nfsd: reorder printk in do_probe_callback to avoid use-after-free
[safe/jmp/linux-2.6] / fs / nfsd / vfs.c
index 46f59d5..a3a291f 100644 (file)
@@ -264,7 +264,6 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
        struct inode    *inode;
        int             accmode = MAY_SATTR;
        int             ftype = 0;
-       int             imode;
        __be32          err;
        int             host_err;
        int             size_change = 0;
@@ -360,25 +359,25 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
                DQUOT_INIT(inode);
        }
 
-       imode = inode->i_mode;
+       /* sanitize the mode change */
        if (iap->ia_valid & ATTR_MODE) {
                iap->ia_mode &= S_IALLUGO;
-               imode = iap->ia_mode |= (imode & ~S_IALLUGO);
-               /* if changing uid/gid revoke setuid/setgid in mode */
-               if ((iap->ia_valid & ATTR_UID) && iap->ia_uid != inode->i_uid) {
-                       iap->ia_valid |= ATTR_KILL_PRIV;
+               iap->ia_mode |= (inode->i_mode & ~S_IALLUGO);
+       }
+
+       /* Revoke setuid/setgid on chown */
+       if (((iap->ia_valid & ATTR_UID) && iap->ia_uid != inode->i_uid) ||
+           ((iap->ia_valid & ATTR_GID) && iap->ia_gid != inode->i_gid)) {
+               iap->ia_valid |= ATTR_KILL_PRIV;
+               if (iap->ia_valid & ATTR_MODE) {
+                       /* we're setting mode too, just clear the s*id bits */
                        iap->ia_mode &= ~S_ISUID;
+                       if (iap->ia_mode & S_IXGRP)
+                               iap->ia_mode &= ~S_ISGID;
+               } else {
+                       /* set ATTR_KILL_* bits and let VFS handle it */
+                       iap->ia_valid |= (ATTR_KILL_SUID | ATTR_KILL_SGID);
                }
-               if ((iap->ia_valid & ATTR_GID) && iap->ia_gid != inode->i_gid)
-                       iap->ia_mode &= ~S_ISGID;
-       } else {
-               /*
-                * Revoke setuid/setgid bit on chown/chgrp
-                */
-               if ((iap->ia_valid & ATTR_UID) && iap->ia_uid != inode->i_uid)
-                       iap->ia_valid |= ATTR_KILL_SUID | ATTR_KILL_PRIV;
-               if ((iap->ia_valid & ATTR_GID) && iap->ia_gid != inode->i_gid)
-                       iap->ia_valid |= ATTR_KILL_SGID;
        }
 
        /* Change the attributes. */
@@ -988,7 +987,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
         * flushing the data to disk is handled separately below.
         */
 
-       if (file->f_op->fsync == 0) {/* COMMIT3 cannot work */
+       if (!file->f_op->fsync) {/* COMMIT3 cannot work */
               stable = 2;
               *stablep = 2; /* FILE_SYNC */
        }
@@ -1152,7 +1151,7 @@ nfsd_commit(struct svc_rqst *rqstp, struct svc_fh *fhp,
 }
 #endif /* CONFIG_NFSD_V3 */
 
-__be32
+static __be32
 nfsd_create_setattr(struct svc_rqst *rqstp, struct svc_fh *resfhp,
                        struct iattr *iap)
 {
@@ -1255,23 +1254,35 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
        err = 0;
        switch (type) {
        case S_IFREG:
+               host_err = mnt_want_write(fhp->fh_export->ex_path.mnt);
+               if (host_err)
+                       goto out_nfserr;
                host_err = vfs_create(dirp, dchild, iap->ia_mode, NULL);
                break;
        case S_IFDIR:
+               host_err = mnt_want_write(fhp->fh_export->ex_path.mnt);
+               if (host_err)
+                       goto out_nfserr;
                host_err = vfs_mkdir(dirp, dchild, iap->ia_mode);
                break;
        case S_IFCHR:
        case S_IFBLK:
        case S_IFIFO:
        case S_IFSOCK:
+               host_err = mnt_want_write(fhp->fh_export->ex_path.mnt);
+               if (host_err)
+                       goto out_nfserr;
                host_err = vfs_mknod(dirp, dchild, iap->ia_mode, rdev);
                break;
        default:
                printk("nfsd: bad file type %o in nfsd_create\n", type);
                host_err = -EINVAL;
+               goto out_nfserr;
        }
-       if (host_err < 0)
+       if (host_err < 0) {
+               mnt_drop_write(fhp->fh_export->ex_path.mnt);
                goto out_nfserr;
+       }
 
