Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932428AbdFLPkw (ORCPT ); Mon, 12 Jun 2017 11:40:52 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:43498 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755246AbdFLPkp (ORCPT ); Mon, 12 Jun 2017 11:40:45 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Donald Buczek , Al Viro , Trond Myklebust , Paul Menzel Subject: [PATCH 4.4 82/90] NFSv4: Dont perform cached access checks before weve OPENed the file Date: Mon, 12 Jun 2017 17:26:28 +0200 Message-Id: <20170612152602.021003275@linuxfoundation.org> X-Mailer: git-send-email 2.13.1 In-Reply-To: <20170612152556.133240249@linuxfoundation.org> References: <20170612152556.133240249@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2234 Lines: 62 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Trond Myklebust commit 762674f86d0328d5dc923c966e209e1ee59663f2 upstream. Donald Buczek reports that a nfs4 client incorrectly denies execute access based on outdated file mode (missing 'x' bit). After the mode on the server is 'fixed' (chmod +x) further execution attempts continue to fail, because the nfs ACCESS call updates the access parameter but not the mode parameter or the mode in the inode. The root cause is ultimately that the VFS is calling may_open() before the NFS client has a chance to OPEN the file and hence revalidate the access and attribute caches. Al Viro suggests: >>> Make nfs_permission() relax the checks when it sees MAY_OPEN, if you know >>> that things will be caught by server anyway? >> >> That can work as long as we're guaranteed that everything that calls >> inode_permission() with MAY_OPEN on a regular file will also follow up >> with a vfs_open() or dentry_open() on success. Is this always the >> case? > > 1) in do_tmpfile(), followed by do_dentry_open() (not reachable by NFS since > it doesn't have ->tmpfile() instance anyway) > > 2) in atomic_open(), after the call of ->atomic_open() has succeeded. > > 3) in do_last(), followed on success by vfs_open() > > That's all. All calls of inode_permission() that get MAY_OPEN come from > may_open(), and there's no other callers of that puppy. Reported-by: Donald Buczek Link: https://bugzilla.kernel.org/show_bug.cgi?id=109771 Link: http://lkml.kernel.org/r/1451046656-26319-1-git-send-email-buczek@molgen.mpg.de Cc: Al Viro Signed-off-by: Trond Myklebust Signed-off-by: Paul Menzel Signed-off-by: Greg Kroah-Hartman --- fs/nfs/dir.c | 3 +++ 1 file changed, 3 insertions(+) --- a/fs/nfs/dir.c +++ b/fs/nfs/dir.c @@ -2452,6 +2452,9 @@ int nfs_permission(struct inode *inode, case S_IFLNK: goto out; case S_IFREG: + if ((mask & MAY_OPEN) && + nfs_server_capable(inode, NFS_CAP_ATOMIC_OPEN)) + return 0; break; case S_IFDIR: /*