export.c

   1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 * NFS exporting and validation.
   4 *
   5 * We maintain a list of clients, each of which has a list of
   6 * exports. To export an fs to a given client, you first have
   7 * to create the client entry with NFSCTL_ADDCLIENT, which
   8 * creates a client control block and adds it to the hash
   9 * table. Then, you call NFSCTL_EXPORT for each fs.
  10 *
  11 *
  12 * Copyright (C) 1995, 1996 Olaf Kirch, <okir@monad.swb.de>
  13 */
  14
  15#include <linux/slab.h>
  16#include <linux/namei.h>
  17#include <linux/module.h>
  18#include <linux/exportfs.h>
  19#include <linux/sunrpc/svc_xprt.h>
  20
  21#include "nfsd.h"
  22#include "nfsfh.h"
  23#include "netns.h"
  24#include "pnfs.h"
  25#include "filecache.h"
  26#include "trace.h"
  27
  28#define NFSDDBG_FACILITY	NFSDDBG_EXPORT
  29
  30/*
  31 * We have two caches.
  32 * One maps client+vfsmnt+dentry to export options - the export map
  33 * The other maps client+filehandle-fragment to export options. - the expkey map
  34 *
  35 * The export options are actually stored in the first map, and the
  36 * second map contains a reference to the entry in the first map.
  37 */
  38
  39static struct workqueue_struct *nfsd_export_wq;
  40
  41#define	EXPKEY_HASHBITS		8
  42#define	EXPKEY_HASHMAX		(1 << EXPKEY_HASHBITS)
  43#define	EXPKEY_HASHMASK		(EXPKEY_HASHMAX -1)
  44
  45static void expkey_release(struct work_struct *work)
  46{
  47	struct svc_expkey *key = container_of(to_rcu_work(work),
  48					      struct svc_expkey, ek_rwork);
  49
  50	if (test_bit(CACHE_VALID, &key->h.flags) &&
  51	    !test_bit(CACHE_NEGATIVE, &key->h.flags))
  52		path_put(&key->ek_path);
  53	auth_domain_put(key->ek_client);
  54	kfree(key);
  55}
  56
  57static void expkey_put(struct kref *ref)
  58{
  59	struct svc_expkey *key = container_of(ref, struct svc_expkey, h.ref);
  60
  61	INIT_RCU_WORK(&key->ek_rwork, expkey_release);
  62	queue_rcu_work(nfsd_export_wq, &key->ek_rwork);
  63}
  64
  65static int expkey_upcall(struct cache_detail *cd, struct cache_head *h)
  66{
  67	return sunrpc_cache_pipe_upcall(cd, h);
  68}
  69
  70static void expkey_request(struct cache_detail *cd,
  71			   struct cache_head *h,
  72			   char **bpp, int *blen)
  73{
  74	/* client fsidtype \xfsid */
  75	struct svc_expkey *ek = container_of(h, struct svc_expkey, h);
  76	char type[5];
  77
  78	qword_add(bpp, blen, ek->ek_client->name);
  79	snprintf(type, 5, "%d", ek->ek_fsidtype);
  80	qword_add(bpp, blen, type);
  81	qword_addhex(bpp, blen, (char*)ek->ek_fsid, key_len(ek->ek_fsidtype));
  82	(*bpp)[-1] = '\n';
  83}
  84
  85static struct svc_expkey *svc_expkey_update(struct cache_detail *cd, struct svc_expkey *new,
  86					    struct svc_expkey *old);
  87static struct svc_expkey *svc_expkey_lookup(struct cache_detail *cd, struct svc_expkey *);
  88
  89static int expkey_parse(struct cache_detail *cd, char *mesg, int mlen)
  90{
  91	/* client fsidtype fsid expiry [path] */
  92	char *buf;
  93	int len;
  94	struct auth_domain *dom = NULL;
