1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * NFS server file handle treatment.
4 *
5 * Copyright (C) 1995, 1996 Olaf Kirch <okir@monad.swb.de>
6 * Portions Copyright (C) 1999 G. Allen Morris III <gam3@acm.org>
7 * Extensive rewrite by Neil Brown <neilb@cse.unsw.edu.au> Southern-Spring 1999
8 * ... and again Southern-Winter 2001 to support export_operations
9 */
10
11 #include <linux/exportfs.h>
12
13 #include <linux/sunrpc/svcauth_gss.h>
14 #include <crypto/utils.h>
15 #include "nfsd.h"
16 #include "netns.h"
17 #include "stats.h"
18 #include "vfs.h"
19 #include "auth.h"
20 #include "trace.h"
21
22 #define NFSDDBG_FACILITY NFSDDBG_FH
23
24
25 /*
26 * our acceptability function.
27 * if NOSUBTREECHECK, accept anything
28 * if not, require that we can walk up to exp->ex_dentry
29 * doing some checks on the 'x' bits
30 */
nfsd_acceptable(void * expv,struct dentry * dentry)31 static int nfsd_acceptable(void *expv, struct dentry *dentry)
32 {
33 struct svc_export *exp = expv;
34 int rv;
35 struct dentry *tdentry;
36 struct dentry *parent;
37
38 if (exp->ex_flags & NFSEXP_NOSUBTREECHECK)
39 return 1;
40
41 tdentry = dget(dentry);
42 while (tdentry != exp->ex_path.dentry && !IS_ROOT(tdentry)) {
43 /* make sure parents give x permission to user */
44 int err;
45 parent = dget_parent(tdentry);
46 err = inode_permission(&nop_mnt_idmap,
47 d_inode(parent), MAY_EXEC);
48 if (err < 0) {
49 dput(parent);
50 break;
51 }
52 dput(tdentry);
53 tdentry = parent;
54 }
55 if (tdentry != exp->ex_path.dentry)
56 dprintk("nfsd_acceptable failed at %p %pd\n", tdentry, tdentry);
57 rv = (tdentry == exp->ex_path.dentry);
58 dput(tdentry);
59 return rv;
60 }
61
62 /* Type check. The correct error return for type mismatches does not seem to be
63 * generally agreed upon. SunOS seems to use EISDIR if file isn't S_IFREG; a
64 * comment in the NFSv3 spec says this is incorrect (implementation notes for
65 * the write call).
66 */
67 static inline __be32
nfsd_mode_check(struct dentry * dentry,umode_t requested)68 nfsd_mode_check(struct dentry *dentry, umode_t requested)
69 {
70 umode_t mode = d_inode(dentry)->i_mode & S_IFMT;
71
72 if (requested == 0) /* the caller doesn't care */
73 return nfs_ok;
74 if (mode == requested) {
75 if (mode == S_IFDIR && !d_can_lookup(dentry))
76 return nfserr_notdir;
77 return nfs_ok;
78 }
79 if (mode == S_IFLNK) {
80 if (requested == S_IFDIR)
81 return nfserr_symlink_not_dir;
82 return nfserr_symlink;
83 }
84 if (requested == S_IFDIR)
85 return nfserr_notdir;
86 if (mode == S_IFDIR)
87 return nfserr_isdir;
88 return nfserr_wrong_type;
89 }
90
nfsd_originating_port_ok(struct svc_rqst * rqstp,struct svc_cred * cred,struct svc_export * exp)91 static bool nfsd_originating_port_ok(struct svc_rqst *rqstp,
92 struct svc_cred *cred,
93 struct svc_export *exp)
94 {
95 if (nfsexp_flags(cred, exp) & NFSEXP_INSECURE_PORT)
96 return true;
97 /* We don't require gss requests to use low ports: */
98 if (cred->cr_flavor >= RPC_AUTH_GSS)
99 return true;
100 return test_bit(RQ_SECURE, &rqstp->rq_flags);
101 }
102
nfsd_setuser_and_check_port(struct svc_rqst * rqstp,struct svc_cred * cred,struct svc_export * exp)103 static __be32 nfsd_setuser_and_check_port(struct svc_rqst *rqstp,
104 struct svc_cred *cred,
105 struct svc_export *exp)
106 {
107 /* Check if the request originated from a secure port. */
108 if (rqstp && !nfsd_originating_port_ok(rqstp, cred, exp)) {
109 if (IS_ENABLED(CONFIG_SUNRPC_DEBUG)) {
110 char buf[RPC_MAX_ADDRBUFLEN];
111
112 dprintk("nfsd: request from insecure port %s!\n",
113 svc_print_addr(rqstp, buf, sizeof(buf)));
114 }
115 return nfserr_perm;
116 }
117
118 /* Set user creds for this exportpoint */
119 return nfserrno(nfsd_setuser(cred, exp));
120 }
121
check_pseudo_root(struct dentry * dentry,struct svc_export * exp)122 static inline __be32 check_pseudo_root(struct dentry *dentry,
