1	// SPDX-License-Identifier: GPL-2.0
2	/*
3	* File operations used by nfsd. Some of these have been ripped from
4	* other parts of the kernel because they weren't exported, others
5	* are partial duplicates with added or changed functionality.
6	*
7	* Note that several functions dget() the dentry upon which they want
8	* to act, most notably those that create directory entries. Response
9	* dentry's are dput()'d if necessary in the release callback.
10	* So if you notice code paths that apparently fail to dput() the
11	* dentry, don't worry--they have been taken care of.
12	*
13	* Copyright (C) 1995-1999 Olaf Kirch <okir@monad.swb.de>
14	* Zerocpy NFS support (C) 2002 Hirokazu Takahashi <taka@valinux.co.jp>
15	*/
16
17	#include <linux/fs.h>
18	#include <linux/file.h>
19	#include <linux/splice.h>
20	#include <linux/falloc.h>
21	#include <linux/fcntl.h>
22	#include <linux/namei.h>
23	#include <linux/delay.h>
24	#include <linux/fsnotify.h>
25	#include <linux/posix_acl_xattr.h>
26	#include <linux/xattr.h>
27	#include <linux/jhash.h>
28	#include <linux/ima.h>
29	#include <linux/pagemap.h>
30	#include <linux/slab.h>
31	#include <linux/uaccess.h>
32	#include <linux/exportfs.h>
33	#include <linux/writeback.h>
34	#include <linux/security.h>
35
36	#include "xdr3.h"
37
38	#ifdef CONFIG_NFSD_V4
39	#include "../internal.h"
40	#include "acl.h"
41	#include "idmap.h"
42	#include "xdr4.h"
43	#endif /* CONFIG_NFSD_V4 */
44
45	#include "nfsd.h"
46	#include "vfs.h"
47	#include "filecache.h"
48	#include "trace.h"
49
50	#define NFSDDBG_FACILITY NFSDDBG_FILEOP
51
52	/**
53	* nfserrno - Map Linux errnos to NFS errnos
54	* @errno: POSIX(-ish) error code to be mapped
55	*
56	* Returns the appropriate (net-endian) nfserr_* (or nfs_ok if errno is 0). If
57	* it's an error we don't expect, log it once and return nfserr_io.
58	*/
59	__be32
60	nfserrno (int errno)
61	{
62	static struct {
63	__be32 nfserr;
64	int syserr;
65	} nfs_errtbl[] = {
66	{ nfs_ok, 0 },
67	{ nfserr_perm, -EPERM },
68	{ nfserr_noent, -ENOENT },
69	{ nfserr_io, -EIO },
70	{ nfserr_nxio, -ENXIO },
71	{ nfserr_fbig, -E2BIG },
72	{ nfserr_stale, -EBADF },
73	{ nfserr_acces, -EACCES },
74	{ nfserr_exist, -EEXIST },
75	{ nfserr_xdev, -EXDEV },
76	{ nfserr_mlink, -EMLINK },
77	{ nfserr_nodev, -ENODEV },
78	{ nfserr_notdir, -ENOTDIR },
79	{ nfserr_isdir, -EISDIR },
80	{ nfserr_inval, -EINVAL },
81	{ nfserr_fbig, -EFBIG },
82	{ nfserr_nospc, -ENOSPC },
83	{ nfserr_rofs, -EROFS },
84	{ nfserr_mlink, -EMLINK },
85	{ nfserr_nametoolong, -ENAMETOOLONG },
86	{ nfserr_notempty, -ENOTEMPTY },
87	{ nfserr_dquot, -EDQUOT },
88	{ nfserr_stale, -ESTALE },
89	{ nfserr_jukebox, -ETIMEDOUT },
90	{ nfserr_jukebox, -ERESTARTSYS },
91	{ nfserr_jukebox, -EAGAIN },
92	{ nfserr_jukebox, -EWOULDBLOCK },
93	{ nfserr_jukebox, -ENOMEM },
94	{ nfserr_io, -ETXTBSY },
95	{ nfserr_notsupp, -EOPNOTSUPP },
96	{ nfserr_toosmall, -ETOOSMALL },
97	{ nfserr_serverfault, -ESERVERFAULT },
98	{ nfserr_serverfault, -ENFILE },
99	{ nfserr_io, -EREMOTEIO },
100	{ nfserr_stale, -EOPENSTALE },
101	{ nfserr_io, -EUCLEAN },
102	{ nfserr_perm, -ENOKEY },
103	{ nfserr_no_grace, -ENOGRACE},
104	};
105	int i;
106
107	for (i = 0; i < ARRAY_SIZE(nfs_errtbl); i++) {
108	if (nfs_errtbl[i].syserr == errno)
109	return nfs_errtbl[i].nfserr;
110	}
111	WARN_ONCE(1, "nfsd: non-standard errno: %d\n", errno);
112	return nfserr_io;
113	}
114
115	/*
116	* Called from nfsd_lookup and encode_dirent. Check if we have crossed
117	* a mount point.
118	* Returns -EAGAIN or -ETIMEDOUT leaving *dpp and *expp unchanged,
119	* or nfs_ok having possibly changed *dpp and *expp
120	*/
121	int
122	nfsd_cross_mnt(struct svc_rqst *rqstp, struct dentry **dpp,
123	struct svc_export **expp)
124	{
125	struct svc_export *exp = *expp, *exp2 = NULL;
126	struct dentry *dentry = *dpp;
127	struct path path = {.mnt = mntget(mnt: exp->ex_path.mnt),
128	.dentry = dget(dentry)};
129	unsigned int follow_flags = 0;
130	int err = 0;
131
132	if (exp->ex_flags & NFSEXP_CROSSMOUNT)
133	follow_flags = LOOKUP_AUTOMOUNT;
134
135	err = follow_down(path: &path, flags: follow_flags);
136	if (err < 0)
137	goto out;
138	if (path.mnt == exp->ex_path.mnt && path.dentry == dentry &&
139	nfsd_mountpoint(dentry, exp) == 2) {
140	/* This is only a mountpoint in some other namespace */
141	path_put(&path);
142	goto out;
143	}
144
145	exp2 = rqst_exp_get_by_name(rqstp, &path);
146	if (IS_ERR(ptr: exp2)) {
147	err = PTR_ERR(ptr: exp2);
148	/*
149	* We normally allow NFS clients to continue
150	* "underneath" a mountpoint that is not exported.
151	* The exception is V4ROOT, where no traversal is ever
152	* allowed without an explicit export of the new
153	* directory.
154	*/
155	if (err == -ENOENT && !(exp->ex_flags & NFSEXP_V4ROOT))
156	err = 0;
157	path_put(&path);
158	goto out;
159	}
160	if (nfsd_v4client(rq: rqstp) ||
161	(exp->ex_flags & NFSEXP_CROSSMOUNT) || EX_NOHIDE(exp2)) {
162	/* successfully crossed mount point */
163	/*
164	* This is subtle: path.dentry is *not* on path.mnt
165	* at this point. The only reason we are safe is that
166	* original mnt is pinned down by exp, so we should
167	* put path *before* putting exp
168	*/
169	*dpp = path.dentry;
170	path.dentry = dentry;
171	*expp = exp2;
172	exp2 = exp;
173	}
174	path_put(&path);
175	exp_put(exp: exp2);
176	out:
177	return err;
178	}
179
180	static void follow_to_parent(struct path *path)
181	{
182	struct dentry *dp;
183
184	while (path->dentry == path->mnt->mnt_root && follow_up(path))
185	;
186	dp = dget_parent(dentry: path->dentry);
187	dput(path->dentry);
188	path->dentry = dp;
189	}
190
191	static int nfsd_lookup_parent(struct svc_rqst *rqstp, struct dentry *dparent, struct svc_export **exp, struct dentry **dentryp)
192	{
193	struct svc_export *exp2;
194	struct path path = {.mnt = mntget(mnt: (*exp)->ex_path.mnt),
195	.dentry = dget(dentry: dparent)};
196
197	follow_to_parent(path: &path);
198
199	exp2 = rqst_exp_parent(rqstp, &path);
200	if (PTR_ERR(ptr: exp2) == -ENOENT) {
201	*dentryp = dget(dentry: dparent);
202	} else if (IS_ERR(ptr: exp2)) {
203	path_put(&path);
204	return PTR_ERR(ptr: exp2);
205	} else {
206	*dentryp = dget(dentry: path.dentry);
207	exp_put(exp: *exp);
208	*exp = exp2;
209	}
210	path_put(&path);
211	return 0;
212	}
213
214	/*
215	* For nfsd purposes, we treat V4ROOT exports as though there was an
216	* export at *every* directory.
217	* We return:
218	* '1' if this dentry *must* be an export point,
219	* '2' if it might be, if there is really a mount here, and
220	* '0' if there is no chance of an export point here.
221	*/
222	int nfsd_mountpoint(struct dentry *dentry, struct svc_export *exp)
223	{
224	if (!d_inode(dentry))
225	return 0;
226	if (exp->ex_flags & NFSEXP_V4ROOT)
227	return 1;
228	if (nfsd4_is_junction(dentry))
229	return 1;
230	if (d_managed(dentry))
231	/*
232	* Might only be a mountpoint in a different namespace,
233	* but we need to check.
234	*/
235	return 2;
236	return 0;
237	}
238
239	__be32
240	nfsd_lookup_dentry(struct svc_rqst *rqstp, struct svc_fh *fhp,
241	const char *name, unsigned int len,
242	struct svc_export **exp_ret, struct dentry **dentry_ret)
243	{
244	struct svc_export *exp;
245	struct dentry *dparent;
246	struct dentry *dentry;
247	int host_err;
248
249	dprintk("nfsd: nfsd_lookup(fh %s, %.*s)\n", SVCFH_fmt(fhp), len,name);
250
251	dparent = fhp->fh_dentry;
252	exp = exp_get(exp: fhp->fh_export);
253
254	/* Lookup the name, but don't follow links */
255	if (isdotent(name, len)) {
256	if (len==1)
257	dentry = dget(dentry: dparent);
258	else if (dparent != exp->ex_path.dentry)
259	dentry = dget_parent(dentry: dparent);
260	else if (!EX_NOHIDE(exp) && !nfsd_v4client(rq: rqstp))
261	dentry = dget(dentry: dparent); /* .. == . just like at / */
262	else {
263	/* checking mountpoint crossing is very different when stepping up */
264	host_err = nfsd_lookup_parent(rqstp, dparent, exp: &exp, dentryp: &dentry);
265	if (host_err)
266	goto out_nfserr;
267	}
268	} else {
269	dentry = lookup_one_len_unlocked(name, dparent, len);
270	host_err = PTR_ERR(ptr: dentry);
271	if (IS_ERR(ptr: dentry))
272	goto out_nfserr;
273	if (nfsd_mountpoint(dentry, exp)) {
274	host_err = nfsd_cross_mnt(rqstp, dpp: &dentry, expp: &exp);
275	if (host_err) {
276	dput(dentry);
277	goto out_nfserr;
278	}
279	}
280	}
281	*dentry_ret = dentry;
282	*exp_ret = exp;
283	return 0;
284
285	out_nfserr:
286	exp_put(exp);
287	return nfserrno(errno: host_err);
288	}
289
290	/**
291	* nfsd_lookup - look up a single path component for nfsd
292	*
293	* @rqstp: the request context
294	* @fhp: the file handle of the directory
295	* @name: the component name, or %NULL to look up parent
296	* @len: length of name to examine
297	* @resfh: pointer to pre-initialised filehandle to hold result.
298	*
299	* Look up one component of a pathname.