        if (EX_ISSYNC(fhp->fh_export)) {
                err = nfserrno(nfsd_sync_dir(dentry));
@@ -1282,6 +1293,7 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
        err2 = nfsd_create_setattr(rqstp, resfhp, iap);
        if (err2)
                err = err2;
+       mnt_drop_write(fhp->fh_export->ex_path.mnt);
        /*
         * Update the file handle to get the new inode info.
         */
@@ -1359,6 +1371,9 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
                v_atime = verifier[1]&0x7fffffff;
        }
        
+       host_err = mnt_want_write(fhp->fh_export->ex_path.mnt);
+       if (host_err)
+               goto out_nfserr;
        if (dchild->d_inode) {
                err = 0;
 
@@ -1390,12 +1405,15 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
                case NFS3_CREATE_GUARDED:
                        err = nfserr_exist;
                }
+               mnt_drop_write(fhp->fh_export->ex_path.mnt);
                goto out;
        }
 
        host_err = vfs_create(dirp, dchild, iap->ia_mode, NULL);
-       if (host_err < 0)
+       if (host_err < 0) {
+               mnt_drop_write(fhp->fh_export->ex_path.mnt);
                goto out_nfserr;
+       }
        if (created)
                *created = 1;
 
@@ -1420,6 +1438,7 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
        if (err2)
                err = err2;
 
+       mnt_drop_write(fhp->fh_export->ex_path.mnt);
        /*
         * Update the filehandle to get the new inode info.
         */
@@ -1522,6 +1541,10 @@ nfsd_symlink(struct svc_rqst *rqstp, struct svc_fh *fhp,
        if (iap && (iap->ia_valid & ATTR_MODE))
                mode = iap->ia_mode & S_IALLUGO;
 
+       host_err = mnt_want_write(fhp->fh_export->ex_path.mnt);
+       if (host_err)
+               goto out_nfserr;
+
        if (unlikely(path[plen] != 0)) {
                char *path_alloced = kmalloc(plen+1, GFP_KERNEL);
                if (path_alloced == NULL)
@@ -1542,6 +1565,8 @@ nfsd_symlink(struct svc_rqst *rqstp, struct svc_fh *fhp,
        err = nfserrno(host_err);
        fh_unlock(fhp);
 
+       mnt_drop_write(fhp->fh_export->ex_path.mnt);
+
        cerr = fh_compose(resfhp, fhp->fh_export, dnew, fhp);
        dput(dnew);
        if (err==0) err = cerr;
@@ -1592,6 +1617,11 @@ nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp,
        dold = tfhp->fh_dentry;
        dest = dold->d_inode;
 
+       host_err = mnt_want_write(tfhp->fh_export->ex_path.mnt);
+       if (host_err) {
+               err = nfserrno(host_err);
+               goto out_dput;
+       }
        host_err = vfs_link(dold, dirp, dnew);
        if (!host_err) {
                if (EX_ISSYNC(ffhp->fh_export)) {
@@ -1605,7 +1635,8 @@ nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp,
                else
                        err = nfserrno(host_err);
        }
-
+       mnt_drop_write(tfhp->fh_export->ex_path.mnt);
+out_dput:
        dput(dnew);
 out_unlock:
        fh_unlock(ffhp);
@@ -1678,13 +1709,20 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen,
        if (ndentry == trap)
                goto out_dput_new;
 