123 struct svc_export *exp)
124 {
125 if (!(exp->ex_flags & NFSEXP_V4ROOT))
126 return nfs_ok;
127 /*
128 * We're exposing only the directories and symlinks that have to be
129 * traversed on the way to real exports:
130 */
131 if (unlikely(!d_is_dir(dentry) &&
132 !d_is_symlink(dentry)))
133 return nfserr_stale;
134 /*
135 * A pseudoroot export gives permission to access only one
136 * single directory; the kernel has to make another upcall
137 * before granting access to anything else under it:
138 */
139 if (unlikely(dentry != exp->ex_path.dentry))
140 return nfserr_stale;
141 return nfs_ok;
142 }
143
144 /* Size of a file handle MAC, in 4-octet words */
145 #define FH_MAC_WORDS (sizeof(__le64) / 4)
146
fh_append_mac(struct knfsd_fh * fh,int fh_maxsize,struct net * net)147 bool fh_append_mac(struct knfsd_fh *fh, int fh_maxsize, struct net *net)
148 {
149 struct nfsd_net *nn = net_generic(net, nfsd_net_id);
150 siphash_key_t *fh_key = nn->fh_key;
151 __le64 hash;
152
153 if (!fh_key)
154 goto out_no_key;
155 if (fh->fh_size + sizeof(hash) > fh_maxsize)
156 goto out_no_space;
157
158 hash = cpu_to_le64(siphash(&fh->fh_raw, fh->fh_size, fh_key));
159 memcpy(&fh->fh_raw[fh->fh_size], &hash, sizeof(hash));
160 fh->fh_size += sizeof(hash);
161 return true;
162
163 out_no_key:
164 pr_warn_ratelimited("NFSD: unable to sign filehandles, fh_key not set.\n");
165 return false;
166
167 out_no_space:
168 pr_warn_ratelimited("NFSD: unable to sign filehandles, fh_size %zu would be greater than fh_maxsize %d.\n",
169 fh->fh_size + sizeof(hash), fh_maxsize);
170 return false;
171 }
172
173 /*
174 * Verify that the filehandle's MAC was hashed from this filehandle
175 * given the server's fh_key:
176 */
fh_verify_mac(struct svc_fh * fhp,struct net * net)177 static bool fh_verify_mac(struct svc_fh *fhp, struct net *net)
178 {
179 struct nfsd_net *nn = net_generic(net, nfsd_net_id);
180 struct knfsd_fh *fh = &fhp->fh_handle;
181 siphash_key_t *fh_key = nn->fh_key;
182 __le64 hash;
183
184 if (!fh_key) {
185 pr_warn_ratelimited("NFSD: unable to verify signed filehandles, fh_key not set.\n");
186 return false;
187 }
188
189 hash = cpu_to_le64(siphash(&fh->fh_raw, fh->fh_size - sizeof(hash), fh_key));
190 return crypto_memneq(&fh->fh_raw[fh->fh_size - sizeof(hash)],
191 &hash, sizeof(hash)) == 0;
192 }
193
194 /*
195 * Use the given filehandle to look up the corresponding export and
196 * dentry. On success, the results are used to set fh_export and
197 * fh_dentry.
198 */
nfsd_set_fh_dentry(struct svc_rqst * rqstp,struct net * net,struct svc_cred * cred,struct auth_domain * client,struct auth_domain * gssclient,struct svc_fh * fhp)199 static __be32 nfsd_set_fh_dentry(struct svc_rqst *rqstp, struct net *net,
200 struct svc_cred *cred,
201 struct auth_domain *client,
202 struct auth_domain *gssclient,
203 struct svc_fh *fhp)
204 {
205 struct knfsd_fh *fh = &fhp->fh_handle;
206 struct fid *fid = NULL;
207 struct svc_export *exp;
208 struct dentry *dentry;
209 int fileid_type;
210 int data_left = fh->fh_size/4;
211 int len;
212 __be32 error;
213
214 error = nfserr_badhandle;
215 if (fh->fh_size == 0)
216 return nfserr_nofilehandle;
217
218 if (fh->fh_version != 1)
219 return error;
220
221 if (--data_left < 0)
222 return error;
223 if (fh->fh_auth_type != 0)
224 return error;
225 len = key_len(fh->fh_fsid_type) / 4;
226 if (len == 0)
227 return error;
228 if (fh->fh_fsid_type == FSID_MAJOR_MINOR) {
229 u32 *fsid = fh_fsid(fh);
230
231 /* deprecated, convert to type 3 */
232 len = key_len(FSID_ENCODE_DEV)/4;
233 fh->fh_fsid_type = FSID_ENCODE_DEV;
234 /*
235 * struct knfsd_fh uses host-endian fields, which are
236 * sometimes used to hold net-endian values. This
237 * confuses sparse, so we must use __force here to
238 * keep it from complaining.