300	* N.B. After this call _both_ fhp and resfh need an fh_put
301	*
302	* If the lookup would cross a mountpoint, and the mounted filesystem
303	* is exported to the client with NFSEXP_NOHIDE, then the lookup is
304	* accepted as it stands and the mounted directory is
305	* returned. Otherwise the covered directory is returned.
306	* NOTE: this mountpoint crossing is not supported properly by all
307	* clients and is explicitly disallowed for NFSv3
308	*
309	*/
310	__be32
311	nfsd_lookup(struct svc_rqst *rqstp, struct svc_fh *fhp, const char *name,
312	unsigned int len, struct svc_fh *resfh)
313	{
314	struct svc_export *exp;
315	struct dentry *dentry;
316	__be32 err;
317
318	err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_EXEC);
319	if (err)
320	return err;
321	err = nfsd_lookup_dentry(rqstp, fhp, name, len, exp_ret: &exp, dentry_ret: &dentry);
322	if (err)
323	return err;
324	err = check_nfsd_access(exp, rqstp);
325	if (err)
326	goto out;
327	/*
328	* Note: we compose the file handle now, but as the
329	* dentry may be negative, it may need to be updated.
330	*/
331	err = fh_compose(resfh, exp, dentry, fhp);
332	if (!err && d_really_is_negative(dentry))
333	err = nfserr_noent;
334	out:
335	dput(dentry);
336	exp_put(exp);
337	return err;
338	}
339
340	static void
341	commit_reset_write_verifier(struct nfsd_net *nn, struct svc_rqst *rqstp,
342	int err)
343	{
344	switch (err) {
345	case -EAGAIN:
346	case -ESTALE:
347	/*
348	* Neither of these are the result of a problem with
349	* durable storage, so avoid a write verifier reset.
350	*/
351	break;
352	default:
353	nfsd_reset_write_verifier(nn);
354	trace_nfsd_writeverf_reset(nn, rqstp, error: err);
355	}
356	}
357
358	/*
359	* Commit metadata changes to stable storage.
360	*/
361	static int
362	commit_inode_metadata(struct inode *inode)
363	{
364	const struct export_operations *export_ops = inode->i_sb->s_export_op;
365
366	if (export_ops->commit_metadata)
367	return export_ops->commit_metadata(inode);
368	return sync_inode_metadata(inode, wait: 1);
369	}
370
371	static int
372	commit_metadata(struct svc_fh *fhp)
373	{
374	struct inode *inode = d_inode(dentry: fhp->fh_dentry);
375
376	if (!EX_ISSYNC(fhp->fh_export))
377	return 0;
378	return commit_inode_metadata(inode);
379	}
380
381	/*
382	* Go over the attributes and take care of the small differences between
383	* NFS semantics and what Linux expects.
384	*/
385	static void
386	nfsd_sanitize_attrs(struct inode *inode, struct iattr *iap)
387	{
388	/* Ignore mode updates on symlinks */
389	if (S_ISLNK(inode->i_mode))
390	iap->ia_valid &= ~ATTR_MODE;
391
392	/* sanitize the mode change */
393	if (iap->ia_valid & ATTR_MODE) {
394	iap->ia_mode &= S_IALLUGO;
395	iap->ia_mode |= (inode->i_mode & ~S_IALLUGO);
396	}
397
398	/* Revoke setuid/setgid on chown */
399	if (!S_ISDIR(inode->i_mode) &&
400	((iap->ia_valid & ATTR_UID) || (iap->ia_valid & ATTR_GID))) {
401	iap->ia_valid |= ATTR_KILL_PRIV;
402	if (iap->ia_valid & ATTR_MODE) {
403	/* we're setting mode too, just clear the s*id bits */
404	iap->ia_mode &= ~S_ISUID;
405	if (iap->ia_mode & S_IXGRP)
406	iap->ia_mode &= ~S_ISGID;
407	} else {
408	/* set ATTR_KILL_* bits and let VFS handle it */
409	iap->ia_valid |= ATTR_KILL_SUID;
410	iap->ia_valid |=
411	setattr_should_drop_sgid(idmap: &nop_mnt_idmap, inode);
412	}
413	}
414	}
415
416	static __be32
417	nfsd_get_write_access(struct svc_rqst *rqstp, struct svc_fh *fhp,
418	struct iattr *iap)
419	{
420	struct inode *inode = d_inode(dentry: fhp->fh_dentry);
421
422	if (iap->ia_size < inode->i_size) {
423	__be32 err;
424
425	err = nfsd_permission(rqstp, fhp->fh_export, fhp->fh_dentry,
426	NFSD_MAY_TRUNC | NFSD_MAY_OWNER_OVERRIDE);
427	if (err)
428	return err;
429	}
430	return nfserrno(errno: get_write_access(inode));
431	}
432
433	static int __nfsd_setattr(struct dentry *dentry, struct iattr *iap)
434	{
435	int host_err;
436
437	if (iap->ia_valid & ATTR_SIZE) {
438	/*
439	* RFC5661, Section 18.30.4:
440	* Changing the size of a file with SETATTR indirectly
441	* changes the time_modify and change attributes.
442	*
443	* (and similar for the older RFCs)
444	*/
445	struct iattr size_attr = {
446	.ia_valid = ATTR_SIZE | ATTR_CTIME | ATTR_MTIME,
447	.ia_size = iap->ia_size,
448	};
449
450	if (iap->ia_size < 0)
451	return -EFBIG;
452
453	host_err = notify_change(&nop_mnt_idmap, dentry, &size_attr, NULL);
454	if (host_err)
455	return host_err;
456	iap->ia_valid &= ~ATTR_SIZE;
457
458	/*
459	* Avoid the additional setattr call below if the only other
460	* attribute that the client sends is the mtime, as we update
461	* it as part of the size change above.
462	*/
463	if ((iap->ia_valid & ~ATTR_MTIME) == 0)
464	return 0;
465	}
466
467	if (!iap->ia_valid)
468	return 0;
469
470	iap->ia_valid |= ATTR_CTIME;
471	return notify_change(&nop_mnt_idmap, dentry, iap, NULL);
472	}
473
474	/**
475	* nfsd_setattr - Set various file attributes.
476	* @rqstp: controlling RPC transaction
477	* @fhp: filehandle of target
478	* @attr: attributes to set
479	* @check_guard: set to 1 if guardtime is a valid timestamp
480	* @guardtime: do not act if ctime.tv_sec does not match this timestamp
481	*
482	* This call may adjust the contents of @attr (in particular, this
483	* call may change the bits in the na_iattr.ia_valid field).
484	*
485	* Returns nfs_ok on success, otherwise an NFS status code is
486	* returned. Caller must release @fhp by calling fh_put in either
487	* case.
488	*/
489	__be32
490	nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp,
491	struct nfsd_attrs *attr,
492	int check_guard, time64_t guardtime)
493	{
494	struct dentry *dentry;
495	struct inode *inode;
496	struct iattr *iap = attr->na_iattr;
497	int accmode = NFSD_MAY_SATTR;
498	umode_t ftype = 0;
499	__be32 err;
500	int host_err;
501	bool get_write_count;
502	bool size_change = (iap->ia_valid & ATTR_SIZE);
503	int retries;
504
505	if (iap->ia_valid & ATTR_SIZE) {
506	accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE;
507	ftype = S_IFREG;
508	}
509
510	/*
511	* If utimes(2) and friends are called with times not NULL, we should
512	* not set NFSD_MAY_WRITE bit. Otherwise fh_verify->nfsd_permission
513	* will return EACCES, when the caller's effective UID does not match
514	* the owner of the file, and the caller is not privileged. In this
515	* situation, we should return EPERM(notify_change will return this).
516	*/
517	if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME)) {
518	accmode |= NFSD_MAY_OWNER_OVERRIDE;
519	if (!(iap->ia_valid & (ATTR_ATIME_SET | ATTR_MTIME_SET)))
520	accmode |= NFSD_MAY_WRITE;
521	}
522
523	/* Callers that do fh_verify should do the fh_want_write: */
524	get_write_count = !fhp->fh_dentry;
525
526	/* Get inode */
527	err = fh_verify(rqstp, fhp, ftype, accmode);
528	if (err)
529	return err;
530	if (get_write_count) {
531	host_err = fh_want_write(fh: fhp);
532	if (host_err)
533	goto out;
534	}
535
536	dentry = fhp->fh_dentry;
537	inode = d_inode(dentry);
538
539	nfsd_sanitize_attrs(inode, iap);
540
541	if (check_guard && guardtime != inode_get_ctime_sec(inode))
542	return nfserr_notsync;
543
544	/*
545	* The size case is special, it changes the file in addition to the
546	* attributes, and file systems don't expect it to be mixed with
547	* "random" attribute changes. We thus split out the size change
548	* into a separate call to ->setattr, and do the rest as a separate
549	* setattr call.
550	*/
551	if (size_change) {
552	err = nfsd_get_write_access(rqstp, fhp, iap);
553	if (err)
554	return err;
555	}
556
557	inode_lock(inode);
558	for (retries = 1;;) {
559	struct iattr attrs;
560
561	/*
562	* notify_change() can alter its iattr argument, making
563	* @iap unsuitable for submission multiple times. Make a
564	* copy for every loop iteration.
565	*/
566	attrs = *iap;
567	host_err = __nfsd_setattr(dentry, iap: &attrs);
568	if (host_err != -EAGAIN || !retries--)
569	break;
570	if (!nfsd_wait_for_delegreturn(rqstp, inode))
571	break;
572	}
573	if (attr->na_seclabel && attr->na_seclabel->len)
574	attr->na_labelerr = security_inode_setsecctx(dentry,
575	ctx: attr->na_seclabel->data, ctxlen: attr->na_seclabel->len);
576	if (IS_ENABLED(CONFIG_FS_POSIX_ACL) && attr->na_pacl)
577	attr->na_aclerr = set_posix_acl(&nop_mnt_idmap,
578	dentry, ACL_TYPE_ACCESS,
579	attr->na_pacl);
580	if (IS_ENABLED(CONFIG_FS_POSIX_ACL) &&
581	!attr->na_aclerr && attr->na_dpacl && S_ISDIR(inode->i_mode))
582	attr->na_aclerr = set_posix_acl(&nop_mnt_idmap,
583	dentry, ACL_TYPE_DEFAULT,
584	attr->na_dpacl);
585	inode_unlock(inode);
586	if (size_change)
587	put_write_access(inode);
588	out:
589	if (!host_err)
590	host_err = commit_metadata(fhp);
591	return nfserrno(errno: host_err);
592	}
593
594	#if defined(CONFIG_NFSD_V4)
595	/*
596	* NFS junction information is stored in an extended attribute.
597	*/
598	#define NFSD_JUNCTION_XATTR_NAME XATTR_TRUSTED_PREFIX "junction.nfs"
599
600	/**
601	* nfsd4_is_junction - Test if an object could be an NFS junction
602	*
603	* @dentry: object to test
604	*
605	* Returns 1 if "dentry" appears to contain NFS junction information.
606	* Otherwise 0 is returned.
