsd4_cstate_assign_replay(struct nfsd4_compound_state * cstate,struct nfs4_stateowner * so)4873 static int nfsd4_cstate_assign_replay(struct nfsd4_compound_state *cstate,
4874 				      struct nfs4_stateowner *so)
4875 {
4876 	if (!nfsd4_has_session(cstate)) {
4877 		wait_var_event(&so->so_replay.rp_locked,
4878 			       cmpxchg(&so->so_replay.rp_locked,
4879 				       RP_UNLOCKED, RP_LOCKED) != RP_LOCKED);
4880 		if (so->so_replay.rp_locked == RP_UNHASHED)
4881 			return -EAGAIN;
4882 		cstate->replay_owner = nfs4_get_stateowner(so);
4883 	}
4884 	return 0;
4885 }
4886 
nfsd4_cstate_clear_replay(struct nfsd4_compound_state * cstate)4887 void nfsd4_cstate_clear_replay(struct nfsd4_compound_state *cstate)
4888 {
4889 	struct nfs4_stateowner *so = cstate->replay_owner;
4890 
4891 	if (so != NULL) {
4892 		cstate->replay_owner = NULL;
4893 		store_release_wake_up(&so->so_replay.rp_locked, RP_UNLOCKED);
4894 		nfs4_put_stateowner(so);
4895 	}
4896 }
4897 
alloc_stateowner(struct kmem_cache * slab,struct xdr_netobj * owner,struct nfs4_client * clp)4898 static inline void *alloc_stateowner(struct kmem_cache *slab, struct xdr_netobj *owner, struct nfs4_client *clp)
4899 {
4900 	struct nfs4_stateowner *sop;
4901 
4902 	sop = kmem_cache_alloc(slab, GFP_KERNEL);
4903 	if (!sop)
4904 		return NULL;
4905 
4906 	xdr_netobj_dup(&sop->so_owner, owner, GFP_KERNEL);
4907 	if (!sop->so_owner.data) {
4908 		kmem_cache_free(slab, sop);
4909 		return NULL;
4910 	}
4911 
4912 	INIT_LIST_HEAD(&sop->so_stateids);
4913 	sop->so_client = clp;
4914 	init_nfs4_replay(&sop->so_replay);
4915 	atomic_set(&sop->so_count, 1);
4916 	return sop;
4917 }
4918 
hash_openowner(struct nfs4_openowner * oo,struct nfs4_client * clp,unsigned int strhashval)4919 static void hash_openowner(struct nfs4_openowner *oo, struct nfs4_client *clp, unsigned int strhashval)
4920 {
4921 	lockdep_assert_held(&clp->cl_lock);
4922 
4923 	list_add(&oo->oo_owner.so_strhash,
4924 		 &clp->cl_ownerstr_hashtbl[strhashval]);
4925 	list_add(&oo->oo_perclient, &clp->cl_openowners);
4926 }
4927 
nfs4_unhash_openowner(struct nfs4_stateowner * so)4928 static void nfs4_unhash_openowner(struct nfs4_stateowner *so)
4929 {
4930 	unhash_openowner_locked(openowner(so));
4931 }
4932 
nfs4_free_openowner(struct nfs4_stateowner * so)4933 static void nfs4_free_openowner(struct nfs4_stateowner *so)
4934 {
4935 	struct nfs4_openowner *oo = openowner(so);
4936 
4937 	kmem_cache_free(openowner_slab, oo);
4938 }
4939 
4940 static const struct nfs4_stateowner_operations openowner_ops = {
4941 	.so_unhash =	nfs4_unhash_openowner,
4942 	.so_free =	nfs4_free_openowner,
4943 };
4944 
4945 static struct nfs4_ol_stateid *
nfsd4_find_existing_open(struct nfs4_file * fp,struct nfsd4_open * open)4946 nfsd4_find_existing_open(struct nfs4_file *fp, struct nfsd4_open *open)
4947 {
4948 	struct nfs4_ol_stateid *local, *ret = NULL;
4949 	struct nfs4_openowner *oo = open->op_openowner;
4950 
4951 	lockdep_assert_held(&fp->fi_lock);
4952 
4953 	list_for_each_entry(local, &fp->fi_stateids, st_perfile) {
4954 		/* ignore lock owners */
4955 		if (local->st_stateowner->so_is_open_owner == 0)
4956 			continue;
4957 		if (local->st_stateowner != &oo->oo_owner)
4958 			continue;
4959 		if (local->st_stid.sc_type == SC_TYPE_OPEN &&
4960 		    !local->st_stid.sc_status) {
4961 			ret = local;
4962 			refcount_inc(&ret->st_stid.sc_count);
4963 			break;
4964 		}
4965 	}
4966 	return ret;
4967 }
4968 
nfsd4_drop_revoked_stid(struct nfs4_stid * s)4969 static void nfsd4_drop_revoked_stid(struct nfs4_stid *s)
4970 	__releases(&s->sc_client->cl_lock)
4971 {
4972 	struct nfs4_client *cl = s->sc_client;
4973 	LIST_HEAD(reaplist);
4974 	struct nfs4_ol_stateid *stp;
4975 	struct nfs4_delegation *dp;
4976 	bool unhashed;
4977 
4978 	switch (s->sc_type) {
4979 	case SC_TYPE_OPEN:
4980 		stp = openlockstateid(s);
4981 		if (unhash_open_stateid(stp, &reaplist))
4982 			put_ol_stateid_locked(stp, &reaplist);
4983 		spin_unlock(&cl->cl_lock);
4984 		free_ol_stateid_reaplist(&reaplist);
4985 		break;
4986 	case SC_TYPE_LOCK:
4987 		stp = openlockstateid(s);
4988 		unhashed = unhash_lock_stateid(stp);
4989 		spin_unlock(&cl->cl_lock);
4990 		if (unhashed)
4991 			nfs4_put_stid(s);
4992 		break;
4993 	case SC_TYPE_DELEG:
4994 		dp = delegstateid(s);
4995 		list_del_init(&dp->dl_recall_lru);
4996 		spin_unlock(&cl->cl_lock);
4997 		nfs4_put_stid(s);
4998 		break;
4999 	default:
5000 		spin_unlock(&cl->cl_lock);
5001 	}
5002 }
5003 
nfsd40_drop_revoked_stid(struct nfs4_client * cl,stateid_t * stid)5004 static void nfsd40_drop_revoked_stid(struct nfs4_client *cl,
5005 				    stateid_t *stid)
5006 {
5007 	/* NFSv4.0 has no way for the client to tell the server
5008 	 * that it can forget an admin-revoked stateid.
5009 	 * So we keep it around until the first time that the
5010 	 * client uses it, and drop it the first time
5011 	 * nfserr_admin_revoked is returned.
5012 	 * For v4.1 and later we wait until explicitly told
5013 	 * to free the stateid.
5014 	 */
5015 	if (cl->cl_minorversion == 0) {
5016 		struct nfs4_stid *st;
5017 
5018 		spin_lock(&cl->cl_lock);
5019 		st = find_stateid_locked(cl, stid);
5020 		if (st)
5021 			nfsd4_drop_revoked_stid(st);
5022 		else
5023 			spin_unlock(&cl->cl_lock);
5024 	}
5025 }
5026 
5027 static __be32
nfsd4_verify_open_stid(struct nfs4_stid * s)5028 nfsd4_verify_open_stid(struct nfs4_stid *s)
5029 {
5030 	__be32 ret = nfs_ok;
5031 
5032 	if (s->sc_status & SC_STATUS_ADMIN_REVOKED)
5033 		ret = nfserr_admin_revoked;
5034 	else if (s->sc_status & SC_STATUS_REVOKED)
5035 		ret = nfserr_deleg_revoked;
5036 	else if (s->sc_status & SC_STATUS_CLOSED)
5037 		ret = nfserr_bad_stateid;
5038 	return ret;
5039 }
5040 
5041 /* Lock the stateid st_mutex, and deal with races with CLOSE */
5042 static __be32
nfsd4_lock_ol_stateid(struct nfs4_ol_stateid * stp)5043 nfsd4_lock_ol_stateid(struct nfs4_ol_stateid *stp)
5044 {
5045 	__be32 ret;
5046 
5047 	mutex_lock_nested(&stp->st_mutex, LOCK_STATEID_MUTEX);
5048 	ret = nfsd4_verify_open_stid(&stp->st_stid);
5049 	if (ret == nfserr_admin_revoked)
5050 		nfsd40_drop_revoked_stid(stp->st_stid.sc_client,
5051 					&stp->st_stid.sc_stateid);
5052 
5053 	if (ret != nfs_ok)
5054 		mutex_unlock(&stp->st_mutex);
5055 	return ret;
5056 }
5057 
5058 static struct nfs4_ol_stateid *
nfsd4_find_and_lock_existing_open(struct nfs4_file * fp,struct nfsd4_open * open)5059 nfsd4_find_and_lock_existing_open(struct nfs4_file *fp, struct nfsd4_open *open)
5060 {
5061 	struct nfs4_ol_stateid *stp;
5062 	for (;;) {
5063 		spin_lock(&fp->fi_lock);
5064 		stp = nfsd4_find_existing_open(fp, open);
5065 		spin_unlock(&fp->fi_lock);
5066 		if (!stp || nfsd4_lock_ol_stateid(stp) == nfs_ok)
5067 			break;
5068 		nfs4_put_stid(&stp->st_stid);
5069 	}
5070 	return stp;
5071 }
5072 
5073 static struct nfs4_openowner *
find_or_alloc_open_stateowner(unsigned int strhashval,struct nfsd4_open * open,struct nfsd4_compound_state * cstate)5074 find_or_alloc_open_stateowner(unsigned int strhashval, struct nfsd4_open *open,
5075 			      struct nfsd4_compound_state *cstate)
5076 {
5077 	struct nfs4_client *clp = cstate->clp;
5078 	struct nfs4_openowner *oo, *new = NULL;
5079 
5080 retry:
5081 	spin_lock(&clp->cl_lock);
5082 	oo = find_openstateowner_str(strhashval, open, clp);
5083 	if (!oo && new) {
5084 		hash_openowner(new, clp, strhashval);
5085 		spin_unlock(&clp->cl_lock);
5086 		return new;
5087 	}
5088 	spin_unlock(&clp->cl_lock);
5089 
5090 	if (oo && !(oo->oo_flags & NFS4_OO_CONFIRMED)) {
5091 		/* Replace unconfirmed owners without checking for replay. */
5092 		release_openowner(oo);
5093 		oo = NULL;
5094 	}
5095 	if (oo) {
5096 		if (new)
5097 			nfs4_free_stateowner(&new->oo_owner);
5098 		return oo;
5099 	}
5100 
5101 	new = alloc_stateowner(openowner_slab, &open->op_owner, clp);
5102 	if (!new)
5103 		return NULL;
5104 	new->oo_owner.so_ops = &openowner_ops;
5105 	new->oo_owner.so_is_open_owner = 1;
5106 	new->oo_owner.so_seqid = open->op_seqid;
5107 	new->oo_flags = 0;
5108 	if (nfsd4_has_session(cstate))
5109 		new->oo_flags |= NFS4_OO_CONFIRMED;
5110 	new->oo_time = 0;
5111 	new->oo_last_closed_stid = NULL;
5112 	INIT_LIST_HEAD(&new->oo_close_lru);
5113 	goto retry;
5114 }
5115 
5116 static struct nfs4_ol_stateid *
init_open_stateid(struct nfs4_file * fp,struct nfsd4_open * open)5117 init_open_stateid(struct nfs4_file *fp, struct nfsd4_open *open)
5118 {
5119 
5120 	struct nfs4_openowner *oo = open->op_openowner;
5121 	struct nfs4_ol_stateid *retstp = NULL;
5122 	struct nfs4_ol_stateid *stp;
5123 
5124 	stp = open->op_stp;
5125 	/* We are moving these outside of the spinlocks to avoid the warnings */
5126 	mutex_init(&stp->st_mutex);
5127 	mutex_lock_nested(&stp->st_mutex, OPEN_STATEID_MUTEX);
5128 
5129 retry:
5130 	spin_lock(&oo->oo_owner.so_client->cl_lock);
5131 	spin_lock(&fp->fi_lock);
5132 
5133 	if (nfs4_openowner_unhashed(oo)) {
5134 		mutex_unlock(&stp->st_mutex);
5135 		stp = NULL;
5136 		goto out_unlock;
5137 	}
5138 
5139 	retstp = nfsd4_find_existing_open(fp, open);
5140 	if (retstp)
5141 		goto out_unlock;
5142 
5143 	open->op_stp = NULL;
5144 	refcount_inc(&stp->st_stid.sc_count);
5145 	stp->st_stid.sc_type = SC_TYPE_OPEN;
5146 	INIT_LIST_HEAD(&stp->st_locks);
5147 	stp->st_stateowner = nfs4_get_stateowner(&oo->oo_owner);
5148 	get_nfs4_file(fp);
5149 	stp->st_stid.sc_file = fp;
5150 	stp->st_access_bmap = 0;
5151 	stp->st_deny_bmap = 0;
5152 	stp->st_openstp = NULL;
5153 	list_add(&stp->st_perstateowner, &oo->oo_owner.so_stateids);
5154 	list_add(&stp->st_perfile, &fp->fi_stateids);
5155 
5156 out_unlock:
5157 	spin_unlock(&fp->fi_lock);
5158 	spin_unlock(&oo->oo_owner.so_client->cl_lock);
5159 	if (retstp) {
5160 		/* Handle races with CLOSE */
5161 		if (nfsd4_lock_ol_stateid(retstp) != nfs_ok) {
5162 			nfs4_put_stid(&retstp->st_stid);
5163 			goto retry;
5164 		}
5165 		/* To keep mutex tracking happy */
5166 		mutex_unlock(&stp->st_mutex);
5167 		stp = retstp;
5168 	}
5169 	return stp;
5170 }
5171 
5172 /*
5173  * In the 4.0 case we need to keep the owners around a little while to handle
5174  * CLOSE replay. We still do need to release any file access that is held by
5175  * them before returning however.
5176  */
5177 static void
move_to_close_lru(struct nfs4_ol_stateid * s,struct net * net)5178 move_to_close_lru(struct nfs4_ol_stateid *s, struct net *net)
5179 {
5180 	struct nfs4_ol_stateid *last;
5181 	struct nfs4_openowner *oo = openowner(s->st_stateowner);
5182 	struct nfsd_net *nn = net_generic(s->st_stid.sc_client->net,
5183 						nfsd_net_id);
5184 
5185 	dprintk("NFSD: move_to_close_lru nfs4_openowner %p\n", oo);
5186 
5187 	/*
5188 	 * We know that we hold one reference via nfsd4_close, and another
5189 	 * "persistent" reference for the client. If the refcount is higher
5190 	 * than 2, then there are still calls in progress that are using this
5191 	 * stateid. We can't put the sc_file reference until they are finished.
5192 	 * Wait for the refcount to drop to 2. Since it has been unhashed,
5193 	 * there should be no danger of the refcount going back up again at
5194 	 * this point.
5195 	 * Some threads with a reference might be waiting for rp_locked,
5196 	 * so tell them to stop waiting.
5197 	 */
5198 	store_release_wake_up(&oo->oo_owner.so_replay.rp_locked, RP_UNHASHED);
5199 	wait_event(close_wq, refcount_read(&s->st_stid.sc_count) == 2);
5200 
5201 	release_all_access(s);
5202 	if (s->st_stid.sc_file) {
5203 		put_nfs4_file(s->st_stid.sc_file);
5204 		s->st_stid.sc_file = NULL;
5205 	}
5206 
5207 	spin_lock(&nn->client_lock);
5208 	last = oo->oo_last_closed_stid;
5209 	oo->oo_last_closed_stid = s;
5210 	list_move_tail(&oo->oo_close_lru, &nn->close_lru);
5211 	oo->oo_time = ktime_get_boottime_seconds();
5212 	spin_unlock(&nn->client_lock);
5213 	if (last)
5214 		nfs4_put_stid(&last->st_stid);
5215 }
5216 
5217 static noinline_for_stack struct nfs4_file *
nfsd4_file_hash_lookup(const struct svc_fh * fhp)5218 nfsd4_file_hash_lookup(const struct svc_fh *fhp)
5219 {
5220 	struct inode *inode = d_inode(fhp->fh_dentry);
5221 	struct rhlist_head *tmp, *list;
5222 	struct nfs4_file *fi;
5223 
5224 	rcu_read_lock();
5225 	list = rhltable_lookup(&nfs4_file_rhltable, &inode,
5226 			       nfs4_file_rhash_params);
5227 	rhl_for_each_entry_rcu(fi, tmp, list, fi_rlist) {
5228 		if (fh_match(&fi->fi_fhandle, &fhp->fh_handle)) {
5229 			if (refcount_inc_not_zero(&fi->fi_ref)) {
5230 				rcu_read_unlock();
5231 				return fi;
5232 			}
5233 		}
5234 	}
5235 	rcu_read_unlock();
5236 	return NULL;
5237 }
5238 
5239 /*
5240  * On hash insertion, identify entries with the same inode but
5241  * distinct filehandles. They will all be on the list returned
5242  * by rhltable_lookup().
5243  *
5244  * inode->i_lock prevents racing insertions from adding an entry
5245  * for the same inode/fhp pair twice.
5246  */
5247 static noinline_for_stack struct nfs4_file *
nfsd4_file_hash_insert(struct nfs4_file * new,const struct svc_fh * fhp)5248 nfsd4_file_hash_insert(struct nfs4_file *new, const struct svc_fh *fhp)
5249 {
5250 	struct inode *inode = d_inode(fhp->fh_dentry);
5251 	struct rhlist_head *tmp, *list;
5252 	struct nfs4_file *ret = NULL;
5253 	bool alias_found = false;
5254 	struct nfs4_file *fi;
5255 	int err;
5256 
5257 	rcu_read_lock();
5258 	spin_lock(&inode->i_lock);
5259 
5260 	list = rhltable_lookup(&nfs4_file_rhltable, &inode,
5261 			       nfs4_file_rhash_params);
5262 	rhl_for_each_entry_rcu(fi, tmp, list, fi_rlist) {
5263 		if (fh_match(&fi->fi_fhandle, &fhp->fh_handle)) {
5264 			if (refcount_inc_not_zero(&fi->fi_ref))
5265 				ret = fi;
5266 		} else
5267 			fi->fi_aliased = alias_found = true;
5268 	}
5269 	if (ret)
5270 		goto out_unlock;
5271 
5272 	nfsd4_file_init(fhp, new);
5273 	err = rhltable_insert(&nfs4_file_rhltable, &new->fi_rlist,
5274 			      nfs4_file_rhash_params);
5275 	if (err)
5276 		goto out_unlock;
5277 
5278 	new->fi_aliased = alias_found;
5279 	ret = new;
5280 
5281 out_unlock:
5282 	spin_unlock(&inode->i_lock);
5283 	rcu_read_unlock();
5284 	return ret;
5285 }
5286 
nfsd4_file_hash_remove(struct nfs4_file * fi)5287 static noinline_for_stack void nfsd4_file_hash_remove(struct nfs4_file *fi)
5288 {
5289 	rhltable_remove(&nfs4_file_rhltable, &fi->fi_rlist,
5290 			nfs4_file_rhash_params);
5291 }
5292 
5293 /*
5294  * Called to check deny when READ with all zero stateid or
5295  * WRITE with all zero or all one stateid
5296  */
5297 static __be32
nfs4_share_conflict(struct svc_fh * current_fh,unsigned int deny_type)5298 nfs4_share_conflict(struct svc_fh *current_fh, unsigned int deny_type)
5299 {
5300 	struct nfs4_file *fp;
5301 	__be32 ret = nfs_ok;
5302 
5303 	fp = nfsd4_file_hash_lookup(current_fh);
5304 	if (!fp)
5305 		return ret;
5306 
5307 	/* Check for conflicting share reservations */
5308 	spin_lock(&fp->fi_lock);
5309 	if (fp->fi_share_deny & deny_type)
5310 		ret = nfserr_locked;
5311 	spin_unlock(&fp->fi_lock);
5312 	put_nfs4_file(fp);
5313 	return ret;
5314 }
5315 
nfsd4_deleg_present(const struct inode * inode)5316 static bool nfsd4_deleg_present(const struct inode *inode)
5317 {
5318 	struct file_lock_context *ctx = locks_inode_context(inode);
5319 
5320 	return ctx && !list_empty_careful(&ctx->flc_lease);
5321 }
5322 
5323 /**
5324  * nfsd_wait_for_delegreturn - wait for delegations to be returned
5325  * @rqstp: the RPC transaction being executed
5326  * @inode: in-core inode of the file being waited for
5327  *
5328  * The timeout prevents deadlock if all nfsd threads happen to be
5329  * tied up waiting for returning delegations.
5330  *
5331  * Return values:
5332  *   %true: delegation was returned
5333  *   %false: timed out waiting for delegreturn
5334  */
nfsd_wait_for_delegreturn(struct svc_rqst * rqstp,struct inode * inode)5335 bool nfsd_wait_for_delegreturn(struct svc_rqst *rqstp, struct inode *inode)
5336 {
5337 	long __maybe_unused timeo;
5338 
5339 	timeo = wait_var_event_timeout(inode, !nfsd4_deleg_present(inode),
5340 				       NFSD_DELEGRETURN_TIMEOUT);
5341 	trace_nfsd_delegret_wakeup(rqstp, inode, timeo);
5342 	return timeo > 0;
5343 }
5344 
nfsd4_cb_recall_prepare(struct nfsd4_callback * cb)5345 static void nfsd4_cb_recall_prepare(struct nfsd4_callback *cb)
5346 {
5347 	struct nfs4_delegation *dp = cb_to_delegation(cb);
5348 	struct nfsd_net *nn = net_generic(dp->dl_stid.sc_client->net,
5349 					  nfsd_net_id);
5350 
5351 	block_delegations(&dp->dl_stid.sc_file->fi_fhandle);
5352 
5353 	/*
5354 	 * We can't do this in nfsd_break_deleg_cb because it is
5355 	 * already holding inode->i_lock.
5356 	 *
5357 	 * If the dl_time != 0, then we know that it has already been
5358 	 * queued for a lease break. Don't queue it again.
5359 	 */
5360 	spin_lock(&state_lock);
5361 	if (delegation_hashed(dp) && dp->dl_time == 0) {
5362 		dp->dl_time = ktime_get_boottime_seconds();
5363 		list_add_tail(&dp->dl_recall_lru, &nn->del_recall_lru);
5364 	}
5365 	spin_unlock(&state_lock);
5366 }
5367 
nfsd4_cb_recall_done(struct nfsd4_callback * cb,struct rpc_task * task)5368 static int nfsd4_cb_recall_done(struct nfsd4_callback *cb,
5369 		struct rpc_task *task)
5370 {
5371 	struct nfs4_delegation *dp = cb_to_delegation(cb);
5372 
5373 	trace_nfsd_cb_recall_done(&dp->dl_stid.sc_stateid, task);
5374 
5375 	if (dp->dl_stid.sc_status)
5376 		/* CLOSED or REVOKED */
5377 		return 1;
5378 
5379 	switch (task->tk_status) {
5380 	case 0:
5381 		return 1;
5382 	case -NFS4ERR_DELAY:
5383 		rpc_delay(task, 2 * HZ);
5384 		return 0;
5385 	case -EBADHANDLE:
5386 	case -NFS4ERR_BAD_STATEID:
5387 		/*
5388 		 * Race: client probably got cb_recall before open reply
5389 		 * granting delegation.
5390 		 */
5391 		if (dp->dl_retries--) {
5392 			rpc_delay(task, 2 * HZ);
5393 			return 0;
5394 		}
5395 		fallthrough;
5396 	default:
5397 		return 1;
5398 	}
5399 }
5400 
nfsd4_cb_recall_release(struct nfsd4_callback * cb)5401 static void nfsd4_cb_recall_release(struct nfsd4_callback *cb)
5402 {
5403 	struct nfs4_delegation *dp = cb_to_delegation(cb);
5404 
5405 	nfs4_put_stid(&dp->dl_stid);
5406 }
5407 
5408 static const struct nfsd4_callback_ops nfsd4_cb_recall_ops = {
5409 	.prepare	= nfsd4_cb_recall_prepare,
5410 	.done		= nfsd4_cb_recall_done,
5411 	.release	= nfsd4_cb_recall_release,
5412 	.opcode		= OP_CB_RECALL,
5413 };
5414 
nfsd_break_one_deleg(struct nfs4_delegation * dp)5415 static void nfsd_break_one_deleg(struct nfs4_delegation *dp)
5416 {
5417 	/*
5418 	 * We're assuming the state code never drops its reference
5419 	 * without first removing the lease.  Since we're in this lease
5420 	 * callback (and since the lease code is serialized by the
5421 	 * flc_lock) we know the server hasn't removed the lease yet, and
5422 	 * we know it's safe to take a reference.