239 */
240 fsid[0] = new_encode_dev(MKDEV(ntohl((__force __be32)fsid[0]),
241 ntohl((__force __be32)fsid[1])));
242 fsid[1] = fsid[2];
243 }
244 data_left -= len;
245 if (data_left < 0)
246 return error;
247 exp = rqst_exp_find(rqstp ? &rqstp->rq_chandle : NULL,
248 net, client, gssclient,
249 fh->fh_fsid_type, fh_fsid(fh));
250 fid = (struct fid *)(fh_fsid(fh) + len);
251
252 error = nfserr_stale;
253 if (IS_ERR(exp)) {
254 trace_nfsd_set_fh_dentry_badexport(rqstp, fhp, PTR_ERR(exp));
255
256 if (PTR_ERR(exp) == -ENOENT)
257 return error;
258
259 return nfserrno(PTR_ERR(exp));
260 }
261
262 if (exp->ex_flags & NFSEXP_NOSUBTREECHECK) {
263 /* Elevate privileges so that the lack of 'r' or 'x'
264 * permission on some parent directory will
265 * not stop exportfs_decode_fh from being able
266 * to reconnect a directory into the dentry cache.
267 * The same problem can affect "SUBTREECHECK" exports,
268 * but as nfsd_acceptable depends on correct
269 * access control settings being in effect, we cannot
270 * fix that case easily.
271 */
272 struct cred *new = prepare_creds();
273 if (!new) {
274 error = nfserrno(-ENOMEM);
275 goto out;
276 }
277 new->cap_effective =
278 cap_raise_nfsd_set(new->cap_effective,
279 new->cap_permitted);
280 put_cred(override_creds(new));
281 } else {
282 error = nfsd_setuser_and_check_port(rqstp, cred, exp);
283 if (error)
284 goto out;
285 }
286
287 /*
288 * Look up the dentry using the NFS file handle.
289 */
290 fileid_type = fh->fh_fileid_type;
291 error = nfserr_stale;
292
293 if (fileid_type == FILEID_ROOT) {
294 /* We don't sign or verify the root, no per-file identity */
295 dentry = dget(exp->ex_path.dentry);
296 } else {
297 if (exp->ex_flags & NFSEXP_SIGN_FH) {
298 if (!fh_verify_mac(fhp, net)) {
299 trace_nfsd_set_fh_dentry_badmac(rqstp, fhp, -ESTALE);
300 goto out;
301 }
302 data_left -= FH_MAC_WORDS;
303 }
304
305 dentry = exportfs_decode_fh_raw(exp->ex_path.mnt, fid,
306 data_left, fileid_type, 0,
307 nfsd_acceptable, exp);
308 if (IS_ERR_OR_NULL(dentry)) {
309 trace_nfsd_set_fh_dentry_badhandle(rqstp, fhp,
310 dentry ? PTR_ERR(dentry) : -ESTALE);
311 switch (PTR_ERR(dentry)) {
312 case -ENOMEM:
313 case -ETIMEDOUT:
314 break;
315 default:
316 dentry = ERR_PTR(-ESTALE);
317 }
318 }
319 }
320
321 error = nfserr_badhandle;
322 if (dentry == NULL)
323 goto out;
324 if (IS_ERR(dentry)) {
325 if (PTR_ERR(dentry) != -EINVAL)
326 error = nfserrno(PTR_ERR(dentry));
327 goto out;
328 }
329
330 if (d_is_dir(dentry) &&
331 (dentry->d_flags & DCACHE_DISCONNECTED)) {
332 printk("nfsd: find_fh_dentry returned a DISCONNECTED directory: %pd2\n",
333 dentry);
334 }
335
336 switch (fhp->fh_maxsize) {
337 case NFS4_FHSIZE:
338 if (dentry->d_sb->s_export_op->flags & EXPORT_OP_NOATOMIC_ATTR)
339 fhp->fh_no_atomic_attr = true;
340 fhp->fh_64bit_cookies = true;
341 break;
342 case NFS3_FHSIZE:
343 if (dentry->d_sb->s_export_op->flags & EXPORT_OP_NOWCC)
344 fhp->fh_no_wcc = true;
345 fhp->fh_64bit_cookies = true;
346 if (exp->ex_flags & NFSEXP_V4ROOT) {
347 dput(dentry);
348 goto out;
349 }
350 break;
351 case NFS_FHSIZE:
352 fhp->fh_no_wcc = true;
353 if (EX_WGATHER(exp))
354 fhp->fh_use_wgather = true;
355 if (exp->ex_flags & NFSEXP_V4ROOT) {
356 dput(dentry);
357 goto out;
358 }
359 }
360
361 fhp->fh_dentry = dentry;
362 fhp->fh_export = exp;
363
364 return 0;
365 out:
366 exp_put(exp);
367 return error;
368 }
369
370 /**
371 * __fh_verify - filehandle lookup and access checking
372 * @rqstp: RPC transaction context, or NULL
373 * @net: net namespace in which to perform the export lookup
374 * @cred: RPC user credential
375 * @client: RPC auth domain
376 * @gssclient: RPC GSS auth domain, or NULL
377 * @fhp: filehandle to be verified
378 * @type: expected type of object pointed to by filehandle
379 * @access: type of access needed to object
380 *
381 * See fh_verify() for further descriptions of @fhp, @type, and @access.