607	*/
608	int nfsd4_is_junction(struct dentry *dentry)
609	{
610	struct inode *inode = d_inode(dentry);
611
612	if (inode == NULL)
613	return 0;
614	if (inode->i_mode & S_IXUGO)
615	return 0;
616	if (!(inode->i_mode & S_ISVTX))
617	return 0;
618	if (vfs_getxattr(&nop_mnt_idmap, dentry, NFSD_JUNCTION_XATTR_NAME,
619	NULL, 0) <= 0)
620	return 0;
621	return 1;
622	}
623
624	static struct nfsd4_compound_state *nfsd4_get_cstate(struct svc_rqst *rqstp)
625	{
626	return &((struct nfsd4_compoundres *)rqstp->rq_resp)->cstate;
627	}
628
629	__be32 nfsd4_clone_file_range(struct svc_rqst *rqstp,
630	struct nfsd_file *nf_src, u64 src_pos,
631	struct nfsd_file *nf_dst, u64 dst_pos,
632	u64 count, bool sync)
633	{
634	struct file *src = nf_src->nf_file;
635	struct file *dst = nf_dst->nf_file;
636	errseq_t since;
637	loff_t cloned;
638	__be32 ret = 0;
639
640	since = READ_ONCE(dst->f_wb_err);
641	cloned = vfs_clone_file_range(file_in: src, pos_in: src_pos, file_out: dst, pos_out: dst_pos, len: count, remap_flags: 0);
642	if (cloned < 0) {
643	ret = nfserrno(errno: cloned);
644	goto out_err;
645	}
646	if (count && cloned != count) {
647	ret = nfserrno(errno: -EINVAL);
648	goto out_err;
649	}
650	if (sync) {
651	loff_t dst_end = count ? dst_pos + count - 1 : LLONG_MAX;
652	int status = vfs_fsync_range(file: dst, start: dst_pos, end: dst_end, datasync: 0);
653
654	if (!status)
655	status = filemap_check_wb_err(mapping: dst->f_mapping, since);
656	if (!status)
657	status = commit_inode_metadata(inode: file_inode(f: src));
658	if (status < 0) {
659	struct nfsd_net *nn = net_generic(net: nf_dst->nf_net,
660	id: nfsd_net_id);
661
662	trace_nfsd_clone_file_range_err(rqstp,
663	src_fhp: &nfsd4_get_cstate(rqstp)->save_fh,
664	src_offset: src_pos,
665	dst_fhp: &nfsd4_get_cstate(rqstp)->current_fh,
666	dst_offset: dst_pos,
667	count, status);
668	commit_reset_write_verifier(nn, rqstp, err: status);
669	ret = nfserrno(errno: status);
670	}
671	}
672	out_err:
673	return ret;
674	}
675
676	ssize_t nfsd_copy_file_range(struct file *src, u64 src_pos, struct file *dst,
677	u64 dst_pos, u64 count)
678	{
679	ssize_t ret;
680
681	/*
682	* Limit copy to 4MB to prevent indefinitely blocking an nfsd
683	* thread and client rpc slot. The choice of 4MB is somewhat
684	* arbitrary. We might instead base this on r/wsize, or make it
685	* tunable, or use a time instead of a byte limit, or implement
686	* asynchronous copy. In theory a client could also recognize a
687	* limit like this and pipeline multiple COPY requests.
688	*/
689	count = min_t(u64, count, 1 << 22);
690	ret = vfs_copy_file_range(src, src_pos, dst, dst_pos, count, 0);
691
692	if (ret == -EOPNOTSUPP || ret == -EXDEV)
693	ret = vfs_copy_file_range(src, src_pos, dst, dst_pos, count,
694	COPY_FILE_SPLICE);
695	return ret;
696	}
697
698	__be32 nfsd4_vfs_fallocate(struct svc_rqst *rqstp, struct svc_fh *fhp,
699	struct file *file, loff_t offset, loff_t len,
700	int flags)
701	{
702	int error;
703
704	if (!S_ISREG(file_inode(file)->i_mode))
705	return nfserr_inval;
706
707	error = vfs_fallocate(file, mode: flags, offset, len);
708	if (!error)
709	error = commit_metadata(fhp);
710
711	return nfserrno(errno: error);
712	}
713	#endif /* defined(CONFIG_NFSD_V4) */
714
715	/*
716	* Check server access rights to a file system object
717	*/
718	struct accessmap {
719	u32 access;
720	int how;
721	};
722	static struct accessmap nfs3_regaccess[] = {
723	{ NFS3_ACCESS_READ, NFSD_MAY_READ },
724	{ NFS3_ACCESS_EXECUTE, NFSD_MAY_EXEC },
725	{ NFS3_ACCESS_MODIFY, NFSD_MAY_WRITE|NFSD_MAY_TRUNC },
726	{ NFS3_ACCESS_EXTEND, NFSD_MAY_WRITE },
727
728	#ifdef CONFIG_NFSD_V4
729	{ NFS4_ACCESS_XAREAD, NFSD_MAY_READ },
730	{ NFS4_ACCESS_XAWRITE, NFSD_MAY_WRITE },
731	{ NFS4_ACCESS_XALIST, NFSD_MAY_READ },
732	#endif
733
734	{ 0, 0 }
735	};
736
737	static struct accessmap nfs3_diraccess[] = {
738	{ NFS3_ACCESS_READ, NFSD_MAY_READ },
739	{ NFS3_ACCESS_LOOKUP, NFSD_MAY_EXEC },
740	{ NFS3_ACCESS_MODIFY, NFSD_MAY_EXEC|NFSD_MAY_WRITE|NFSD_MAY_TRUNC},
741	{ NFS3_ACCESS_EXTEND, NFSD_MAY_EXEC|NFSD_MAY_WRITE },
742	{ NFS3_ACCESS_DELETE, NFSD_MAY_REMOVE },
743
744	#ifdef CONFIG_NFSD_V4
745	{ NFS4_ACCESS_XAREAD, NFSD_MAY_READ },
746	{ NFS4_ACCESS_XAWRITE, NFSD_MAY_WRITE },
747	{ NFS4_ACCESS_XALIST, NFSD_MAY_READ },
748	#endif
749
750	{ 0, 0 }
751	};
752
753	static struct accessmap nfs3_anyaccess[] = {
754	/* Some clients - Solaris 2.6 at least, make an access call
755	* to the server to check for access for things like /dev/null
756	* (which really, the server doesn't care about). So
757	* We provide simple access checking for them, looking
758	* mainly at mode bits, and we make sure to ignore read-only
759	* filesystem checks
760	*/
761	{ NFS3_ACCESS_READ, NFSD_MAY_READ },
762	{ NFS3_ACCESS_EXECUTE, NFSD_MAY_EXEC },
763	{ NFS3_ACCESS_MODIFY, NFSD_MAY_WRITE|NFSD_MAY_LOCAL_ACCESS },
764	{ NFS3_ACCESS_EXTEND, NFSD_MAY_WRITE|NFSD_MAY_LOCAL_ACCESS },
765
766	{ 0, 0 }
767	};
768
769	__be32
770	nfsd_access(struct svc_rqst *rqstp, struct svc_fh *fhp, u32 *access, u32 *supported)
771	{
772	struct accessmap *map;
773	struct svc_export *export;
774	struct dentry *dentry;
775	u32 query, result = 0, sresult = 0;
776	__be32 error;
777
778	error = fh_verify(rqstp, fhp, 0, NFSD_MAY_NOP);
779	if (error)
780	goto out;
781
782	export = fhp->fh_export;
783	dentry = fhp->fh_dentry;
784
785	if (d_is_reg(dentry))
786	map = nfs3_regaccess;
787	else if (d_is_dir(dentry))
788	map = nfs3_diraccess;
789	else
790	map = nfs3_anyaccess;
791
792
793	query = *access;
794	for (; map->access; map++) {
795	if (map->access & query) {
796	__be32 err2;
797
798	sresult |= map->access;
799
800	err2 = nfsd_permission(rqstp, export, dentry, map->how);
801	switch (err2) {
802	case nfs_ok:
803	result |= map->access;
804	break;
805
806	/* the following error codes just mean the access was not allowed,
807	* rather than an error occurred */
808	case nfserr_rofs:
809	case nfserr_acces:
810	case nfserr_perm:
811	/* simply don't "or" in the access bit. */
812	break;
813	default:
814	error = err2;
815	goto out;
816	}
817	}
818	}
819	*access = result;
820	if (supported)
821	*supported = sresult;
822
823	out:
824	return error;
825	}
826
827	int nfsd_open_break_lease(struct inode *inode, int access)
828	{
829	unsigned int mode;
830
831	if (access & NFSD_MAY_NOT_BREAK_LEASE)
832	return 0;
833	mode = (access & NFSD_MAY_WRITE) ? O_WRONLY : O_RDONLY;
834	return break_lease(inode, mode: mode | O_NONBLOCK);
835	}
836
837	/*
838	* Open an existing file or directory.
839	* The may_flags argument indicates the type of open (read/write/lock)
840	* and additional flags.
841	* N.B. After this call fhp needs an fh_put
842	*/
843	static int
844	__nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, umode_t type,
845	int may_flags, struct file **filp)
846	{
847	struct path path;
848	struct inode *inode;
849	struct file *file;
850	int flags = O_RDONLY|O_LARGEFILE;
851	int host_err = -EPERM;
852
853	path.mnt = fhp->fh_export->ex_path.mnt;
854	path.dentry = fhp->fh_dentry;
855	inode = d_inode(dentry: path.dentry);
856
857	if (IS_APPEND(inode) && (may_flags & NFSD_MAY_WRITE))
858	goto out;
859
860	if (!inode->i_fop)
861	goto out;
862
863	host_err = nfsd_open_break_lease(inode, access: may_flags);
864	if (host_err) /* NOMEM or WOULDBLOCK */
865	goto out;
866
867	if (may_flags & NFSD_MAY_WRITE) {
868	if (may_flags & NFSD_MAY_READ)
869	flags = O_RDWR|O_LARGEFILE;
870	else
871	flags = O_WRONLY|O_LARGEFILE;
872	}
873
874	file = dentry_open(path: &path, flags, current_cred());
875	if (IS_ERR(ptr: file)) {
876	host_err = PTR_ERR(ptr: file);
877	goto out;
878	}
879
880	host_err = ima_file_check(file, mask: may_flags);
881	if (host_err) {
882	fput(file);
883	goto out;
884	}
885
886	if (may_flags & NFSD_MAY_64BIT_COOKIE)
887	file->f_mode |= FMODE_64BITHASH;
888	else
889	file->f_mode |= FMODE_32BITHASH;
890
891	*filp = file;
892	out:
893	return host_err;
894	}
895
896	__be32
897	nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, umode_t type,
898	int may_flags, struct file **filp)
899	{
900	__be32 err;
901	int host_err;
902	bool retried = false;
903
904	validate_process_creds();
905	/*
906	* If we get here, then the client has already done an "open",
907	* and (hopefully) checked permission - so allow OWNER_OVERRIDE
908	* in case a chmod has now revoked permission.
909	*
910	* Arguably we should also allow the owner override for
911	* directories, but we never have and it doesn't seem to have
912	* caused anyone a problem. If we were to change this, note
913	* also that our filldir callbacks would need a variant of
914	* lookup_one_len that doesn't check permissions.
915	*/
916	if (type == S_IFREG)
917	may_flags |= NFSD_MAY_OWNER_OVERRIDE;
918	retry:
919	err = fh_verify(rqstp, fhp, type, may_flags);
920	if (!err) {
921	host_err = __nfsd_open(rqstp, fhp, type, may_flags, filp);
922	if (host_err == -EOPENSTALE && !retried) {
923	retried = true;
924	fh_put(fhp);
925	goto retry;
926	}
927	err = nfserrno(errno: host_err);
928	}
929	validate_process_creds();
930	return err;
931	}
932
933	/**
934	* nfsd_open_verified - Open a regular file for the filecache
935	* @rqstp: RPC request
936	* @fhp: NFS filehandle of the file to open
937	* @may_flags: internal permission flags
938	* @filp: OUT: open "struct file *"
939	*
940	* Returns zero on success, or a negative errno value.
