NFS: Ensure we revalidate attributes before using execute_ok() (5c5fc09a) · Commits · 戴 / test

Donald Buczek reports that NFS clients can also report incorrect results for access() due to lack of revalidation of attributes before calling execute_ok(). Looking closely, it seems chdir() is afflicted with the same problem. Fix is to ensure we call nfs_revalidate_inode_rcu() or nfs_revalidate_inode() as appropriate before deciding to trust execute_ok(). Reported-by:

Donald Buczek <buczek@molgen.mpg.de> Link: http://lkml.kernel.org/r/1451331530-3748-1-git-send-email-buczek@molgen.mpg.de Signed-off-by:

Trond Myklebust <trond.myklebust@primarydata.com>

fs/nfs/dir.c

+16 −2

Original line number	Diff line number	Diff line
		@@ -2432,6 +2432,20 @@ int nfs_may_open(struct inode inode, struct rpc_cred cred, int openflags)
		}
		EXPORT_SYMBOL_GPL(nfs_may_open);

		static int nfs_execute_ok(struct inode *inode, int mask)
		{
		struct nfs_server *server = NFS_SERVER(inode);
		int ret;

		if (mask & MAY_NOT_BLOCK)
		ret = nfs_revalidate_inode_rcu(server, inode);
		else
		ret = nfs_revalidate_inode(server, inode);
		if (ret == 0 && !execute_ok(inode))
		ret = -EACCES;
		return ret;
		}

		int nfs_permission(struct inode *inode, int mask)
		{
		struct rpc_cred *cred;
		@@ -2484,8 +2498,8 @@ force_lookup:
		res = PTR_ERR(cred);
		}
		out:
		if (!res && (mask & MAY_EXEC) && !execute_ok(inode))
		res = -EACCES;
		if (!res && (mask & MAY_EXEC))
		res = nfs_execute_ok(inode, mask);

		dfprintk(VFS, "NFS: permission(%s/%lu), mask=0x%x, res=%d\n",
		inode->i_sb->s_id, inode->i_ino, mask, res);

Admin message