382 */
383 static __be32
__fh_verify(struct svc_rqst * rqstp,struct net * net,struct svc_cred * cred,struct auth_domain * client,struct auth_domain * gssclient,struct svc_fh * fhp,umode_t type,int access)384 __fh_verify(struct svc_rqst *rqstp,
385 struct net *net, struct svc_cred *cred,
386 struct auth_domain *client,
387 struct auth_domain *gssclient,
388 struct svc_fh *fhp, umode_t type, int access)
389 {
390 struct nfsd_net *nn = net_generic(net, nfsd_net_id);
391 struct svc_export *exp = NULL;
392 bool may_bypass_gss = false;
393 struct dentry *dentry;
394 __be32 error;
395
396 if (!fhp->fh_dentry) {
397 error = nfsd_set_fh_dentry(rqstp, net, cred, client,
398 gssclient, fhp);
399 if (error)
400 goto out;
401 }
402 dentry = fhp->fh_dentry;
403 exp = fhp->fh_export;
404
405 trace_nfsd_fh_verify(rqstp, fhp, type, access);
406
407 /*
408 * We still have to do all these permission checks, even when
409 * fh_dentry is already set:
410 * - fh_verify may be called multiple times with different
411 * "access" arguments (e.g. nfsd_proc_create calls
412 * fh_verify(...,NFSD_MAY_EXEC) first, then later (in
413 * nfsd_create) calls fh_verify(...,NFSD_MAY_CREATE).
414 * - in the NFSv4 case, the filehandle may have been filled
415 * in by fh_compose, and given a dentry, but further
416 * compound operations performed with that filehandle
417 * still need permissions checks. In the worst case, a
418 * mountpoint crossing may have changed the export
419 * options, and we may now need to use a different uid
420 * (for example, if different id-squashing options are in
421 * effect on the new filesystem).
422 */
423 error = check_pseudo_root(dentry, exp);
424 if (error)
425 goto out;
426
427 error = nfsd_setuser_and_check_port(rqstp, cred, exp);
428 if (error)
429 goto out;
430
431 error = nfsd_mode_check(dentry, type);
432 if (error)
433 goto out;
434
435 /*
436 * If rqstp is NULL, this is a LOCALIO request which will only
437 * ever use a filehandle/credential pair for which access has
438 * been affirmed (by ACCESS or OPEN NFS requests) over the
439 * wire. Skip both the xprtsec policy and the security flavor
440 * checks.
441 */
442 if (!rqstp)
443 goto check_permissions;
444
445 if ((access & NFSD_MAY_NLM) && (exp->ex_flags & NFSEXP_NOAUTHNLM))
446 /* NLM is allowed to fully bypass authentication */
447 goto out;
448
449 /*
450 * NLM is allowed to bypass the xprtsec policy check because lockd
451 * doesn't support xprtsec.
452 */
453 if (!(access & NFSD_MAY_NLM)) {
454 error = check_xprtsec_policy(exp, rqstp);
455 if (error)
456 goto out;
457 }
458
459 if (access & NFSD_MAY_BYPASS_GSS)
460 may_bypass_gss = true;
461 /*
462 * Clients may expect to be able to use auth_sys during mount,
463 * even if they use gss for everything else; see section 2.3.2
464 * of rfc 2623.
465 */
466 if (access & NFSD_MAY_BYPASS_GSS_ON_ROOT
467 && exp->ex_path.dentry == dentry)
468 may_bypass_gss = true;
469
470 error = check_security_flavor(exp, rqstp, may_bypass_gss);
471 if (error)
472 goto out;
473
474 svc_xprt_set_valid(rqstp->rq_xprt);
475
476 check_permissions:
477 /* Finally, check access permissions. */
478 error = nfsd_permission(cred, exp, dentry, access);
479 out:
480 trace_nfsd_fh_verify_err(rqstp, fhp, type, access, error);
481 if (error == nfserr_stale)
482 nfsd_stats_fh_stale_inc(nn, exp);
483 return error;
484 }
485
486 /**
487 * fh_verify_local - filehandle lookup and access checking
488 * @net: net namespace in which to perform the export lookup
489 * @cred: RPC user credential
490 * @client: RPC auth domain
491 * @fhp: filehandle to be verified
492 * @type: expected type of object pointed to by filehandle
493 * @access: type of access needed to object
494 *
495 * This API can be used by callers who do not have an RPC
496 * transaction context (ie are not running in an nfsd thread).