5423 	 */
5424 	refcount_inc(&dp->dl_stid.sc_count);
5425 	WARN_ON_ONCE(!nfsd4_run_cb(&dp->dl_recall));
5426 }
5427 
5428 /* Called from break_lease() with flc_lock held. */
5429 static bool
nfsd_break_deleg_cb(struct file_lease * fl)5430 nfsd_break_deleg_cb(struct file_lease *fl)
5431 {
5432 	struct nfs4_delegation *dp = (struct nfs4_delegation *) fl->c.flc_owner;
5433 	struct nfs4_file *fp = dp->dl_stid.sc_file;
5434 	struct nfs4_client *clp = dp->dl_stid.sc_client;
5435 	struct nfsd_net *nn;
5436 
5437 	trace_nfsd_cb_recall(&dp->dl_stid);
5438 
5439 	dp->dl_recalled = true;
5440 	atomic_inc(&clp->cl_delegs_in_recall);
5441 	if (try_to_expire_client(clp)) {
5442 		nn = net_generic(clp->net, nfsd_net_id);
5443 		mod_delayed_work(laundry_wq, &nn->laundromat_work, 0);
5444 	}
5445 
5446 	/*
5447 	 * We don't want the locks code to timeout the lease for us;
5448 	 * we'll remove it ourself if a delegation isn't returned
5449 	 * in time:
5450 	 */
5451 	fl->fl_break_time = 0;
5452 
5453 	fp->fi_had_conflict = true;
5454 	nfsd_break_one_deleg(dp);
5455 	return false;
5456 }
5457 
5458 /**
5459  * nfsd_breaker_owns_lease - Check if lease conflict was resolved
5460  * @fl: Lock state to check
5461  *
5462  * Return values:
5463  *   %true: Lease conflict was resolved
5464  *   %false: Lease conflict was not resolved.
5465  */
nfsd_breaker_owns_lease(struct file_lease * fl)5466 static bool nfsd_breaker_owns_lease(struct file_lease *fl)
5467 {
5468 	struct nfs4_delegation *dl = fl->c.flc_owner;
5469 	struct svc_rqst *rqst;
5470 	struct nfs4_client *clp;
5471 
5472 	rqst = nfsd_current_rqst();
5473 	if (!nfsd_v4client(rqst))
5474 		return false;
5475 	clp = *(rqst->rq_lease_breaker);
5476 	return dl->dl_stid.sc_client == clp;
5477 }
5478 
5479 static int
nfsd_change_deleg_cb(struct file_lease * onlist,int arg,struct list_head * dispose)5480 nfsd_change_deleg_cb(struct file_lease *onlist, int arg,
5481 		     struct list_head *dispose)
5482 {
5483 	struct nfs4_delegation *dp = (struct nfs4_delegation *) onlist->c.flc_owner;
5484 	struct nfs4_client *clp = dp->dl_stid.sc_client;
5485 
5486 	if (arg & F_UNLCK) {
5487 		if (dp->dl_recalled)
5488 			atomic_dec(&clp->cl_delegs_in_recall);
5489 		return lease_modify(onlist, arg, dispose);
5490 	} else
5491 		return -EAGAIN;
5492 }
5493 
5494 static const struct lease_manager_operations nfsd_lease_mng_ops = {
5495 	.lm_breaker_owns_lease = nfsd_breaker_owns_lease,
5496 	.lm_break = nfsd_break_deleg_cb,
5497 	.lm_change = nfsd_change_deleg_cb,
5498 };
5499 
nfsd4_check_seqid(struct nfsd4_compound_state * cstate,struct nfs4_stateowner * so,u32 seqid)5500 static __be32 nfsd4_check_seqid(struct nfsd4_compound_state *cstate, struct nfs4_stateowner *so, u32 seqid)
5501 {
5502 	if (nfsd4_has_session(cstate))
5503 		return nfs_ok;
5504 	if (seqid == so->so_seqid - 1)
5505 		return nfserr_replay_me;
5506 	if (seqid == so->so_seqid)
5507 		return nfs_ok;
5508 	return nfserr_bad_seqid;
5509 }
5510 
lookup_clientid(clientid_t * clid,bool sessions,struct nfsd_net * nn)5511 static struct nfs4_client *lookup_clientid(clientid_t *clid, bool sessions,
5512 						struct nfsd_net *nn)
5513 {
5514 	struct nfs4_client *found;
5515 
5516 	spin_lock(&nn->client_lock);
5517 	found = find_confirmed_client(clid, sessions, nn);
5518 	if (found)
5519 		atomic_inc(&found->cl_rpc_users);
5520 	spin_unlock(&nn->client_lock);
5521 	return found;
5522 }
5523 
set_client(clientid_t * clid,struct nfsd4_compound_state * cstate,struct nfsd_net * nn)5524 static __be32 set_client(clientid_t *clid,
5525 		struct nfsd4_compound_state *cstate,
5526 		struct nfsd_net *nn)
5527 {
5528 	if (cstate->clp) {
5529 		if (!same_clid(&cstate->clp->cl_clientid, clid))
5530 			return nfserr_stale_clientid;
5531 		return nfs_ok;
5532 	}
5533 	if (STALE_CLIENTID(clid, nn))
5534 		return nfserr_stale_clientid;
5535 	/*
5536 	 * We're in the 4.0 case (otherwise the SEQUENCE op would have
5537 	 * set cstate->clp), so session = false:
5538 	 */
5539 	cstate->clp = lookup_clientid(clid, false, nn);
5540 	if (!cstate->clp)
5541 		return nfserr_expired;
5542 	return nfs_ok;
5543 }
5544 
5545 __be32
nfsd4_process_open1(struct nfsd4_compound_state * cstate,struct nfsd4_open * open,struct nfsd_net * nn)5546 nfsd4_process_open1(struct nfsd4_compound_state *cstate,
5547 		    struct nfsd4_open *open, struct nfsd_net *nn)
5548 {
5549 	clientid_t *clientid = &open->op_clientid;
5550 	struct nfs4_client *clp = NULL;
5551 	unsigned int strhashval;
5552 	struct nfs4_openowner *oo = NULL;
5553 	__be32 status;
5554 
5555 	/*
5556 	 * In case we need it later, after we've already created the
5557 	 * file and don't want to risk a further failure:
5558 	 */
5559 	open->op_file = nfsd4_alloc_file();
5560 	if (open->op_file == NULL)
5561 		return nfserr_jukebox;
5562 
5563 	status = set_client(clientid, cstate, nn);
5564 	if (status)
5565 		return status;
5566 	clp = cstate->clp;
5567 
5568 	strhashval = ownerstr_hashval(&open->op_owner);
5569 retry:
5570 	oo = find_or_alloc_open_stateowner(strhashval, open, cstate);
5571 	open->op_openowner = oo;
5572 	if (!oo)
5573 		return nfserr_jukebox;
5574 	if (nfsd4_cstate_assign_replay(cstate, &oo->oo_owner) == -EAGAIN) {
5575 		nfs4_put_stateowner(&oo->oo_owner);
5576 		goto retry;
5577 	}
5578 	status = nfsd4_check_seqid(cstate, &oo->oo_owner, open->op_seqid);
5579 	if (status)
5580 		return status;
5581 
5582 	open->op_stp = nfs4_alloc_open_stateid(clp);
5583 	if (!open->op_stp)
5584 		return nfserr_jukebox;
5585 
5586 	if (nfsd4_has_session(cstate) &&
5587 	    (cstate->current_fh.fh_export->ex_flags & NFSEXP_PNFS)) {
5588 		open->op_odstate = alloc_clnt_odstate(clp);
5589 		if (!open->op_odstate)
5590 			return nfserr_jukebox;
5591 	}
5592 
5593 	return nfs_ok;
5594 }
5595 
5596 static inline __be32
nfs4_check_delegmode(struct nfs4_delegation * dp,int flags)5597 nfs4_check_delegmode(struct nfs4_delegation *dp, int flags)
5598 {
5599 	if (!(flags & RD_STATE) && deleg_is_read(dp->dl_type))
5600 		return nfserr_openmode;
5601 	else
5602 		return nfs_ok;
5603 }
5604 
share_access_to_flags(u32 share_access)5605 static int share_access_to_flags(u32 share_access)
5606 {
5607 	return share_access == NFS4_SHARE_ACCESS_READ ? RD_STATE : WR_STATE;
5608 }
5609 
find_deleg_stateid(struct nfs4_client * cl,stateid_t * s)5610 static struct nfs4_delegation *find_deleg_stateid(struct nfs4_client *cl,
5611 						  stateid_t *s)
5612 {
5613 	struct nfs4_stid *ret;
5614 
5615 	ret = find_stateid_by_type(cl, s, SC_TYPE_DELEG, SC_STATUS_REVOKED);
5616 	if (!ret)
5617 		return NULL;
5618 	return delegstateid(ret);
5619 }
5620 
nfsd4_is_deleg_cur(struct nfsd4_open * open)5621 static bool nfsd4_is_deleg_cur(struct nfsd4_open *open)
5622 {
5623 	return open->op_claim_type == NFS4_OPEN_CLAIM_DELEGATE_CUR ||
5624 	       open->op_claim_type == NFS4_OPEN_CLAIM_DELEG_CUR_FH;
5625 }
5626 
5627 static __be32
nfs4_check_deleg(struct nfs4_client * cl,struct nfsd4_open * open,struct nfs4_delegation ** dp)5628 nfs4_check_deleg(struct nfs4_client *cl, struct nfsd4_open *open,
5629 		struct nfs4_delegation **dp)
5630 {
5631 	int flags;
5632 	__be32 status = nfserr_bad_stateid;
5633 	struct nfs4_delegation *deleg;
5634 
5635 	deleg = find_deleg_stateid(cl, &open->op_delegate_stateid);
5636 	if (deleg == NULL)
5637 		goto out;
5638 	if (deleg->dl_stid.sc_status & SC_STATUS_ADMIN_REVOKED) {
5639 		nfs4_put_stid(&deleg->dl_stid);
5640 		status = nfserr_admin_revoked;
5641 		goto out;
5642 	}
5643 	if (deleg->dl_stid.sc_status & SC_STATUS_REVOKED) {
5644 		nfs4_put_stid(&deleg->dl_stid);
5645 		nfsd40_drop_revoked_stid(cl, &open->op_delegate_stateid);
5646 		status = nfserr_deleg_revoked;
5647 		goto out;
5648 	}
5649 	flags = share_access_to_flags(open->op_share_access);
5650 	status = nfs4_check_delegmode(deleg, flags);
5651 	if (status) {
5652 		nfs4_put_stid(&deleg->dl_stid);
5653 		goto out;
5654 	}
5655 	*dp = deleg;
5656 out:
5657 	if (!nfsd4_is_deleg_cur(open))
5658 		return nfs_ok;
5659 	if (status)
5660 		return status;
5661 	open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
5662 	return nfs_ok;
5663 }
5664 
nfs4_access_to_access(u32 nfs4_access)5665 static inline int nfs4_access_to_access(u32 nfs4_access)
5666 {
5667 	int flags = 0;
5668 
5669 	if (nfs4_access & NFS4_SHARE_ACCESS_READ)
5670 		flags |= NFSD_MAY_READ;
5671 	if (nfs4_access & NFS4_SHARE_ACCESS_WRITE)
5672 		flags |= NFSD_MAY_WRITE;
5673 	return flags;
5674 }
5675 
5676 static inline __be32
nfsd4_truncate(struct svc_rqst * rqstp,struct svc_fh * fh,struct nfsd4_open * open)5677 nfsd4_truncate(struct svc_rqst *rqstp, struct svc_fh *fh,
5678 		struct nfsd4_open *open)
5679 {
5680 	struct iattr iattr = {
5681 		.ia_valid = ATTR_SIZE,
5682 		.ia_size = 0,
5683 	};
5684 	struct nfsd_attrs attrs = {
5685 		.na_iattr	= &iattr,
5686 	};
5687 	if (!open->op_truncate)
5688 		return 0;
5689 	if (!(open->op_share_access & NFS4_SHARE_ACCESS_WRITE))
5690 		return nfserr_inval;
5691 	return nfsd_setattr(rqstp, fh, &attrs, NULL);
5692 }
5693 
nfs4_get_vfs_file(struct svc_rqst * rqstp,struct nfs4_file * fp,struct svc_fh * cur_fh,struct nfs4_ol_stateid * stp,struct nfsd4_open * open,bool new_stp)5694 static __be32 nfs4_get_vfs_file(struct svc_rqst *rqstp, struct nfs4_file *fp,
5695 		struct svc_fh *cur_fh, struct nfs4_ol_stateid *stp,
5696 		struct nfsd4_open *open, bool new_stp)
5697 {
5698 	struct nfsd_file *nf = NULL;
5699 	__be32 status;
5700 	int oflag = nfs4_access_to_omode(open->op_share_access);
5701 	int access = nfs4_access_to_access(open->op_share_access);
5702 	unsigned char old_access_bmap, old_deny_bmap;
5703 
5704 	spin_lock(&fp->fi_lock);
5705 
5706 	/*
5707 	 * Are we trying to set a deny mode that would conflict with
5708 	 * current access?
5709 	 */
5710 	status = nfs4_file_check_deny(fp, open->op_share_deny);
5711 	if (status != nfs_ok) {
5712 		if (status != nfserr_share_denied) {
5713 			spin_unlock(&fp->fi_lock);
5714 			goto out;
5715 		}
5716 		if (nfs4_resolve_deny_conflicts_locked(fp, new_stp,
5717 				stp, open->op_share_deny, false))
5718 			status = nfserr_jukebox;
5719 		spin_unlock(&fp->fi_lock);
5720 		goto out;
5721 	}
5722 
5723 	/* set access to the file */
5724 	status = nfs4_file_get_access(fp, open->op_share_access);
5725 	if (status != nfs_ok) {
5726 		if (status != nfserr_share_denied) {
5727 			spin_unlock(&fp->fi_lock);
5728 			goto out;
5729 		}
5730 		if (nfs4_resolve_deny_conflicts_locked(fp, new_stp,
5731 				stp, open->op_share_access, true))
5732 			status = nfserr_jukebox;
5733 		spin_unlock(&fp->fi_lock);
5734 		goto out;
5735 	}
5736 
5737 	/* Set access bits in stateid */
5738 	old_access_bmap = stp->st_access_bmap;
5739 	set_access(open->op_share_access, stp);
5740 
5741 	/* Set new deny mask */
5742 	old_deny_bmap = stp->st_deny_bmap;
5743 	set_deny(open->op_share_deny, stp);
5744 	fp->fi_share_deny |= (open->op_share_deny & NFS4_SHARE_DENY_BOTH);
5745 
5746 	if (!fp->fi_fds[oflag]) {
5747 		spin_unlock(&fp->fi_lock);
5748 
5749 		status = nfsd_file_acquire_opened(rqstp, cur_fh, access,
5750 						  open->op_filp, &nf);
5751 		if (status != nfs_ok)
5752 			goto out_put_access;
5753 
5754 		spin_lock(&fp->fi_lock);
5755 		if (!fp->fi_fds[oflag]) {
5756 			fp->fi_fds[oflag] = nf;
5757 			nf = NULL;
5758 		}
5759 	}
5760 	spin_unlock(&fp->fi_lock);
5761 	if (nf)
5762 		nfsd_file_put(nf);
5763 
5764 	status = nfserrno(nfsd_open_break_lease(cur_fh->fh_dentry->d_inode,
5765 								access));
5766 	if (status)
5767 		goto out_put_access;
5768 
5769 	status = nfsd4_truncate(rqstp, cur_fh, open);
5770 	if (status)
5771 		goto out_put_access;
5772 out:
5773 	return status;
5774 out_put_access:
5775 	stp->st_access_bmap = old_access_bmap;
5776 	nfs4_file_put_access(fp, open->op_share_access);
5777 	reset_union_bmap_deny(bmap_to_share_mode(old_deny_bmap), stp);
5778 	goto out;
5779 }
5780 
5781 static __be32
nfs4_upgrade_open(struct svc_rqst * rqstp,struct nfs4_file * fp,struct svc_fh * cur_fh,struct nfs4_ol_stateid * stp,struct nfsd4_open * open)5782 nfs4_upgrade_open(struct svc_rqst *rqstp, struct nfs4_file *fp,
5783 		struct svc_fh *cur_fh, struct nfs4_ol_stateid *stp,
5784 		struct nfsd4_open *open)
5785 {
5786 	__be32 status;
5787 	unsigned char old_deny_bmap = stp->st_deny_bmap;
5788 
5789 	if (!test_access(open->op_share_access, stp))
5790 		return nfs4_get_vfs_file(rqstp, fp, cur_fh, stp, open, false);
5791 
5792 	/* test and set deny mode */
5793 	spin_lock(&fp->fi_lock);
5794 	status = nfs4_file_check_deny(fp, open->op_share_deny);
5795 	switch (status) {
5796 	case nfs_ok:
5797 		set_deny(open->op_share_deny, stp);
5798 		fp->fi_share_deny |=
5799 			(open->op_share_deny & NFS4_SHARE_DENY_BOTH);
5800 		break;
5801 	case nfserr_share_denied:
5802 		if (nfs4_resolve_deny_conflicts_locked(fp, false,
5803 				stp, open->op_share_deny, false))
5804 			status = nfserr_jukebox;
5805 		break;
5806 	}
5807 	spin_unlock(&fp->fi_lock);
5808 
5809 	if (status != nfs_ok)
5810 		return status;
5811 
5812 	status = nfsd4_truncate(rqstp, cur_fh, open);
5813 	if (status != nfs_ok)
5814 		reset_union_bmap_deny(old_deny_bmap, stp);
5815 	return status;
5816 }
5817 
5818 /* Should we give out recallable state?: */
nfsd4_cb_channel_good(struct nfs4_client * clp)5819 static bool nfsd4_cb_channel_good(struct nfs4_client *clp)
5820 {
5821 	if (clp->cl_cb_state == NFSD4_CB_UP)
5822 		return true;
5823 	/*
5824 	 * In the sessions case, since we don't have to establish a
5825 	 * separate connection for callbacks, we assume it's OK
5826 	 * until we hear otherwise:
5827 	 */
5828 	return clp->cl_minorversion && clp->cl_cb_state == NFSD4_CB_UNKNOWN;
5829 }
5830 
nfs4_alloc_init_lease(struct nfs4_delegation * dp)5831 static struct file_lease *nfs4_alloc_init_lease(struct nfs4_delegation *dp)
5832 {
5833 	struct file_lease *fl;
5834 
5835 	fl = locks_alloc_lease();
5836 	if (!fl)
5837 		return NULL;
5838 	fl->fl_lmops = &nfsd_lease_mng_ops;
5839 	fl->c.flc_flags = FL_DELEG;
5840 	fl->c.flc_type = deleg_is_read(dp->dl_type) ? F_RDLCK : F_WRLCK;
5841 	fl->c.flc_owner = (fl_owner_t)dp;
5842 	fl->c.flc_pid = current->tgid;
5843 	fl->c.flc_file = dp->dl_stid.sc_file->fi_deleg_file->nf_file;
5844 	return fl;
5845 }
5846 
nfsd4_check_conflicting_opens(struct nfs4_client * clp,struct nfs4_file * fp)5847 static int nfsd4_check_conflicting_opens(struct nfs4_client *clp,
5848 					 struct nfs4_file *fp)
5849 {
5850 	struct nfs4_ol_stateid *st;
5851 	struct file *f = fp->fi_deleg_file->nf_file;
5852 	struct inode *ino = file_inode(f);
5853 	int writes;
5854 
5855 	writes = atomic_read(&ino->i_writecount);
5856 	if (!writes)
5857 		return 0;
5858 	/*
5859 	 * There could be multiple filehandles (hence multiple
5860 	 * nfs4_files) referencing this file, but that's not too
5861 	 * common; let's just give up in that case rather than
5862 	 * trying to go look up all the clients using that other
5863 	 * nfs4_file as well:
5864 	 */
5865 	if (fp->fi_aliased)
5866 		return -EAGAIN;
5867 	/*
5868 	 * If there's a close in progress, make sure that we see it
5869 	 * clear any fi_fds[] entries before we see it decrement
5870 	 * i_writecount:
5871 	 */
5872 	smp_mb__after_atomic();
5873 
5874 	if (fp->fi_fds[O_WRONLY])
5875 		writes--;
5876 	if (fp->fi_fds[O_RDWR])
5877 		writes--;
5878 	if (writes > 0)
5879 		return -EAGAIN; /* There may be non-NFSv4 writers */
5880 	/*
5881 	 * It's possible there are non-NFSv4 write opens in progress,
5882 	 * but if they haven't incremented i_writecount yet then they
5883 	 * also haven't called break lease yet; so, they'll break this
5884 	 * lease soon enough.  So, all that's left to check for is NFSv4
5885 	 * opens:
5886 	 */
5887 	spin_lock(&fp->fi_lock);
5888 	list_for_each_entry(st, &fp->fi_stateids, st_perfile) {
5889 		if (st->st_openstp == NULL /* it's an open */ &&
5890 		    access_permit_write(st) &&
5891 		    st->st_stid.sc_client != clp) {
5892 			spin_unlock(&fp->fi_lock);
5893 			return -EAGAIN;
5894 		}
5895 	}
5896 	spin_unlock(&fp->fi_lock);
5897 	/*
5898 	 * There's a small chance that we could be racing with another
5899 	 * NFSv4 open.  However, any open that hasn't added itself to
5900 	 * the fi_stateids list also hasn't called break_lease yet; so,
5901 	 * they'll break this lease soon enough.
5902 	 */
5903 	return 0;
5904 }
5905 
5906 /*
5907  * It's possible that between opening the dentry and setting the delegation,
5908  * that it has been renamed or unlinked. Redo the lookup to verify that this
5909  * hasn't happened.
5910  */
5911 static int
nfsd4_verify_deleg_dentry(struct nfsd4_open * open,struct nfs4_file * fp,struct svc_fh * parent)5912 nfsd4_verify_deleg_dentry(struct nfsd4_open *open, struct nfs4_file *fp,
5913 			  struct svc_fh *parent)
5914 {
5915 	struct svc_export *exp;
5916 	struct dentry *child;
5917 	__be32 err;
5918 
5919 	err = nfsd_lookup_dentry(open->op_rqstp, parent,
5920 				 open->op_fname, open->op_fnamelen,
5921 				 &exp, &child);
5922 
5923 	if (err)
5924 		return -EAGAIN;
5925 
5926 	exp_put(exp);
5927 	dput(child);
5928 	if (child != file_dentry(fp->fi_deleg_file->nf_file))
5929 		return -EAGAIN;
5930 
5931 	return 0;
5932 }
5933 
5934 /*
5935  * We avoid breaking delegations held by a client due to its own activity, but
5936  * clearing setuid/setgid bits on a write is an implicit activity and the client
5937  * may not notice and continue using the old mode. Avoid giving out a delegation
5938  * on setuid/setgid files when the client is requesting an open for write.