941	*/
942	int
943	nfsd_open_verified(struct svc_rqst *rqstp, struct svc_fh *fhp, int may_flags,
944	struct file **filp)
945	{
946	int err;
947
948	validate_process_creds();
949	err = __nfsd_open(rqstp, fhp, S_IFREG, may_flags, filp);
950	validate_process_creds();
951	return err;
952	}
953
954	/*
955	* Grab and keep cached pages associated with a file in the svc_rqst
956	* so that they can be passed to the network sendmsg routines
957	* directly. They will be released after the sending has completed.
958	*
959	* Return values: Number of bytes consumed, or -EIO if there are no
960	* remaining pages in rqstp->rq_pages.
961	*/
962	static int
963	nfsd_splice_actor(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
964	struct splice_desc *sd)
965	{
966	struct svc_rqst *rqstp = sd->u.data;
967	struct page *page = buf->page; // may be a compound one
968	unsigned offset = buf->offset;
969	struct page *last_page;
970
971	last_page = page + (offset + sd->len - 1) / PAGE_SIZE;
972	for (page += offset / PAGE_SIZE; page <= last_page; page++) {
973	/*
974	* Skip page replacement when extending the contents of the
975	* current page. But note that we may get two zero_pages in a
976	* row from shmem.
977	*/
978	if (page == *(rqstp->rq_next_page - 1) &&
979	offset_in_page(rqstp->rq_res.page_base +
980	rqstp->rq_res.page_len))
981	continue;
982	if (unlikely(!svc_rqst_replace_page(rqstp, page)))
983	return -EIO;
984	}
985	if (rqstp->rq_res.page_len == 0) // first call
986	rqstp->rq_res.page_base = offset % PAGE_SIZE;
987	rqstp->rq_res.page_len += sd->len;
988	return sd->len;
989	}
990
991	static int nfsd_direct_splice_actor(struct pipe_inode_info *pipe,
992	struct splice_desc *sd)
993	{
994	return __splice_from_pipe(pipe, sd, nfsd_splice_actor);
995	}
996
997	static u32 nfsd_eof_on_read(struct file *file, loff_t offset, ssize_t len,
998	size_t expected)
999	{
1000	if (expected != 0 && len == 0)
1001	return 1;
1002	if (offset+len >= i_size_read(inode: file_inode(f: file)))
1003	return 1;
1004	return 0;
1005	}
1006
1007	static __be32 nfsd_finish_read(struct svc_rqst *rqstp, struct svc_fh *fhp,
1008	struct file *file, loff_t offset,
1009	unsigned long *count, u32 *eof, ssize_t host_err)
1010	{
1011	if (host_err >= 0) {
1012	nfsd_stats_io_read_add(exp: fhp->fh_export, amount: host_err);
1013	*eof = nfsd_eof_on_read(file, offset, len: host_err, expected: *count);
1014	*count = host_err;
1015	fsnotify_access(file);
1016	trace_nfsd_read_io_done(rqstp, fhp, offset, len: *count);
1017	return 0;
1018	} else {
1019	trace_nfsd_read_err(rqstp, fhp, offset, len: host_err);
1020	return nfserrno(errno: host_err);
1021	}
1022	}
1023
1024	/**
1025	* nfsd_splice_read - Perform a VFS read using a splice pipe
1026	* @rqstp: RPC transaction context
1027	* @fhp: file handle of file to be read
1028	* @file: opened struct file of file to be read
1029	* @offset: starting byte offset
1030	* @count: IN: requested number of bytes; OUT: number of bytes read
1031	* @eof: OUT: set non-zero if operation reached the end of the file
1032	*
1033	* Returns nfs_ok on success, otherwise an nfserr stat value is
1034	* returned.
1035	*/
1036	__be32 nfsd_splice_read(struct svc_rqst *rqstp, struct svc_fh *fhp,
1037	struct file *file, loff_t offset, unsigned long *count,
1038	u32 *eof)
1039	{
1040	struct splice_desc sd = {
1041	.len = 0,
1042	.total_len = *count,
1043	.pos = offset,
1044	.u.data = rqstp,
1045	};
1046	ssize_t host_err;
1047
1048	trace_nfsd_read_splice(rqstp, fhp, offset, len: *count);
1049	host_err = splice_direct_to_actor(file, &sd, nfsd_direct_splice_actor);
1050	return nfsd_finish_read(rqstp, fhp, file, offset, count, eof, host_err);
1051	}
1052
1053	/**
1054	* nfsd_iter_read - Perform a VFS read using an iterator
1055	* @rqstp: RPC transaction context
1056	* @fhp: file handle of file to be read
1057	* @file: opened struct file of file to be read
1058	* @offset: starting byte offset
1059	* @count: IN: requested number of bytes; OUT: number of bytes read
1060	* @base: offset in first page of read buffer
1061	* @eof: OUT: set non-zero if operation reached the end of the file
1062	*
1063	* Some filesystems or situations cannot use nfsd_splice_read. This
1064	* function is the slightly less-performant fallback for those cases.
1065	*
1066	* Returns nfs_ok on success, otherwise an nfserr stat value is
1067	* returned.
1068	*/
1069	__be32 nfsd_iter_read(struct svc_rqst *rqstp, struct svc_fh *fhp,
1070	struct file *file, loff_t offset, unsigned long *count,
1071	unsigned int base, u32 *eof)
1072	{
1073	unsigned long v, total;
1074	struct iov_iter iter;
1075	loff_t ppos = offset;
1076	struct page *page;
1077	ssize_t host_err;
1078
1079	v = 0;
1080	total = *count;
1081	while (total) {
1082	page = *(rqstp->rq_next_page++);
1083	rqstp->rq_vec[v].iov_base = page_address(page) + base;
1084	rqstp->rq_vec[v].iov_len = min_t(size_t, total, PAGE_SIZE - base);
1085	total -= rqstp->rq_vec[v].iov_len;
1086	++v;
1087	base = 0;
1088	}
1089	WARN_ON_ONCE(v > ARRAY_SIZE(rqstp->rq_vec));
1090
1091	trace_nfsd_read_vector(rqstp, fhp, offset, len: *count);
1092	iov_iter_kvec(i: &iter, ITER_DEST, kvec: rqstp->rq_vec, nr_segs: v, count: *count);
1093	host_err = vfs_iter_read(file, iter: &iter, ppos: &ppos, flags: 0);
1094	return nfsd_finish_read(rqstp, fhp, file, offset, count, eof, host_err);
1095	}
1096
1097	/*
1098	* Gathered writes: If another process is currently writing to the file,
1099	* there's a high chance this is another nfsd (triggered by a bulk write
1100	* from a client's biod). Rather than syncing the file with each write
1101	* request, we sleep for 10 msec.
1102	*
1103	* I don't know if this roughly approximates C. Juszak's idea of
1104	* gathered writes, but it's a nice and simple solution (IMHO), and it
1105	* seems to work:-)
1106	*
1107	* Note: we do this only in the NFSv2 case, since v3 and higher have a
1108	* better tool (separate unstable writes and commits) for solving this
1109	* problem.
1110	*/
1111	static int wait_for_concurrent_writes(struct file *file)
1112	{
1113	struct inode *inode = file_inode(f: file);
1114	static ino_t last_ino;
1115	static dev_t last_dev;
1116	int err = 0;
1117
1118	if (atomic_read(v: &inode->i_writecount) > 1
1119	|| (last_ino == inode->i_ino && last_dev == inode->i_sb->s_dev)) {
1120	dprintk("nfsd: write defer %d\n", task_pid_nr(current));
1121	msleep(msecs: 10);
1122	dprintk("nfsd: write resume %d\n", task_pid_nr(current));
1123	}
1124
1125	if (inode->i_state & I_DIRTY) {
1126	dprintk("nfsd: write sync %d\n", task_pid_nr(current));
1127	err = vfs_fsync(file, datasync: 0);
1128	}
1129	last_ino = inode->i_ino;
1130	last_dev = inode->i_sb->s_dev;
1131	return err;
1132	}
1133
1134	__be32
1135	nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct nfsd_file *nf,
1136	loff_t offset, struct kvec *vec, int vlen,
1137	unsigned long *cnt, int stable,
1138	__be32 *verf)
1139	{
1140	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), id: nfsd_net_id);
1141	struct file *file = nf->nf_file;
1142	struct super_block *sb = file_inode(f: file)->i_sb;
1143	struct svc_export *exp;
1144	struct iov_iter iter;
1145	errseq_t since;
1146	__be32 nfserr;
1147	int host_err;
1148	int use_wgather;
1149	loff_t pos = offset;
1150	unsigned long exp_op_flags = 0;
1151	unsigned int pflags = current->flags;
1152	rwf_t flags = 0;
1153	bool restore_flags = false;
1154
1155	trace_nfsd_write_opened(rqstp, fhp, offset, len: *cnt);
1156
1157	if (sb->s_export_op)
1158	exp_op_flags = sb->s_export_op->flags;
1159
1160	if (test_bit(RQ_LOCAL, &rqstp->rq_flags) &&
1161	!(exp_op_flags & EXPORT_OP_REMOTE_FS)) {
1162	/*
1163	* We want throttling in balance_dirty_pages()
1164	* and shrink_inactive_list() to only consider
1165	* the backingdev we are writing to, so that nfs to
1166	* localhost doesn't cause nfsd to lock up due to all
1167	* the client's dirty pages or its congested queue.
1168	*/
1169	current->flags |= PF_LOCAL_THROTTLE;
1170	restore_flags = true;
1171	}
1172
1173	exp = fhp->fh_export;
1174	use_wgather = (rqstp->rq_vers == 2) && EX_WGATHER(exp);
1175
1176	if (!EX_ISSYNC(exp))
1177	stable = NFS_UNSTABLE;
1178
1179	if (stable && !use_wgather)
1180	flags |= RWF_SYNC;
1181
1182	iov_iter_kvec(i: &iter, ITER_SOURCE, kvec: vec, nr_segs: vlen, count: *cnt);
1183	since = READ_ONCE(file->f_wb_err);
1184	if (verf)
1185	nfsd_copy_write_verifier(verf, nn);
1186	file_start_write(file);
1187	host_err = vfs_iter_write(file, iter: &iter, ppos: &pos, flags);
1188	file_end_write(file);
1189	if (host_err < 0) {
1190	commit_reset_write_verifier(nn, rqstp, err: host_err);
1191	goto out_nfserr;
1192	}
1193	*cnt = host_err;
1194	nfsd_stats_io_write_add(exp, amount: *cnt);
1195	fsnotify_modify(file);
1196	host_err = filemap_check_wb_err(mapping: file->f_mapping, since);
1197	if (host_err < 0)
1198	goto out_nfserr;
1199
1200	if (stable && use_wgather) {
1201	host_err = wait_for_concurrent_writes(file);
1202	if (host_err < 0)
1203	commit_reset_write_verifier(nn, rqstp, err: host_err);
1204	}
1205
1206	out_nfserr:
1207	if (host_err >= 0) {
1208	trace_nfsd_write_io_done(rqstp, fhp, offset, len: *cnt);
1209	nfserr = nfs_ok;
1210	} else {
1211	trace_nfsd_write_err(rqstp, fhp, offset, len: host_err);
1212	nfserr = nfserrno(errno: host_err);
1213	}
1214	if (restore_flags)
1215	current_restore_flags(orig_flags: pflags, PF_LOCAL_THROTTLE);
1216	return nfserr;
1217	}
1218
1219	/**
1220	* nfsd_read - Read data from a file
1221	* @rqstp: RPC transaction context
1222	* @fhp: file handle of file to be read
1223	* @offset: starting byte offset
1224	* @count: IN: requested number of bytes; OUT: number of bytes read
1225	* @eof: OUT: set non-zero if operation reached the end of the file
1226	*
1227	* The caller must verify that there is enough space in @rqstp.rq_res
1228	* to perform this operation.