497 *
498 * See fh_verify() for further descriptions of @fhp, @type, and @access.
499 */
500 __be32
fh_verify_local(struct net * net,struct svc_cred * cred,struct auth_domain * client,struct svc_fh * fhp,umode_t type,int access)501 fh_verify_local(struct net *net, struct svc_cred *cred,
502 struct auth_domain *client, struct svc_fh *fhp,
503 umode_t type, int access)
504 {
505 return __fh_verify(NULL, net, cred, client, NULL,
506 fhp, type, access);
507 }
508
509 /**
510 * fh_verify - filehandle lookup and access checking
511 * @rqstp: pointer to current rpc request
512 * @fhp: filehandle to be verified
513 * @type: expected type of object pointed to by filehandle
514 * @access: type of access needed to object
515 *
516 * Look up a dentry from the on-the-wire filehandle, check the client's
517 * access to the export, and set the current task's credentials.
518 *
519 * Regardless of success or failure of fh_verify(), fh_put() should be
520 * called on @fhp when the caller is finished with the filehandle.
521 *
522 * fh_verify() may be called multiple times on a given filehandle, for
523 * example, when processing an NFSv4 compound. The first call will look
524 * up a dentry using the on-the-wire filehandle. Subsequent calls will
525 * skip the lookup and just perform the other checks and possibly change
526 * the current task's credentials.
527 *
528 * @type specifies the type of object expected using one of the S_IF*
529 * constants defined in include/linux/stat.h. The caller may use zero
530 * to indicate that it doesn't care, or a negative integer to indicate
531 * that it expects something not of the given type.
532 *
533 * @access is formed from the NFSD_MAY_* constants defined in
534 * fs/nfsd/vfs.h.
535 */
536 __be32
fh_verify(struct svc_rqst * rqstp,struct svc_fh * fhp,umode_t type,int access)537 fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, umode_t type, int access)
538 {
539 return __fh_verify(rqstp, SVC_NET(rqstp), &rqstp->rq_cred,
540 rqstp->rq_client, rqstp->rq_gssclient,
541 fhp, type, access);
542 }
543
544 /*
545 * Compose a file handle for an NFS reply.
546 *
547 * Note that when first composed, the dentry may not yet have
548 * an inode. In this case a call to fh_update should be made
549 * before the fh goes out on the wire ...
550 */
_fh_update(struct svc_fh * fhp,struct svc_export * exp,struct dentry * dentry)551 static void _fh_update(struct svc_fh *fhp, struct svc_export *exp,
552 struct dentry *dentry)
553 {
554 if (dentry != exp->ex_path.dentry) {
555 struct fid *fid = (struct fid *)
556 (fh_fsid(&fhp->fh_handle) + fhp->fh_handle.fh_size/4 - 1);
557 int maxsize = (fhp->fh_maxsize - fhp->fh_handle.fh_size)/4;
558 int fh_flags = (exp->ex_flags & NFSEXP_NOSUBTREECHECK) ? 0 :
559 EXPORT_FH_CONNECTABLE;
560 int fileid_type =
561 exportfs_encode_fh(dentry, fid, &maxsize, fh_flags);
562
563 fhp->fh_handle.fh_fileid_type =
564 fileid_type > 0 ? fileid_type : FILEID_INVALID;
565 fhp->fh_handle.fh_size += maxsize * 4;
566
567 if (exp->ex_flags & NFSEXP_SIGN_FH)
568 if (!fh_append_mac(&fhp->fh_handle, fhp->fh_maxsize,
569 exp->cd->net))
570 fhp->fh_handle.fh_fileid_type = FILEID_INVALID;
571 } else {
572 fhp->fh_handle.fh_fileid_type = FILEID_ROOT;
573 }
574 }
575
is_root_export(struct svc_export * exp)576 static bool is_root_export(struct svc_export *exp)
577 {
578 return exp->ex_path.dentry == exp->ex_path.dentry->d_sb->s_root;
579 }
580
exp_sb(struct svc_export * exp)581 static struct super_block *exp_sb(struct svc_export *exp)
582 {
583 return exp->ex_path.dentry->d_sb;
584 }
585
fsid_type_ok_for_exp(u8 fsid_type,struct svc_export * exp)586 static bool fsid_type_ok_for_exp(u8 fsid_type, struct svc_export *exp)
587 {
588 switch (fsid_type) {
589 case FSID_DEV:
590 if (!old_valid_dev(exp_sb(exp)->s_dev))
591 return false;
592 fallthrough;
593 case FSID_MAJOR_MINOR:
594 case FSID_ENCODE_DEV:
595 return exp_sb(exp)->s_type->fs_flags & FS_REQUIRES_DEV;
596 case FSID_NUM:
597 return exp->ex_flags & NFSEXP_FSID;
598 case FSID_UUID8:
599 case FSID_UUID16:
600 if (!is_root_export(exp))
601 return false;
602 fallthrough;
603 case FSID_UUID4_INUM:
604 case FSID_UUID16_INUM:
605 return exp->ex_uuid != NULL;
606 }
607 return true;
608 }
609
610
set_version_and_fsid_type(struct svc_fh * fhp,struct svc_export * exp,struct svc_fh * ref_fh)611 static void set_version_and_fsid_type(struct svc_fh *fhp, struct svc_export *exp, struct svc_fh *ref_fh)
612 {
613 u8 version;
614 u8 fsid_type;
615 retry:
616 version = 1;
617 if (ref_fh && ref_fh->fh_export == exp) {
618 version = ref_fh->fh_handle.fh_version;
619 fsid_type = ref_fh->fh_handle.fh_fsid_type;
620
621 ref_fh = NULL;
622
623 switch (version) {
624 case 0xca:
625 fsid_type = FSID_DEV;
626 break;
627 case 1:
628 break;
629 default:
630 goto retry;
631 }
632
633 /*
634 * As the fsid -> filesystem mapping was guided by
635 * user-space, there is no guarantee that the filesystem
636 * actually supports that fsid type. If it doesn't we
637 * loop around again without ref_fh set.