5939  */
5940 static int
nfsd4_verify_setuid_write(struct nfsd4_open * open,struct nfsd_file * nf)5941 nfsd4_verify_setuid_write(struct nfsd4_open *open, struct nfsd_file *nf)
5942 {
5943 	struct inode *inode = file_inode(nf->nf_file);
5944 
5945 	if ((open->op_share_access & NFS4_SHARE_ACCESS_WRITE) &&
5946 	    (inode->i_mode & (S_ISUID|S_ISGID)))
5947 		return -EAGAIN;
5948 	return 0;
5949 }
5950 
5951 static struct nfs4_delegation *
nfs4_set_delegation(struct nfsd4_open * open,struct nfs4_ol_stateid * stp,struct svc_fh * parent)5952 nfs4_set_delegation(struct nfsd4_open *open, struct nfs4_ol_stateid *stp,
5953 		    struct svc_fh *parent)
5954 {
5955 	bool deleg_ts = open->op_deleg_want & OPEN4_SHARE_ACCESS_WANT_DELEG_TIMESTAMPS;
5956 	struct nfs4_client *clp = stp->st_stid.sc_client;
5957 	struct nfs4_file *fp = stp->st_stid.sc_file;
5958 	struct nfs4_clnt_odstate *odstate = stp->st_clnt_odstate;
5959 	struct nfs4_delegation *dp;
5960 	struct nfsd_file *nf = NULL;
5961 	struct file_lease *fl;
5962 	int status = 0;
5963 	u32 dl_type;
5964 
5965 	/*
5966 	 * The fi_had_conflict and nfs_get_existing_delegation checks
5967 	 * here are just optimizations; we'll need to recheck them at
5968 	 * the end:
5969 	 */
5970 	if (fp->fi_had_conflict)
5971 		return ERR_PTR(-EAGAIN);
5972 
5973 	/*
5974 	 * Try for a write delegation first. RFC8881 section 10.4 says:
5975 	 *
5976 	 *  "An OPEN_DELEGATE_WRITE delegation allows the client to handle,
5977 	 *   on its own, all opens."
5978 	 *
5979 	 * Furthermore the client can use a write delegation for most READ
5980 	 * operations as well, so we require a O_RDWR file here.
5981 	 *
5982 	 * Offer a write delegation in the case of a BOTH open, and ensure
5983 	 * we get the O_RDWR descriptor.
5984 	 */
5985 	if ((open->op_share_access & NFS4_SHARE_ACCESS_BOTH) == NFS4_SHARE_ACCESS_BOTH) {
5986 		nf = find_rw_file(fp);
5987 		dl_type = deleg_ts ? OPEN_DELEGATE_WRITE_ATTRS_DELEG : OPEN_DELEGATE_WRITE;
5988 	}
5989 
5990 	/*
5991 	 * If the file is being opened O_RDONLY or we couldn't get a O_RDWR
5992 	 * file for some reason, then try for a read delegation instead.
5993 	 */
5994 	if (!nf && (open->op_share_access & NFS4_SHARE_ACCESS_READ)) {
5995 		nf = find_readable_file(fp);
5996 		dl_type = deleg_ts ? OPEN_DELEGATE_READ_ATTRS_DELEG : OPEN_DELEGATE_READ;
5997 	}
5998 
5999 	if (!nf)
6000 		return ERR_PTR(-EAGAIN);
6001 
6002 	spin_lock(&state_lock);
6003 	spin_lock(&fp->fi_lock);
6004 	if (nfs4_delegation_exists(clp, fp))
6005 		status = -EAGAIN;
6006 	else if (nfsd4_verify_setuid_write(open, nf))
6007 		status = -EAGAIN;
6008 	else if (!fp->fi_deleg_file) {
6009 		fp->fi_deleg_file = nf;
6010 		/* increment early to prevent fi_deleg_file from being
6011 		 * cleared */
6012 		fp->fi_delegees = 1;
6013 		nf = NULL;
6014 	} else
6015 		fp->fi_delegees++;
6016 	spin_unlock(&fp->fi_lock);
6017 	spin_unlock(&state_lock);
6018 	if (nf)
6019 		nfsd_file_put(nf);
6020 	if (status)
6021 		return ERR_PTR(status);
6022 
6023 	status = -ENOMEM;
6024 	dp = alloc_init_deleg(clp, fp, odstate, dl_type);
6025 	if (!dp)
6026 		goto out_delegees;
6027 
6028 	fl = nfs4_alloc_init_lease(dp);
6029 	if (!fl)
6030 		goto out_clnt_odstate;
6031 
6032 	status = kernel_setlease(fp->fi_deleg_file->nf_file,
6033 				      fl->c.flc_type, &fl, NULL);
6034 	if (fl)
6035 		locks_free_lease(fl);
6036 	if (status)
6037 		goto out_clnt_odstate;
6038 
6039 	if (parent) {
6040 		status = nfsd4_verify_deleg_dentry(open, fp, parent);
6041 		if (status)
6042 			goto out_unlock;
6043 	}
6044 
6045 	status = nfsd4_check_conflicting_opens(clp, fp);
6046 	if (status)
6047 		goto out_unlock;
6048 
6049 	/*
6050 	 * Now that the deleg is set, check again to ensure that nothing
6051 	 * raced in and changed the mode while we weren't looking.
6052 	 */
6053 	status = nfsd4_verify_setuid_write(open, fp->fi_deleg_file);
6054 	if (status)
6055 		goto out_unlock;
6056 
6057 	status = -EAGAIN;
6058 	if (fp->fi_had_conflict)
6059 		goto out_unlock;
6060 
6061 	spin_lock(&state_lock);
6062 	spin_lock(&clp->cl_lock);
6063 	spin_lock(&fp->fi_lock);
6064 	status = hash_delegation_locked(dp, fp);
6065 	spin_unlock(&fp->fi_lock);
6066 	spin_unlock(&clp->cl_lock);
6067 	spin_unlock(&state_lock);
6068 
6069 	if (status)
6070 		goto out_unlock;
6071 
6072 	return dp;
6073 out_unlock:
6074 	kernel_setlease(fp->fi_deleg_file->nf_file, F_UNLCK, NULL, (void **)&dp);
6075 out_clnt_odstate:
6076 	put_clnt_odstate(dp->dl_clnt_odstate);
6077 	nfs4_put_stid(&dp->dl_stid);
6078 out_delegees:
6079 	put_deleg_file(fp);
6080 	return ERR_PTR(status);
6081 }
6082 
nfsd4_open_deleg_none_ext(struct nfsd4_open * open,int status)6083 static void nfsd4_open_deleg_none_ext(struct nfsd4_open *open, int status)
6084 {
6085 	open->op_delegate_type = OPEN_DELEGATE_NONE_EXT;
6086 	if (status == -EAGAIN)
6087 		open->op_why_no_deleg = WND4_CONTENTION;
6088 	else {
6089 		open->op_why_no_deleg = WND4_RESOURCE;
6090 		switch (open->op_deleg_want) {
6091 		case OPEN4_SHARE_ACCESS_WANT_READ_DELEG:
6092 		case OPEN4_SHARE_ACCESS_WANT_WRITE_DELEG:
6093 		case OPEN4_SHARE_ACCESS_WANT_ANY_DELEG:
6094 			break;
6095 		case OPEN4_SHARE_ACCESS_WANT_CANCEL:
6096 			open->op_why_no_deleg = WND4_CANCELLED;
6097 			break;
6098 		case OPEN4_SHARE_ACCESS_WANT_NO_DELEG:
6099 			WARN_ON_ONCE(1);
6100 		}
6101 	}
6102 }
6103 
6104 static bool
nfs4_delegation_stat(struct nfs4_delegation * dp,struct svc_fh * currentfh,struct kstat * stat)6105 nfs4_delegation_stat(struct nfs4_delegation *dp, struct svc_fh *currentfh,
6106 		     struct kstat *stat)
6107 {
6108 	struct nfsd_file *nf = find_rw_file(dp->dl_stid.sc_file);
6109 	struct path path;
6110 	int rc;
6111 
6112 	if (!nf)
6113 		return false;
6114 
6115 	path.mnt = currentfh->fh_export->ex_path.mnt;
6116 	path.dentry = file_dentry(nf->nf_file);
6117 
6118 	rc = vfs_getattr(&path, stat,
6119 			 (STATX_MODE | STATX_SIZE | STATX_CTIME | STATX_CHANGE_COOKIE),
6120 			 AT_STATX_SYNC_AS_STAT);
6121 
6122 	nfsd_file_put(nf);
6123 	return rc == 0;
6124 }
6125 
6126 /*
6127  * The Linux NFS server does not offer write delegations to NFSv4.0
6128  * clients in order to avoid conflicts between write delegations and
6129  * GETATTRs requesting CHANGE or SIZE attributes.
6130  *
6131  * With NFSv4.1 and later minorversions, the SEQUENCE operation that
6132  * begins each COMPOUND contains a client ID. Delegation recall can
6133  * be avoided when the server recognizes the client sending a
6134  * GETATTR also holds write delegation it conflicts with.
6135  *
6136  * However, the NFSv4.0 protocol does not enable a server to
6137  * determine that a GETATTR originated from the client holding the
6138  * conflicting delegation versus coming from some other client. Per
6139  * RFC 7530 Section 16.7.5, the server must recall or send a
6140  * CB_GETATTR even when the GETATTR originates from the client that
6141  * holds the conflicting delegation.
6142  *
6143  * An NFSv4.0 client can trigger a pathological situation if it
6144  * always sends a DELEGRETURN preceded by a conflicting GETATTR in
6145  * the same COMPOUND. COMPOUND execution will always stop at the
6146  * GETATTR and the DELEGRETURN will never get executed. The server
6147  * eventually revokes the delegation, which can result in loss of
6148  * open or lock state.
6149  */
6150 static void
nfs4_open_delegation(struct nfsd4_open * open,struct nfs4_ol_stateid * stp,struct svc_fh * currentfh)6151 nfs4_open_delegation(struct nfsd4_open *open, struct nfs4_ol_stateid *stp,
6152 		     struct svc_fh *currentfh)
6153 {
6154 	bool deleg_ts = open->op_deleg_want & OPEN4_SHARE_ACCESS_WANT_DELEG_TIMESTAMPS;
6155 	struct nfs4_openowner *oo = openowner(stp->st_stateowner);
6156 	struct nfs4_client *clp = stp->st_stid.sc_client;
6157 	struct svc_fh *parent = NULL;
6158 	struct nfs4_delegation *dp;
6159 	struct kstat stat;
6160 	int status = 0;
6161 	int cb_up;
6162 
6163 	cb_up = nfsd4_cb_channel_good(oo->oo_owner.so_client);
6164 	open->op_recall = false;
6165 	switch (open->op_claim_type) {
6166 		case NFS4_OPEN_CLAIM_PREVIOUS:
6167 			if (!cb_up)
6168 				open->op_recall = true;
6169 			break;
6170 		case NFS4_OPEN_CLAIM_NULL:
6171 			parent = currentfh;
6172 			fallthrough;
6173 		case NFS4_OPEN_CLAIM_FH:
6174 			/*
6175 			 * Let's not give out any delegations till everyone's
6176 			 * had the chance to reclaim theirs, *and* until
6177 			 * NLM locks have all been reclaimed:
6178 			 */
6179 			if (locks_in_grace(clp->net))
6180 				goto out_no_deleg;
6181 			if (!cb_up || !(oo->oo_flags & NFS4_OO_CONFIRMED))
6182 				goto out_no_deleg;
6183 			if (open->op_share_access & NFS4_SHARE_ACCESS_WRITE &&
6184 					!clp->cl_minorversion)
6185 				goto out_no_deleg;
6186 			break;
6187 		default:
6188 			goto out_no_deleg;
6189 	}
6190 	dp = nfs4_set_delegation(open, stp, parent);
6191 	if (IS_ERR(dp))
6192 		goto out_no_deleg;
6193 
6194 	memcpy(&open->op_delegate_stateid, &dp->dl_stid.sc_stateid, sizeof(dp->dl_stid.sc_stateid));
6195 
6196 	if (open->op_share_access & NFS4_SHARE_ACCESS_WRITE) {
6197 		if (!nfs4_delegation_stat(dp, currentfh, &stat)) {
6198 			nfs4_put_stid(&dp->dl_stid);
6199 			destroy_delegation(dp);
6200 			goto out_no_deleg;
6201 		}
6202 		open->op_delegate_type = deleg_ts ? OPEN_DELEGATE_WRITE_ATTRS_DELEG :
6203 						    OPEN_DELEGATE_WRITE;
6204 		dp->dl_cb_fattr.ncf_cur_fsize = stat.size;
6205 		dp->dl_cb_fattr.ncf_initial_cinfo = nfsd4_change_attribute(&stat);
6206 		trace_nfsd_deleg_write(&dp->dl_stid.sc_stateid);
6207 	} else {
6208 		open->op_delegate_type = deleg_ts ? OPEN_DELEGATE_READ_ATTRS_DELEG :
6209 						    OPEN_DELEGATE_READ;
6210 		trace_nfsd_deleg_read(&dp->dl_stid.sc_stateid);
6211 	}
6212 	nfs4_put_stid(&dp->dl_stid);
6213 	return;
6214 out_no_deleg:
6215 	open->op_delegate_type = OPEN_DELEGATE_NONE;
6216 	if (open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS &&
6217 	    open->op_delegate_type != OPEN_DELEGATE_NONE) {
6218 		dprintk("NFSD: WARNING: refusing delegation reclaim\n");
6219 		open->op_recall = true;
6220 	}
6221 
6222 	/* 4.1 client asking for a delegation? */
6223 	if (open->op_deleg_want)
6224 		nfsd4_open_deleg_none_ext(open, status);
6225 	return;
6226 }
6227 
nfsd4_deleg_xgrade_none_ext(struct nfsd4_open * open,struct nfs4_delegation * dp)6228 static void nfsd4_deleg_xgrade_none_ext(struct nfsd4_open *open,
6229 					struct nfs4_delegation *dp)
6230 {
6231 	if (deleg_is_write(dp->dl_type)) {
6232 		if (open->op_deleg_want & OPEN4_SHARE_ACCESS_WANT_READ_DELEG) {
6233 			open->op_delegate_type = OPEN_DELEGATE_NONE_EXT;
6234 			open->op_why_no_deleg = WND4_NOT_SUPP_DOWNGRADE;
6235 		} else if (open->op_deleg_want & OPEN4_SHARE_ACCESS_WANT_WRITE_DELEG) {
6236 			open->op_delegate_type = OPEN_DELEGATE_NONE_EXT;
6237 			open->op_why_no_deleg = WND4_NOT_SUPP_UPGRADE;
6238 		}
6239 	}
6240 	/* Otherwise the client must be confused wanting a delegation
6241 	 * it already has, therefore we don't return
6242 	 * OPEN_DELEGATE_NONE_EXT and reason.
6243 	 */
6244 }
6245 
6246 /* Are we returning only a delegation stateid? */
open_xor_delegation(struct nfsd4_open * open)6247 static bool open_xor_delegation(struct nfsd4_open *open)
6248 {
6249 	if (!(open->op_deleg_want & OPEN4_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION))
6250 		return false;
6251 	/* Did we actually get a delegation? */
6252 	if (!deleg_is_read(open->op_delegate_type) && !deleg_is_write(open->op_delegate_type))
6253 		return false;
6254 	return true;
6255 }
6256 
6257 /**
6258  * nfsd4_process_open2 - finish open processing
6259  * @rqstp: the RPC transaction being executed
6260  * @current_fh: NFSv4 COMPOUND's current filehandle
6261  * @open: OPEN arguments
6262  *
6263  * If successful, (1) truncate the file if open->op_truncate was
6264  * set, (2) set open->op_stateid, (3) set open->op_delegation.
6265  *
6266  * Returns %nfs_ok on success; otherwise an nfs4stat value in
6267  * network byte order is returned.
6268  */
6269 __be32
nfsd4_process_open2(struct svc_rqst * rqstp,struct svc_fh * current_fh,struct nfsd4_open * open)6270 nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open)
6271 {
6272 	struct nfsd4_compoundres *resp = rqstp->rq_resp;
6273 	struct nfs4_client *cl = open->op_openowner->oo_owner.so_client;
6274 	struct nfs4_file *fp = NULL;
6275 	struct nfs4_ol_stateid *stp = NULL;
6276 	struct nfs4_delegation *dp = NULL;
6277 	__be32 status;
6278 	bool new_stp = false;
6279 
6280 	/*
6281 	 * Lookup file; if found, lookup stateid and check open request,
6282 	 * and check for delegations in the process of being recalled.
6283 	 * If not found, create the nfs4_file struct
6284 	 */
6285 	fp = nfsd4_file_hash_insert(open->op_file, current_fh);
6286 	if (unlikely(!fp))
6287 		return nfserr_jukebox;
6288 	if (fp != open->op_file) {
6289 		status = nfs4_check_deleg(cl, open, &dp);
6290 		if (status)
6291 			goto out;
6292 		stp = nfsd4_find_and_lock_existing_open(fp, open);
6293 	} else {
6294 		open->op_file = NULL;
6295 		status = nfserr_bad_stateid;
6296 		if (nfsd4_is_deleg_cur(open))
6297 			goto out;
6298 	}
6299 
6300 	if (!stp) {
6301 		stp = init_open_stateid(fp, open);
6302 		if (!stp) {
6303 			status = nfserr_jukebox;
6304 			goto out;
6305 		}
6306 
6307 		if (!open->op_stp)
6308 			new_stp = true;
6309 	}
6310 
6311 	/*
6312 	 * OPEN the file, or upgrade an existing OPEN.
6313 	 * If truncate fails, the OPEN fails.
6314 	 *
6315 	 * stp is already locked.
6316 	 */
6317 	if (!new_stp) {
6318 		/* Stateid was found, this is an OPEN upgrade */
6319 		status = nfs4_upgrade_open(rqstp, fp, current_fh, stp, open);
6320 		if (status) {
6321 			mutex_unlock(&stp->st_mutex);
6322 			goto out;
6323 		}
6324 	} else {
6325 		status = nfs4_get_vfs_file(rqstp, fp, current_fh, stp, open, true);
6326 		if (status) {
6327 			release_open_stateid(stp);
6328 			mutex_unlock(&stp->st_mutex);
6329 			goto out;
6330 		}
6331 
6332 		stp->st_clnt_odstate = find_or_hash_clnt_odstate(fp,
6333 							open->op_odstate);
6334 		if (stp->st_clnt_odstate == open->op_odstate)
6335 			open->op_odstate = NULL;
6336 	}
6337 
6338 	nfs4_inc_and_copy_stateid(&open->op_stateid, &stp->st_stid);
6339 	mutex_unlock(&stp->st_mutex);
6340 
6341 	if (nfsd4_has_session(&resp->cstate)) {
6342 		if (open->op_deleg_want & OPEN4_SHARE_ACCESS_WANT_NO_DELEG) {
6343 			open->op_delegate_type = OPEN_DELEGATE_NONE_EXT;
6344 			open->op_why_no_deleg = WND4_NOT_WANTED;
6345 			goto nodeleg;
6346 		}
6347 	}
6348 
6349 	/*
6350 	* Attempt to hand out a delegation. No error return, because the
6351 	* OPEN succeeds even if we fail.
6352 	*/
6353 	nfs4_open_delegation(open, stp, &resp->cstate.current_fh);
6354 
6355 	/*
6356 	 * If there is an existing open stateid, it must be updated and
6357 	 * returned. Only respect WANT_OPEN_XOR_DELEGATION when a new
6358 	 * open stateid would have to be created.
6359 	 */
6360 	if (new_stp && open_xor_delegation(open)) {
6361 		memcpy(&open->op_stateid, &zero_stateid, sizeof(open->op_stateid));
6362 		open->op_rflags |= OPEN4_RESULT_NO_OPEN_STATEID;
6363 		release_open_stateid(stp);
6364 	}
6365 nodeleg:
6366 	status = nfs_ok;
6367 	trace_nfsd_open(&stp->st_stid.sc_stateid);
6368 out:
6369 	/* 4.1 client trying to upgrade/downgrade delegation? */
6370 	if (open->op_delegate_type == OPEN_DELEGATE_NONE && dp &&
6371 	    open->op_deleg_want)
6372 		nfsd4_deleg_xgrade_none_ext(open, dp);
6373 
6374 	if (fp)
6375 		put_nfs4_file(fp);
6376 	if (status == 0 && open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS)
6377 		open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
6378 	/*
6379 	* To finish the open response, we just need to set the rflags.
6380 	*/
6381 	open->op_rflags |= NFS4_OPEN_RESULT_LOCKTYPE_POSIX;
6382 	if (nfsd4_has_session(&resp->cstate))
6383 		open->op_rflags |= NFS4_OPEN_RESULT_MAY_NOTIFY_LOCK;
6384 	else if (!(open->op_openowner->oo_flags & NFS4_OO_CONFIRMED))
6385 		open->op_rflags |= NFS4_OPEN_RESULT_CONFIRM;
6386 
6387 	if (dp)
6388 		nfs4_put_stid(&dp->dl_stid);
6389 	if (stp)
6390 		nfs4_put_stid(&stp->st_stid);
6391 
6392 	return status;
6393 }
6394 
nfsd4_cleanup_open_state(struct nfsd4_compound_state * cstate,struct nfsd4_open * open)6395 void nfsd4_cleanup_open_state(struct nfsd4_compound_state *cstate,
6396 			      struct nfsd4_open *open)
6397 {
6398 	if (open->op_openowner)
6399 		nfs4_put_stateowner(&open->op_openowner->oo_owner);
6400 	if (open->op_file)
6401 		kmem_cache_free(file_slab, open->op_file);
6402 	if (open->op_stp)
6403 		nfs4_put_stid(&open->op_stp->st_stid);
6404 	if (open->op_odstate)
6405 		kmem_cache_free(odstate_slab, open->op_odstate);
6406 }
6407 
6408 __be32
nfsd4_renew(struct svc_rqst * rqstp,struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)6409 nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
6410 	    union nfsd4_op_u *u)
6411 {
6412 	clientid_t *clid = &u->renew;
6413 	struct nfs4_client *clp;
6414 	__be32 status;
6415 	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
6416 
6417 	trace_nfsd_clid_renew(clid);
6418 	status = set_client(clid, cstate, nn);
6419 	if (status)
6420 		return status;
6421 	clp = cstate->clp;
6422 	if (!list_empty(&clp->cl_delegations)
6423 			&& clp->cl_cb_state != NFSD4_CB_UP)
6424 		return nfserr_cb_path_down;
6425 	return nfs_ok;
6426 }
6427 
6428 void
nfsd4_end_grace(struct nfsd_net * nn)6429 nfsd4_end_grace(struct nfsd_net *nn)
6430 {
6431 	/* do nothing if grace period already ended */
6432 	if (nn->grace_ended)
6433 		return;
6434 
6435 	trace_nfsd_grace_complete(nn);
6436 	nn->grace_ended = true;
6437 	/*
6438 	 * If the server goes down again right now, an NFSv4
6439 	 * client will still be allowed to reclaim after it comes back up,
6440 	 * even if it hasn't yet had a chance to reclaim state this time.
6441 	 *
6442 	 */
6443 	nfsd4_record_grace_done(nn);
6444 	/*
6445 	 * At this point, NFSv4 clients can still reclaim.  But if the
6446 	 * server crashes, any that have not yet reclaimed will be out
6447 	 * of luck on the next boot.
6448 	 *
6449 	 * (NFSv4.1+ clients are considered to have reclaimed once they
6450 	 * call RECLAIM_COMPLETE.  NFSv4.0 clients are considered to
6451 	 * have reclaimed after their first OPEN.)
6452 	 */
6453 	locks_end_grace(&nn->nfsd4_manager);
6454 	/*
6455 	 * At this point, and once lockd and/or any other containers
6456 	 * exit their grace period, further reclaims will fail and
6457 	 * regular locking can resume.
6458 	 */
6459 }
6460 
6461 /*
6462  * If we've waited a lease period but there are still clients trying to
6463  * reclaim, wait a little longer to give them a chance to finish.
6464  */
clients_still_reclaiming(struct nfsd_net * nn)6465 static bool clients_still_reclaiming(struct nfsd_net *nn)
6466 {
6467 	time64_t double_grace_period_end = nn->boot_time +
6468 					   2 * nn->nfsd4_lease;
6469 
6470 	if (nn->track_reclaim_completes &&
6471 			atomic_read(&nn->nr_reclaim_complete) ==
6472 			nn->reclaim_str_hashtbl_size)
6473 		return false;
6474 	if (!nn->somebody_reclaimed)
6475 		return false;
6476 	nn->somebody_reclaimed = false;
6477 	/*
6478 	 * If we've given them *two* lease times to reclaim, and they're
6479 	 * still not done, give up:
6480 	 */
6481 	if (ktime_get_boottime_seconds() > double_grace_period_end)
6482 		return false;
6483 	return true;
6484 }
6485 
6486 struct laundry_time {
6487 	time64_t cutoff;
6488 	time64_t new_timeo;
6489 };
6490 
state_expired(struct laundry_time * lt,time64_t last_refresh)6491 static bool state_expired(struct laundry_time *lt, time64_t last_refresh)
6492 {
6493 	time64_t time_remaining;
6494 
6495 	if (last_refresh < lt->cutoff)
6496 		return true;
6497 	time_remaining = last_refresh - lt->cutoff;
6498 	lt->new_timeo = min(lt->new_timeo, time_remaining);
6499 	return false;
6500 }
6501 
6502 #ifdef CONFIG_NFSD_V4_2_INTER_SSC
nfsd4_ssc_init_umount_work(struct nfsd_net * nn)6503 void nfsd4_ssc_init_umount_work(struct nfsd_net *nn)
6504 {
6505 	spin_lock_init(&nn->nfsd_ssc_lock);
6506 	INIT_LIST_HEAD(&nn->nfsd_ssc_mount_list);
6507 	init_waitqueue_head(&nn->nfsd_ssc_waitq);
6508 }
6509 
6510 /*
6511  * This is called when nfsd is being shutdown, after all inter_ssc
6512  * cleanup were done, to destroy the ssc delayed unmount list.