1229	*
1230	* N.B. After this call fhp needs an fh_put
1231	*
1232	* Returns nfs_ok on success, otherwise an nfserr stat value is
1233	* returned.
1234	*/
1235	__be32 nfsd_read(struct svc_rqst *rqstp, struct svc_fh *fhp,
1236	loff_t offset, unsigned long *count, u32 *eof)
1237	{
1238	struct nfsd_file *nf;
1239	struct file *file;
1240	__be32 err;
1241
1242	trace_nfsd_read_start(rqstp, fhp, offset, len: *count);
1243	err = nfsd_file_acquire_gc(rqstp, fhp, NFSD_MAY_READ, nfp: &nf);
1244	if (err)
1245	return err;
1246
1247	file = nf->nf_file;
1248	if (file->f_op->splice_read && test_bit(RQ_SPLICE_OK, &rqstp->rq_flags))
1249	err = nfsd_splice_read(rqstp, fhp, file, offset, count, eof);
1250	else
1251	err = nfsd_iter_read(rqstp, fhp, file, offset, count, base: 0, eof);
1252
1253	nfsd_file_put(nf);
1254	trace_nfsd_read_done(rqstp, fhp, offset, len: *count);
1255	return err;
1256	}
1257
1258	/*
1259	* Write data to a file.
1260	* The stable flag requests synchronous writes.
1261	* N.B. After this call fhp needs an fh_put
1262	*/
1263	__be32
1264	nfsd_write(struct svc_rqst *rqstp, struct svc_fh *fhp, loff_t offset,
1265	struct kvec *vec, int vlen, unsigned long *cnt, int stable,
1266	__be32 *verf)
1267	{
1268	struct nfsd_file *nf;
1269	__be32 err;
1270
1271	trace_nfsd_write_start(rqstp, fhp, offset, len: *cnt);
1272
1273	err = nfsd_file_acquire_gc(rqstp, fhp, NFSD_MAY_WRITE, nfp: &nf);
1274	if (err)
1275	goto out;
1276
1277	err = nfsd_vfs_write(rqstp, fhp, nf, offset, vec,
1278	vlen, cnt, stable, verf);
1279	nfsd_file_put(nf);
1280	out:
1281	trace_nfsd_write_done(rqstp, fhp, offset, len: *cnt);
1282	return err;
1283	}
1284
1285	/**
1286	* nfsd_commit - Commit pending writes to stable storage
1287	* @rqstp: RPC request being processed
1288	* @fhp: NFS filehandle
1289	* @nf: target file
1290	* @offset: raw offset from beginning of file
1291	* @count: raw count of bytes to sync
1292	* @verf: filled in with the server's current write verifier
1293	*
1294	* Note: we guarantee that data that lies within the range specified
1295	* by the 'offset' and 'count' parameters will be synced. The server
1296	* is permitted to sync data that lies outside this range at the
1297	* same time.
1298	*
1299	* Unfortunately we cannot lock the file to make sure we return full WCC
1300	* data to the client, as locking happens lower down in the filesystem.
1301	*
1302	* Return values:
1303	* An nfsstat value in network byte order.
1304	*/
1305	__be32
1306	nfsd_commit(struct svc_rqst *rqstp, struct svc_fh *fhp, struct nfsd_file *nf,
1307	u64 offset, u32 count, __be32 *verf)
1308	{
1309	__be32 err = nfs_ok;
1310	u64 maxbytes;
1311	loff_t start, end;
1312	struct nfsd_net *nn;
1313
1314	/*
1315	* Convert the client-provided (offset, count) range to a
1316	* (start, end) range. If the client-provided range falls
1317	* outside the maximum file size of the underlying FS,
1318	* clamp the sync range appropriately.
1319	*/
1320	start = 0;
1321	end = LLONG_MAX;
1322	maxbytes = (u64)fhp->fh_dentry->d_sb->s_maxbytes;
1323	if (offset < maxbytes) {
1324	start = offset;
1325	if (count && (offset + count - 1 < maxbytes))
1326	end = offset + count - 1;
1327	}
1328
1329	nn = net_generic(net: nf->nf_net, id: nfsd_net_id);
1330	if (EX_ISSYNC(fhp->fh_export)) {
1331	errseq_t since = READ_ONCE(nf->nf_file->f_wb_err);
1332	int err2;
1333
1334	err2 = vfs_fsync_range(file: nf->nf_file, start, end, datasync: 0);
1335	switch (err2) {
1336	case 0:
1337	nfsd_copy_write_verifier(verf, nn);
1338	err2 = filemap_check_wb_err(mapping: nf->nf_file->f_mapping,
1339	since);
1340	err = nfserrno(errno: err2);
1341	break;
1342	case -EINVAL:
1343	err = nfserr_notsupp;
1344	break;
1345	default:
1346	commit_reset_write_verifier(nn, rqstp, err: err2);
1347	err = nfserrno(errno: err2);
1348	}
1349	} else
1350	nfsd_copy_write_verifier(verf, nn);
1351
1352	return err;
1353	}
1354
1355	/**
1356	* nfsd_create_setattr - Set a created file's attributes
1357	* @rqstp: RPC transaction being executed
1358	* @fhp: NFS filehandle of parent directory
1359	* @resfhp: NFS filehandle of new object
1360	* @attrs: requested attributes of new object
1361	*
1362	* Returns nfs_ok on success, or an nfsstat in network byte order.
1363	*/
1364	__be32
1365	nfsd_create_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp,
1366	struct svc_fh *resfhp, struct nfsd_attrs *attrs)
1367	{
1368	struct iattr *iap = attrs->na_iattr;
1369	__be32 status;
1370
1371	/*
1372	* Mode has already been set by file creation.
1373	*/
1374	iap->ia_valid &= ~ATTR_MODE;
1375
1376	/*
1377	* Setting uid/gid works only for root. Irix appears to
1378	* send along the gid on create when it tries to implement
1379	* setgid directories via NFS:
1380	*/
1381	if (!uid_eq(current_fsuid(), GLOBAL_ROOT_UID))
1382	iap->ia_valid &= ~(ATTR_UID|ATTR_GID);
1383
1384	/*
1385	* Callers expect new file metadata to be committed even
1386	* if the attributes have not changed.
1387	*/
1388	if (iap->ia_valid)
1389	status = nfsd_setattr(rqstp, resfhp, attrs, 0, (time64_t)0);
1390	else
1391	status = nfserrno(commit_metadata(resfhp));
1392
1393	/*
1394	* Transactional filesystems had a chance to commit changes
1395	* for both parent and child simultaneously making the
1396	* following commit_metadata a noop in many cases.
1397	*/
1398	if (!status)
1399	status = nfserrno(commit_metadata(fhp));
1400
1401	/*
1402	* Update the new filehandle to pick up the new attributes.
1403	*/
1404	if (!status)
1405	status = fh_update(resfhp);
1406
1407	return status;
1408	}
1409
1410	/* HPUX client sometimes creates a file in mode 000, and sets size to 0.
1411	* setting size to 0 may fail for some specific file systems by the permission
1412	* checking which requires WRITE permission but the mode is 000.
1413	* we ignore the resizing(to 0) on the just new created file, since the size is
1414	* 0 after file created.
1415	*
1416	* call this only after vfs_create() is called.
1417	* */
1418	static void
1419	nfsd_check_ignore_resizing(struct iattr *iap)
1420	{
1421	if ((iap->ia_valid & ATTR_SIZE) && (iap->ia_size == 0))
1422	iap->ia_valid &= ~ATTR_SIZE;
1423	}
1424
1425	/* The parent directory should already be locked: */
1426	__be32
1427	nfsd_create_locked(struct svc_rqst *rqstp, struct svc_fh *fhp,
1428	struct nfsd_attrs *attrs,
1429	int type, dev_t rdev, struct svc_fh *resfhp)
1430	{
1431	struct dentry *dentry, *dchild;
1432	struct inode *dirp;
1433	struct iattr *iap = attrs->na_iattr;
1434	__be32 err;
1435	int host_err;
1436
1437	dentry = fhp->fh_dentry;
1438	dirp = d_inode(dentry);
1439
1440	dchild = dget(dentry: resfhp->fh_dentry);
1441	err = nfsd_permission(rqstp, fhp->fh_export, dentry, NFSD_MAY_CREATE);
1442	if (err)
1443	goto out;
1444
1445	if (!(iap->ia_valid & ATTR_MODE))
1446	iap->ia_mode = 0;
1447	iap->ia_mode = (iap->ia_mode & S_IALLUGO) | type;
1448
1449	if (!IS_POSIXACL(dirp))
1450	iap->ia_mode &= ~current_umask();
1451
1452	err = 0;
1453	switch (type) {
1454	case S_IFREG:
1455	host_err = vfs_create(&nop_mnt_idmap, dirp, dchild,
1456	iap->ia_mode, true);
1457	if (!host_err)
1458	nfsd_check_ignore_resizing(iap);
1459	break;
1460	case S_IFDIR:
1461	host_err = vfs_mkdir(&nop_mnt_idmap, dirp, dchild, iap->ia_mode);
1462	if (!host_err && unlikely(d_unhashed(dchild))) {
1463	struct dentry *d;
1464	d = lookup_one_len(dchild->d_name.name,
1465	dchild->d_parent,
1466	dchild->d_name.len);
1467	if (IS_ERR(ptr: d)) {
1468	host_err = PTR_ERR(ptr: d);
1469	break;
1470	}
1471	if (unlikely(d_is_negative(d))) {
1472	dput(d);
1473	err = nfserr_serverfault;
1474	goto out;
1475	}
1476	dput(resfhp->fh_dentry);
1477	resfhp->fh_dentry = dget(dentry: d);
1478	err = fh_update(resfhp);
1479	dput(dchild);
1480	dchild = d;
1481	if (err)
1482	goto out;
1483	}
1484	break;
1485	case S_IFCHR:
1486	case S_IFBLK:
1487	case S_IFIFO:
1488	case S_IFSOCK:
1489	host_err = vfs_mknod(&nop_mnt_idmap, dirp, dchild,
1490	iap->ia_mode, rdev);
1491	break;
1492	default:
1493	printk(KERN_WARNING "nfsd: bad file type %o in nfsd_create\n",
1494	type);
1495	host_err = -EINVAL;
1496	}
1497	if (host_err < 0)
1498	goto out_nfserr;
1499
1500	err = nfsd_create_setattr(rqstp, fhp, resfhp, attrs);
1501
1502	out:
1503	dput(dchild);
1504	return err;
1505
1506	out_nfserr:
1507	err = nfserrno(errno: host_err);
1508	goto out;
1509	}
1510
1511	/*
1512	* Create a filesystem object (regular, directory, special).
1513	* Note that the parent directory is left locked.
1514	*
1515	* N.B. Every call to nfsd_create needs an fh_put for _both_ fhp and resfhp
1516	*/
1517	__be32
1518	nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
1519	char *fname, int flen, struct nfsd_attrs *attrs,
1520	int type, dev_t rdev, struct svc_fh *resfhp)
1521	{
1522	struct dentry *dentry, *dchild = NULL;
1523	__be32 err;
1524	int host_err;
1525
1526	if (isdotent(fname, flen))
1527	return nfserr_exist;
1528
1529	err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_NOP);
1530	if (err)
1531	return err;
1532
1533	dentry = fhp->fh_dentry;
1534
1535	host_err = fh_want_write(fh: fhp);
1536	if (host_err)
1537	return nfserrno(errno: host_err);
1538
1539	inode_lock_nested(inode: dentry->d_inode, subclass: I_MUTEX_PARENT);
1540	dchild = lookup_one_len(fname, dentry, flen);
1541	host_err = PTR_ERR(ptr: dchild);
1542	if (IS_ERR(ptr: dchild)) {
1543	err = nfserrno(errno: host_err);
1544	goto out_unlock;
1545	}
1546	err = fh_compose(resfhp, fhp->fh_export, dchild, fhp);
1547	/*
1548	* We unconditionally drop our ref to dchild as fh_compose will have
1549	* already grabbed its own ref for it.
