Commit d88520ad authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'pull-nfsd-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 

Pull nfsd fix from Al Viro:
 "Catch from lock_rename() audit; nfsd_rename() checked that both
  directories belonged to the same filesystem, but only after having
  done lock_rename().

  Trivial fix, tested and acked by nfs folks"

* tag 'pull-nfsd-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  nfsd: lock_rename() needs both directories to live on the same fs
parents 84186fcb 1aee9158

fs/nfsd/vfs.c

+6 −6
Original line number Diff line number Diff line
@@ -1788,6 +1788,12 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen, 
	if (!flen || isdotent(fname, flen) || !tlen || isdotent(tname, tlen))

		goto out;



	err = (rqstp->rq_vers == 2) ? nfserr_acces : nfserr_xdev;

	if (ffhp->fh_export->ex_path.mnt != tfhp->fh_export->ex_path.mnt)

		goto out;

	if (ffhp->fh_export->ex_path.dentry != tfhp->fh_export->ex_path.dentry)

		goto out;



retry:

	host_err = fh_want_write(ffhp);

	if (host_err) {
@@ -1823,12 +1829,6 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen, 
	if (ndentry == trap)

		goto out_dput_new;



	host_err = -EXDEV;

	if (ffhp->fh_export->ex_path.mnt != tfhp->fh_export->ex_path.mnt)

		goto out_dput_new;

	if (ffhp->fh_export->ex_path.dentry != tfhp->fh_export->ex_path.dentry)

		goto out_dput_new;



	if ((ndentry->d_sb->s_export_op->flags & EXPORT_OP_CLOSE_BEFORE_UNLINK) &&

	    nfsd_has_cached_files(ndentry)) {

		close_cached = true;