Commit 898f9446 authored by Jeff Layton's avatar Jeff Layton Committed by Chuck Lever
Browse files

lockd: don't allow locking on reexported NFSv2/3 



Since commit 9254c8ae ("nfsd: disallow file locking and delegations
for NFSv4 reexport"), file locking when reexporting an NFS mount via
NFSv4 is expressly prohibited by nfsd. Do the same in lockd:

Add a new  nlmsvc_file_cannot_lock() helper that will test whether file
locking is allowed for a given file, and return nlm_lck_denied_nolocks
if it isn't.

Signed-off-by: default avatarJeff Layton <jlayton@kernel.org>
Tested-by: default avatarOlga Kornievskaia <okorniev@redhat.com>
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
parent f6dcad1d

fs/lockd/svclock.c

+12 −0
Original line number Diff line number Diff line
@@ -495,6 +495,9 @@ nlmsvc_lock(struct svc_rqst *rqstp, struct nlm_file *file, 
				(long long)lock->fl.fl_end,

				wait);



	if (nlmsvc_file_cannot_lock(file))

		return nlm_lck_denied_nolocks;



	if (!locks_can_async_lock(nlmsvc_file_file(file)->f_op)) {

		async_block = wait;

		wait = 0;
@@ -621,6 +624,9 @@ nlmsvc_testlock(struct svc_rqst *rqstp, struct nlm_file *file, 
				(long long)lock->fl.fl_start,

				(long long)lock->fl.fl_end);



	if (nlmsvc_file_cannot_lock(file))

		return nlm_lck_denied_nolocks;



	if (locks_in_grace(SVC_NET(rqstp))) {

		ret = nlm_lck_denied_grace_period;

		goto out;
@@ -678,6 +684,9 @@ nlmsvc_unlock(struct net *net, struct nlm_file *file, struct nlm_lock *lock) 
				(long long)lock->fl.fl_start,

				(long long)lock->fl.fl_end);



	if (nlmsvc_file_cannot_lock(file))

		return nlm_lck_denied_nolocks;



	/* First, cancel any lock that might be there */

	nlmsvc_cancel_blocked(net, file, lock);
@@ -715,6 +724,9 @@ nlmsvc_cancel_blocked(struct net *net, struct nlm_file *file, struct nlm_lock *l 
				(long long)lock->fl.fl_start,

				(long long)lock->fl.fl_end);



	if (nlmsvc_file_cannot_lock(file))

		return nlm_lck_denied_nolocks;



	if (locks_in_grace(net))

		return nlm_lck_denied_grace_period;

fs/lockd/svcshare.c

+6 −0
Original line number Diff line number Diff line
@@ -32,6 +32,9 @@ nlmsvc_share_file(struct nlm_host *host, struct nlm_file *file, 
	struct xdr_netobj	*oh = &argp->lock.oh;

	u8			*ohdata;



	if (nlmsvc_file_cannot_lock(file))

		return nlm_lck_denied_nolocks;



	for (share = file->f_shares; share; share = share->s_next) {

		if (share->s_host == host && nlm_cmp_owner(share, oh))

			goto update;
@@ -72,6 +75,9 @@ nlmsvc_unshare_file(struct nlm_host *host, struct nlm_file *file, 
	struct nlm_share	*share, **shpp;

	struct xdr_netobj	*oh = &argp->lock.oh;



	if (nlmsvc_file_cannot_lock(file))

		return nlm_lck_denied_nolocks;



	for (shpp = &file->f_shares; (share = *shpp) != NULL;

					shpp = &share->s_next) {

		if (share->s_host == host && nlm_cmp_owner(share, oh)) {

include/linux/lockd/lockd.h

+8 −1
Original line number Diff line number Diff line
@@ -12,6 +12,7 @@ 


/* XXX: a lot of this should really be under fs/lockd. */



#include <linux/exportfs.h>

#include <linux/in.h>

#include <linux/in6.h>

#include <net/ipv6.h>
@@ -307,7 +308,7 @@ void nlmsvc_invalidate_all(void); 
int           nlmsvc_unlock_all_by_sb(struct super_block *sb);

int           nlmsvc_unlock_all_by_ip(struct sockaddr *server_addr);



static inline struct file *nlmsvc_file_file(struct nlm_file *file)

static inline struct file *nlmsvc_file_file(const struct nlm_file *file)

{

	return file->f_file[O_RDONLY] ?

	       file->f_file[O_RDONLY] : file->f_file[O_WRONLY];
@@ -318,6 +319,12 @@ static inline struct inode *nlmsvc_file_inode(struct nlm_file *file) 
	return file_inode(nlmsvc_file_file(file));

}



static inline bool

nlmsvc_file_cannot_lock(const struct nlm_file *file)

{

	return exportfs_cannot_lock(nlmsvc_file_file(file)->f_path.dentry->d_sb->s_export_op);

}



static inline int __nlm_privileged_request4(const struct sockaddr *sap)

{

	const struct sockaddr_in *sin = (struct sockaddr_in *)sap;