1550	*/
1551	dput(dchild);
1552	if (err)
1553	goto out_unlock;
1554	err = fh_fill_pre_attrs(fhp);
1555	if (err != nfs_ok)
1556	goto out_unlock;
1557	err = nfsd_create_locked(rqstp, fhp, attrs, type, rdev, resfhp);
1558	fh_fill_post_attrs(fhp);
1559	out_unlock:
1560	inode_unlock(inode: dentry->d_inode);
1561	return err;
1562	}
1563
1564	/*
1565	* Read a symlink. On entry, *lenp must contain the maximum path length that
1566	* fits into the buffer. On return, it contains the true length.
1567	* N.B. After this call fhp needs an fh_put
1568	*/
1569	__be32
1570	nfsd_readlink(struct svc_rqst *rqstp, struct svc_fh *fhp, char *buf, int *lenp)
1571	{
1572	__be32 err;
1573	const char *link;
1574	struct path path;
1575	DEFINE_DELAYED_CALL(done);
1576	int len;
1577
1578	err = fh_verify(rqstp, fhp, S_IFLNK, NFSD_MAY_NOP);
1579	if (unlikely(err))
1580	return err;
1581
1582	path.mnt = fhp->fh_export->ex_path.mnt;
1583	path.dentry = fhp->fh_dentry;
1584
1585	if (unlikely(!d_is_symlink(path.dentry)))
1586	return nfserr_inval;
1587
1588	touch_atime(&path);
1589
1590	link = vfs_get_link(path.dentry, &done);
1591	if (IS_ERR(ptr: link))
1592	return nfserrno(errno: PTR_ERR(ptr: link));
1593
1594	len = strlen(link);
1595	if (len < *lenp)
1596	*lenp = len;
1597	memcpy(buf, link, *lenp);
1598	do_delayed_call(call: &done);
1599	return 0;
1600	}
1601
1602	/**
1603	* nfsd_symlink - Create a symlink and look up its inode
1604	* @rqstp: RPC transaction being executed
1605	* @fhp: NFS filehandle of parent directory
1606	* @fname: filename of the new symlink
1607	* @flen: length of @fname
1608	* @path: content of the new symlink (NUL-terminated)
1609	* @attrs: requested attributes of new object
1610	* @resfhp: NFS filehandle of new object
1611	*
1612	* N.B. After this call _both_ fhp and resfhp need an fh_put
1613	*
1614	* Returns nfs_ok on success, or an nfsstat in network byte order.
1615	*/
1616	__be32
1617	nfsd_symlink(struct svc_rqst *rqstp, struct svc_fh *fhp,
1618	char *fname, int flen,
1619	char *path, struct nfsd_attrs *attrs,
1620	struct svc_fh *resfhp)
1621	{
1622	struct dentry *dentry, *dnew;
1623	__be32 err, cerr;
1624	int host_err;
1625
1626	err = nfserr_noent;
1627	if (!flen || path[0] == '\0')
1628	goto out;
1629	err = nfserr_exist;
1630	if (isdotent(fname, flen))
1631	goto out;
1632
1633	err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
1634	if (err)
1635	goto out;
1636
1637	host_err = fh_want_write(fh: fhp);
1638	if (host_err) {
1639	err = nfserrno(errno: host_err);
1640	goto out;
1641	}
1642
1643	dentry = fhp->fh_dentry;
1644	inode_lock_nested(inode: dentry->d_inode, subclass: I_MUTEX_PARENT);
1645	dnew = lookup_one_len(fname, dentry, flen);
1646	if (IS_ERR(ptr: dnew)) {
1647	err = nfserrno(errno: PTR_ERR(ptr: dnew));
1648	inode_unlock(inode: dentry->d_inode);
1649	goto out_drop_write;
1650	}
1651	err = fh_fill_pre_attrs(fhp);
1652	if (err != nfs_ok)
1653	goto out_unlock;
1654	host_err = vfs_symlink(&nop_mnt_idmap, d_inode(dentry), dnew, path);
1655	err = nfserrno(errno: host_err);
1656	cerr = fh_compose(resfhp, fhp->fh_export, dnew, fhp);
1657	if (!err)
1658	nfsd_create_setattr(rqstp, fhp, resfhp, attrs);
1659	fh_fill_post_attrs(fhp);
1660	out_unlock:
1661	inode_unlock(inode: dentry->d_inode);
1662	if (!err)
1663	err = nfserrno(errno: commit_metadata(fhp));
1664	dput(dnew);
1665	if (err==0) err = cerr;
1666	out_drop_write:
1667	fh_drop_write(fh: fhp);
1668	out:
1669	return err;
1670	}
1671
1672	/*
1673	* Create a hardlink
1674	* N.B. After this call _both_ ffhp and tfhp need an fh_put
1675	*/
1676	__be32
1677	nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp,
1678	char *name, int len, struct svc_fh *tfhp)
1679	{
1680	struct dentry *ddir, *dnew, *dold;
1681	struct inode *dirp;
1682	__be32 err;
1683	int host_err;
1684
1685	err = fh_verify(rqstp, ffhp, S_IFDIR, NFSD_MAY_CREATE);
1686	if (err)
1687	goto out;
1688	err = fh_verify(rqstp, tfhp, 0, NFSD_MAY_NOP);
1689	if (err)
1690	goto out;
1691	err = nfserr_isdir;
1692	if (d_is_dir(dentry: tfhp->fh_dentry))
1693	goto out;
1694	err = nfserr_perm;
1695	if (!len)
1696	goto out;
1697	err = nfserr_exist;
1698	if (isdotent(name, len))
1699	goto out;
1700
1701	host_err = fh_want_write(fh: tfhp);
1702	if (host_err) {
1703	err = nfserrno(errno: host_err);
1704	goto out;
1705	}
1706
1707	ddir = ffhp->fh_dentry;
1708	dirp = d_inode(dentry: ddir);
1709	inode_lock_nested(inode: dirp, subclass: I_MUTEX_PARENT);
1710
1711	dnew = lookup_one_len(name, ddir, len);
1712	if (IS_ERR(ptr: dnew)) {
1713	err = nfserrno(errno: PTR_ERR(ptr: dnew));
1714	goto out_unlock;
1715	}
1716
1717	dold = tfhp->fh_dentry;
1718
1719	err = nfserr_noent;
1720	if (d_really_is_negative(dentry: dold))
1721	goto out_dput;
1722	err = fh_fill_pre_attrs(fhp: ffhp);
1723	if (err != nfs_ok)
1724	goto out_dput;
1725	host_err = vfs_link(dold, &nop_mnt_idmap, dirp, dnew, NULL);
1726	fh_fill_post_attrs(fhp: ffhp);
1727	inode_unlock(inode: dirp);
1728	if (!host_err) {
1729	err = nfserrno(errno: commit_metadata(fhp: ffhp));
1730	if (!err)
1731	err = nfserrno(errno: commit_metadata(fhp: tfhp));
1732	} else {
1733	if (host_err == -EXDEV && rqstp->rq_vers == 2)
1734	err = nfserr_acces;
1735	else
1736	err = nfserrno(errno: host_err);
1737	}
1738	dput(dnew);
1739	out_drop_write:
1740	fh_drop_write(fh: tfhp);
1741	out:
1742	return err;
1743
1744	out_dput:
1745	dput(dnew);
1746	out_unlock:
1747	inode_unlock(inode: dirp);
1748	goto out_drop_write;
1749	}
1750
1751	static void
1752	nfsd_close_cached_files(struct dentry *dentry)
1753	{
1754	struct inode *inode = d_inode(dentry);
1755
1756	if (inode && S_ISREG(inode->i_mode))
1757	nfsd_file_close_inode_sync(inode);
1758	}
1759
1760	static bool
1761	nfsd_has_cached_files(struct dentry *dentry)
1762	{
1763	bool ret = false;
1764	struct inode *inode = d_inode(dentry);
1765
1766	if (inode && S_ISREG(inode->i_mode))
1767	ret = nfsd_file_is_cached(inode);
1768	return ret;
1769	}
1770
1771	/*
1772	* Rename a file
1773	* N.B. After this call _both_ ffhp and tfhp need an fh_put
1774	*/
1775	__be32
1776	nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen,
1777	struct svc_fh *tfhp, char *tname, int tlen)
1778	{
1779	struct dentry *fdentry, *tdentry, *odentry, *ndentry, *trap;
1780	struct inode *fdir, *tdir;
1781	__be32 err;
1782	int host_err;
1783	bool close_cached = false;
1784
1785	err = fh_verify(rqstp, ffhp, S_IFDIR, NFSD_MAY_REMOVE);
1786	if (err)
1787	goto out;
1788	err = fh_verify(rqstp, tfhp, S_IFDIR, NFSD_MAY_CREATE);
1789	if (err)
1790	goto out;
1791
1792	fdentry = ffhp->fh_dentry;
1793	fdir = d_inode(dentry: fdentry);
1794
1795	tdentry = tfhp->fh_dentry;
1796	tdir = d_inode(dentry: tdentry);
1797
1798	err = nfserr_perm;
1799	if (!flen || isdotent(fname, flen) || !tlen || isdotent(tname, tlen))
1800	goto out;
1801
1802	err = (rqstp->rq_vers == 2) ? nfserr_acces : nfserr_xdev;
1803	if (ffhp->fh_export->ex_path.mnt != tfhp->fh_export->ex_path.mnt)
1804	goto out;
1805	if (ffhp->fh_export->ex_path.dentry != tfhp->fh_export->ex_path.dentry)
1806	goto out;
1807
1808	retry:
1809	host_err = fh_want_write(fh: ffhp);
1810	if (host_err) {
1811	err = nfserrno(errno: host_err);
1812	goto out;
1813	}
1814
1815	trap = lock_rename(tdentry, fdentry);
1816	err = fh_fill_pre_attrs(fhp: ffhp);
1817	if (err != nfs_ok)
1818	goto out_unlock;
1819	err = fh_fill_pre_attrs(fhp: tfhp);
1820	if (err != nfs_ok)
1821	goto out_unlock;
1822
1823	odentry = lookup_one_len(fname, fdentry, flen);
1824	host_err = PTR_ERR(ptr: odentry);
1825	if (IS_ERR(ptr: odentry))
1826	goto out_nfserr;
1827
1828	host_err = -ENOENT;
1829	if (d_really_is_negative(dentry: odentry))
1830	goto out_dput_old;
1831	host_err = -EINVAL;
1832	if (odentry == trap)
1833	goto out_dput_old;
1834
1835	ndentry = lookup_one_len(tname, tdentry, tlen);
1836	host_err = PTR_ERR(ptr: ndentry);
1837	if (IS_ERR(ptr: ndentry))
1838	goto out_dput_old;
1839	host_err = -ENOTEMPTY;
1840	if (ndentry == trap)
1841	goto out_dput_new;
1842
1843	if ((ndentry->d_sb->s_export_op->flags & EXPORT_OP_CLOSE_BEFORE_UNLINK) &&
1844	nfsd_has_cached_files(dentry: ndentry)) {
1845	close_cached = true;
1846	goto out_dput_old;
1847	} else {
1848	struct renamedata rd = {
1849	.old_mnt_idmap = &nop_mnt_idmap,
1850	.old_dir = fdir,
1851	.old_dentry = odentry,
1852	.new_mnt_idmap = &nop_mnt_idmap,
1853	.new_dir = tdir,
1854	.new_dentry = ndentry,
1855	};
1856	int retries;
1857
1858	for (retries = 1;;) {
1859	host_err = vfs_rename(&rd);
1860	if (host_err != -EAGAIN || !retries--)
1861	break;
1862	if (!nfsd_wait_for_delegreturn(rqstp, inode: d_inode(dentry: odentry)))
1863	break;
1864	}
1865	if (!host_err) {
1866	host_err = commit_metadata(fhp: tfhp);
1867	if (!host_err)
1868	host_err = commit_metadata(fhp: ffhp);
1869	}
1870	}
1871	out_dput_new:
1872	dput(ndentry);
1873	out_dput_old:
1874	dput(odentry);
1875	out_nfserr:
1876	err = nfserrno(errno: host_err);
1877
1878	if (!close_cached) {
1879	fh_fill_post_attrs(fhp: ffhp);
1880	fh_fill_post_attrs(fhp: tfhp);
1881	}
1882	out_unlock:
1883	unlock_rename(tdentry, fdentry);
1884	fh_drop_write(fh: ffhp);
1885
1886	/*
1887	* If the target dentry has cached open files, then we need to try to
1888	* close them prior to doing the rename. Flushing delayed fput
1889	* shouldn't be done with locks held however, so we delay it until this
1890	* point and then reattempt the whole shebang.