6513  */
nfsd4_ssc_shutdown_umount(struct nfsd_net * nn)6514 static void nfsd4_ssc_shutdown_umount(struct nfsd_net *nn)
6515 {
6516 	struct nfsd4_ssc_umount_item *ni = NULL;
6517 	struct nfsd4_ssc_umount_item *tmp;
6518 
6519 	spin_lock(&nn->nfsd_ssc_lock);
6520 	list_for_each_entry_safe(ni, tmp, &nn->nfsd_ssc_mount_list, nsui_list) {
6521 		list_del(&ni->nsui_list);
6522 		spin_unlock(&nn->nfsd_ssc_lock);
6523 		mntput(ni->nsui_vfsmount);
6524 		kfree(ni);
6525 		spin_lock(&nn->nfsd_ssc_lock);
6526 	}
6527 	spin_unlock(&nn->nfsd_ssc_lock);
6528 }
6529 
nfsd4_ssc_expire_umount(struct nfsd_net * nn)6530 static void nfsd4_ssc_expire_umount(struct nfsd_net *nn)
6531 {
6532 	bool do_wakeup = false;
6533 	struct nfsd4_ssc_umount_item *ni = NULL;
6534 	struct nfsd4_ssc_umount_item *tmp;
6535 
6536 	spin_lock(&nn->nfsd_ssc_lock);
6537 	list_for_each_entry_safe(ni, tmp, &nn->nfsd_ssc_mount_list, nsui_list) {
6538 		if (time_after(jiffies, ni->nsui_expire)) {
6539 			if (refcount_read(&ni->nsui_refcnt) > 1)
6540 				continue;
6541 
6542 			/* mark being unmount */
6543 			ni->nsui_busy = true;
6544 			spin_unlock(&nn->nfsd_ssc_lock);
6545 			mntput(ni->nsui_vfsmount);
6546 			spin_lock(&nn->nfsd_ssc_lock);
6547 
6548 			/* waiters need to start from begin of list */
6549 			list_del(&ni->nsui_list);
6550 			kfree(ni);
6551 
6552 			/* wakeup ssc_connect waiters */
6553 			do_wakeup = true;
6554 			continue;
6555 		}
6556 		break;
6557 	}
6558 	if (do_wakeup)
6559 		wake_up_all(&nn->nfsd_ssc_waitq);
6560 	spin_unlock(&nn->nfsd_ssc_lock);
6561 }
6562 #endif
6563 
6564 /* Check if any lock belonging to this lockowner has any blockers */
6565 static bool
nfs4_lockowner_has_blockers(struct nfs4_lockowner * lo)6566 nfs4_lockowner_has_blockers(struct nfs4_lockowner *lo)
6567 {
6568 	struct file_lock_context *ctx;
6569 	struct nfs4_ol_stateid *stp;
6570 	struct nfs4_file *nf;
6571 
6572 	list_for_each_entry(stp, &lo->lo_owner.so_stateids, st_perstateowner) {
6573 		nf = stp->st_stid.sc_file;
6574 		ctx = locks_inode_context(nf->fi_inode);
6575 		if (!ctx)
6576 			continue;
6577 		if (locks_owner_has_blockers(ctx, lo))
6578 			return true;
6579 	}
6580 	return false;
6581 }
6582 
6583 static bool
nfs4_anylock_blockers(struct nfs4_client * clp)6584 nfs4_anylock_blockers(struct nfs4_client *clp)
6585 {
6586 	int i;
6587 	struct nfs4_stateowner *so;
6588 	struct nfs4_lockowner *lo;
6589 
6590 	if (atomic_read(&clp->cl_delegs_in_recall))
6591 		return true;
6592 	spin_lock(&clp->cl_lock);
6593 	for (i = 0; i < OWNER_HASH_SIZE; i++) {
6594 		list_for_each_entry(so, &clp->cl_ownerstr_hashtbl[i],
6595 				so_strhash) {
6596 			if (so->so_is_open_owner)
6597 				continue;
6598 			lo = lockowner(so);
6599 			if (nfs4_lockowner_has_blockers(lo)) {
6600 				spin_unlock(&clp->cl_lock);
6601 				return true;
6602 			}
6603 		}
6604 	}
6605 	spin_unlock(&clp->cl_lock);
6606 	return false;
6607 }
6608 
6609 static void
nfs4_get_client_reaplist(struct nfsd_net * nn,struct list_head * reaplist,struct laundry_time * lt)6610 nfs4_get_client_reaplist(struct nfsd_net *nn, struct list_head *reaplist,
6611 				struct laundry_time *lt)
6612 {
6613 	unsigned int maxreap, reapcnt = 0;
6614 	struct list_head *pos, *next;
6615 	struct nfs4_client *clp;
6616 
6617 	maxreap = (atomic_read(&nn->nfs4_client_count) >= nn->nfs4_max_clients) ?
6618 			NFSD_CLIENT_MAX_TRIM_PER_RUN : 0;
6619 	INIT_LIST_HEAD(reaplist);
6620 	spin_lock(&nn->client_lock);
6621 	list_for_each_safe(pos, next, &nn->client_lru) {
6622 		clp = list_entry(pos, struct nfs4_client, cl_lru);
6623 		if (clp->cl_state == NFSD4_EXPIRABLE)
6624 			goto exp_client;
6625 		if (!state_expired(lt, clp->cl_time))
6626 			break;
6627 		if (!atomic_read(&clp->cl_rpc_users)) {
6628 			if (clp->cl_state == NFSD4_ACTIVE)
6629 				atomic_inc(&nn->nfsd_courtesy_clients);
6630 			clp->cl_state = NFSD4_COURTESY;
6631 		}
6632 		if (!client_has_state(clp))
6633 			goto exp_client;
6634 		if (!nfs4_anylock_blockers(clp))
6635 			if (reapcnt >= maxreap)
6636 				continue;
6637 exp_client:
6638 		if (!mark_client_expired_locked(clp)) {
6639 			list_add(&clp->cl_lru, reaplist);
6640 			reapcnt++;
6641 		}
6642 	}
6643 	spin_unlock(&nn->client_lock);
6644 }
6645 
6646 static void
nfs4_get_courtesy_client_reaplist(struct nfsd_net * nn,struct list_head * reaplist)6647 nfs4_get_courtesy_client_reaplist(struct nfsd_net *nn,
6648 				struct list_head *reaplist)
6649 {
6650 	unsigned int maxreap = 0, reapcnt = 0;
6651 	struct list_head *pos, *next;
6652 	struct nfs4_client *clp;
6653 
6654 	maxreap = NFSD_CLIENT_MAX_TRIM_PER_RUN;
6655 	INIT_LIST_HEAD(reaplist);
6656 
6657 	spin_lock(&nn->client_lock);
6658 	list_for_each_safe(pos, next, &nn->client_lru) {
6659 		clp = list_entry(pos, struct nfs4_client, cl_lru);
6660 		if (clp->cl_state == NFSD4_ACTIVE)
6661 			break;
6662 		if (reapcnt >= maxreap)
6663 			break;
6664 		if (!mark_client_expired_locked(clp)) {
6665 			list_add(&clp->cl_lru, reaplist);
6666 			reapcnt++;
6667 		}
6668 	}
6669 	spin_unlock(&nn->client_lock);
6670 }
6671 
6672 static void
nfs4_process_client_reaplist(struct list_head * reaplist)6673 nfs4_process_client_reaplist(struct list_head *reaplist)
6674 {
6675 	struct list_head *pos, *next;
6676 	struct nfs4_client *clp;
6677 
6678 	list_for_each_safe(pos, next, reaplist) {
6679 		clp = list_entry(pos, struct nfs4_client, cl_lru);
6680 		trace_nfsd_clid_purged(&clp->cl_clientid);
6681 		list_del_init(&clp->cl_lru);
6682 		expire_client(clp);
6683 	}
6684 }
6685 
nfs40_clean_admin_revoked(struct nfsd_net * nn,struct laundry_time * lt)6686 static void nfs40_clean_admin_revoked(struct nfsd_net *nn,
6687 				      struct laundry_time *lt)
6688 {
6689 	struct nfs4_client *clp;
6690 
6691 	spin_lock(&nn->client_lock);
6692 	if (nn->nfs40_last_revoke == 0 ||
6693 	    nn->nfs40_last_revoke > lt->cutoff) {
6694 		spin_unlock(&nn->client_lock);
6695 		return;
6696 	}
6697 	nn->nfs40_last_revoke = 0;
6698 
6699 retry:
6700 	list_for_each_entry(clp, &nn->client_lru, cl_lru) {
6701 		unsigned long id, tmp;
6702 		struct nfs4_stid *stid;
6703 
6704 		if (atomic_read(&clp->cl_admin_revoked) == 0)
6705 			continue;
6706 
6707 		spin_lock(&clp->cl_lock);
6708 		idr_for_each_entry_ul(&clp->cl_stateids, stid, tmp, id)
6709 			if (stid->sc_status & SC_STATUS_ADMIN_REVOKED) {
6710 				refcount_inc(&stid->sc_count);
6711 				spin_unlock(&nn->client_lock);
6712 				/* this function drops ->cl_lock */
6713 				nfsd4_drop_revoked_stid(stid);
6714 				nfs4_put_stid(stid);
6715 				spin_lock(&nn->client_lock);
6716 				goto retry;
6717 			}
6718 		spin_unlock(&clp->cl_lock);
6719 	}
6720 	spin_unlock(&nn->client_lock);
6721 }
6722 
6723 static time64_t
nfs4_laundromat(struct nfsd_net * nn)6724 nfs4_laundromat(struct nfsd_net *nn)
6725 {
6726 	struct nfs4_openowner *oo;
6727 	struct nfs4_delegation *dp;
6728 	struct nfs4_ol_stateid *stp;
6729 	struct nfsd4_blocked_lock *nbl;
6730 	struct list_head *pos, *next, reaplist;
6731 	struct laundry_time lt = {
6732 		.cutoff = ktime_get_boottime_seconds() - nn->nfsd4_lease,
6733 		.new_timeo = nn->nfsd4_lease
6734 	};
6735 	struct nfs4_cpntf_state *cps;
6736 	copy_stateid_t *cps_t;
6737 	int i;
6738 
6739 	if (clients_still_reclaiming(nn)) {
6740 		lt.new_timeo = 0;
6741 		goto out;
6742 	}
6743 	nfsd4_end_grace(nn);
6744 
6745 	spin_lock(&nn->s2s_cp_lock);
6746 	idr_for_each_entry(&nn->s2s_cp_stateids, cps_t, i) {
6747 		cps = container_of(cps_t, struct nfs4_cpntf_state, cp_stateid);
6748 		if (cps->cp_stateid.cs_type == NFS4_COPYNOTIFY_STID &&
6749 				state_expired(&lt, cps->cpntf_time))
6750 			_free_cpntf_state_locked(nn, cps);
6751 	}
6752 	spin_unlock(&nn->s2s_cp_lock);
6753 	nfsd4_async_copy_reaper(nn);
6754 	nfs4_get_client_reaplist(nn, &reaplist, &lt);
6755 	nfs4_process_client_reaplist(&reaplist);
6756 
6757 	nfs40_clean_admin_revoked(nn, &lt);
6758 
6759 	spin_lock(&state_lock);
6760 	list_for_each_safe(pos, next, &nn->del_recall_lru) {
6761 		dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
6762 		if (!state_expired(&lt, dp->dl_time))
6763 			break;
6764 		refcount_inc(&dp->dl_stid.sc_count);
6765 		unhash_delegation_locked(dp, SC_STATUS_REVOKED);
6766 		list_add(&dp->dl_recall_lru, &reaplist);
6767 	}
6768 	spin_unlock(&state_lock);
6769 	while (!list_empty(&reaplist)) {
6770 		dp = list_first_entry(&reaplist, struct nfs4_delegation,
6771 					dl_recall_lru);
6772 		list_del_init(&dp->dl_recall_lru);
6773 		revoke_delegation(dp);
6774 	}
6775 
6776 	spin_lock(&nn->client_lock);
6777 	while (!list_empty(&nn->close_lru)) {
6778 		oo = list_first_entry(&nn->close_lru, struct nfs4_openowner,
6779 					oo_close_lru);
6780 		if (!state_expired(&lt, oo->oo_time))
6781 			break;
6782 		list_del_init(&oo->oo_close_lru);
6783 		stp = oo->oo_last_closed_stid;
6784 		oo->oo_last_closed_stid = NULL;
6785 		spin_unlock(&nn->client_lock);
6786 		nfs4_put_stid(&stp->st_stid);
6787 		spin_lock(&nn->client_lock);
6788 	}
6789 	spin_unlock(&nn->client_lock);
6790 
6791 	/*
6792 	 * It's possible for a client to try and acquire an already held lock
6793 	 * that is being held for a long time, and then lose interest in it.
6794 	 * So, we clean out any un-revisited request after a lease period
6795 	 * under the assumption that the client is no longer interested.
6796 	 *
6797 	 * RFC5661, sec. 9.6 states that the client must not rely on getting
6798 	 * notifications and must continue to poll for locks, even when the
6799 	 * server supports them. Thus this shouldn't lead to clients blocking
6800 	 * indefinitely once the lock does become free.
6801 	 */
6802 	BUG_ON(!list_empty(&reaplist));
6803 	spin_lock(&nn->blocked_locks_lock);
6804 	while (!list_empty(&nn->blocked_locks_lru)) {
6805 		nbl = list_first_entry(&nn->blocked_locks_lru,
6806 					struct nfsd4_blocked_lock, nbl_lru);
6807 		if (!state_expired(&lt, nbl->nbl_time))
6808 			break;
6809 		list_move(&nbl->nbl_lru, &reaplist);
6810 		list_del_init(&nbl->nbl_list);
6811 	}
6812 	spin_unlock(&nn->blocked_locks_lock);
6813 
6814 	while (!list_empty(&reaplist)) {
6815 		nbl = list_first_entry(&reaplist,
6816 					struct nfsd4_blocked_lock, nbl_lru);
6817 		list_del_init(&nbl->nbl_lru);
6818 		free_blocked_lock(nbl);
6819 	}
6820 #ifdef CONFIG_NFSD_V4_2_INTER_SSC
6821 	/* service the server-to-server copy delayed unmount list */
6822 	nfsd4_ssc_expire_umount(nn);
6823 #endif
6824 	if (atomic_long_read(&num_delegations) >= max_delegations)
6825 		deleg_reaper(nn);
6826 out:
6827 	return max_t(time64_t, lt.new_timeo, NFSD_LAUNDROMAT_MINTIMEOUT);
6828 }
6829 
6830 static void laundromat_main(struct work_struct *);
6831 
6832 static void
laundromat_main(struct work_struct * laundry)6833 laundromat_main(struct work_struct *laundry)
6834 {
6835 	time64_t t;
6836 	struct delayed_work *dwork = to_delayed_work(laundry);
6837 	struct nfsd_net *nn = container_of(dwork, struct nfsd_net,
6838 					   laundromat_work);
6839 
6840 	t = nfs4_laundromat(nn);
6841 	queue_delayed_work(laundry_wq, &nn->laundromat_work, t*HZ);
6842 }
6843 
6844 static void
courtesy_client_reaper(struct nfsd_net * nn)6845 courtesy_client_reaper(struct nfsd_net *nn)
6846 {
6847 	struct list_head reaplist;
6848 
6849 	nfs4_get_courtesy_client_reaplist(nn, &reaplist);
6850 	nfs4_process_client_reaplist(&reaplist);
6851 }
6852 
6853 static void
deleg_reaper(struct nfsd_net * nn)6854 deleg_reaper(struct nfsd_net *nn)
6855 {
6856 	struct list_head *pos, *next;
6857 	struct nfs4_client *clp;
6858 	LIST_HEAD(cblist);
6859 
6860 	spin_lock(&nn->client_lock);
6861 	list_for_each_safe(pos, next, &nn->client_lru) {
6862 		clp = list_entry(pos, struct nfs4_client, cl_lru);
6863 		if (clp->cl_state != NFSD4_ACTIVE ||
6864 			list_empty(&clp->cl_delegations) ||
6865 			atomic_read(&clp->cl_delegs_in_recall) ||
6866 			test_bit(NFSD4_CLIENT_CB_RECALL_ANY, &clp->cl_flags) ||
6867 			(ktime_get_boottime_seconds() -
6868 				clp->cl_ra_time < 5)) {
6869 			continue;
6870 		}
6871 		list_add(&clp->cl_ra_cblist, &cblist);
6872 
6873 		/* release in nfsd4_cb_recall_any_release */
6874 		kref_get(&clp->cl_nfsdfs.cl_ref);
6875 		set_bit(NFSD4_CLIENT_CB_RECALL_ANY, &clp->cl_flags);
6876 		clp->cl_ra_time = ktime_get_boottime_seconds();
6877 	}
6878 	spin_unlock(&nn->client_lock);
6879 
6880 	while (!list_empty(&cblist)) {
6881 		clp = list_first_entry(&cblist, struct nfs4_client,
6882 					cl_ra_cblist);
6883 		list_del_init(&clp->cl_ra_cblist);
6884 		clp->cl_ra->ra_keep = 0;
6885 		clp->cl_ra->ra_bmval[0] = BIT(RCA4_TYPE_MASK_RDATA_DLG) |
6886 						BIT(RCA4_TYPE_MASK_WDATA_DLG);
6887 		trace_nfsd_cb_recall_any(clp->cl_ra);
6888 		nfsd4_run_cb(&clp->cl_ra->ra_cb);
6889 	}
6890 }
6891 
6892 static void
nfsd4_state_shrinker_worker(struct work_struct * work)6893 nfsd4_state_shrinker_worker(struct work_struct *work)
6894 {
6895 	struct nfsd_net *nn = container_of(work, struct nfsd_net,
6896 				nfsd_shrinker_work);
6897 
6898 	courtesy_client_reaper(nn);
6899 	deleg_reaper(nn);
6900 }
6901 
nfs4_check_fh(struct svc_fh * fhp,struct nfs4_stid * stp)6902 static inline __be32 nfs4_check_fh(struct svc_fh *fhp, struct nfs4_stid *stp)
6903 {
6904 	if (!fh_match(&fhp->fh_handle, &stp->sc_file->fi_fhandle))
6905 		return nfserr_bad_stateid;
6906 	return nfs_ok;
6907 }
6908 
6909 static
nfs4_check_openmode(struct nfs4_ol_stateid * stp,int flags)6910 __be32 nfs4_check_openmode(struct nfs4_ol_stateid *stp, int flags)
6911 {
6912         __be32 status = nfserr_openmode;
6913 
6914 	/* For lock stateid's, we test the parent open, not the lock: */
6915 	if (stp->st_openstp)
6916 		stp = stp->st_openstp;
6917 	if ((flags & WR_STATE) && !access_permit_write(stp))
6918                 goto out;
6919 	if ((flags & RD_STATE) && !access_permit_read(stp))
6920                 goto out;
6921 	status = nfs_ok;
6922 out:
6923 	return status;
6924 }
6925 
6926 static inline __be32
check_special_stateids(struct net * net,svc_fh * current_fh,stateid_t * stateid,int flags)6927 check_special_stateids(struct net *net, svc_fh *current_fh, stateid_t *stateid, int flags)
6928 {
6929 	if (ONE_STATEID(stateid) && (flags & RD_STATE))
6930 		return nfs_ok;
6931 	else if (opens_in_grace(net)) {
6932 		/* Answer in remaining cases depends on existence of
6933 		 * conflicting state; so we must wait out the grace period. */
6934 		return nfserr_grace;
6935 	} else if (flags & WR_STATE)
6936 		return nfs4_share_conflict(current_fh,
6937 				NFS4_SHARE_DENY_WRITE);
6938 	else /* (flags & RD_STATE) && ZERO_STATEID(stateid) */
6939 		return nfs4_share_conflict(current_fh,
6940 				NFS4_SHARE_DENY_READ);
6941 }
6942 
check_stateid_generation(stateid_t * in,stateid_t * ref,bool has_session)6943 static __be32 check_stateid_generation(stateid_t *in, stateid_t *ref, bool has_session)
6944 {
6945 	/*
6946 	 * When sessions are used the stateid generation number is ignored
6947 	 * when it is zero.
6948 	 */
6949 	if (has_session && in->si_generation == 0)
6950 		return nfs_ok;
6951 
6952 	if (in->si_generation == ref->si_generation)
6953 		return nfs_ok;
6954 
6955 	/* If the client sends us a stateid from the future, it's buggy: */
6956 	if (nfsd4_stateid_generation_after(in, ref))
6957 		return nfserr_bad_stateid;
6958 	/*
6959 	 * However, we could see a stateid from the past, even from a
6960 	 * non-buggy client.  For example, if the client sends a lock
6961 	 * while some IO is outstanding, the lock may bump si_generation
6962 	 * while the IO is still in flight.  The client could avoid that
6963 	 * situation by waiting for responses on all the IO requests,
6964 	 * but better performance may result in retrying IO that
6965 	 * receives an old_stateid error if requests are rarely
6966 	 * reordered in flight:
6967 	 */
6968 	return nfserr_old_stateid;
6969 }
6970 
nfsd4_stid_check_stateid_generation(stateid_t * in,struct nfs4_stid * s,bool has_session)6971 static __be32 nfsd4_stid_check_stateid_generation(stateid_t *in, struct nfs4_stid *s, bool has_session)
6972 {
6973 	__be32 ret;
6974 
6975 	spin_lock(&s->sc_lock);
6976 	ret = nfsd4_verify_open_stid(s);
6977 	if (ret == nfs_ok)
6978 		ret = check_stateid_generation(in, &s->sc_stateid, has_session);
6979 	spin_unlock(&s->sc_lock);
6980 	if (ret == nfserr_admin_revoked)
6981 		nfsd40_drop_revoked_stid(s->sc_client,
6982 					&s->sc_stateid);
6983 	return ret;
6984 }
6985 
nfsd4_check_openowner_confirmed(struct nfs4_ol_stateid * ols)6986 static __be32 nfsd4_check_openowner_confirmed(struct nfs4_ol_stateid *ols)
6987 {
6988 	if (ols->st_stateowner->so_is_open_owner &&
6989 	    !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
6990 		return nfserr_bad_stateid;
6991 	return nfs_ok;
6992 }
6993 
nfsd4_validate_stateid(struct nfs4_client * cl,stateid_t * stateid)6994 static __be32 nfsd4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
6995 {
6996 	struct nfs4_stid *s;
6997 	__be32 status = nfserr_bad_stateid;
6998 
6999 	if (ZERO_STATEID(stateid) || ONE_STATEID(stateid) ||
7000 		CLOSE_STATEID(stateid))
7001 		return status;
7002 	spin_lock(&cl->cl_lock);
7003 	s = find_stateid_locked(cl, stateid);
7004 	if (!s)
7005 		goto out_unlock;
7006 	status = nfsd4_stid_check_stateid_generation(stateid, s, 1);
7007 	if (status)
7008 		goto out_unlock;
7009 	status = nfsd4_verify_open_stid(s);
7010 	if (status)
7011 		goto out_unlock;
7012 
7013 	switch (s->sc_type) {
7014 	case SC_TYPE_DELEG:
7015 		status = nfs_ok;
7016 		break;
7017 	case SC_TYPE_OPEN:
7018 	case SC_TYPE_LOCK:
7019 		status = nfsd4_check_openowner_confirmed(openlockstateid(s));
7020 		break;
7021 	default:
7022 		printk("unknown stateid type %x\n", s->sc_type);
7023 		status = nfserr_bad_stateid;
7024 	}
7025 out_unlock:
7026 	spin_unlock(&cl->cl_lock);
7027 	if (status == nfserr_admin_revoked)
7028 		nfsd40_drop_revoked_stid(cl, stateid);
7029 	return status;
7030 }
7031 
7032 __be32
nfsd4_lookup_stateid(struct nfsd4_compound_state * cstate,stateid_t * stateid,unsigned short typemask,unsigned short statusmask,struct nfs4_stid ** s,struct nfsd_net * nn)7033 nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate,
7034 		     stateid_t *stateid,
7035 		     unsigned short typemask, unsigned short statusmask,
7036 		     struct nfs4_stid **s, struct nfsd_net *nn)
7037 {
7038 	__be32 status;
7039 	struct nfs4_stid *stid;
7040 	bool return_revoked = false;
7041 
7042 	/*
7043 	 *  only return revoked delegations if explicitly asked.
