Commit 9c65001c authored by Dai Ngo's avatar Dai Ngo Committed by Chuck Lever
Browse files

NFSD: detect mismatch of file handle and delegation stateid in OPEN op 



When the client sends an OPEN with claim type CLAIM_DELEG_CUR_FH or
CLAIM_DELEGATION_CUR, the delegation stateid and the file handle
must belong to the same file, otherwise return NFS4ERR_INVAL.

Note that RFC8881, section 8.2.4, mandates the server to return
NFS4ERR_BAD_STATEID if the selected table entry does not match the
current filehandle. However returning NFS4ERR_BAD_STATEID in the
OPEN causes the client to retry the operation and therefor get the
client into a loop. To avoid this situation we return NFS4ERR_INVAL
instead.

Reported-by: default avatarPetro Pavlov <petro.pavlov@vastdata.com>
Fixes: c44c5eeb ("[PATCH] nfsd4: add open state code for CLAIM_DELEGATE_CUR")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarDai Ngo <dai.ngo@oracle.com>
Reviewed-by: default avatarJeff Layton <jlayton@kernel.org>
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
parent 908e4ead

fs/nfsd/nfs4state.c

+14 −0
Original line number Diff line number Diff line
@@ -6361,6 +6361,20 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf 
		status = nfs4_check_deleg(cl, open, &dp);

		if (status)

			goto out;

		if (dp && nfsd4_is_deleg_cur(open) &&

				(dp->dl_stid.sc_file != fp)) {

			/*

			 * RFC8881 section 8.2.4 mandates the server to return

			 * NFS4ERR_BAD_STATEID if the selected table entry does

			 * not match the current filehandle. However returning

			 * NFS4ERR_BAD_STATEID in the OPEN can cause the client

			 * to repeatedly retry the operation with the same

			 * stateid, since the stateid itself is valid. To avoid

			 * this situation NFSD returns NFS4ERR_INVAL instead.

			 */

			status = nfserr_inval;

			goto out;

		}

		stp = nfsd4_find_and_lock_existing_open(fp, open);

	} else {

		open->op_file = NULL;