1891	*/
1892	if (close_cached) {
1893	close_cached = false;
1894	nfsd_close_cached_files(dentry: ndentry);
1895	dput(ndentry);
1896	goto retry;
1897	}
1898	out:
1899	return err;
1900	}
1901
1902	/*
1903	* Unlink a file or directory
1904	* N.B. After this call fhp needs an fh_put
1905	*/
1906	__be32
1907	nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
1908	char *fname, int flen)
1909	{
1910	struct dentry *dentry, *rdentry;
1911	struct inode *dirp;
1912	struct inode *rinode;
1913	__be32 err;
1914	int host_err;
1915
1916	err = nfserr_acces;
1917	if (!flen || isdotent(fname, flen))
1918	goto out;
1919	err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_REMOVE);
1920	if (err)
1921	goto out;
1922
1923	host_err = fh_want_write(fh: fhp);
1924	if (host_err)
1925	goto out_nfserr;
1926
1927	dentry = fhp->fh_dentry;
1928	dirp = d_inode(dentry);
1929	inode_lock_nested(inode: dirp, subclass: I_MUTEX_PARENT);
1930
1931	rdentry = lookup_one_len(fname, dentry, flen);
1932	host_err = PTR_ERR(ptr: rdentry);
1933	if (IS_ERR(ptr: rdentry))
1934	goto out_unlock;
1935
1936	if (d_really_is_negative(dentry: rdentry)) {
1937	dput(rdentry);
1938	host_err = -ENOENT;
1939	goto out_unlock;
1940	}
1941	rinode = d_inode(dentry: rdentry);
1942	err = fh_fill_pre_attrs(fhp);
1943	if (err != nfs_ok)
1944	goto out_unlock;
1945
1946	ihold(inode: rinode);
1947	if (!type)
1948	type = d_inode(dentry: rdentry)->i_mode & S_IFMT;
1949
1950	if (type != S_IFDIR) {
1951	int retries;
1952
1953	if (rdentry->d_sb->s_export_op->flags & EXPORT_OP_CLOSE_BEFORE_UNLINK)
1954	nfsd_close_cached_files(dentry: rdentry);
1955
1956	for (retries = 1;;) {
1957	host_err = vfs_unlink(&nop_mnt_idmap, dirp, rdentry, NULL);
1958	if (host_err != -EAGAIN || !retries--)
1959	break;
1960	if (!nfsd_wait_for_delegreturn(rqstp, inode: rinode))
1961	break;
1962	}
1963	} else {
1964	host_err = vfs_rmdir(&nop_mnt_idmap, dirp, rdentry);
1965	}
1966	fh_fill_post_attrs(fhp);
1967
1968	inode_unlock(inode: dirp);
1969	if (!host_err)
1970	host_err = commit_metadata(fhp);
1971	dput(rdentry);
1972	iput(rinode); /* truncate the inode here */
1973
1974	out_drop_write:
1975	fh_drop_write(fh: fhp);
1976	out_nfserr:
1977	if (host_err == -EBUSY) {
1978	/* name is mounted-on. There is no perfect
1979	* error status.
1980	*/
1981	if (nfsd_v4client(rq: rqstp))
1982	err = nfserr_file_open;
1983	else
1984	err = nfserr_acces;
1985	} else {
1986	err = nfserrno(errno: host_err);
1987	}
1988	out:
1989	return err;
1990	out_unlock:
1991	inode_unlock(inode: dirp);
1992	goto out_drop_write;
1993	}
1994
1995	/*
1996	* We do this buffering because we must not call back into the file
1997	* system's ->lookup() method from the filldir callback. That may well
1998	* deadlock a number of file systems.
1999	*
2000	* This is based heavily on the implementation of same in XFS.
2001	*/
2002	struct buffered_dirent {
2003	u64 ino;
2004	loff_t offset;
2005	int namlen;
2006	unsigned int d_type;
2007	char name[];
2008	};
2009
2010	struct readdir_data {
2011	struct dir_context ctx;
2012	char *dirent;
2013	size_t used;
2014	int full;
2015	};
2016
2017	static bool nfsd_buffered_filldir(struct dir_context *ctx, const char *name,
2018	int namlen, loff_t offset, u64 ino,
2019	unsigned int d_type)
2020	{
2021	struct readdir_data *buf =
2022	container_of(ctx, struct readdir_data, ctx);
2023	struct buffered_dirent *de = (void *)(buf->dirent + buf->used);
2024	unsigned int reclen;
2025
2026	reclen = ALIGN(sizeof(struct buffered_dirent) + namlen, sizeof(u64));
2027	if (buf->used + reclen > PAGE_SIZE) {
2028	buf->full = 1;
2029	return false;
2030	}
2031
2032	de->namlen = namlen;
2033	de->offset = offset;
2034	de->ino = ino;
2035	de->d_type = d_type;
2036	memcpy(de->name, name, namlen);
2037	buf->used += reclen;
2038
2039	return true;
2040	}
2041
2042	static __be32 nfsd_buffered_readdir(struct file *file, struct svc_fh *fhp,
2043	nfsd_filldir_t func, struct readdir_cd *cdp,
2044	loff_t *offsetp)
2045	{
2046	struct buffered_dirent *de;
2047	int host_err;
2048	int size;
2049	loff_t offset;
2050	struct readdir_data buf = {
2051	.ctx.actor = nfsd_buffered_filldir,
2052	.dirent = (void *)__get_free_page(GFP_KERNEL)
2053	};
2054
2055	if (!buf.dirent)
2056	return nfserrno(errno: -ENOMEM);
2057
2058	offset = *offsetp;
2059
2060	while (1) {
2061	unsigned int reclen;
2062
2063	cdp->err = nfserr_eof; /* will be cleared on successful read */
2064	buf.used = 0;
2065	buf.full = 0;
2066
2067	host_err = iterate_dir(file, &buf.ctx);
2068	if (buf.full)
2069	host_err = 0;
2070
2071	if (host_err < 0)
2072	break;
2073
2074	size = buf.used;
2075
2076	if (!size)
2077	break;
2078
2079	de = (struct buffered_dirent *)buf.dirent;
2080	while (size > 0) {
2081	offset = de->offset;
2082
2083	if (func(cdp, de->name, de->namlen, de->offset,
2084	de->ino, de->d_type))
2085	break;
2086
2087	if (cdp->err != nfs_ok)
2088	break;
2089
2090	trace_nfsd_dirent(fhp, ino: de->ino, name: de->name, namlen: de->namlen);
2091
2092	reclen = ALIGN(sizeof(*de) + de->namlen,
2093	sizeof(u64));
2094	size -= reclen;
2095	de = (struct buffered_dirent *)((char *)de + reclen);
2096	}
2097	if (size > 0) /* We bailed out early */
2098	break;
2099
2100	offset = vfs_llseek(file, offset: 0, SEEK_CUR);
2101	}
2102
2103	free_page((unsigned long)(buf.dirent));
2104
2105	if (host_err)
2106	return nfserrno(errno: host_err);
2107
2108	*offsetp = offset;
2109	return cdp->err;
2110	}
2111
2112	/*
2113	* Read entries from a directory.
2114	* The NFSv3/4 verifier we ignore for now.
2115	*/
2116	__be32
2117	nfsd_readdir(struct svc_rqst *rqstp, struct svc_fh *fhp, loff_t *offsetp,
2118	struct readdir_cd *cdp, nfsd_filldir_t func)
2119	{
2120	__be32 err;
2121	struct file *file;
2122	loff_t offset = *offsetp;
2123	int may_flags = NFSD_MAY_READ;
2124
2125	/* NFSv2 only supports 32 bit cookies */
2126	if (rqstp->rq_vers > 2)
2127	may_flags |= NFSD_MAY_64BIT_COOKIE;
2128
2129	err = nfsd_open(rqstp, fhp, S_IFDIR, may_flags, filp: &file);
2130	if (err)
2131	goto out;
2132
2133	offset = vfs_llseek(file, offset, SEEK_SET);
2134	if (offset < 0) {
2135	err = nfserrno(errno: (int)offset);
2136	goto out_close;
2137	}
2138
2139	err = nfsd_buffered_readdir(file, fhp, func, cdp, offsetp);
2140
2141	if (err == nfserr_eof || err == nfserr_toosmall)
2142	err = nfs_ok; /* can still be found in ->err */
2143	out_close:
2144	fput(file);
2145	out:
2146	return err;
2147	}
2148
2149	/*
2150	* Get file system stats
2151	* N.B. After this call fhp needs an fh_put
2152	*/
2153	__be32
2154	nfsd_statfs(struct svc_rqst *rqstp, struct svc_fh *fhp, struct kstatfs *stat, int access)
2155	{
2156	__be32 err;
2157
2158	err = fh_verify(rqstp, fhp, 0, NFSD_MAY_NOP | access);
2159	if (!err) {
2160	struct path path = {
2161	.mnt = fhp->fh_export->ex_path.mnt,
2162	.dentry = fhp->fh_dentry,
2163	};
2164	if (vfs_statfs(&path, stat))
2165	err = nfserr_io;
2166	}
2167	return err;
2168	}
2169
2170	static int exp_rdonly(struct svc_rqst *rqstp, struct svc_export *exp)
2171	{
2172	return nfsexp_flags(rqstp, exp) & NFSEXP_READONLY;
2173	}
2174
2175	#ifdef CONFIG_NFSD_V4
2176	/*
2177	* Helper function to translate error numbers. In the case of xattr operations,
2178	* some error codes need to be translated outside of the standard translations.
2179	*
2180	* ENODATA needs to be translated to nfserr_noxattr.
2181	* E2BIG to nfserr_xattr2big.
2182	*
2183	* Additionally, vfs_listxattr can return -ERANGE. This means that the
2184	* file has too many extended attributes to retrieve inside an
2185	* XATTR_LIST_MAX sized buffer. This is a bug in the xattr implementation:
2186	* filesystems will allow the adding of extended attributes until they hit
2187	* their own internal limit. This limit may be larger than XATTR_LIST_MAX.
2188	* So, at that point, the attributes are present and valid, but can't
2189	* be retrieved using listxattr, since the upper level xattr code enforces
2190	* the XATTR_LIST_MAX limit.
2191	*
2192	* This bug means that we need to deal with listxattr returning -ERANGE. The
2193	* best mapping is to return TOOSMALL.