7044 	 *  otherwise we report revoked or bad_stateid status.
7045 	 */
7046 	if (statusmask & SC_STATUS_REVOKED)
7047 		return_revoked = true;
7048 	if (typemask & SC_TYPE_DELEG)
7049 		/* Always allow REVOKED for DELEG so we can
7050 		 * retturn the appropriate error.
7051 		 */
7052 		statusmask |= SC_STATUS_REVOKED;
7053 
7054 	statusmask |= SC_STATUS_ADMIN_REVOKED;
7055 
7056 	if (ZERO_STATEID(stateid) || ONE_STATEID(stateid) ||
7057 		CLOSE_STATEID(stateid))
7058 		return nfserr_bad_stateid;
7059 	status = set_client(&stateid->si_opaque.so_clid, cstate, nn);
7060 	if (status == nfserr_stale_clientid) {
7061 		if (cstate->session)
7062 			return nfserr_bad_stateid;
7063 		return nfserr_stale_stateid;
7064 	}
7065 	if (status)
7066 		return status;
7067 	stid = find_stateid_by_type(cstate->clp, stateid, typemask, statusmask);
7068 	if (!stid)
7069 		return nfserr_bad_stateid;
7070 	if ((stid->sc_status & SC_STATUS_REVOKED) && !return_revoked) {
7071 		nfs4_put_stid(stid);
7072 		return nfserr_deleg_revoked;
7073 	}
7074 	if (stid->sc_status & SC_STATUS_ADMIN_REVOKED) {
7075 		nfsd40_drop_revoked_stid(cstate->clp, stateid);
7076 		nfs4_put_stid(stid);
7077 		return nfserr_admin_revoked;
7078 	}
7079 	*s = stid;
7080 	return nfs_ok;
7081 }
7082 
7083 static struct nfsd_file *
nfs4_find_file(struct nfs4_stid * s,int flags)7084 nfs4_find_file(struct nfs4_stid *s, int flags)
7085 {
7086 	struct nfsd_file *ret = NULL;
7087 
7088 	if (!s || s->sc_status)
7089 		return NULL;
7090 
7091 	switch (s->sc_type) {
7092 	case SC_TYPE_DELEG:
7093 		spin_lock(&s->sc_file->fi_lock);
7094 		ret = nfsd_file_get(s->sc_file->fi_deleg_file);
7095 		spin_unlock(&s->sc_file->fi_lock);
7096 		break;
7097 	case SC_TYPE_OPEN:
7098 	case SC_TYPE_LOCK:
7099 		if (flags & RD_STATE)
7100 			ret = find_readable_file(s->sc_file);
7101 		else
7102 			ret = find_writeable_file(s->sc_file);
7103 	}
7104 
7105 	return ret;
7106 }
7107 
7108 static __be32
nfs4_check_olstateid(struct nfs4_ol_stateid * ols,int flags)7109 nfs4_check_olstateid(struct nfs4_ol_stateid *ols, int flags)
7110 {
7111 	__be32 status;
7112 
7113 	status = nfsd4_check_openowner_confirmed(ols);
7114 	if (status)
7115 		return status;
7116 	return nfs4_check_openmode(ols, flags);
7117 }
7118 
7119 static __be32
nfs4_check_file(struct svc_rqst * rqstp,struct svc_fh * fhp,struct nfs4_stid * s,struct nfsd_file ** nfp,int flags)7120 nfs4_check_file(struct svc_rqst *rqstp, struct svc_fh *fhp, struct nfs4_stid *s,
7121 		struct nfsd_file **nfp, int flags)
7122 {
7123 	int acc = (flags & RD_STATE) ? NFSD_MAY_READ : NFSD_MAY_WRITE;
7124 	struct nfsd_file *nf;
7125 	__be32 status;
7126 
7127 	nf = nfs4_find_file(s, flags);
7128 	if (nf) {
7129 		status = nfsd_permission(&rqstp->rq_cred,
7130 					 fhp->fh_export, fhp->fh_dentry,
7131 				acc | NFSD_MAY_OWNER_OVERRIDE);
7132 		if (status) {
7133 			nfsd_file_put(nf);
7134 			goto out;
7135 		}
7136 	} else {
7137 		status = nfsd_file_acquire(rqstp, fhp, acc, &nf);
7138 		if (status)
7139 			return status;
7140 	}
7141 	*nfp = nf;
7142 out:
7143 	return status;
7144 }
7145 static void
_free_cpntf_state_locked(struct nfsd_net * nn,struct nfs4_cpntf_state * cps)7146 _free_cpntf_state_locked(struct nfsd_net *nn, struct nfs4_cpntf_state *cps)
7147 {
7148 	WARN_ON_ONCE(cps->cp_stateid.cs_type != NFS4_COPYNOTIFY_STID);
7149 	if (!refcount_dec_and_test(&cps->cp_stateid.cs_count))
7150 		return;
7151 	list_del(&cps->cp_list);
7152 	idr_remove(&nn->s2s_cp_stateids,
7153 		   cps->cp_stateid.cs_stid.si_opaque.so_id);
7154 	kfree(cps);
7155 }
7156 /*
7157  * A READ from an inter server to server COPY will have a
7158  * copy stateid. Look up the copy notify stateid from the
7159  * idr structure and take a reference on it.
7160  */
manage_cpntf_state(struct nfsd_net * nn,stateid_t * st,struct nfs4_client * clp,struct nfs4_cpntf_state ** cps)7161 __be32 manage_cpntf_state(struct nfsd_net *nn, stateid_t *st,
7162 			  struct nfs4_client *clp,
7163 			  struct nfs4_cpntf_state **cps)
7164 {
7165 	copy_stateid_t *cps_t;
7166 	struct nfs4_cpntf_state *state = NULL;
7167 
7168 	if (st->si_opaque.so_clid.cl_id != nn->s2s_cp_cl_id)
7169 		return nfserr_bad_stateid;
7170 	spin_lock(&nn->s2s_cp_lock);
7171 	cps_t = idr_find(&nn->s2s_cp_stateids, st->si_opaque.so_id);
7172 	if (cps_t) {
7173 		state = container_of(cps_t, struct nfs4_cpntf_state,
7174 				     cp_stateid);
7175 		if (state->cp_stateid.cs_type != NFS4_COPYNOTIFY_STID) {
7176 			state = NULL;
7177 			goto unlock;
7178 		}
7179 		if (!clp)
7180 			refcount_inc(&state->cp_stateid.cs_count);
7181 		else
7182 			_free_cpntf_state_locked(nn, state);
7183 	}
7184 unlock:
7185 	spin_unlock(&nn->s2s_cp_lock);
7186 	if (!state)
7187 		return nfserr_bad_stateid;
7188 	if (!clp)
7189 		*cps = state;
7190 	return 0;
7191 }
7192 
find_cpntf_state(struct nfsd_net * nn,stateid_t * st,struct nfs4_stid ** stid)7193 static __be32 find_cpntf_state(struct nfsd_net *nn, stateid_t *st,
7194 			       struct nfs4_stid **stid)
7195 {
7196 	__be32 status;
7197 	struct nfs4_cpntf_state *cps = NULL;
7198 	struct nfs4_client *found;
7199 
7200 	status = manage_cpntf_state(nn, st, NULL, &cps);
7201 	if (status)
7202 		return status;
7203 
7204 	cps->cpntf_time = ktime_get_boottime_seconds();
7205 
7206 	status = nfserr_expired;
7207 	found = lookup_clientid(&cps->cp_p_clid, true, nn);
7208 	if (!found)
7209 		goto out;
7210 
7211 	*stid = find_stateid_by_type(found, &cps->cp_p_stateid,
7212 				     SC_TYPE_DELEG|SC_TYPE_OPEN|SC_TYPE_LOCK,
7213 				     0);
7214 	if (*stid)
7215 		status = nfs_ok;
7216 	else
7217 		status = nfserr_bad_stateid;
7218 
7219 	put_client_renew(found);
7220 out:
7221 	nfs4_put_cpntf_state(nn, cps);
7222 	return status;
7223 }
7224 
nfs4_put_cpntf_state(struct nfsd_net * nn,struct nfs4_cpntf_state * cps)7225 void nfs4_put_cpntf_state(struct nfsd_net *nn, struct nfs4_cpntf_state *cps)
7226 {
7227 	spin_lock(&nn->s2s_cp_lock);
7228 	_free_cpntf_state_locked(nn, cps);
7229 	spin_unlock(&nn->s2s_cp_lock);
7230 }
7231 
7232 /**
7233  * nfs4_preprocess_stateid_op - find and prep stateid for an operation
7234  * @rqstp: incoming request from client
7235  * @cstate: current compound state
7236  * @fhp: filehandle associated with requested stateid
7237  * @stateid: stateid (provided by client)
7238  * @flags: flags describing type of operation to be done
7239  * @nfp: optional nfsd_file return pointer (may be NULL)
7240  * @cstid: optional returned nfs4_stid pointer (may be NULL)
7241  *
7242  * Given info from the client, look up a nfs4_stid for the operation. On
7243  * success, it returns a reference to the nfs4_stid and/or the nfsd_file
7244  * associated with it.
7245  */
7246 __be32
nfs4_preprocess_stateid_op(struct svc_rqst * rqstp,struct nfsd4_compound_state * cstate,struct svc_fh * fhp,stateid_t * stateid,int flags,struct nfsd_file ** nfp,struct nfs4_stid ** cstid)7247 nfs4_preprocess_stateid_op(struct svc_rqst *rqstp,
7248 		struct nfsd4_compound_state *cstate, struct svc_fh *fhp,
7249 		stateid_t *stateid, int flags, struct nfsd_file **nfp,
7250 		struct nfs4_stid **cstid)
7251 {
7252 	struct net *net = SVC_NET(rqstp);
7253 	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
7254 	struct nfs4_stid *s = NULL;
7255 	__be32 status;
7256 
7257 	if (nfp)
7258 		*nfp = NULL;
7259 
7260 	if (ZERO_STATEID(stateid) || ONE_STATEID(stateid)) {
7261 		status = check_special_stateids(net, fhp, stateid, flags);
7262 		goto done;
7263 	}
7264 
7265 	status = nfsd4_lookup_stateid(cstate, stateid,
7266 				SC_TYPE_DELEG|SC_TYPE_OPEN|SC_TYPE_LOCK,
7267 				0, &s, nn);
7268 	if (status == nfserr_bad_stateid)
7269 		status = find_cpntf_state(nn, stateid, &s);
7270 	if (status)
7271 		return status;
7272 	status = nfsd4_stid_check_stateid_generation(stateid, s,
7273 			nfsd4_has_session(cstate));
7274 	if (status)
7275 		goto out;
7276 
7277 	switch (s->sc_type) {
7278 	case SC_TYPE_DELEG:
7279 		status = nfs4_check_delegmode(delegstateid(s), flags);
7280 		break;
7281 	case SC_TYPE_OPEN:
7282 	case SC_TYPE_LOCK:
7283 		status = nfs4_check_olstateid(openlockstateid(s), flags);
7284 		break;
7285 	}
7286 	if (status)
7287 		goto out;
7288 	status = nfs4_check_fh(fhp, s);
7289 
7290 done:
7291 	if (status == nfs_ok && nfp)
7292 		status = nfs4_check_file(rqstp, fhp, s, nfp, flags);
7293 out:
7294 	if (s) {
7295 		if (!status && cstid)
7296 			*cstid = s;
7297 		else
7298 			nfs4_put_stid(s);
7299 	}
7300 	return status;
7301 }
7302 
7303 /*
7304  * Test if the stateid is valid
7305  */
7306 __be32
nfsd4_test_stateid(struct svc_rqst * rqstp,struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)7307 nfsd4_test_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
7308 		   union nfsd4_op_u *u)
7309 {
7310 	struct nfsd4_test_stateid *test_stateid = &u->test_stateid;
7311 	struct nfsd4_test_stateid_id *stateid;
7312 	struct nfs4_client *cl = cstate->clp;
7313 
7314 	list_for_each_entry(stateid, &test_stateid->ts_stateid_list, ts_id_list)
7315 		stateid->ts_id_status =
7316 			nfsd4_validate_stateid(cl, &stateid->ts_id_stateid);
7317 
7318 	return nfs_ok;
7319 }
7320 
7321 static __be32
nfsd4_free_lock_stateid(stateid_t * stateid,struct nfs4_stid * s)7322 nfsd4_free_lock_stateid(stateid_t *stateid, struct nfs4_stid *s)
7323 {
7324 	struct nfs4_ol_stateid *stp = openlockstateid(s);
7325 	__be32 ret;
7326 
7327 	ret = nfsd4_lock_ol_stateid(stp);
7328 	if (ret)
7329 		goto out_put_stid;
7330 
7331 	ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
7332 	if (ret)
7333 		goto out;
7334 
7335 	ret = nfserr_locks_held;
7336 	if (check_for_locks(stp->st_stid.sc_file,
7337 			    lockowner(stp->st_stateowner)))
7338 		goto out;
7339 
7340 	release_lock_stateid(stp);
7341 	ret = nfs_ok;
7342 
7343 out:
7344 	mutex_unlock(&stp->st_mutex);
7345 out_put_stid:
7346 	nfs4_put_stid(s);
7347 	return ret;
7348 }
7349 
7350 __be32
nfsd4_free_stateid(struct svc_rqst * rqstp,struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)7351 nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
7352 		   union nfsd4_op_u *u)
7353 {
7354 	struct nfsd4_free_stateid *free_stateid = &u->free_stateid;
7355 	stateid_t *stateid = &free_stateid->fr_stateid;
7356 	struct nfs4_stid *s;
7357 	struct nfs4_delegation *dp;
7358 	struct nfs4_client *cl = cstate->clp;
7359 	__be32 ret = nfserr_bad_stateid;
7360 
7361 	spin_lock(&cl->cl_lock);
7362 	s = find_stateid_locked(cl, stateid);
7363 	if (!s || s->sc_status & SC_STATUS_CLOSED)
7364 		goto out_unlock;
7365 	if (s->sc_status & SC_STATUS_ADMIN_REVOKED) {
7366 		nfsd4_drop_revoked_stid(s);
7367 		ret = nfs_ok;
7368 		goto out;
7369 	}
7370 	spin_lock(&s->sc_lock);
7371 	switch (s->sc_type) {
7372 	case SC_TYPE_DELEG:
7373 		if (s->sc_status & SC_STATUS_REVOKED) {
7374 			s->sc_status |= SC_STATUS_CLOSED;
7375 			spin_unlock(&s->sc_lock);
7376 			dp = delegstateid(s);
7377 			if (s->sc_status & SC_STATUS_FREEABLE)
7378 				list_del_init(&dp->dl_recall_lru);
7379 			s->sc_status |= SC_STATUS_FREED;
7380 			spin_unlock(&cl->cl_lock);
7381 			nfs4_put_stid(s);
7382 			ret = nfs_ok;
7383 			goto out;
7384 		}
7385 		ret = nfserr_locks_held;
7386 		break;
7387 	case SC_TYPE_OPEN:
7388 		ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
7389 		if (ret)
7390 			break;
7391 		ret = nfserr_locks_held;
7392 		break;
7393 	case SC_TYPE_LOCK:
7394 		spin_unlock(&s->sc_lock);
7395 		refcount_inc(&s->sc_count);
7396 		spin_unlock(&cl->cl_lock);
7397 		ret = nfsd4_free_lock_stateid(stateid, s);
7398 		goto out;
7399 	}
7400 	spin_unlock(&s->sc_lock);
7401 out_unlock:
7402 	spin_unlock(&cl->cl_lock);
7403 out:
7404 	return ret;
7405 }
7406 
7407 static inline int
setlkflg(int type)7408 setlkflg (int type)
7409 {
7410 	return (type == NFS4_READW_LT || type == NFS4_READ_LT) ?
7411 		RD_STATE : WR_STATE;
7412 }
7413 
nfs4_seqid_op_checks(struct nfsd4_compound_state * cstate,stateid_t * stateid,u32 seqid,struct nfs4_ol_stateid * stp)7414 static __be32 nfs4_seqid_op_checks(struct nfsd4_compound_state *cstate, stateid_t *stateid, u32 seqid, struct nfs4_ol_stateid *stp)
7415 {
7416 	struct svc_fh *current_fh = &cstate->current_fh;
7417 	struct nfs4_stateowner *sop = stp->st_stateowner;
7418 	__be32 status;
7419 
7420 	status = nfsd4_check_seqid(cstate, sop, seqid);
7421 	if (status)
7422 		return status;
7423 	status = nfsd4_lock_ol_stateid(stp);
7424 	if (status != nfs_ok)
7425 		return status;
7426 	status = check_stateid_generation(stateid, &stp->st_stid.sc_stateid, nfsd4_has_session(cstate));
7427 	if (status == nfs_ok)
7428 		status = nfs4_check_fh(current_fh, &stp->st_stid);
7429 	if (status != nfs_ok)
7430 		mutex_unlock(&stp->st_mutex);
7431 	return status;
7432 }
7433 
7434 /**
7435  * nfs4_preprocess_seqid_op - find and prep an ol_stateid for a seqid-morphing op
7436  * @cstate: compund state
7437  * @seqid: seqid (provided by client)
7438  * @stateid: stateid (provided by client)
7439  * @typemask: mask of allowable types for this operation
7440  * @statusmask: mask of allowed states: 0 or STID_CLOSED
7441  * @stpp: return pointer for the stateid found
7442  * @nn: net namespace for request
7443  *
7444  * Given a stateid+seqid from a client, look up an nfs4_ol_stateid and
7445  * return it in @stpp. On a nfs_ok return, the returned stateid will
7446  * have its st_mutex locked.
7447  */
7448 static __be32
nfs4_preprocess_seqid_op(struct nfsd4_compound_state * cstate,u32 seqid,stateid_t * stateid,unsigned short typemask,unsigned short statusmask,struct nfs4_ol_stateid ** stpp,struct nfsd_net * nn)7449 nfs4_preprocess_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
7450 			 stateid_t *stateid,
7451 			 unsigned short typemask, unsigned short statusmask,
7452 			 struct nfs4_ol_stateid **stpp,
7453 			 struct nfsd_net *nn)
7454 {
7455 	__be32 status;
7456 	struct nfs4_stid *s;
7457 	struct nfs4_ol_stateid *stp = NULL;
7458 
7459 	trace_nfsd_preprocess(seqid, stateid);
7460 
7461 	*stpp = NULL;
7462 retry:
7463 	status = nfsd4_lookup_stateid(cstate, stateid,
7464 				      typemask, statusmask, &s, nn);
7465 	if (status)
7466 		return status;
7467 	stp = openlockstateid(s);
7468 	if (nfsd4_cstate_assign_replay(cstate, stp->st_stateowner) == -EAGAIN) {
7469 		nfs4_put_stateowner(stp->st_stateowner);
7470 		goto retry;
7471 	}
7472 
7473 	status = nfs4_seqid_op_checks(cstate, stateid, seqid, stp);
7474 	if (!status)
7475 		*stpp = stp;
7476 	else
7477 		nfs4_put_stid(&stp->st_stid);
7478 	return status;
7479 }
7480 
nfs4_preprocess_confirmed_seqid_op(struct nfsd4_compound_state * cstate,u32 seqid,stateid_t * stateid,struct nfs4_ol_stateid ** stpp,struct nfsd_net * nn)7481 static __be32 nfs4_preprocess_confirmed_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
7482 						 stateid_t *stateid, struct nfs4_ol_stateid **stpp, struct nfsd_net *nn)
7483 {
7484 	__be32 status;
7485 	struct nfs4_openowner *oo;
7486 	struct nfs4_ol_stateid *stp;
7487 
7488 	status = nfs4_preprocess_seqid_op(cstate, seqid, stateid,
7489 					  SC_TYPE_OPEN, 0, &stp, nn);
7490 	if (status)
7491 		return status;
7492 	oo = openowner(stp->st_stateowner);
7493 	if (!(oo->oo_flags & NFS4_OO_CONFIRMED)) {
7494 		mutex_unlock(&stp->st_mutex);
7495 		nfs4_put_stid(&stp->st_stid);
7496 		return nfserr_bad_stateid;
7497 	}
7498 	*stpp = stp;
7499 	return nfs_ok;
7500 }
7501 
7502 __be32
nfsd4_open_confirm(struct svc_rqst * rqstp,struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)7503 nfsd4_open_confirm(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
7504 		   union nfsd4_op_u *u)
7505 {
7506 	struct nfsd4_open_confirm *oc = &u->open_confirm;
7507 	__be32 status;
7508 	struct nfs4_openowner *oo;
7509 	struct nfs4_ol_stateid *stp;
7510 	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
7511 
7512 	dprintk("NFSD: nfsd4_open_confirm on file %pd\n",
7513 			cstate->current_fh.fh_dentry);
7514 
7515 	status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0);
7516 	if (status)
7517 		return status;
7518 
7519 	status = nfs4_preprocess_seqid_op(cstate,
7520 					  oc->oc_seqid, &oc->oc_req_stateid,
7521 					  SC_TYPE_OPEN, 0, &stp, nn);
7522 	if (status)
7523 		goto out;
7524 	oo = openowner(stp->st_stateowner);
7525 	status = nfserr_bad_stateid;
7526 	if (oo->oo_flags & NFS4_OO_CONFIRMED) {
7527 		mutex_unlock(&stp->st_mutex);
7528 		goto put_stateid;
7529 	}
7530 	oo->oo_flags |= NFS4_OO_CONFIRMED;
7531 	nfs4_inc_and_copy_stateid(&oc->oc_resp_stateid, &stp->st_stid);
7532 	mutex_unlock(&stp->st_mutex);
7533 	trace_nfsd_open_confirm(oc->oc_seqid, &stp->st_stid.sc_stateid);
7534 	nfsd4_client_record_create(oo->oo_owner.so_client);
7535 	status = nfs_ok;
7536 put_stateid:
7537 	nfs4_put_stid(&stp->st_stid);
7538 out:
7539 	nfsd4_bump_seqid(cstate, status);
7540 	return status;
7541 }
7542 
nfs4_stateid_downgrade_bit(struct nfs4_ol_stateid * stp,u32 access)7543 static inline void nfs4_stateid_downgrade_bit(struct nfs4_ol_stateid *stp, u32 access)
7544 {
7545 	if (!test_access(access, stp))
7546 		return;
7547 	nfs4_file_put_access(stp->st_stid.sc_file, access);
7548 	clear_access(access, stp);
7549 }
7550 
nfs4_stateid_downgrade(struct nfs4_ol_stateid * stp,u32 to_access)7551 static inline void nfs4_stateid_downgrade(struct nfs4_ol_stateid *stp, u32 to_access)
7552 {
7553 	switch (to_access) {
7554 	case NFS4_SHARE_ACCESS_READ:
7555 		nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_WRITE);
7556 		nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_BOTH);
7557 		break;
7558 	case NFS4_SHARE_ACCESS_WRITE:
7559 		nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_READ);
7560 		nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_BOTH);
7561 		break;
7562 	case NFS4_SHARE_ACCESS_BOTH:
7563 		break;
7564 	default:
7565 		WARN_ON_ONCE(1);
7566 	}
7567 }
7568 
7569 __be32
nfsd4_open_downgrade(struct svc_rqst * rqstp,struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)7570 nfsd4_open_downgrade(struct svc_rqst *rqstp,
7571 		     struct nfsd4_compound_state *cstate, union nfsd4_op_u *u)
7572 {
7573 	struct nfsd4_open_downgrade *od = &u->open_downgrade;
7574 	__be32 status;
7575 	struct nfs4_ol_stateid *stp;
7576 	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
7577 
7578 	dprintk("NFSD: nfsd4_open_downgrade on file %pd\n",
7579 			cstate->current_fh.fh_dentry);
7580 
7581 	/* We don't yet support WANT bits: */
7582 	if (od->od_deleg_want)
7583 		dprintk("NFSD: %s: od_deleg_want=0x%x ignored\n", __func__,
7584 			od->od_deleg_want);
7585 
7586 	status = nfs4_preprocess_confirmed_seqid_op(cstate, od->od_seqid,
7587 					&od->od_stateid, &stp, nn);
7588 	if (status)
7589 		goto out;
7590 	status = nfserr_inval;
7591 	if (!test_access(od->od_share_access, stp)) {
7592 		dprintk("NFSD: access not a subset of current bitmap: 0x%hhx, input access=%08x\n",
7593 			stp->st_access_bmap, od->od_share_access);
7594 		goto put_stateid;
7595 	}
7596 	if (!test_deny(od->od_share_deny, stp)) {
7597 		dprintk("NFSD: deny not a subset of current bitmap: 0x%hhx, input deny=%08x\n",
7598 			stp->st_deny_bmap, od->od_share_deny);
7599 		goto put_stateid;
7600 	}
7601 	nfs4_stateid_downgrade(stp, od->od_share_access);
7602 	reset_union_bmap_deny(od->od_share_deny, stp);
7603 	nfs4_inc_and_copy_stateid(&od->od_stateid, &stp->st_stid);
7604 	status = nfs_ok;
7605 put_stateid:
7606 	mutex_unlock(&stp->st_mutex);
7607 	nfs4_put_stid(&stp->st_stid);
7608 out:
7609 	nfsd4_bump_seqid(cstate, status);
7610 	return status;
7611 }
7612 
nfsd4_close_open_stateid(struct nfs4_ol_stateid * s)7613 static bool nfsd4_close_open_stateid(struct nfs4_ol_stateid *s)
7614 {
7615 	struct nfs4_client *clp = s->st_stid.sc_client;
7616 	bool unhashed;
7617 	LIST_HEAD(reaplist);
7618 	struct nfs4_ol_stateid *stp;
7619 
7620 	spin_lock(&clp->cl_lock);
7621 	unhashed = unhash_open_stateid(s, &reaplist);
7622 
7623 	if (clp->cl_minorversion) {
7624 		if (unhashed)
7625 			put_ol_stateid_locked(s, &reaplist);
7626 		spin_unlock(&clp->cl_lock);
7627 		list_for_each_entry(stp, &reaplist, st_locks)
7628 			nfs4_free_cpntf_statelist(clp->net, &stp->st_stid);
7629 		free_ol_stateid_reaplist(&reaplist);
7630 		return false;
7631 	} else {
7632 		spin_unlock(&clp->cl_lock);
7633 		free_ol_stateid_reaplist(&reaplist);
7634 		return unhashed;
7635 	}
7636 }
7637 
7638 /*
7639  * nfs4_unlock_state() called after encode
7640  */
7641 __be32
nfsd4_close(struct svc_rqst * rqstp,struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)7642 nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
7643 		union nfsd4_op_u *u)
7644 {
7645 	struct nfsd4_close *close = &u->close;
7646 	__be32 status;
7647 	struct nfs4_ol_stateid *stp;
7648 	struct net *net = SVC_NET(rqstp);
7649 	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
7650 	bool need_move_to_close_list;
7651 
7652 	dprintk("NFSD: nfsd4_close on file %pd\n",
7653 			cstate->current_fh.fh_dentry);
7654 
7655 	status = nfs4_preprocess_seqid_op(cstate, close->cl_seqid,
7656 					  &close->cl_stateid,
7657 					  SC_TYPE_OPEN, SC_STATUS_CLOSED,
7658 					  &stp, nn);
7659 	nfsd4_bump_seqid(cstate, status);
7660 	if (status)
7661 		goto out;
7662 
7663 	spin_lock(&stp->st_stid.sc_client->cl_lock);
7664 	stp->st_stid.sc_status |= SC_STATUS_CLOSED;
7665 	spin_unlock(&stp->st_stid.sc_client->cl_lock);
7666 
7667 	/*
7668 	 * Technically we don't _really_ have to increment or copy it, since
7669 	 * it should just be gone after this operation and we clobber the
7670 	 * copied value below, but we continue to do so here just to ensure
7671 	 * that racing ops see that there was a state change.