638 */
639 if (!fsid_type_ok_for_exp(fsid_type, exp))
640 goto retry;
641 } else if (exp->ex_flags & NFSEXP_FSID) {
642 fsid_type = FSID_NUM;
643 } else if (exp->ex_uuid) {
644 if (fhp->fh_maxsize >= 64) {
645 if (is_root_export(exp))
646 fsid_type = FSID_UUID16;
647 else
648 fsid_type = FSID_UUID16_INUM;
649 } else {
650 if (is_root_export(exp))
651 fsid_type = FSID_UUID8;
652 else
653 fsid_type = FSID_UUID4_INUM;
654 }
655 } else if (!old_valid_dev(exp_sb(exp)->s_dev))
656 /* for newer device numbers, we must use a newer fsid format */
657 fsid_type = FSID_ENCODE_DEV;
658 else
659 fsid_type = FSID_DEV;
660 fhp->fh_handle.fh_version = version;
661 if (version)
662 fhp->fh_handle.fh_fsid_type = fsid_type;
663 }
664
665 __be32
fh_compose(struct svc_fh * fhp,struct svc_export * exp,struct dentry * dentry,struct svc_fh * ref_fh)666 fh_compose(struct svc_fh *fhp, struct svc_export *exp, struct dentry *dentry,
667 struct svc_fh *ref_fh)
668 {
669 /* ref_fh is a reference file handle.
670 * if it is non-null and for the same filesystem, then we should compose
671 * a filehandle which is of the same version, where possible.
672 */
673
674 struct inode * inode = d_inode(dentry);
675 dev_t ex_dev = exp_sb(exp)->s_dev;
676
677 dprintk("nfsd: fh_compose(exp %02x:%02x/%llu %pd2, ino=%llu)\n",
678 MAJOR(ex_dev), MINOR(ex_dev),
679 d_inode(exp->ex_path.dentry)->i_ino,
680 dentry,
681 (inode ? inode->i_ino : 0));
682
683 /* Choose filehandle version and fsid type based on
684 * the reference filehandle (if it is in the same export)
685 * or the export options.
686 */
687 set_version_and_fsid_type(fhp, exp, ref_fh);
688
689 /* If we have a ref_fh, then copy the fh_no_wcc setting from it. */
690 fhp->fh_no_wcc = ref_fh ? ref_fh->fh_no_wcc : false;
691
692 if (ref_fh == fhp)
693 fh_put(ref_fh);
694
695 if (fhp->fh_dentry) {
696 printk(KERN_ERR "fh_compose: fh %pd2 not initialized!\n",
697 dentry);
698 }
699 if (fhp->fh_maxsize < NFS_FHSIZE)
700 printk(KERN_ERR "fh_compose: called with maxsize %d! %pd2\n",
701 fhp->fh_maxsize,
702 dentry);
703
704 fhp->fh_dentry = dget(dentry); /* our internal copy */
705 fhp->fh_export = exp_get(exp);
706
707 fhp->fh_handle.fh_size =
708 key_len(fhp->fh_handle.fh_fsid_type) + 4;
709 fhp->fh_handle.fh_auth_type = 0;
710
711 mk_fsid(fhp->fh_handle.fh_fsid_type,
712 fh_fsid(&fhp->fh_handle),
713 ex_dev,
714 d_inode(exp->ex_path.dentry)->i_ino,
715 exp->ex_fsid, exp->ex_uuid);
716
717 if (inode)
718 _fh_update(fhp, exp, dentry);
719 if (fhp->fh_handle.fh_fileid_type == FILEID_INVALID) {
720 fh_put(fhp);
721 return nfserr_stale;
722 }
723
724 return 0;
725 }
726
727 /*
728 * Update file handle information after changing a dentry.
