diff options
| author | Trond Myklebust <trond.myklebust@primarydata.com> | 2015-12-28 19:30:05 -0500 |
|---|---|---|
| committer | Sasha Levin <alexander.levin@verizon.com> | 2017-07-26 19:27:34 -0400 |
| commit | 36cfa33b12d6f80469f7642afc87fd310b7afb96 (patch) | |
| tree | e7ad808e30830e73cec074d3a9b2b1c9fe273b61 /fs | |
| parent | 5f01567ce5412df02cbaa1d3ff4bddae028ca4f6 (diff) | |
NFS: Ensure we revalidate attributes before using execute_ok()
[ Upstream commit 5c5fc09a1157a11dbe84e6421c3e0b37d05238cb ]
Donald Buczek reports that NFS clients can also report incorrect
results for access() due to lack of revalidation of attributes
before calling execute_ok().
Looking closely, it seems chdir() is afflicted with the same problem.
Fix is to ensure we call nfs_revalidate_inode_rcu() or
nfs_revalidate_inode() as appropriate before deciding to trust
execute_ok().
Reported-by: Donald Buczek <buczek@molgen.mpg.de>
Link: http://lkml.kernel.org/r/1451331530-3748-1-git-send-email-buczek@molgen.mpg.de
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/nfs/dir.c | 18 |
1 files changed, 16 insertions, 2 deletions
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c index aadb4af4a0fe..a6b791e029f9 100644 --- a/fs/nfs/dir.c +++ b/fs/nfs/dir.c @@ -2446,6 +2446,20 @@ int nfs_may_open(struct inode *inode, struct rpc_cred *cred, int openflags) } EXPORT_SYMBOL_GPL(nfs_may_open); +static int nfs_execute_ok(struct inode *inode, int mask) +{ + struct nfs_server *server = NFS_SERVER(inode); + int ret; + + if (mask & MAY_NOT_BLOCK) + ret = nfs_revalidate_inode_rcu(server, inode); + else + ret = nfs_revalidate_inode(server, inode); + if (ret == 0 && !execute_ok(inode)) + ret = -EACCES; + return ret; +} + int nfs_permission(struct inode *inode, int mask) { struct rpc_cred *cred; @@ -2495,8 +2509,8 @@ force_lookup: res = PTR_ERR(cred); } out: - if (!res && (mask & MAY_EXEC) && !execute_ok(inode)) - res = -EACCES; + if (!res && (mask & MAY_EXEC)) + res = nfs_execute_ok(inode, mask); dfprintk(VFS, "NFS: permission(%s/%lu), mask=0x%x, res=%d\n", inode->i_sb->s_id, inode->i_ino, mask, res); |