7672 	 */
7673 	nfs4_inc_and_copy_stateid(&close->cl_stateid, &stp->st_stid);
7674 
7675 	need_move_to_close_list = nfsd4_close_open_stateid(stp);
7676 	mutex_unlock(&stp->st_mutex);
7677 	if (need_move_to_close_list)
7678 		move_to_close_lru(stp, net);
7679 
7680 	/* v4.1+ suggests that we send a special stateid in here, since the
7681 	 * clients should just ignore this anyway. Since this is not useful
7682 	 * for v4.0 clients either, we set it to the special close_stateid
7683 	 * universally.
7684 	 *
7685 	 * See RFC5661 section 18.2.4, and RFC7530 section 16.2.5
7686 	 */
7687 	memcpy(&close->cl_stateid, &close_stateid, sizeof(close->cl_stateid));
7688 
7689 	/* put reference from nfs4_preprocess_seqid_op */
7690 	nfs4_put_stid(&stp->st_stid);
7691 out:
7692 	return status;
7693 }
7694 
7695 __be32
nfsd4_delegreturn(struct svc_rqst * rqstp,struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)7696 nfsd4_delegreturn(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
7697 		  union nfsd4_op_u *u)
7698 {
7699 	struct nfsd4_delegreturn *dr = &u->delegreturn;
7700 	struct nfs4_delegation *dp;
7701 	stateid_t *stateid = &dr->dr_stateid;
7702 	struct nfs4_stid *s;
7703 	__be32 status;
7704 	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
7705 
7706 	if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
7707 		return status;
7708 
7709 	status = nfsd4_lookup_stateid(cstate, stateid, SC_TYPE_DELEG,
7710 				      SC_STATUS_REVOKED | SC_STATUS_FREEABLE,
7711 				      &s, nn);
7712 	if (status)
7713 		goto out;
7714 	dp = delegstateid(s);
7715 	status = nfsd4_stid_check_stateid_generation(stateid, &dp->dl_stid, nfsd4_has_session(cstate));
7716 	if (status)
7717 		goto put_stateid;
7718 
7719 	trace_nfsd_deleg_return(stateid);
7720 	destroy_delegation(dp);
7721 	smp_mb__after_atomic();
7722 	wake_up_var(d_inode(cstate->current_fh.fh_dentry));
7723 put_stateid:
7724 	nfs4_put_stid(&dp->dl_stid);
7725 out:
7726 	return status;
7727 }
7728 
7729 /* last octet in a range */
7730 static inline u64
last_byte_offset(u64 start,u64 len)7731 last_byte_offset(u64 start, u64 len)
7732 {
7733 	u64 end;
7734 
7735 	WARN_ON_ONCE(!len);
7736 	end = start + len;
7737 	return end > start ? end - 1: NFS4_MAX_UINT64;
7738 }
7739 
7740 /*
7741  * TODO: Linux file offsets are _signed_ 64-bit quantities, which means that
7742  * we can't properly handle lock requests that go beyond the (2^63 - 1)-th
7743  * byte, because of sign extension problems.  Since NFSv4 calls for 64-bit
7744  * locking, this prevents us from being completely protocol-compliant.  The
7745  * real solution to this problem is to start using unsigned file offsets in
7746  * the VFS, but this is a very deep change!
7747  */
7748 static inline void
nfs4_transform_lock_offset(struct file_lock * lock)7749 nfs4_transform_lock_offset(struct file_lock *lock)
7750 {
7751 	if (lock->fl_start < 0)
7752 		lock->fl_start = OFFSET_MAX;
7753 	if (lock->fl_end < 0)
7754 		lock->fl_end = OFFSET_MAX;
7755 }
7756 
7757 static fl_owner_t
nfsd4_lm_get_owner(fl_owner_t owner)7758 nfsd4_lm_get_owner(fl_owner_t owner)
7759 {
7760 	struct nfs4_lockowner *lo = (struct nfs4_lockowner *)owner;
7761 
7762 	nfs4_get_stateowner(&lo->lo_owner);
7763 	return owner;
7764 }
7765 
7766 static void
nfsd4_lm_put_owner(fl_owner_t owner)7767 nfsd4_lm_put_owner(fl_owner_t owner)
7768 {
7769 	struct nfs4_lockowner *lo = (struct nfs4_lockowner *)owner;
7770 
7771 	if (lo)
7772 		nfs4_put_stateowner(&lo->lo_owner);
7773 }
7774 
7775 /* return pointer to struct nfs4_client if client is expirable */
7776 static bool
nfsd4_lm_lock_expirable(struct file_lock * cfl)7777 nfsd4_lm_lock_expirable(struct file_lock *cfl)
7778 {
7779 	struct nfs4_lockowner *lo = (struct nfs4_lockowner *) cfl->c.flc_owner;
7780 	struct nfs4_client *clp = lo->lo_owner.so_client;
7781 	struct nfsd_net *nn;
7782 
7783 	if (try_to_expire_client(clp)) {
7784 		nn = net_generic(clp->net, nfsd_net_id);
7785 		mod_delayed_work(laundry_wq, &nn->laundromat_work, 0);
7786 		return true;
7787 	}
7788 	return false;
7789 }
7790 
7791 /* schedule laundromat to run immediately and wait for it to complete */
7792 static void
nfsd4_lm_expire_lock(void)7793 nfsd4_lm_expire_lock(void)
7794 {
7795 	flush_workqueue(laundry_wq);
7796 }
7797 
7798 static void
nfsd4_lm_notify(struct file_lock * fl)7799 nfsd4_lm_notify(struct file_lock *fl)
7800 {
7801 	struct nfs4_lockowner		*lo = (struct nfs4_lockowner *) fl->c.flc_owner;
7802 	struct net			*net = lo->lo_owner.so_client->net;
7803 	struct nfsd_net			*nn = net_generic(net, nfsd_net_id);
7804 	struct nfsd4_blocked_lock	*nbl = container_of(fl,
7805 						struct nfsd4_blocked_lock, nbl_lock);
7806 	bool queue = false;
7807 
7808 	/* An empty list means that something else is going to be using it */
7809 	spin_lock(&nn->blocked_locks_lock);
7810 	if (!list_empty(&nbl->nbl_list)) {
7811 		list_del_init(&nbl->nbl_list);
7812 		list_del_init(&nbl->nbl_lru);
7813 		queue = true;
7814 	}
7815 	spin_unlock(&nn->blocked_locks_lock);
7816 
7817 	if (queue) {
7818 		trace_nfsd_cb_notify_lock(lo, nbl);
7819 		nfsd4_run_cb(&nbl->nbl_cb);
7820 	}
7821 }
7822 
7823 static const struct lock_manager_operations nfsd_posix_mng_ops  = {
7824 	.lm_mod_owner = THIS_MODULE,
7825 	.lm_notify = nfsd4_lm_notify,
7826 	.lm_get_owner = nfsd4_lm_get_owner,
7827 	.lm_put_owner = nfsd4_lm_put_owner,
7828 	.lm_lock_expirable = nfsd4_lm_lock_expirable,
7829 	.lm_expire_lock = nfsd4_lm_expire_lock,
7830 };
7831 
7832 static inline void
nfs4_set_lock_denied(struct file_lock * fl,struct nfsd4_lock_denied * deny)7833 nfs4_set_lock_denied(struct file_lock *fl, struct nfsd4_lock_denied *deny)
7834 {
7835 	struct nfs4_lockowner *lo;
7836 
7837 	if (fl->fl_lmops == &nfsd_posix_mng_ops) {
7838 		lo = (struct nfs4_lockowner *) fl->c.flc_owner;
7839 		xdr_netobj_dup(&deny->ld_owner, &lo->lo_owner.so_owner,
7840 						GFP_KERNEL);
7841 		if (!deny->ld_owner.data)
7842 			/* We just don't care that much */
7843 			goto nevermind;
7844 		deny->ld_clientid = lo->lo_owner.so_client->cl_clientid;
7845 	} else {
7846 nevermind:
7847 		deny->ld_owner.len = 0;
7848 		deny->ld_owner.data = NULL;
7849 		deny->ld_clientid.cl_boot = 0;
7850 		deny->ld_clientid.cl_id = 0;
7851 	}
7852 	deny->ld_start = fl->fl_start;
7853 	deny->ld_length = NFS4_MAX_UINT64;
7854 	if (fl->fl_end != NFS4_MAX_UINT64)
7855 		deny->ld_length = fl->fl_end - fl->fl_start + 1;
7856 	deny->ld_type = NFS4_READ_LT;
7857 	if (fl->c.flc_type != F_RDLCK)
7858 		deny->ld_type = NFS4_WRITE_LT;
7859 }
7860 
7861 static struct nfs4_lockowner *
find_lockowner_str_locked(struct nfs4_client * clp,struct xdr_netobj * owner)7862 find_lockowner_str_locked(struct nfs4_client *clp, struct xdr_netobj *owner)
7863 {
7864 	unsigned int strhashval = ownerstr_hashval(owner);
7865 	struct nfs4_stateowner *so;
7866 
7867 	lockdep_assert_held(&clp->cl_lock);
7868 
7869 	list_for_each_entry(so, &clp->cl_ownerstr_hashtbl[strhashval],
7870 			    so_strhash) {
7871 		if (so->so_is_open_owner)
7872 			continue;
7873 		if (same_owner_str(so, owner))
7874 			return lockowner(nfs4_get_stateowner(so));
7875 	}
7876 	return NULL;
7877 }
7878 
7879 static struct nfs4_lockowner *
find_lockowner_str(struct nfs4_client * clp,struct xdr_netobj * owner)7880 find_lockowner_str(struct nfs4_client *clp, struct xdr_netobj *owner)
7881 {
7882 	struct nfs4_lockowner *lo;
7883 
7884 	spin_lock(&clp->cl_lock);
7885 	lo = find_lockowner_str_locked(clp, owner);
7886 	spin_unlock(&clp->cl_lock);
7887 	return lo;
7888 }
7889 
nfs4_unhash_lockowner(struct nfs4_stateowner * sop)7890 static void nfs4_unhash_lockowner(struct nfs4_stateowner *sop)
7891 {
7892 	unhash_lockowner_locked(lockowner(sop));
7893 }
7894 
nfs4_free_lockowner(struct nfs4_stateowner * sop)7895 static void nfs4_free_lockowner(struct nfs4_stateowner *sop)
7896 {
7897 	struct nfs4_lockowner *lo = lockowner(sop);
7898 
7899 	kmem_cache_free(lockowner_slab, lo);
7900 }
7901 
7902 static const struct nfs4_stateowner_operations lockowner_ops = {
7903 	.so_unhash =	nfs4_unhash_lockowner,
7904 	.so_free =	nfs4_free_lockowner,
7905 };
7906 
7907 /*
7908  * Alloc a lock owner structure.
7909  * Called in nfsd4_lock - therefore, OPEN and OPEN_CONFIRM (if needed) has
7910  * occurred.
7911  *
7912  * strhashval = ownerstr_hashval
7913  */
7914 static struct nfs4_lockowner *
alloc_init_lock_stateowner(unsigned int strhashval,struct nfs4_client * clp,struct nfs4_ol_stateid * open_stp,struct nfsd4_lock * lock)7915 alloc_init_lock_stateowner(unsigned int strhashval, struct nfs4_client *clp,
7916 			   struct nfs4_ol_stateid *open_stp,
7917 			   struct nfsd4_lock *lock)
7918 {
7919 	struct nfs4_lockowner *lo, *ret;
7920 
7921 	lo = alloc_stateowner(lockowner_slab, &lock->lk_new_owner, clp);
7922 	if (!lo)
7923 		return NULL;
7924 	INIT_LIST_HEAD(&lo->lo_blocked);
7925 	INIT_LIST_HEAD(&lo->lo_owner.so_stateids);
7926 	lo->lo_owner.so_is_open_owner = 0;
7927 	lo->lo_owner.so_seqid = lock->lk_new_lock_seqid;
7928 	lo->lo_owner.so_ops = &lockowner_ops;
7929 	spin_lock(&clp->cl_lock);
7930 	ret = find_lockowner_str_locked(clp, &lock->lk_new_owner);
7931 	if (ret == NULL) {
7932 		list_add(&lo->lo_owner.so_strhash,
7933 			 &clp->cl_ownerstr_hashtbl[strhashval]);
7934 		ret = lo;
7935 	} else
7936 		nfs4_free_stateowner(&lo->lo_owner);
7937 
7938 	spin_unlock(&clp->cl_lock);
7939 	return ret;
7940 }
7941 
7942 static struct nfs4_ol_stateid *
find_lock_stateid(const struct nfs4_lockowner * lo,const struct nfs4_ol_stateid * ost)7943 find_lock_stateid(const struct nfs4_lockowner *lo,
7944 		  const struct nfs4_ol_stateid *ost)
7945 {
7946 	struct nfs4_ol_stateid *lst;
7947 
7948 	lockdep_assert_held(&ost->st_stid.sc_client->cl_lock);
7949 
7950 	/* If ost is not hashed, ost->st_locks will not be valid */
7951 	if (!nfs4_ol_stateid_unhashed(ost))
7952 		list_for_each_entry(lst, &ost->st_locks, st_locks) {
7953 			if (lst->st_stateowner == &lo->lo_owner) {
7954 				refcount_inc(&lst->st_stid.sc_count);
7955 				return lst;
7956 			}
7957 		}
7958 	return NULL;
7959 }
7960 
7961 static struct nfs4_ol_stateid *
init_lock_stateid(struct nfs4_ol_stateid * stp,struct nfs4_lockowner * lo,struct nfs4_file * fp,struct inode * inode,struct nfs4_ol_stateid * open_stp)7962 init_lock_stateid(struct nfs4_ol_stateid *stp, struct nfs4_lockowner *lo,
7963 		  struct nfs4_file *fp, struct inode *inode,
7964 		  struct nfs4_ol_stateid *open_stp)
7965 {
7966 	struct nfs4_client *clp = lo->lo_owner.so_client;
7967 	struct nfs4_ol_stateid *retstp;
7968 
7969 	mutex_init(&stp->st_mutex);
7970 	mutex_lock_nested(&stp->st_mutex, OPEN_STATEID_MUTEX);
7971 retry:
7972 	spin_lock(&clp->cl_lock);
7973 	if (nfs4_ol_stateid_unhashed(open_stp))
7974 		goto out_close;
7975 	retstp = find_lock_stateid(lo, open_stp);
7976 	if (retstp)
7977 		goto out_found;
7978 	refcount_inc(&stp->st_stid.sc_count);
7979 	stp->st_stid.sc_type = SC_TYPE_LOCK;
7980 	stp->st_stateowner = nfs4_get_stateowner(&lo->lo_owner);
7981 	get_nfs4_file(fp);
7982 	stp->st_stid.sc_file = fp;
7983 	stp->st_access_bmap = 0;
7984 	stp->st_deny_bmap = open_stp->st_deny_bmap;
7985 	stp->st_openstp = open_stp;
7986 	spin_lock(&fp->fi_lock);
7987 	list_add(&stp->st_locks, &open_stp->st_locks);
7988 	list_add(&stp->st_perstateowner, &lo->lo_owner.so_stateids);
7989 	list_add(&stp->st_perfile, &fp->fi_stateids);
7990 	spin_unlock(&fp->fi_lock);
7991 	spin_unlock(&clp->cl_lock);
7992 	return stp;
7993 out_found:
7994 	spin_unlock(&clp->cl_lock);
7995 	if (nfsd4_lock_ol_stateid(retstp) != nfs_ok) {
7996 		nfs4_put_stid(&retstp->st_stid);
7997 		goto retry;
7998 	}
7999 	/* To keep mutex tracking happy */
8000 	mutex_unlock(&stp->st_mutex);
8001 	return retstp;
8002 out_close:
8003 	spin_unlock(&clp->cl_lock);
8004 	mutex_unlock(&stp->st_mutex);
8005 	return NULL;
8006 }
8007 
8008 static struct nfs4_ol_stateid *
find_or_create_lock_stateid(struct nfs4_lockowner * lo,struct nfs4_file * fi,struct inode * inode,struct nfs4_ol_stateid * ost,bool * new)8009 find_or_create_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fi,
8010 			    struct inode *inode, struct nfs4_ol_stateid *ost,
8011 			    bool *new)
8012 {
8013 	struct nfs4_stid *ns = NULL;
8014 	struct nfs4_ol_stateid *lst;
8015 	struct nfs4_openowner *oo = openowner(ost->st_stateowner);
8016 	struct nfs4_client *clp = oo->oo_owner.so_client;
8017 
8018 	*new = false;
8019 	spin_lock(&clp->cl_lock);
8020 	lst = find_lock_stateid(lo, ost);
8021 	spin_unlock(&clp->cl_lock);
8022 	if (lst != NULL) {
8023 		if (nfsd4_lock_ol_stateid(lst) == nfs_ok)
8024 			goto out;
8025 		nfs4_put_stid(&lst->st_stid);
8026 	}
8027 	ns = nfs4_alloc_stid(clp, stateid_slab, nfs4_free_lock_stateid);
8028 	if (ns == NULL)
8029 		return NULL;
8030 
8031 	lst = init_lock_stateid(openlockstateid(ns), lo, fi, inode, ost);
8032 	if (lst == openlockstateid(ns))
8033 		*new = true;
8034 	else
8035 		nfs4_put_stid(ns);
8036 out:
8037 	return lst;
8038 }
8039 
8040 static int
check_lock_length(u64 offset,u64 length)8041 check_lock_length(u64 offset, u64 length)
8042 {
8043 	return ((length == 0) || ((length != NFS4_MAX_UINT64) &&
8044 		(length > ~offset)));
8045 }
8046 
get_lock_access(struct nfs4_ol_stateid * lock_stp,u32 access)8047 static void get_lock_access(struct nfs4_ol_stateid *lock_stp, u32 access)
8048 {
8049 	struct nfs4_file *fp = lock_stp->st_stid.sc_file;
8050 
8051 	lockdep_assert_held(&fp->fi_lock);
8052 
8053 	if (test_access(access, lock_stp))
8054 		return;
8055 	__nfs4_file_get_access(fp, access);
8056 	set_access(access, lock_stp);
8057 }
8058 
8059 static __be32
lookup_or_create_lock_state(struct nfsd4_compound_state * cstate,struct nfs4_ol_stateid * ost,struct nfsd4_lock * lock,struct nfs4_ol_stateid ** plst,bool * new)8060 lookup_or_create_lock_state(struct nfsd4_compound_state *cstate,
8061 			    struct nfs4_ol_stateid *ost,
8062 			    struct nfsd4_lock *lock,
8063 			    struct nfs4_ol_stateid **plst, bool *new)
8064 {
8065 	__be32 status;
8066 	struct nfs4_file *fi = ost->st_stid.sc_file;
8067 	struct nfs4_openowner *oo = openowner(ost->st_stateowner);
8068 	struct nfs4_client *cl = oo->oo_owner.so_client;
8069 	struct inode *inode = d_inode(cstate->current_fh.fh_dentry);
8070 	struct nfs4_lockowner *lo;
8071 	struct nfs4_ol_stateid *lst;
8072 	unsigned int strhashval;
8073 
8074 	lo = find_lockowner_str(cl, &lock->lk_new_owner);
8075 	if (!lo) {
8076 		strhashval = ownerstr_hashval(&lock->lk_new_owner);
8077 		lo = alloc_init_lock_stateowner(strhashval, cl, ost, lock);
8078 		if (lo == NULL)
8079 			return nfserr_jukebox;
8080 	} else {
8081 		/* with an existing lockowner, seqids must be the same */
8082 		status = nfserr_bad_seqid;
8083 		if (!cstate->minorversion &&
8084 		    lock->lk_new_lock_seqid != lo->lo_owner.so_seqid)
8085 			goto out;
8086 	}
8087 
8088 	lst = find_or_create_lock_stateid(lo, fi, inode, ost, new);
8089 	if (lst == NULL) {
8090 		status = nfserr_jukebox;
8091 		goto out;
8092 	}
8093 
8094 	status = nfs_ok;
8095 	*plst = lst;
8096 out:
8097 	nfs4_put_stateowner(&lo->lo_owner);
8098 	return status;
8099 }
8100 
8101 /*
8102  *  LOCK operation
8103  */
8104 __be32
nfsd4_lock(struct svc_rqst * rqstp,struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)8105 nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
8106 	   union nfsd4_op_u *u)
8107 {
8108 	struct nfsd4_lock *lock = &u->lock;
8109 	struct nfs4_openowner *open_sop = NULL;
8110 	struct nfs4_lockowner *lock_sop = NULL;
8111 	struct nfs4_ol_stateid *lock_stp = NULL;
8112 	struct nfs4_ol_stateid *open_stp = NULL;
8113 	struct nfs4_file *fp;
8114 	struct nfsd_file *nf = NULL;
8115 	struct nfsd4_blocked_lock *nbl = NULL;
8116 	struct file_lock *file_lock = NULL;
8117 	struct file_lock *conflock = NULL;
8118 	__be32 status = 0;
8119 	int lkflg;
8120 	int err;
8121 	bool new = false;
8122 	unsigned char type;
8123 	unsigned int flags = FL_POSIX;
8124 	struct net *net = SVC_NET(rqstp);
8125 	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
8126 
8127 	dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
8128 		(long long) lock->lk_offset,
8129 		(long long) lock->lk_length);
8130 
8131 	if (check_lock_length(lock->lk_offset, lock->lk_length))
8132 		 return nfserr_inval;
8133 
8134 	status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0);
