NFSD: verify the opened dentry after setting a delegation

[ Upstream commit 876c553cb41026cb6ad3cef970a35e5f69c42a25 ]

Between opening a file and setting a delegation on it, someone could
rename or unlink the dentry. If this happens, we do not want to grant a
delegation on the open.

On a CLAIM_NULL open, we're opening by filename, and we may (in the
non-create case) or may not (in the create case) be holding i_rwsem
when attempting to set a delegation.  The latter case allows a
race.

After getting a lease, redo the lookup of the file being opened and
validate that the resulting dentry matches the one in the open file
description.

To properly redo the lookup we need an rqst pointer to pass to
nfsd_lookup_dentry(), so make sure that is available.

Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>

diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 46ec66f4ec9e7197cd0a43df5298d27cfbf446f5..ae0948271da9ccc51130d7111be792d622d62660 100644 (file)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -547,6 +547,7 @@ nfsd4_open(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                open->op_openowner);
 
        open->op_filp = NULL;
+       open->op_rqstp = rqstp;
 
        /* This check required by spec. */
        if (open->op_create && open->op_claim_type != NFS4_OPEN_CLAIM_NULL)

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 2b333f9259a0373b05dd3f9de570b6f52297f48e..7122ebc50a0359823bf5163999841da6ff4e2588 100644 (file)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -5305,11 +5305,44 @@ static int nfsd4_check_conflicting_opens(struct nfs4_client *clp,
        return 0;
 }
 
+/*
+ * It's possible that between opening the dentry and setting the delegation,
+ * that it has been renamed or unlinked. Redo the lookup to verify that this
+ * hasn't happened.
+ */
+static int
+nfsd4_verify_deleg_dentry(struct nfsd4_open *open, struct nfs4_file *fp,
+                         struct svc_fh *parent)
+{
+       struct svc_export *exp;
+       struct dentry *child;
+       __be32 err;
+
+       /* parent may already be locked, and it may get unlocked by
+        * this call, but that is safe.
+        */
+       err = nfsd_lookup_dentry(open->op_rqstp, parent,
+                                open->op_fname, open->op_fnamelen,
+                                &exp, &child);
+
+       if (err)
+               return -EAGAIN;
+
+       dput(child);
+       if (child != file_dentry(fp->fi_deleg_file->nf_file))
+               return -EAGAIN;
+
+       return 0;
+}
+
 static struct nfs4_delegation *
-nfs4_set_delegation(struct nfs4_client *clp,
-                   struct nfs4_file *fp, struct nfs4_clnt_odstate *odstate)
+nfs4_set_delegation(struct nfsd4_open *open, struct nfs4_ol_stateid *stp,
+                   struct svc_fh *parent)
 {
        int status = 0;
+       struct nfs4_client *clp = stp->st_stid.sc_client;
+       struct nfs4_file *fp = stp->st_stid.sc_file;
+       struct nfs4_clnt_odstate *odstate = stp->st_clnt_odstate;
        struct nfs4_delegation *dp;
        struct nfsd_file *nf;
        struct file_lock *fl;
@@ -5364,6 +5397,13 @@ nfs4_set_delegation(struct nfs4_client *clp,
                locks_free_lock(fl);
        if (status)
                goto out_clnt_odstate;
+
+       if (parent) {
+               status = nfsd4_verify_deleg_dentry(open, fp, parent);
+               if (status)
+                       goto out_unlock;
+       }
+
        status = nfsd4_check_conflicting_opens(clp, fp);
        if (status)
                goto out_unlock;
@@ -5419,11 +5459,13 @@ static void nfsd4_open_deleg_none_ext(struct nfsd4_open *open, int status)
  * proper support for them.
  */
 static void
-nfs4_open_delegation(struct nfsd4_open *open, struct nfs4_ol_stateid *stp)
+nfs4_open_delegation(struct nfsd4_open *open, struct nfs4_ol_stateid *stp,
+                    struct svc_fh *currentfh)
 {
        struct nfs4_delegation *dp;
        struct nfs4_openowner *oo = openowner(stp->st_stateowner);
        struct nfs4_client *clp = stp->st_stid.sc_client;
+       struct svc_fh *parent = NULL;
        int cb_up;
        int status = 0;
 
@@ -5437,6 +5479,8 @@ nfs4_open_delegation(struct nfsd4_open *open, struct nfs4_ol_stateid *stp)
                                goto out_no_deleg;
                        break;
                case NFS4_OPEN_CLAIM_NULL:
+                       parent = currentfh;
+                       fallthrough;
                case NFS4_OPEN_CLAIM_FH:
                        /*
                         * Let's not give out any delegations till everyone's
@@ -5451,7 +5495,7 @@ nfs4_open_delegation(struct nfsd4_open *open, struct nfs4_ol_stateid *stp)
                default:
                        goto out_no_deleg;
        }
-       dp = nfs4_set_delegation(clp, stp->st_stid.sc_file, stp->st_clnt_odstate);
+       dp = nfs4_set_delegation(open, stp, parent);
        if (IS_ERR(dp))
                goto out_no_deleg;
 
@@ -5583,7 +5627,7 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf
        * Attempt to hand out a delegation. No error return, because the
        * OPEN succeeds even if we fail.
        */
-       nfs4_open_delegation(open, stp);
+       nfs4_open_delegation(open, stp, &resp->cstate.current_fh);
 nodeleg:
        status = nfs_ok;
        trace_nfsd_open(&stp->st_stid.sc_stateid);

diff --git a/fs/nfsd/xdr4.h b/fs/nfsd/xdr4.h
index adb9aef26d7f1bea4f68c43b2ac6a0364a288786..466e2786fc976ca3d1fcb9c460dc172366475794 100644 (file)
--- a/fs/nfsd/xdr4.h
+++ b/fs/nfsd/xdr4.h
@@ -279,6 +279,7 @@ struct nfsd4_open {
        struct nfs4_clnt_odstate *op_odstate; /* used during processing */
        struct nfs4_acl *op_acl;
        struct xdr_netobj op_label;
+       struct svc_rqst *op_rqstp;
 };
 
 struct nfsd4_open_confirm {