729 * This is only called by nfsd_create, nfsd_create_v3 and nfsd_proc_create
730 */
731 __be32
fh_update(struct svc_fh * fhp)732 fh_update(struct svc_fh *fhp)
733 {
734 struct dentry *dentry;
735
736 if (!fhp->fh_dentry)
737 goto out_bad;
738
739 dentry = fhp->fh_dentry;
740 if (d_really_is_negative(dentry))
741 goto out_negative;
742 if (fhp->fh_handle.fh_fileid_type != FILEID_ROOT)
743 return 0;
744
745 _fh_update(fhp, fhp->fh_export, dentry);
746 if (fhp->fh_handle.fh_fileid_type == FILEID_INVALID)
747 return nfserr_stale;
748 return 0;
749 out_bad:
750 printk(KERN_ERR "fh_update: fh not verified!\n");
751 return nfserr_serverfault;
752 out_negative:
753 printk(KERN_ERR "fh_update: %pd2 still negative!\n",
754 dentry);
755 return nfserr_serverfault;
756 }
757
758 /**
759 * fh_getattr - Retrieve attributes on a local file
760 * @fhp: File handle of target file
761 * @stat: Caller-supplied kstat buffer to be filled in
762 *
763 * Returns nfs_ok on success, otherwise an NFS status code is
764 * returned.
765 */
fh_getattr(const struct svc_fh * fhp,struct kstat * stat)766 __be32 fh_getattr(const struct svc_fh *fhp, struct kstat *stat)
767 {
768 struct path p = {
769 .mnt = fhp->fh_export->ex_path.mnt,
770 .dentry = fhp->fh_dentry,
771 };
772 struct inode *inode = d_inode(p.dentry);
773 u32 request_mask = STATX_BASIC_STATS;
774
775 if (S_ISREG(inode->i_mode))
776 request_mask |= (STATX_DIOALIGN | STATX_DIO_READ_ALIGN);
777
778 if (fhp->fh_maxsize == NFS4_FHSIZE)
779 request_mask |= (STATX_BTIME | STATX_CHANGE_COOKIE);
780
781 return nfserrno(vfs_getattr(&p, stat, request_mask,
782 AT_STATX_SYNC_AS_STAT));
783 }
784
785 /**
786 * fh_fill_pre_attrs - Fill in pre-op attributes
787 * @fhp: file handle to be updated
788 *
789 */
fh_fill_pre_attrs(struct svc_fh * fhp)790 __be32 __must_check fh_fill_pre_attrs(struct svc_fh *fhp)
791 {
792 bool v4 = (fhp->fh_maxsize == NFS4_FHSIZE);
793 struct kstat stat;
794 __be32 err;
795
796 if (fhp->fh_no_wcc || fhp->fh_pre_saved)
797 return nfs_ok;
798
799 err = fh_getattr(fhp, &stat);
800 if (err)
801 return err;
802
803 if (v4)
804 fhp->fh_pre_change = nfsd4_change_attribute(&stat);
805
806 fhp->fh_pre_mtime = stat.mtime;
807 fhp->fh_pre_ctime = stat.ctime;
808 fhp->fh_pre_size = stat.size;
809 fhp->fh_pre_saved = true;
810 return nfs_ok;
811 }
812
813 /**
814 * fh_fill_post_attrs - Fill in post-op attributes
815 * @fhp: file handle to be updated
816 *
817 */
fh_fill_post_attrs(struct svc_fh * fhp)818 __be32 fh_fill_post_attrs(struct svc_fh *fhp)
819 {
820 bool v4 = (fhp->fh_maxsize == NFS4_FHSIZE);
821 __be32 err;
822
823 if (fhp->fh_no_wcc)
824 return nfs_ok;
825
826 if (fhp->fh_post_saved)
827 printk("nfsd: inode locked twice during operation.\n");
828
829 err = fh_getattr(fhp, &fhp->fh_post_attr);
830 if (err)
831 return err;
832
833 fhp->fh_post_saved = true;
834 if (v4)
835 fhp->fh_post_change =
836 nfsd4_change_attribute(&fhp->fh_post_attr);
837 return nfs_ok;
838 }
839
840 /**
841 * fh_fill_both_attrs - Fill pre-op and post-op attributes
842 * @fhp: file handle to be updated
843 *
844 * This is used when the directory wasn't changed, but wcc attributes
845 * are needed anyway.