8135 	if (status != nfs_ok)
8136 		return status;
8137 
8138 	if (lock->lk_is_new) {
8139 		if (nfsd4_has_session(cstate))
8140 			/* See rfc 5661 18.10.3: given clientid is ignored: */
8141 			memcpy(&lock->lk_new_clientid,
8142 				&cstate->clp->cl_clientid,
8143 				sizeof(clientid_t));
8144 
8145 		/* validate and update open stateid and open seqid */
8146 		status = nfs4_preprocess_confirmed_seqid_op(cstate,
8147 				        lock->lk_new_open_seqid,
8148 		                        &lock->lk_new_open_stateid,
8149 					&open_stp, nn);
8150 		if (status)
8151 			goto out;
8152 		mutex_unlock(&open_stp->st_mutex);
8153 		open_sop = openowner(open_stp->st_stateowner);
8154 		status = nfserr_bad_stateid;
8155 		if (!same_clid(&open_sop->oo_owner.so_client->cl_clientid,
8156 						&lock->lk_new_clientid))
8157 			goto out;
8158 		status = lookup_or_create_lock_state(cstate, open_stp, lock,
8159 							&lock_stp, &new);
8160 	} else {
8161 		status = nfs4_preprocess_seqid_op(cstate,
8162 						  lock->lk_old_lock_seqid,
8163 						  &lock->lk_old_lock_stateid,
8164 						  SC_TYPE_LOCK, 0, &lock_stp,
8165 						  nn);
8166 	}
8167 	if (status)
8168 		goto out;
8169 	lock_sop = lockowner(lock_stp->st_stateowner);
8170 
8171 	lkflg = setlkflg(lock->lk_type);
8172 	status = nfs4_check_openmode(lock_stp, lkflg);
8173 	if (status)
8174 		goto out;
8175 
8176 	status = nfserr_grace;
8177 	if (locks_in_grace(net) && !lock->lk_reclaim)
8178 		goto out;
8179 	status = nfserr_no_grace;
8180 	if (!locks_in_grace(net) && lock->lk_reclaim)
8181 		goto out;
8182 
8183 	if (lock->lk_reclaim)
8184 		flags |= FL_RECLAIM;
8185 
8186 	fp = lock_stp->st_stid.sc_file;
8187 	switch (lock->lk_type) {
8188 		case NFS4_READW_LT:
8189 			fallthrough;
8190 		case NFS4_READ_LT:
8191 			spin_lock(&fp->fi_lock);
8192 			nf = find_readable_file_locked(fp);
8193 			if (nf)
8194 				get_lock_access(lock_stp, NFS4_SHARE_ACCESS_READ);
8195 			spin_unlock(&fp->fi_lock);
8196 			type = F_RDLCK;
8197 			break;
8198 		case NFS4_WRITEW_LT:
8199 			fallthrough;
8200 		case NFS4_WRITE_LT:
8201 			spin_lock(&fp->fi_lock);
8202 			nf = find_writeable_file_locked(fp);
8203 			if (nf)
8204 				get_lock_access(lock_stp, NFS4_SHARE_ACCESS_WRITE);
8205 			spin_unlock(&fp->fi_lock);
8206 			type = F_WRLCK;
8207 			break;
8208 		default:
8209 			status = nfserr_inval;
8210 		goto out;
8211 	}
8212 
8213 	if (!nf) {
8214 		status = nfserr_openmode;
8215 		goto out;
8216 	}
8217 
8218 	if (lock->lk_type & (NFS4_READW_LT | NFS4_WRITEW_LT) &&
8219 		nfsd4_has_session(cstate) &&
8220 		locks_can_async_lock(nf->nf_file->f_op))
8221 			flags |= FL_SLEEP;
8222 
8223 	nbl = find_or_allocate_block(lock_sop, &fp->fi_fhandle, nn);
8224 	if (!nbl) {
8225 		dprintk("NFSD: %s: unable to allocate block!\n", __func__);
8226 		status = nfserr_jukebox;
8227 		goto out;
8228 	}
8229 
8230 	file_lock = &nbl->nbl_lock;
8231 	file_lock->c.flc_type = type;
8232 	file_lock->c.flc_owner = (fl_owner_t)lockowner(nfs4_get_stateowner(&lock_sop->lo_owner));
8233 	file_lock->c.flc_pid = current->tgid;
8234 	file_lock->c.flc_file = nf->nf_file;
8235 	file_lock->c.flc_flags = flags;
8236 	file_lock->fl_lmops = &nfsd_posix_mng_ops;
8237 	file_lock->fl_start = lock->lk_offset;
8238 	file_lock->fl_end = last_byte_offset(lock->lk_offset, lock->lk_length);
8239 	nfs4_transform_lock_offset(file_lock);
8240 
8241 	conflock = locks_alloc_lock();
8242 	if (!conflock) {
8243 		dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
8244 		status = nfserr_jukebox;
8245 		goto out;
8246 	}
8247 
8248 	if (flags & FL_SLEEP) {
8249 		nbl->nbl_time = ktime_get_boottime_seconds();
8250 		spin_lock(&nn->blocked_locks_lock);
8251 		list_add_tail(&nbl->nbl_list, &lock_sop->lo_blocked);
8252 		list_add_tail(&nbl->nbl_lru, &nn->blocked_locks_lru);
8253 		kref_get(&nbl->nbl_kref);
8254 		spin_unlock(&nn->blocked_locks_lock);
8255 	}
8256 
8257 	err = vfs_lock_file(nf->nf_file, F_SETLK, file_lock, conflock);
8258 	switch (err) {
8259 	case 0: /* success! */
8260 		nfs4_inc_and_copy_stateid(&lock->lk_resp_stateid, &lock_stp->st_stid);
8261 		status = 0;
8262 		if (lock->lk_reclaim)
8263 			nn->somebody_reclaimed = true;
8264 		break;
8265 	case FILE_LOCK_DEFERRED:
8266 		kref_put(&nbl->nbl_kref, free_nbl);
8267 		nbl = NULL;
8268 		fallthrough;
8269 	case -EAGAIN:		/* conflock holds conflicting lock */
8270 		status = nfserr_denied;
8271 		dprintk("NFSD: nfsd4_lock: conflicting lock found!\n");
8272 		nfs4_set_lock_denied(conflock, &lock->lk_denied);
8273 		break;
8274 	case -EDEADLK:
8275 		status = nfserr_deadlock;
8276 		break;
8277 	default:
8278 		dprintk("NFSD: nfsd4_lock: vfs_lock_file() failed! status %d\n",err);
8279 		status = nfserrno(err);
8280 		break;
8281 	}
8282 out:
8283 	if (nbl) {
8284 		/* dequeue it if we queued it before */
8285 		if (flags & FL_SLEEP) {
8286 			spin_lock(&nn->blocked_locks_lock);
8287 			if (!list_empty(&nbl->nbl_list) &&
8288 			    !list_empty(&nbl->nbl_lru)) {
8289 				list_del_init(&nbl->nbl_list);
8290 				list_del_init(&nbl->nbl_lru);
8291 				kref_put(&nbl->nbl_kref, free_nbl);
8292 			}
8293 			/* nbl can use one of lists to be linked to reaplist */
8294 			spin_unlock(&nn->blocked_locks_lock);
8295 		}
8296 		free_blocked_lock(nbl);
8297 	}
8298 	if (nf)
8299 		nfsd_file_put(nf);
8300 	if (lock_stp) {
8301 		/* Bump seqid manually if the 4.0 replay owner is openowner */
8302 		if (cstate->replay_owner &&
8303 		    cstate->replay_owner != &lock_sop->lo_owner &&
8304 		    seqid_mutating_err(ntohl(status)))
8305 			lock_sop->lo_owner.so_seqid++;
8306 
8307 		/*
8308 		 * If this is a new, never-before-used stateid, and we are
8309 		 * returning an error, then just go ahead and release it.
8310 		 */
8311 		if (status && new)
8312 			release_lock_stateid(lock_stp);
8313 
8314 		mutex_unlock(&lock_stp->st_mutex);
8315 
8316 		nfs4_put_stid(&lock_stp->st_stid);
8317 	}
8318 	if (open_stp)
8319 		nfs4_put_stid(&open_stp->st_stid);
8320 	nfsd4_bump_seqid(cstate, status);
8321 	if (conflock)
8322 		locks_free_lock(conflock);
8323 	return status;
8324 }
8325 
nfsd4_lock_release(union nfsd4_op_u * u)8326 void nfsd4_lock_release(union nfsd4_op_u *u)
8327 {
8328 	struct nfsd4_lock *lock = &u->lock;
8329 	struct nfsd4_lock_denied *deny = &lock->lk_denied;
8330 
8331 	kfree(deny->ld_owner.data);
8332 }
8333 
8334 /*
8335  * The NFSv4 spec allows a client to do a LOCKT without holding an OPEN,
8336  * so we do a temporary open here just to get an open file to pass to
8337  * vfs_test_lock.
8338  */
nfsd_test_lock(struct svc_rqst * rqstp,struct svc_fh * fhp,struct file_lock * lock)8339 static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
8340 {
8341 	struct nfsd_file *nf;
8342 	struct inode *inode;
8343 	__be32 err;
8344 
8345 	err = nfsd_file_acquire(rqstp, fhp, NFSD_MAY_READ, &nf);
8346 	if (err)
8347 		return err;
8348 	inode = fhp->fh_dentry->d_inode;
8349 	inode_lock(inode); /* to block new leases till after test_lock: */
8350 	err = nfserrno(nfsd_open_break_lease(inode, NFSD_MAY_READ));
8351 	if (err)
8352 		goto out;
8353 	lock->c.flc_file = nf->nf_file;
8354 	err = nfserrno(vfs_test_lock(nf->nf_file, lock));
8355 	lock->c.flc_file = NULL;
8356 out:
8357 	inode_unlock(inode);
8358 	nfsd_file_put(nf);
8359 	return err;
8360 }
8361 
8362 /*
8363  * LOCKT operation
8364  */
8365 __be32
nfsd4_lockt(struct svc_rqst * rqstp,struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)8366 nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
8367 	    union nfsd4_op_u *u)
8368 {
8369 	struct nfsd4_lockt *lockt = &u->lockt;
8370 	struct file_lock *file_lock = NULL;
8371 	struct nfs4_lockowner *lo = NULL;
8372 	__be32 status;
8373 	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
8374 
8375 	if (locks_in_grace(SVC_NET(rqstp)))
8376 		return nfserr_grace;
8377 
8378 	if (check_lock_length(lockt->lt_offset, lockt->lt_length))
8379 		 return nfserr_inval;
8380 
8381 	if (!nfsd4_has_session(cstate)) {
8382 		status = set_client(&lockt->lt_clientid, cstate, nn);
8383 		if (status)
8384 			goto out;
8385 	}
8386 
8387 	if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
8388 		goto out;
8389 
8390 	file_lock = locks_alloc_lock();
8391 	if (!file_lock) {
8392 		dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
8393 		status = nfserr_jukebox;
8394 		goto out;
8395 	}
8396 
8397 	switch (lockt->lt_type) {
8398 		case NFS4_READ_LT:
8399 		case NFS4_READW_LT:
8400 			file_lock->c.flc_type = F_RDLCK;
8401 			break;
8402 		case NFS4_WRITE_LT:
8403 		case NFS4_WRITEW_LT:
8404 			file_lock->c.flc_type = F_WRLCK;
8405 			break;
8406 		default:
8407 			dprintk("NFSD: nfs4_lockt: bad lock type!\n");
8408 			status = nfserr_inval;
8409 			goto out;
8410 	}
8411 
8412 	lo = find_lockowner_str(cstate->clp, &lockt->lt_owner);
8413 	if (lo)
8414 		file_lock->c.flc_owner = (fl_owner_t)lo;
8415 	file_lock->c.flc_pid = current->tgid;
8416 	file_lock->c.flc_flags = FL_POSIX;
8417 
8418 	file_lock->fl_start = lockt->lt_offset;
8419 	file_lock->fl_end = last_byte_offset(lockt->lt_offset, lockt->lt_length);
8420 
8421 	nfs4_transform_lock_offset(file_lock);
8422 
8423 	status = nfsd_test_lock(rqstp, &cstate->current_fh, file_lock);
8424 	if (status)
8425 		goto out;
8426 
8427 	if (file_lock->c.flc_type != F_UNLCK) {
8428 		status = nfserr_denied;
8429 		nfs4_set_lock_denied(file_lock, &lockt->lt_denied);
8430 	}
8431 out:
8432 	if (lo)
8433 		nfs4_put_stateowner(&lo->lo_owner);
8434 	if (file_lock)
8435 		locks_free_lock(file_lock);
8436 	return status;
8437 }
8438 
nfsd4_lockt_release(union nfsd4_op_u * u)8439 void nfsd4_lockt_release(union nfsd4_op_u *u)
8440 {
8441 	struct nfsd4_lockt *lockt = &u->lockt;
8442 	struct nfsd4_lock_denied *deny = &lockt->lt_denied;
8443 
8444 	kfree(deny->ld_owner.data);
8445 }
8446 
8447 __be32
nfsd4_locku(struct svc_rqst * rqstp,struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)8448 nfsd4_locku(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
8449 	    union nfsd4_op_u *u)
8450 {
8451 	struct nfsd4_locku *locku = &u->locku;
8452 	struct nfs4_ol_stateid *stp;
8453 	struct nfsd_file *nf = NULL;
8454 	struct file_lock *file_lock = NULL;
8455 	__be32 status;
8456 	int err;
8457 	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
8458 
8459 	dprintk("NFSD: nfsd4_locku: start=%Ld length=%Ld\n",
8460 		(long long) locku->lu_offset,
8461 		(long long) locku->lu_length);
8462 
8463 	if (check_lock_length(locku->lu_offset, locku->lu_length))
8464 		 return nfserr_inval;
8465 
8466 	status = nfs4_preprocess_seqid_op(cstate, locku->lu_seqid,
8467 					  &locku->lu_stateid, SC_TYPE_LOCK, 0,
8468 					  &stp, nn);
8469 	if (status)
8470 		goto out;
8471 	nf = find_any_file(stp->st_stid.sc_file);
8472 	if (!nf) {
8473 		status = nfserr_lock_range;
8474 		goto put_stateid;
8475 	}
8476 	file_lock = locks_alloc_lock();
8477 	if (!file_lock) {
8478 		dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
8479 		status = nfserr_jukebox;
8480 		goto put_file;
8481 	}
8482 
8483 	file_lock->c.flc_type = F_UNLCK;
8484 	file_lock->c.flc_owner = (fl_owner_t)lockowner(nfs4_get_stateowner(stp->st_stateowner));
8485 	file_lock->c.flc_pid = current->tgid;
8486 	file_lock->c.flc_file = nf->nf_file;
8487 	file_lock->c.flc_flags = FL_POSIX;
8488 	file_lock->fl_lmops = &nfsd_posix_mng_ops;
8489 	file_lock->fl_start = locku->lu_offset;
8490 
8491 	file_lock->fl_end = last_byte_offset(locku->lu_offset,
8492 						locku->lu_length);
8493 	nfs4_transform_lock_offset(file_lock);
8494 
8495 	err = vfs_lock_file(nf->nf_file, F_SETLK, file_lock, NULL);
8496 	if (err) {
8497 		dprintk("NFSD: nfs4_locku: vfs_lock_file failed!\n");
8498 		goto out_nfserr;
8499 	}
8500 	nfs4_inc_and_copy_stateid(&locku->lu_stateid, &stp->st_stid);
8501 put_file:
8502 	nfsd_file_put(nf);
8503 put_stateid:
8504 	mutex_unlock(&stp->st_mutex);
8505 	nfs4_put_stid(&stp->st_stid);
8506 out:
8507 	nfsd4_bump_seqid(cstate, status);
8508 	if (file_lock)
8509 		locks_free_lock(file_lock);
8510 	return status;
8511 
8512 out_nfserr:
8513 	status = nfserrno(err);
8514 	goto put_file;
8515 }
8516 
8517 /*
8518  * returns
8519  * 	true:  locks held by lockowner
8520  * 	false: no locks held by lockowner
8521  */
8522 static bool
check_for_locks(struct nfs4_file * fp,struct nfs4_lockowner * lowner)8523 check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner)
8524 {
8525 	struct file_lock *fl;
8526 	int status = false;
8527 	struct nfsd_file *nf;
8528 	struct inode *inode;
8529 	struct file_lock_context *flctx;
8530 
8531 	spin_lock(&fp->fi_lock);
8532 	nf = find_any_file_locked(fp);
8533 	if (!nf) {
8534 		/* Any valid lock stateid should have some sort of access */
8535 		WARN_ON_ONCE(1);
8536 		goto out;
8537 	}
8538 
8539 	inode = file_inode(nf->nf_file);
8540 	flctx = locks_inode_context(inode);
8541 
8542 	if (flctx && !list_empty_careful(&flctx->flc_posix)) {
8543 		spin_lock(&flctx->flc_lock);
8544 		for_each_file_lock(fl, &flctx->flc_posix) {
8545 			if (fl->c.flc_owner == (fl_owner_t)lowner) {
8546 				status = true;
8547 				break;
8548 			}
8549 		}
8550 		spin_unlock(&flctx->flc_lock);
8551 	}
8552 out:
8553 	spin_unlock(&fp->fi_lock);
8554 	return status;
8555 }
8556 
8557 /**
8558  * nfsd4_release_lockowner - process NFSv4.0 RELEASE_LOCKOWNER operations
8559  * @rqstp: RPC transaction
8560  * @cstate: NFSv4 COMPOUND state
8561  * @u: RELEASE_LOCKOWNER arguments
8562  *
8563  * Check if there are any locks still held and if not, free the lockowner
8564  * and any lock state that is owned.
8565  *
8566  * Return values:
8567  *   %nfs_ok: lockowner released or not found
8568  *   %nfserr_locks_held: lockowner still in use
8569  *   %nfserr_stale_clientid: clientid no longer active
8570  *   %nfserr_expired: clientid not recognized
8571  */
8572 __be32
nfsd4_release_lockowner(struct svc_rqst * rqstp,struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)8573 nfsd4_release_lockowner(struct svc_rqst *rqstp,
8574 			struct nfsd4_compound_state *cstate,
8575 			union nfsd4_op_u *u)
8576 {
8577 	struct nfsd4_release_lockowner *rlockowner = &u->release_lockowner;
8578 	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
8579 	clientid_t *clid = &rlockowner->rl_clientid;
8580 	struct nfs4_ol_stateid *stp;
8581 	struct nfs4_lockowner *lo;
8582 	struct nfs4_client *clp;
8583 	LIST_HEAD(reaplist);
8584 	__be32 status;
8585 
8586 	dprintk("nfsd4_release_lockowner clientid: (%08x/%08x):\n",
8587 		clid->cl_boot, clid->cl_id);
8588 
8589 	status = set_client(clid, cstate, nn);
8590 	if (status)
8591 		return status;
8592 	clp = cstate->clp;
8593 
8594 	spin_lock(&clp->cl_lock);
8595 	lo = find_lockowner_str_locked(clp, &rlockowner->rl_owner);
8596 	if (!lo) {
8597 		spin_unlock(&clp->cl_lock);
8598 		return nfs_ok;
8599 	}
8600 
8601 	list_for_each_entry(stp, &lo->lo_owner.so_stateids, st_perstateowner) {
8602 		if (check_for_locks(stp->st_stid.sc_file, lo)) {
8603 			spin_unlock(&clp->cl_lock);
8604 			nfs4_put_stateowner(&lo->lo_owner);
8605 			return nfserr_locks_held;
8606 		}
8607 	}
8608 	unhash_lockowner_locked(lo);
8609 	while (!list_empty(&lo->lo_owner.so_stateids)) {
8610 		stp = list_first_entry(&lo->lo_owner.so_stateids,
8611 				       struct nfs4_ol_stateid,
8612 				       st_perstateowner);
8613 		unhash_lock_stateid(stp);
8614 		put_ol_stateid_locked(stp, &reaplist);
8615 	}
8616 	spin_unlock(&clp->cl_lock);
8617 
8618 	free_ol_stateid_reaplist(&reaplist);
8619 	remove_blocked_locks(lo);
8620 	nfs4_put_stateowner(&lo->lo_owner);
8621 	return nfs_ok;
8622 }
8623 
8624 static inline struct nfs4_client_reclaim *
alloc_reclaim(void)8625 alloc_reclaim(void)
8626 {
8627 	return kmalloc(sizeof(struct nfs4_client_reclaim), GFP_KERNEL);
8628 }
8629 
8630 bool
nfs4_has_reclaimed_state(struct xdr_netobj name,struct nfsd_net * nn)8631 nfs4_has_reclaimed_state(struct xdr_netobj name, struct nfsd_net *nn)
8632 {
8633 	struct nfs4_client_reclaim *crp;
8634 
8635 	crp = nfsd4_find_reclaim_client(name, nn);
8636 	return (crp && crp->cr_clp);
8637 }
8638 
8639 /*
8640  * failure => all reset bets are off, nfserr_no_grace...
8641  *
8642  * The caller is responsible for freeing name.data if NULL is returned (it
8643  * will be freed in nfs4_remove_reclaim_record in the normal case).