  95	int err;
  96	u8 fsidtype;
  97	struct svc_expkey key;
  98	struct svc_expkey *ek = NULL;
  99
 100	if (mesg[mlen - 1] != '\n')
 101		return -EINVAL;
 102	mesg[mlen-1] = 0;
 103
 104	buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
 105	err = -ENOMEM;
 106	if (!buf)
 107		goto out;
 108
 109	err = -EINVAL;
 110	if (qword_get(&mesg, buf, PAGE_SIZE) <= 0)
 111		goto out;
 112
 113	err = -ENOENT;
 114	dom = auth_domain_find(buf);
 115	if (!dom)
 116		goto out;
 117	dprintk("found domain %s\n", buf);
 118
 119	err = -EINVAL;
 120	if (qword_get(&mesg, buf, PAGE_SIZE) <= 0)
 121		goto out;
 122	if (kstrtou8(buf, 10, &fsidtype))
 123		goto out;
 124	dprintk("found fsidtype %u\n", fsidtype);
 125	if (key_len(fsidtype)==0) /* invalid type */
 126		goto out;
 127	if ((len=qword_get(&mesg, buf, PAGE_SIZE)) <= 0)
 128		goto out;
 129	dprintk("found fsid length %d\n", len);
 130	if (len != key_len(fsidtype))
 131		goto out;
 132
 133	/* OK, we seem to have a valid key */
 134	key.h.flags = 0;
 135	err = get_expiry(&mesg, &key.h.expiry_time);
 136	if (err)
 137		goto out;
 138
 139	key.ek_client = dom;
 140	key.ek_fsidtype = fsidtype;
 141	memcpy(key.ek_fsid, buf, len);
 142
 143	ek = svc_expkey_lookup(cd, &key);
 144	err = -ENOMEM;
 145	if (!ek)
 146		goto out;
 147
 148	/* now we want a pathname, or empty meaning NEGATIVE  */
 149	err = -EINVAL;
 150	len = qword_get(&mesg, buf, PAGE_SIZE);
 151	if (len < 0)
 152		goto out;
 153	dprintk("Path seems to be <%s>\n", buf);
 154	err = 0;
 155	if (len == 0) {
 156		set_bit(CACHE_NEGATIVE, &key.h.flags);
 157		ek = svc_expkey_update(cd, &key, ek);
 158		if (ek)
 159			trace_nfsd_expkey_update(ek, NULL);
 160		else
 161			err = -ENOMEM;
 162	} else {
 163		err = kern_path(buf, 0, &key.ek_path);
 164		if (err)
 165			goto out;
 166
 167		dprintk("Found the path %s\n", buf);
 168
 169		ek = svc_expkey_update(cd, &key, ek);
 170		if (ek)
 171			trace_nfsd_expkey_update(ek, buf);
 172		else
 173			err = -ENOMEM;
 174		path_put(&key.ek_path);
 175	}
 176	cache_flush();
 177 out:
 178	if (ek)
 179		cache_put(&ek->h, cd);
 180	if (dom)
 181		auth_domain_put(dom);
 182	kfree(buf);
 183	return err;
 184}
 185
 186static int expkey_show(struct seq_file *m,
 187		       struct cache_detail *cd,
 188		       struct cache_head *h)
 189{
 190	struct svc_expkey *ek ;
 191	int i;
 192
 193	if (h ==NULL) {
 194		seq_puts(m, "#domain fsidtype fsid [path]\n");
 195		return 0;
 196	}
 197	ek = container_of(h, struct svc_expkey, h);
 198	seq_printf(m, "%s %d 0x", ek->ek_client->name,
 199		   ek->ek_fsidtype);
 200	for (i=0; i < key_len(ek->ek_fsidtype)/4; i++)
 201		seq_printf(m, "%08x", ek->ek_fsid[i]);
 202	if (test_bit(CACHE_VALID, &h->flags) && 
 203	    !test_bit(CACHE_NEGATIVE, &h->flags)) {
 204		seq_printf(m, " ");
 205		seq_path(m, &ek->ek_path, "\\ \t\n");
 206	}
 207	seq_printf(m, "\n");
 208	return 0;
 209}
 210
 211static inline int expkey_match (struct cache_head *a, struct cache_head *b)
 212{
 213	struct svc_expkey *orig = container_of(a, struct svc_expkey, h);