2194	*/
2195	static __be32
2196	nfsd_xattr_errno(int err)
2197	{
2198	switch (err) {
2199	case -ENODATA:
2200	return nfserr_noxattr;
2201	case -E2BIG:
2202	return nfserr_xattr2big;
2203	case -ERANGE:
2204	return nfserr_toosmall;
2205	}
2206	return nfserrno(errno: err);
2207	}
2208
2209	/*
2210	* Retrieve the specified user extended attribute. To avoid always
2211	* having to allocate the maximum size (since we are not getting
2212	* a maximum size from the RPC), do a probe + alloc. Hold a reader
2213	* lock on i_rwsem to prevent the extended attribute from changing
2214	* size while we're doing this.
2215	*/
2216	__be32
2217	nfsd_getxattr(struct svc_rqst *rqstp, struct svc_fh *fhp, char *name,
2218	void **bufp, int *lenp)
2219	{
2220	ssize_t len;
2221	__be32 err;
2222	char *buf;
2223	struct inode *inode;
2224	struct dentry *dentry;
2225
2226	err = fh_verify(rqstp, fhp, 0, NFSD_MAY_READ);
2227	if (err)
2228	return err;
2229
2230	err = nfs_ok;
2231	dentry = fhp->fh_dentry;
2232	inode = d_inode(dentry);
2233
2234	inode_lock_shared(inode);
2235
2236	len = vfs_getxattr(&nop_mnt_idmap, dentry, name, NULL, 0);
2237
2238	/*
2239	* Zero-length attribute, just return.
2240	*/
2241	if (len == 0) {
2242	*bufp = NULL;
2243	*lenp = 0;
2244	goto out;
2245	}
2246
2247	if (len < 0) {
2248	err = nfsd_xattr_errno(err: len);
2249	goto out;
2250	}
2251
2252	if (len > *lenp) {
2253	err = nfserr_toosmall;
2254	goto out;
2255	}
2256
2257	buf = kvmalloc(size: len, GFP_KERNEL);
2258	if (buf == NULL) {
2259	err = nfserr_jukebox;
2260	goto out;
2261	}
2262
2263	len = vfs_getxattr(&nop_mnt_idmap, dentry, name, buf, len);
2264	if (len <= 0) {
2265	kvfree(addr: buf);
2266	buf = NULL;
2267	err = nfsd_xattr_errno(err: len);
2268	}
2269
2270	*lenp = len;
2271	*bufp = buf;
2272
2273	out:
2274	inode_unlock_shared(inode);
2275
2276	return err;
2277	}
2278
2279	/*
2280	* Retrieve the xattr names. Since we can't know how many are
2281	* user extended attributes, we must get all attributes here,
2282	* and have the XDR encode filter out the "user." ones.
2283	*
2284	* While this could always just allocate an XATTR_LIST_MAX
2285	* buffer, that's a waste, so do a probe + allocate. To
2286	* avoid any changes between the probe and allocate, wrap
2287	* this in inode_lock.
2288	*/
2289	__be32
2290	nfsd_listxattr(struct svc_rqst *rqstp, struct svc_fh *fhp, char **bufp,
2291	int *lenp)
2292	{
2293	ssize_t len;
2294	__be32 err;
2295	char *buf;
2296	struct inode *inode;
2297	struct dentry *dentry;
2298
2299	err = fh_verify(rqstp, fhp, 0, NFSD_MAY_READ);
2300	if (err)
2301	return err;
2302
2303	dentry = fhp->fh_dentry;
2304	inode = d_inode(dentry);
2305	*lenp = 0;
2306
2307	inode_lock_shared(inode);
2308
2309	len = vfs_listxattr(d: dentry, NULL, size: 0);
2310	if (len <= 0) {
2311	err = nfsd_xattr_errno(err: len);
2312	goto out;
2313	}
2314
2315	if (len > XATTR_LIST_MAX) {
2316	err = nfserr_xattr2big;
2317	goto out;
2318	}
2319
2320	buf = kvmalloc(size: len, GFP_KERNEL);
2321	if (buf == NULL) {
2322	err = nfserr_jukebox;
2323	goto out;
2324	}
2325
2326	len = vfs_listxattr(d: dentry, list: buf, size: len);
2327	if (len <= 0) {
2328	kvfree(addr: buf);
2329	err = nfsd_xattr_errno(err: len);
2330	goto out;
2331	}
2332
2333	*lenp = len;
2334	*bufp = buf;
2335
2336	err = nfs_ok;
2337	out:
2338	inode_unlock_shared(inode);
2339
2340	return err;
2341	}
2342
2343	/**
2344	* nfsd_removexattr - Remove an extended attribute
2345	* @rqstp: RPC transaction being executed
2346	* @fhp: NFS filehandle of object with xattr to remove
2347	* @name: name of xattr to remove (NUL-terminate)
2348	*
2349	* Pass in a NULL pointer for delegated_inode, and let the client deal
2350	* with NFS4ERR_DELAY (same as with e.g. setattr and remove).
2351	*
2352	* Returns nfs_ok on success, or an nfsstat in network byte order.
2353	*/
2354	__be32
2355	nfsd_removexattr(struct svc_rqst *rqstp, struct svc_fh *fhp, char *name)
2356	{
2357	__be32 err;
2358	int ret;
2359
2360	err = fh_verify(rqstp, fhp, 0, NFSD_MAY_WRITE);
2361	if (err)
2362	return err;
2363
2364	ret = fh_want_write(fh: fhp);
2365	if (ret)
2366	return nfserrno(errno: ret);
2367
2368	inode_lock(inode: fhp->fh_dentry->d_inode);
2369	err = fh_fill_pre_attrs(fhp);
2370	if (err != nfs_ok)
2371	goto out_unlock;
2372	ret = __vfs_removexattr_locked(&nop_mnt_idmap, fhp->fh_dentry,
2373	name, NULL);
2374	err = nfsd_xattr_errno(err: ret);
2375	fh_fill_post_attrs(fhp);
2376	out_unlock:
2377	inode_unlock(inode: fhp->fh_dentry->d_inode);
2378	fh_drop_write(fh: fhp);
2379
2380	return err;
2381	}
2382
2383	__be32
2384	nfsd_setxattr(struct svc_rqst *rqstp, struct svc_fh *fhp, char *name,
2385	void *buf, u32 len, u32 flags)
2386	{
2387	__be32 err;
2388	int ret;
2389
2390	err = fh_verify(rqstp, fhp, 0, NFSD_MAY_WRITE);
2391	if (err)
2392	return err;
2393
2394	ret = fh_want_write(fh: fhp);
2395	if (ret)
2396	return nfserrno(errno: ret);
2397	inode_lock(inode: fhp->fh_dentry->d_inode);
2398	err = fh_fill_pre_attrs(fhp);
2399	if (err != nfs_ok)
2400	goto out_unlock;
2401	ret = __vfs_setxattr_locked(&nop_mnt_idmap, fhp->fh_dentry,
2402	name, buf, len, flags, NULL);
2403	fh_fill_post_attrs(fhp);
2404	err = nfsd_xattr_errno(err: ret);
2405	out_unlock:
2406	inode_unlock(inode: fhp->fh_dentry->d_inode);
2407	fh_drop_write(fh: fhp);
2408	return err;
2409	}
2410	#endif
2411
2412	/*
2413	* Check for a user's access permissions to this inode.
2414	*/
2415	__be32
2416	nfsd_permission(struct svc_rqst *rqstp, struct svc_export *exp,
2417	struct dentry *dentry, int acc)
2418	{
2419	struct inode *inode = d_inode(dentry);
2420	int err;
2421
2422	if ((acc & NFSD_MAY_MASK) == NFSD_MAY_NOP)
2423	return 0;
2424	#if 0
2425	dprintk("nfsd: permission 0x%x%s%s%s%s%s%s%s mode 0%o%s%s%s\n",
2426	acc,
2427	(acc & NFSD_MAY_READ)? " read" : "",
2428	(acc & NFSD_MAY_WRITE)? " write" : "",
2429	(acc & NFSD_MAY_EXEC)? " exec" : "",
2430	(acc & NFSD_MAY_SATTR)? " sattr" : "",
2431	(acc & NFSD_MAY_TRUNC)? " trunc" : "",
2432	(acc & NFSD_MAY_LOCK)? " lock" : "",
2433	(acc & NFSD_MAY_OWNER_OVERRIDE)? " owneroverride" : "",
2434	inode->i_mode,
2435	IS_IMMUTABLE(inode)? " immut" : "",
2436	IS_APPEND(inode)? " append" : "",
2437	__mnt_is_readonly(exp->ex_path.mnt)? " ro" : "");
2438	dprintk(" owner %d/%d user %d/%d\n",
2439	inode->i_uid, inode->i_gid, current_fsuid(), current_fsgid());
2440	#endif
2441
2442	/* Normally we reject any write/sattr etc access on a read-only file
2443	* system. But if it is IRIX doing check on write-access for a
2444	* device special file, we ignore rofs.
2445	*/
2446	if (!(acc & NFSD_MAY_LOCAL_ACCESS))
2447	if (acc & (NFSD_MAY_WRITE | NFSD_MAY_SATTR | NFSD_MAY_TRUNC)) {
2448	if (exp_rdonly(rqstp, exp) ||
2449	__mnt_is_readonly(mnt: exp->ex_path.mnt))
2450	return nfserr_rofs;
2451	if (/* (acc & NFSD_MAY_WRITE) && */ IS_IMMUTABLE(inode))
2452	return nfserr_perm;
2453	}
2454	if ((acc & NFSD_MAY_TRUNC) && IS_APPEND(inode))
2455	return nfserr_perm;
2456
2457	if (acc & NFSD_MAY_LOCK) {
2458	/* If we cannot rely on authentication in NLM requests,
2459	* just allow locks, otherwise require read permission, or
2460	* ownership
2461	*/
2462	if (exp->ex_flags & NFSEXP_NOAUTHNLM)
2463	return 0;
2464	else
2465	acc = NFSD_MAY_READ | NFSD_MAY_OWNER_OVERRIDE;
2466	}
2467	/*
2468	* The file owner always gets access permission for accesses that
2469	* would normally be checked at open time. This is to make
2470	* file access work even when the client has done a fchmod(fd, 0).
2471	*
2472	* However, `cp foo bar' should fail nevertheless when bar is
2473	* readonly. A sensible way to do this might be to reject all
2474	* attempts to truncate a read-only file, because a creat() call
2475	* always implies file truncation.
2476	* ... but this isn't really fair. A process may reasonably call
2477	* ftruncate on an open file descriptor on a file with perm 000.
2478	* We must trust the client to do permission checking - using "ACCESS"
2479	* with NFSv3.
2480	*/
2481	if ((acc & NFSD_MAY_OWNER_OVERRIDE) &&
2482	uid_eq(left: inode->i_uid, current_fsuid()))
2483	return 0;
2484
2485	/* This assumes NFSD_MAY_{READ,WRITE,EXEC} == MAY_{READ,WRITE,EXEC} */
2486	err = inode_permission(&nop_mnt_idmap, inode,
2487	acc & (MAY_READ | MAY_WRITE | MAY_EXEC));
2488
2489	/* Allow read access to binaries even when mode 111 */
2490	if (err == -EACCES && S_ISREG(inode->i_mode) &&
2491	(acc == (NFSD_MAY_READ | NFSD_MAY_OWNER_OVERRIDE) ||
2492	acc == (NFSD_MAY_READ | NFSD_MAY_READ_IF_EXEC)))
2493	err = inode_permission(&nop_mnt_idmap, inode, MAY_EXEC);
2494
2495	return err? nfserrno(errno: err) : 0;
2496	}
2497