8644  */
8645 struct nfs4_client_reclaim *
nfs4_client_to_reclaim(struct xdr_netobj name,struct xdr_netobj princhash,struct nfsd_net * nn)8646 nfs4_client_to_reclaim(struct xdr_netobj name, struct xdr_netobj princhash,
8647 		struct nfsd_net *nn)
8648 {
8649 	unsigned int strhashval;
8650 	struct nfs4_client_reclaim *crp;
8651 
8652 	crp = alloc_reclaim();
8653 	if (crp) {
8654 		strhashval = clientstr_hashval(name);
8655 		INIT_LIST_HEAD(&crp->cr_strhash);
8656 		list_add(&crp->cr_strhash, &nn->reclaim_str_hashtbl[strhashval]);
8657 		crp->cr_name.data = name.data;
8658 		crp->cr_name.len = name.len;
8659 		crp->cr_princhash.data = princhash.data;
8660 		crp->cr_princhash.len = princhash.len;
8661 		crp->cr_clp = NULL;
8662 		nn->reclaim_str_hashtbl_size++;
8663 	}
8664 	return crp;
8665 }
8666 
8667 void
nfs4_remove_reclaim_record(struct nfs4_client_reclaim * crp,struct nfsd_net * nn)8668 nfs4_remove_reclaim_record(struct nfs4_client_reclaim *crp, struct nfsd_net *nn)
8669 {
8670 	list_del(&crp->cr_strhash);
8671 	kfree(crp->cr_name.data);
8672 	kfree(crp->cr_princhash.data);
8673 	kfree(crp);
8674 	nn->reclaim_str_hashtbl_size--;
8675 }
8676 
8677 void
nfs4_release_reclaim(struct nfsd_net * nn)8678 nfs4_release_reclaim(struct nfsd_net *nn)
8679 {
8680 	struct nfs4_client_reclaim *crp = NULL;
8681 	int i;
8682 
8683 	for (i = 0; i < CLIENT_HASH_SIZE; i++) {
8684 		while (!list_empty(&nn->reclaim_str_hashtbl[i])) {
8685 			crp = list_entry(nn->reclaim_str_hashtbl[i].next,
8686 			                struct nfs4_client_reclaim, cr_strhash);
8687 			nfs4_remove_reclaim_record(crp, nn);
8688 		}
8689 	}
8690 	WARN_ON_ONCE(nn->reclaim_str_hashtbl_size);
8691 }
8692 
8693 /*
8694  * called from OPEN, CLAIM_PREVIOUS with a new clientid. */
8695 struct nfs4_client_reclaim *
nfsd4_find_reclaim_client(struct xdr_netobj name,struct nfsd_net * nn)8696 nfsd4_find_reclaim_client(struct xdr_netobj name, struct nfsd_net *nn)
8697 {
8698 	unsigned int strhashval;
8699 	struct nfs4_client_reclaim *crp = NULL;
8700 
8701 	strhashval = clientstr_hashval(name);
8702 	list_for_each_entry(crp, &nn->reclaim_str_hashtbl[strhashval], cr_strhash) {
8703 		if (compare_blob(&crp->cr_name, &name) == 0) {
8704 			return crp;
8705 		}
8706 	}
8707 	return NULL;
8708 }
8709 
8710 __be32
nfs4_check_open_reclaim(struct nfs4_client * clp)8711 nfs4_check_open_reclaim(struct nfs4_client *clp)
8712 {
8713 	if (test_bit(NFSD4_CLIENT_RECLAIM_COMPLETE, &clp->cl_flags))
8714 		return nfserr_no_grace;
8715 
8716 	if (nfsd4_client_record_check(clp))
8717 		return nfserr_reclaim_bad;
8718 
8719 	return nfs_ok;
8720 }
8721 
8722 /*
8723  * Since the lifetime of a delegation isn't limited to that of an open, a
8724  * client may quite reasonably hang on to a delegation as long as it has
8725  * the inode cached.  This becomes an obvious problem the first time a
8726  * client's inode cache approaches the size of the server's total memory.
8727  *
8728  * For now we avoid this problem by imposing a hard limit on the number
8729  * of delegations, which varies according to the server's memory size.
8730  */
8731 static void
set_max_delegations(void)8732 set_max_delegations(void)
8733 {
8734 	/*
8735 	 * Allow at most 4 delegations per megabyte of RAM.  Quick
8736 	 * estimates suggest that in the worst case (where every delegation
8737 	 * is for a different inode), a delegation could take about 1.5K,
8738 	 * giving a worst case usage of about 6% of memory.
8739 	 */
8740 	max_delegations = nr_free_buffer_pages() >> (20 - 2 - PAGE_SHIFT);
8741 }
8742 
nfs4_state_create_net(struct net * net)8743 static int nfs4_state_create_net(struct net *net)
8744 {
8745 	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
8746 	int i;
8747 
8748 	nn->conf_id_hashtbl = kmalloc_array(CLIENT_HASH_SIZE,
8749 					    sizeof(struct list_head),
8750 					    GFP_KERNEL);
8751 	if (!nn->conf_id_hashtbl)
8752 		goto err;
8753 	nn->unconf_id_hashtbl = kmalloc_array(CLIENT_HASH_SIZE,
8754 					      sizeof(struct list_head),
8755 					      GFP_KERNEL);
8756 	if (!nn->unconf_id_hashtbl)
8757 		goto err_unconf_id;
8758 	nn->sessionid_hashtbl = kmalloc_array(SESSION_HASH_SIZE,
8759 					      sizeof(struct list_head),
8760 					      GFP_KERNEL);
8761 	if (!nn->sessionid_hashtbl)
8762 		goto err_sessionid;
8763 
8764 	for (i = 0; i < CLIENT_HASH_SIZE; i++) {
8765 		INIT_LIST_HEAD(&nn->conf_id_hashtbl[i]);
8766 		INIT_LIST_HEAD(&nn->unconf_id_hashtbl[i]);
8767 	}
8768 	for (i = 0; i < SESSION_HASH_SIZE; i++)
8769 		INIT_LIST_HEAD(&nn->sessionid_hashtbl[i]);
8770 	nn->conf_name_tree = RB_ROOT;
8771 	nn->unconf_name_tree = RB_ROOT;
8772 	nn->boot_time = ktime_get_real_seconds();
8773 	nn->grace_ended = false;
8774 	nn->nfsd4_manager.block_opens = true;
8775 	INIT_LIST_HEAD(&nn->nfsd4_manager.list);
8776 	INIT_LIST_HEAD(&nn->client_lru);
8777 	INIT_LIST_HEAD(&nn->close_lru);
8778 	INIT_LIST_HEAD(&nn->del_recall_lru);
8779 	spin_lock_init(&nn->client_lock);
8780 	spin_lock_init(&nn->s2s_cp_lock);
8781 	idr_init(&nn->s2s_cp_stateids);
8782 	atomic_set(&nn->pending_async_copies, 0);
8783 
8784 	spin_lock_init(&nn->blocked_locks_lock);
8785 	INIT_LIST_HEAD(&nn->blocked_locks_lru);
8786 
8787 	INIT_DELAYED_WORK(&nn->laundromat_work, laundromat_main);
8788 	INIT_WORK(&nn->nfsd_shrinker_work, nfsd4_state_shrinker_worker);
8789 	get_net(net);
8790 
8791 	nn->nfsd_client_shrinker = shrinker_alloc(0, "nfsd-client");
8792 	if (!nn->nfsd_client_shrinker)
8793 		goto err_shrinker;
8794 
8795 	nn->nfsd_client_shrinker->scan_objects = nfsd4_state_shrinker_scan;
8796 	nn->nfsd_client_shrinker->count_objects = nfsd4_state_shrinker_count;
8797 	nn->nfsd_client_shrinker->private_data = nn;
8798 
8799 	shrinker_register(nn->nfsd_client_shrinker);
8800 
8801 	return 0;
8802 
8803 err_shrinker:
8804 	put_net(net);
8805 	kfree(nn->sessionid_hashtbl);
8806 err_sessionid:
8807 	kfree(nn->unconf_id_hashtbl);
8808 err_unconf_id:
8809 	kfree(nn->conf_id_hashtbl);
8810 err:
8811 	return -ENOMEM;
8812 }
8813 
8814 static void
nfs4_state_destroy_net(struct net * net)8815 nfs4_state_destroy_net(struct net *net)
8816 {
8817 	int i;
8818 	struct nfs4_client *clp = NULL;
8819 	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
8820 
8821 	for (i = 0; i < CLIENT_HASH_SIZE; i++) {
8822 		while (!list_empty(&nn->conf_id_hashtbl[i])) {
8823 			clp = list_entry(nn->conf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
8824 			destroy_client(clp);
8825 		}
8826 	}
8827 
8828 	WARN_ON(!list_empty(&nn->blocked_locks_lru));
8829 
8830 	for (i = 0; i < CLIENT_HASH_SIZE; i++) {
8831 		while (!list_empty(&nn->unconf_id_hashtbl[i])) {
8832 			clp = list_entry(nn->unconf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
8833 			destroy_client(clp);
8834 		}
8835 	}
8836 
8837 	kfree(nn->sessionid_hashtbl);
8838 	kfree(nn->unconf_id_hashtbl);
8839 	kfree(nn->conf_id_hashtbl);
8840 	put_net(net);
8841 }
8842 
8843 int
nfs4_state_start_net(struct net * net)8844 nfs4_state_start_net(struct net *net)
8845 {
8846 	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
8847 	int ret;
8848 
8849 	ret = nfs4_state_create_net(net);
8850 	if (ret)
8851 		return ret;
8852 	locks_start_grace(net, &nn->nfsd4_manager);
8853 	nfsd4_client_tracking_init(net);
8854 	if (nn->track_reclaim_completes && nn->reclaim_str_hashtbl_size == 0)
8855 		goto skip_grace;
8856 	printk(KERN_INFO "NFSD: starting %lld-second grace period (net %x)\n",
8857 	       nn->nfsd4_grace, net->ns.inum);
8858 	trace_nfsd_grace_start(nn);
8859 	queue_delayed_work(laundry_wq, &nn->laundromat_work, nn->nfsd4_grace * HZ);
8860 	return 0;
8861 
8862 skip_grace:
8863 	printk(KERN_INFO "NFSD: no clients to reclaim, skipping NFSv4 grace period (net %x)\n",
8864 			net->ns.inum);
8865 	queue_delayed_work(laundry_wq, &nn->laundromat_work, nn->nfsd4_lease * HZ);
8866 	nfsd4_end_grace(nn);
8867 	return 0;
8868 }
8869 
8870 /* initialization to perform when the nfsd service is started: */
8871 int
nfs4_state_start(void)8872 nfs4_state_start(void)
8873 {
8874 	int ret;
8875 
8876 	ret = rhltable_init(&nfs4_file_rhltable, &nfs4_file_rhash_params);
8877 	if (ret)
8878 		return ret;
8879 
8880 	nfsd_slot_shrinker = shrinker_alloc(0, "nfsd-DRC-slot");
8881 	if (!nfsd_slot_shrinker) {
8882 		rhltable_destroy(&nfs4_file_rhltable);
8883 		return -ENOMEM;
8884 	}
8885 	nfsd_slot_shrinker->count_objects = nfsd_slot_count;
8886 	nfsd_slot_shrinker->scan_objects = nfsd_slot_scan;
8887 	shrinker_register(nfsd_slot_shrinker);
8888 
8889 	set_max_delegations();
8890 	return 0;
8891 }
8892 
8893 void
nfs4_state_shutdown_net(struct net * net)8894 nfs4_state_shutdown_net(struct net *net)
8895 {
8896 	struct nfs4_delegation *dp = NULL;
8897 	struct list_head *pos, *next, reaplist;
8898 	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
8899 
8900 	shrinker_free(nn->nfsd_client_shrinker);
8901 	cancel_work_sync(&nn->nfsd_shrinker_work);
8902 	cancel_delayed_work_sync(&nn->laundromat_work);
8903 	locks_end_grace(&nn->nfsd4_manager);
8904 
8905 	INIT_LIST_HEAD(&reaplist);
8906 	spin_lock(&state_lock);
8907 	list_for_each_safe(pos, next, &nn->del_recall_lru) {
8908 		dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
8909 		unhash_delegation_locked(dp, SC_STATUS_CLOSED);
8910 		list_add(&dp->dl_recall_lru, &reaplist);
8911 	}
8912 	spin_unlock(&state_lock);
8913 	list_for_each_safe(pos, next, &reaplist) {
8914 		dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
8915 		list_del_init(&dp->dl_recall_lru);
8916 		destroy_unhashed_deleg(dp);
8917 	}
8918 
8919 	nfsd4_client_tracking_exit(net);
8920 	nfs4_state_destroy_net(net);
8921 #ifdef CONFIG_NFSD_V4_2_INTER_SSC
8922 	nfsd4_ssc_shutdown_umount(nn);
8923 #endif
8924 }
8925 
8926 void
nfs4_state_shutdown(void)8927 nfs4_state_shutdown(void)
8928 {
8929 	rhltable_destroy(&nfs4_file_rhltable);
8930 	shrinker_free(nfsd_slot_shrinker);
8931 }
8932 
8933 static void
get_stateid(struct nfsd4_compound_state * cstate,stateid_t * stateid)8934 get_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid)
8935 {
8936 	if (HAS_CSTATE_FLAG(cstate, CURRENT_STATE_ID_FLAG) &&
8937 	    CURRENT_STATEID(stateid))
8938 		memcpy(stateid, &cstate->current_stateid, sizeof(stateid_t));
8939 }
8940 
8941 static void
put_stateid(struct nfsd4_compound_state * cstate,stateid_t * stateid)8942 put_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid)
8943 {
8944 	if (cstate->minorversion) {
8945 		memcpy(&cstate->current_stateid, stateid, sizeof(stateid_t));
8946 		SET_CSTATE_FLAG(cstate, CURRENT_STATE_ID_FLAG);
8947 	}
8948 }
8949 
8950 void
clear_current_stateid(struct nfsd4_compound_state * cstate)8951 clear_current_stateid(struct nfsd4_compound_state *cstate)
8952 {
8953 	CLEAR_CSTATE_FLAG(cstate, CURRENT_STATE_ID_FLAG);
8954 }
8955 
8956 /*
8957  * functions to set current state id
8958  */
8959 void
nfsd4_set_opendowngradestateid(struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)8960 nfsd4_set_opendowngradestateid(struct nfsd4_compound_state *cstate,
8961 		union nfsd4_op_u *u)
8962 {
8963 	put_stateid(cstate, &u->open_downgrade.od_stateid);
8964 }
8965 
8966 void
nfsd4_set_openstateid(struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)8967 nfsd4_set_openstateid(struct nfsd4_compound_state *cstate,
8968 		union nfsd4_op_u *u)
8969 {
8970 	put_stateid(cstate, &u->open.op_stateid);
8971 }
8972 
8973 void
nfsd4_set_closestateid(struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)8974 nfsd4_set_closestateid(struct nfsd4_compound_state *cstate,
8975 		union nfsd4_op_u *u)
8976 {
8977 	put_stateid(cstate, &u->close.cl_stateid);
8978 }
8979 
8980 void
nfsd4_set_lockstateid(struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)8981 nfsd4_set_lockstateid(struct nfsd4_compound_state *cstate,
8982 		union nfsd4_op_u *u)
8983 {
8984 	put_stateid(cstate, &u->lock.lk_resp_stateid);
8985 }
8986 
8987 /*
8988  * functions to consume current state id
8989  */
8990 
8991 void
nfsd4_get_opendowngradestateid(struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)8992 nfsd4_get_opendowngradestateid(struct nfsd4_compound_state *cstate,
8993 		union nfsd4_op_u *u)
8994 {
8995 	get_stateid(cstate, &u->open_downgrade.od_stateid);
8996 }
8997 
8998 void
nfsd4_get_delegreturnstateid(struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)8999 nfsd4_get_delegreturnstateid(struct nfsd4_compound_state *cstate,
9000 		union nfsd4_op_u *u)
9001 {
9002 	get_stateid(cstate, &u->delegreturn.dr_stateid);
9003 }
9004 
9005 void
nfsd4_get_freestateid(struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)9006 nfsd4_get_freestateid(struct nfsd4_compound_state *cstate,
9007 		union nfsd4_op_u *u)
9008 {
9009 	get_stateid(cstate, &u->free_stateid.fr_stateid);
9010 }
9011 
9012 void
nfsd4_get_setattrstateid(struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)9013 nfsd4_get_setattrstateid(struct nfsd4_compound_state *cstate,
9014 		union nfsd4_op_u *u)
9015 {
9016 	get_stateid(cstate, &u->setattr.sa_stateid);
9017 }
9018 
9019 void
nfsd4_get_closestateid(struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)9020 nfsd4_get_closestateid(struct nfsd4_compound_state *cstate,
9021 		union nfsd4_op_u *u)
9022 {
9023 	get_stateid(cstate, &u->close.cl_stateid);
9024 }
9025 
9026 void
nfsd4_get_lockustateid(struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)9027 nfsd4_get_lockustateid(struct nfsd4_compound_state *cstate,
9028 		union nfsd4_op_u *u)
9029 {
9030 	get_stateid(cstate, &u->locku.lu_stateid);
9031 }
9032 
9033 void
nfsd4_get_readstateid(struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)9034 nfsd4_get_readstateid(struct nfsd4_compound_state *cstate,
9035 		union nfsd4_op_u *u)
9036 {
9037 	get_stateid(cstate, &u->read.rd_stateid);
9038 }
9039 
9040 void
nfsd4_get_writestateid(struct nfsd4_compound_state * cstate,union nfsd4_op_u * u)9041 nfsd4_get_writestateid(struct nfsd4_compound_state *cstate,
9042 		union nfsd4_op_u *u)
9043 {
9044 	get_stateid(cstate, &u->write.wr_stateid);
9045 }
9046 
9047 /**
9048  * set_cb_time - vet and set the timespec for a cb_getattr update
9049  * @cb: timestamp from the CB_GETATTR response
9050  * @orig: original timestamp in the inode
9051  * @now: current time
9052  *
9053  * Given a timestamp in a CB_GETATTR response, check it against the
9054  * current timestamp in the inode and the current time. Returns true
9055  * if the inode's timestamp needs to be updated, and false otherwise.
9056  * @cb may also be changed if the timestamp needs to be clamped.
9057  */
set_cb_time(struct timespec64 * cb,const struct timespec64 * orig,const struct timespec64 * now)9058 static bool set_cb_time(struct timespec64 *cb, const struct timespec64 *orig,
9059 			const struct timespec64 *now)
9060 {
9061 
9062 	/*
9063 	 * "When the time presented is before the original time, then the
9064 	 *  update is ignored." Also no need to update if there is no change.
9065 	 */
9066 	if (timespec64_compare(cb, orig) <= 0)
9067 		return false;
9068 
9069 	/*
9070 	 * "When the time presented is in the future, the server can either
9071 	 *  clamp the new time to the current time, or it may
9072 	 *  return NFS4ERR_DELAY to the client, allowing it to retry."
9073 	 */
9074 	if (timespec64_compare(cb, now) > 0) {
9075 		/* clamp it */
9076 		*cb = *now;
9077 	}
9078 
9079 	return true;
9080 }
9081 
cb_getattr_update_times(struct dentry * dentry,struct nfs4_delegation * dp)9082 static int cb_getattr_update_times(struct dentry *dentry, struct nfs4_delegation *dp)
9083 {
9084 	struct inode *inode = d_inode(dentry);
9085 	struct timespec64 now = current_time(inode);
9086 	struct nfs4_cb_fattr *ncf = &dp->dl_cb_fattr;
9087 	struct iattr attrs = { };
9088 	int ret;
9089 
9090 	if (deleg_attrs_deleg(dp->dl_type)) {
9091 		struct timespec64 atime = inode_get_atime(inode);
9092 		struct timespec64 mtime = inode_get_mtime(inode);
9093 
9094 		attrs.ia_atime = ncf->ncf_cb_atime;
9095 		attrs.ia_mtime = ncf->ncf_cb_mtime;
9096 
9097 		if (set_cb_time(&attrs.ia_atime, &atime, &now))
9098 			attrs.ia_valid |= ATTR_ATIME | ATTR_ATIME_SET;
9099 
9100 		if (set_cb_time(&attrs.ia_mtime, &mtime, &now)) {
9101 			attrs.ia_valid |= ATTR_CTIME | ATTR_MTIME | ATTR_MTIME_SET;
9102 			attrs.ia_ctime = attrs.ia_mtime;
9103 		}
9104 	} else {
9105 		attrs.ia_valid |= ATTR_MTIME | ATTR_CTIME;
9106 		attrs.ia_mtime = attrs.ia_ctime = now;
9107 	}
9108 
9109 	if (!attrs.ia_valid)
9110 		return 0;
9111 
9112 	attrs.ia_valid |= ATTR_DELEG;
9113 	inode_lock(inode);
9114 	ret = notify_change(&nop_mnt_idmap, dentry, &attrs, NULL);
9115 	inode_unlock(inode);
9116 	return ret;
9117 }
9118 
9119 /**
9120  * nfsd4_deleg_getattr_conflict - Recall if GETATTR causes conflict
9121  * @rqstp: RPC transaction context
9122  * @dentry: dentry of inode to be checked for a conflict
9123  * @pdp: returned WRITE delegation, if one was found
9124  *
9125  * This function is called when there is a conflict between a write
9126  * delegation and a change/size GETATTR from another client. The server
9127  * must either use the CB_GETATTR to get the current values of the
9128  * attributes from the client that holds the delegation or recall the
9129  * delegation before replying to the GETATTR. See RFC 8881 section
9130  * 18.7.4.
9131  *
9132  * Returns 0 if there is no conflict; otherwise an nfs_stat
9133  * code is returned. If @pdp is set to a non-NULL value, then the
9134  * caller must put the reference.
9135  */
9136 __be32
nfsd4_deleg_getattr_conflict(struct svc_rqst * rqstp,struct dentry * dentry,struct nfs4_delegation ** pdp)9137 nfsd4_deleg_getattr_conflict(struct svc_rqst *rqstp, struct dentry *dentry,
9138 			     struct nfs4_delegation **pdp)
9139 {
9140 	__be32 status;
9141 	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
9142 	struct file_lock_context *ctx;
9143 	struct nfs4_delegation *dp = NULL;
9144 	struct file_lease *fl;
9145 	struct nfs4_cb_fattr *ncf;
9146 	struct inode *inode = d_inode(dentry);
9147 
9148 	ctx = locks_inode_context(inode);
9149 	if (!ctx)
9150 		return nfs_ok;
9151 
9152 #define NON_NFSD_LEASE ((void *)1)
9153 
9154 	spin_lock(&ctx->flc_lock);
9155 	for_each_file_lock(fl, &ctx->flc_lease) {
9156 		if (fl->c.flc_flags == FL_LAYOUT)
9157 			continue;
9158 		if (fl->c.flc_type == F_WRLCK) {
9159 			if (fl->fl_lmops == &nfsd_lease_mng_ops)
9160 				dp = fl->c.flc_owner;
9161 			else
9162 				dp = NON_NFSD_LEASE;
9163 		}
9164 		break;
9165 	}
9166 	if (dp == NULL || dp == NON_NFSD_LEASE ||
9167 	    dp->dl_recall.cb_clp == *(rqstp->rq_lease_breaker)) {
9168 		spin_unlock(&ctx->flc_lock);
9169 		if (dp == NON_NFSD_LEASE) {
9170 			status = nfserrno(nfsd_open_break_lease(inode,
9171 								NFSD_MAY_READ));
9172 			if (status != nfserr_jukebox ||
9173 			    !nfsd_wait_for_delegreturn(rqstp, inode))
9174 				return status;
9175 		}
9176 		return 0;
9177 	}
9178 
9179 	nfsd_stats_wdeleg_getattr_inc(nn);
9180 	refcount_inc(&dp->dl_stid.sc_count);
9181 	ncf = &dp->dl_cb_fattr;
9182 	nfs4_cb_getattr(&dp->dl_cb_fattr);
9183 	spin_unlock(&ctx->flc_lock);
9184 
9185 	wait_on_bit_timeout(&ncf->ncf_cb_flags, CB_GETATTR_BUSY,
9186 			    TASK_INTERRUPTIBLE, NFSD_CB_GETATTR_TIMEOUT);
9187 	if (ncf->ncf_cb_status) {
9188 		/* Recall delegation only if client didn't respond */
9189 		status = nfserrno(nfsd_open_break_lease(inode, NFSD_MAY_READ));
9190 		if (status != nfserr_jukebox ||
9191 		    !nfsd_wait_for_delegreturn(rqstp, inode))
9192 			goto out_status;
9193 	}
9194 	if (!ncf->ncf_file_modified &&
9195 	    (ncf->ncf_initial_cinfo != ncf->ncf_cb_change ||
9196 	     ncf->ncf_cur_fsize != ncf->ncf_cb_fsize))
9197 		ncf->ncf_file_modified = true;
9198 	if (ncf->ncf_file_modified) {
9199 		int err;
9200 
9201 		/*
9202 		 * Per section 10.4.3 of RFC 8881, the server would
9203 		 * not update the file's metadata with the client's
9204 		 * modified size
9205 		 */
9206 		err = cb_getattr_update_times(dentry, dp);
9207 		if (err) {
9208 			status = nfserrno(err);
9209 			goto out_status;
9210 		}
9211 		ncf->ncf_cur_fsize = ncf->ncf_cb_fsize;
9212 		*pdp = dp;
9213 		return nfs_ok;
9214 	}
9215 	status = nfs_ok;
9216 out_status:
9217 	nfs4_put_stid(&dp->dl_stid);
9218 	return status;
9219 }
9220