On Wed, 28 Aug 2024, cel@xxxxxxxxxx wrote:
> From: NeilBrown <neilb@xxxxxxx>
>
> LOCALIO-initiated open operations are not running in an nfsd thread
> and thus do not have an associated svc_rqst context.
>
> Signed-off-by: NeilBrown <neilb@xxxxxxx>
> Co-developed-by: Mike Snitzer <snitzer@xxxxxxxxxx>
> Signed-off-by: Mike Snitzer <snitzer@xxxxxxxxxx>
> Signed-off-by: Chuck Lever <chuck.lever@xxxxxxxxxx>
> ---
> fs/nfsd/export.c | 29 ++++++++++++++++++++++++-----
> 1 file changed, 24 insertions(+), 5 deletions(-)
>
> diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
> index 7bb4f2075ac5..46a4d989c850 100644
> --- a/fs/nfsd/export.c
> +++ b/fs/nfsd/export.c
> @@ -1074,10 +1074,29 @@ static struct svc_export *exp_find(struct cache_detail *cd,
> return exp;
> }
>
> +/**
> + * check_nfsd_access - check if access to export is allowed.
> + * @exp: svc_export that is being accessed.
> + * @rqstp: svc_rqst attempting to access @exp (will be NULL for LOCALIO).
> + *
> + * Return values:
> + * %nfs_ok if access is granted, or
> + * %nfserr_wrongsec if access is denied
> + */
> __be32 check_nfsd_access(struct svc_export *exp, struct svc_rqst *rqstp)
> {
> struct exp_flavor_info *f, *end = exp->ex_flavors + exp->ex_nflavors;
> - struct svc_xprt *xprt = rqstp->rq_xprt;
> + struct svc_xprt *xprt;
> +
> + /*
> + * The target use case for rqstp being NULL is LOCALIO, which
> + * currently only supports AUTH_UNIX. The behavior for LOCALIO
> + * is therefore the same as the AUTH_UNIX check below.
The "AUTH_UNIX check below" only applies if exp->ex_flavours == 0.
To make "rqstp == NULL" mean "treat like AUTH_UNIX" I think we need
to confirm that
exp->ex_xprtsec_mods & NFSEXP_XPRTSEC_NONE
and either
exp->ex_nflavours == 0
or
one for the exp->ex_flavors->pseudoflavor values is RPC_AUTH_UNIX
I'm not sure that is all really necessary, but if not then we probably
need a better comment...
NeilBrown
> + */
> + if (!rqstp)
> + return nfs_ok;
> +
> + xprt = rqstp->rq_xprt;
>
> if (exp->ex_xprtsec_modes & NFSEXP_XPRTSEC_NONE) {
> if (!test_bit(XPT_TLS_SESSION, &xprt->xpt_flags))
> @@ -1098,17 +1117,17 @@ __be32 check_nfsd_access(struct svc_export *exp, struct svc_rqst *rqstp)
> ok:
> /* legacy gss-only clients are always OK: */
> if (exp->ex_client == rqstp->rq_gssclient)
> - return 0;
> + return nfs_ok;
> /* ip-address based client; check sec= export option: */
> for (f = exp->ex_flavors; f < end; f++) {
> if (f->pseudoflavor == rqstp->rq_cred.cr_flavor)
> - return 0;
> + return nfs_ok;
> }
> /* defaults in absence of sec= options: */
> if (exp->ex_nflavors == 0) {
> if (rqstp->rq_cred.cr_flavor == RPC_AUTH_NULL ||
> rqstp->rq_cred.cr_flavor == RPC_AUTH_UNIX)
> - return 0;
> + return nfs_ok;
> }
>
> /* If the compound op contains a spo_must_allowed op,
> @@ -1118,7 +1137,7 @@ __be32 check_nfsd_access(struct svc_export *exp, struct svc_rqst *rqstp)
> */
>
> if (nfsd4_spo_must_allow(rqstp))
> - return 0;
> + return nfs_ok;
>
> denied:
> return nfserr_wrongsec;
> --
> 2.45.2
>
>