846 */
fh_fill_both_attrs(struct svc_fh * fhp)847 __be32 __must_check fh_fill_both_attrs(struct svc_fh *fhp)
848 {
849 __be32 err;
850
851 err = fh_fill_post_attrs(fhp);
852 if (err)
853 return err;
854
855 fhp->fh_pre_change = fhp->fh_post_change;
856 fhp->fh_pre_mtime = fhp->fh_post_attr.mtime;
857 fhp->fh_pre_ctime = fhp->fh_post_attr.ctime;
858 fhp->fh_pre_size = fhp->fh_post_attr.size;
859 fhp->fh_pre_saved = true;
860 return nfs_ok;
861 }
862
863 /*
864 * Release a file handle.
865 */
866 void
fh_put(struct svc_fh * fhp)867 fh_put(struct svc_fh *fhp)
868 {
869 struct dentry * dentry = fhp->fh_dentry;
870 struct svc_export * exp = fhp->fh_export;
871 if (dentry) {
872 fhp->fh_dentry = NULL;
873 dput(dentry);
874 fh_clear_pre_post_attrs(fhp);
875 }
876 fh_drop_write(fhp);
877 if (exp) {
878 exp_put(exp);
879 fhp->fh_export = NULL;
880 }
881 fhp->fh_no_wcc = false;
882 return;
883 }
884
885 /*
886 * Shorthand for dprintk()'s
887 */
SVCFH_fmt(struct svc_fh * fhp)888 char * SVCFH_fmt(struct svc_fh *fhp)
889 {
890 struct knfsd_fh *fh = &fhp->fh_handle;
891 static char buf[2+1+1+64*3+1];
892
893 if (fh->fh_size > 64)
894 return "bad-fh";
895 sprintf(buf, "%d: %*ph", fh->fh_size, fh->fh_size, fh->fh_raw);
896 return buf;
897 }
898
fsid_source_fh(const struct knfsd_fh * fh,struct svc_export * exp)899 enum fsid_source fsid_source_fh(const struct knfsd_fh *fh,
900 struct svc_export *exp)
901 {
902 if (fh->fh_version != 1)
903 return FSIDSOURCE_DEV;
904 switch (fh->fh_fsid_type) {
905 case FSID_DEV:
906 case FSID_ENCODE_DEV:
907 case FSID_MAJOR_MINOR:
908 if (exp_sb(exp)->s_type->fs_flags & FS_REQUIRES_DEV)
909 return FSIDSOURCE_DEV;
910 break;
911 case FSID_NUM:
912 if (exp->ex_flags & NFSEXP_FSID)
913 return FSIDSOURCE_FSID;
914 break;
915 default:
916 break;
917 }
918 /* either a UUID type filehandle, or the filehandle doesn't
919 * match the export.
920 */
921 if (exp->ex_flags & NFSEXP_FSID)
922 return FSIDSOURCE_FSID;
923 if (exp->ex_uuid)
924 return FSIDSOURCE_UUID;
925 return FSIDSOURCE_DEV;
926 }
927
fsid_source(const struct svc_fh * fhp)928 enum fsid_source fsid_source(const struct svc_fh *fhp)
929 {
930 return fsid_source_fh(&fhp->fh_handle, fhp->fh_export);
931 }
932
933 /**
934 * nfsd4_change_attribute - Generate an NFSv4 change_attribute value
935 * @stat: inode attributes
936 *
937 * Caller must fill in @stat before calling, typically by invoking
938 * vfs_getattr() with STATX_MODE, STATX_CTIME, and STATX_CHANGE_COOKIE.
939 * Returns an unsigned 64-bit changeid4 value (RFC 8881 Section 3.2).
940 *
941 * We could use i_version alone as the change attribute. However, i_version
942 * can go backwards on a regular file after an unclean shutdown. On its own
943 * that doesn't necessarily cause a problem, but if i_version goes backwards
944 * and then is incremented again it could reuse a value that was previously
945 * used before boot, and a client who queried the two values might incorrectly
946 * assume nothing changed.
947 *
948 * By using both ctime and the i_version counter we guarantee that as long as
949 * time doesn't go backwards we never reuse an old value. If the filesystem
950 * advertises STATX_ATTR_CHANGE_MONOTONIC, then this mitigation is not
951 * needed.
952 *
953 * We only need to do this for regular files as well. For directories, we
954 * assume that the new change attr is always logged to stable storage in some
955 * fashion before the results can be seen.
956 */
nfsd4_change_attribute(const struct kstat * stat)957 u64 nfsd4_change_attribute(const struct kstat *stat)
958 {
959 u64 chattr;
960
961 if (stat->result_mask & STATX_CHANGE_COOKIE) {
962 chattr = stat->change_cookie;
963 if (S_ISREG(stat->mode) &&
964 !(stat->attributes & STATX_ATTR_CHANGE_MONOTONIC)) {
965 chattr += (u64)stat->ctime.tv_sec << 30;
966 chattr += stat->ctime.tv_nsec;
967 }
968 } else {
969 chattr = time_to_chattr(&stat->ctime);
970 }
971 return chattr;
972 }
973