-#ifdef MSNFS
-       if ((ffhp->fh_export->ex_flags & NFSEXP_MSNFS) &&
+       if (svc_msnfs(ffhp) &&
                ((atomic_read(&odentry->d_count) > 1)
                 || (atomic_read(&ndentry->d_count) > 1))) {
                        host_err = -EPERM;
-       } else
-#endif
+                       goto out_dput_new;
+       }
+
+       host_err = -EXDEV;
+       if (ffhp->fh_export->ex_path.mnt != tfhp->fh_export->ex_path.mnt)
+               goto out_dput_new;
+       host_err = mnt_want_write(ffhp->fh_export->ex_path.mnt);
+       if (host_err)
+               goto out_dput_new;
+
        host_err = vfs_rename(fdir, odentry, tdir, ndentry);
        if (!host_err && EX_ISSYNC(tfhp->fh_export)) {
                host_err = nfsd_sync_dir(tdentry);
@@ -1692,6 +1730,8 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen,
                        host_err = nfsd_sync_dir(fdentry);
        }
 
+       mnt_drop_write(ffhp->fh_export->ex_path.mnt);
+
  out_dput_new:
        dput(ndentry);
  out_dput_old:
@@ -1750,6 +1790,10 @@ nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
        if (!type)
                type = rdentry->d_inode->i_mode & S_IFMT;
 
+       host_err = mnt_want_write(fhp->fh_export->ex_path.mnt);
+       if (host_err)
+               goto out_nfserr;
+
        if (type != S_IFDIR) { /* It's UNLINK */
 #ifdef MSNFS
                if ((fhp->fh_export->ex_flags & NFSEXP_MSNFS) &&
@@ -1765,10 +1809,12 @@ nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
        dput(rdentry);
 
        if (host_err)
-               goto out_nfserr;
+               goto out_drop;
        if (EX_ISSYNC(fhp->fh_export))
                host_err = nfsd_sync_dir(dentry);
 
+out_drop:
+       mnt_drop_write(fhp->fh_export->ex_path.mnt);
 out_nfserr:
        err = nfserrno(host_err);
 out:
@@ -1865,7 +1911,7 @@ nfsd_permission(struct svc_rqst *rqstp, struct svc_export *exp,
                inode->i_mode,
                IS_IMMUTABLE(inode)?    " immut" : "",
                IS_APPEND(inode)?       " append" : "",
-               IS_RDONLY(inode)?       " ro" : "");
+               __mnt_is_readonly(exp->ex_path.mnt)?    " ro" : "");
        dprintk("      owner %d/%d user %d/%d\n",
                inode->i_uid, inode->i_gid, current->fsuid, current->fsgid);
 #endif
@@ -1876,7 +1922,8 @@ nfsd_permission(struct svc_rqst *rqstp, struct svc_export *exp,
         */
        if (!(acc & MAY_LOCAL_ACCESS))
                if (acc & (MAY_WRITE | MAY_SATTR | MAY_TRUNC)) {
-                       if (exp_rdonly(rqstp, exp) || IS_RDONLY(inode))
+                       if (exp_rdonly(rqstp, exp) ||
+                           __mnt_is_readonly(exp->ex_path.mnt))
                                return nfserr_rofs;
                        if (/* (acc & MAY_WRITE) && */ IS_IMMUTABLE(inode))
                                return nfserr_perm;
@@ -2039,6 +2086,9 @@ nfsd_set_posix_acl(struct svc_fh *fhp, int type, struct posix_acl *acl)
        } else
                size = 0;
 
+       error = mnt_want_write(fhp->fh_export->ex_path.mnt);
+       if (error)
+               goto getout;
        if (size)
                error = vfs_setxattr(fhp->fh_dentry, name, value, size, 0);
        else {
@@ -2050,6 +2100,7 @@ nfsd_set_posix_acl(struct svc_fh *fhp, int type, struct posix_acl *acl)
                                error = 0;
                }
        }
+       mnt_drop_write(fhp->fh_export->ex_path.mnt);
 
 getout:
        kfree(value);