 214	struct svc_expkey *new = container_of(b, struct svc_expkey, h);
 215
 216	if (orig->ek_fsidtype != new->ek_fsidtype ||
 217	    orig->ek_client != new->ek_client ||
 218	    memcmp(orig->ek_fsid, new->ek_fsid, key_len(orig->ek_fsidtype)) != 0)
 219		return 0;
 220	return 1;
 221}
 222
 223static inline void expkey_init(struct cache_head *cnew,
 224				   struct cache_head *citem)
 225{
 226	struct svc_expkey *new = container_of(cnew, struct svc_expkey, h);
 227	struct svc_expkey *item = container_of(citem, struct svc_expkey, h);
 228
 229	kref_get(&item->ek_client->ref);
 230	new->ek_client = item->ek_client;
 231	new->ek_fsidtype = item->ek_fsidtype;
 232
 233	memcpy(new->ek_fsid, item->ek_fsid, sizeof(new->ek_fsid));
 234}
 235
 236static inline void expkey_update(struct cache_head *cnew,
 237				   struct cache_head *citem)
 238{
 239	struct svc_expkey *new = container_of(cnew, struct svc_expkey, h);
 240	struct svc_expkey *item = container_of(citem, struct svc_expkey, h);
 241
 242	new->ek_path = item->ek_path;
 243	path_get(&item->ek_path);
 244}
 245
 246static struct cache_head *expkey_alloc(void)
 247{
 248	struct svc_expkey *i = kmalloc(sizeof(*i), GFP_KERNEL);
 249	if (i)
 250		return &i->h;
 251	else
 252		return NULL;
 253}
 254
 255static void expkey_flush(void)
 256{
 257	/*
 258	 * Take the nfsd_mutex here to ensure that the file cache is not
 259	 * destroyed while we're in the middle of flushing.
 260	 */
 261	mutex_lock(&nfsd_mutex);
 262	nfsd_file_cache_purge(current->nsproxy->net_ns);
 263	mutex_unlock(&nfsd_mutex);
 264}
 265
 266static const struct cache_detail svc_expkey_cache_template = {
 267	.owner		= THIS_MODULE,
 268	.hash_size	= EXPKEY_HASHMAX,
 269	.name		= "nfsd.fh",
 270	.cache_put	= expkey_put,
 271	.cache_upcall	= expkey_upcall,
 272	.cache_request	= expkey_request,
 273	.cache_parse	= expkey_parse,
 274	.cache_show	= expkey_show,
 275	.match		= expkey_match,
 276	.init		= expkey_init,
 277	.update       	= expkey_update,
 278	.alloc		= expkey_alloc,
 279	.flush		= expkey_flush,
 280};
 281
 282static int
 283svc_expkey_hash(struct svc_expkey *item)
 284{
 285	int hash = item->ek_fsidtype;
 286	char * cp = (char*)item->ek_fsid;
 287	int len = key_len(item->ek_fsidtype);
 288
 289	hash ^= hash_mem(cp, len, EXPKEY_HASHBITS);
 290	hash ^= hash_ptr(item->ek_client, EXPKEY_HASHBITS);
 291	hash &= EXPKEY_HASHMASK;
 292	return hash;
 293}
 294
 295static struct svc_expkey *
 296svc_expkey_lookup(struct cache_detail *cd, struct svc_expkey *item)
 297{
 298	struct cache_head *ch;
 299	int hash = svc_expkey_hash(item);
 300
 301	ch = sunrpc_cache_lookup_rcu(cd, &item->h, hash);
 302	if (ch)
 303		return container_of(ch, struct svc_expkey, h);
 304	else
 305		return NULL;
 306}
 307
 308static struct svc_expkey *
 309svc_expkey_update(struct cache_detail *cd, struct svc_expkey *new,
 310		  struct svc_expkey *old)
 311{
 312	struct cache_head *ch;
 313	int hash = svc_expkey_hash(new);
 314
 315	ch = sunrpc_cache_update(cd, &new->h, &old->h, hash);
 316	if (ch)
 317		return container_of(ch, struct svc_expkey, h);
 318	else
 319		return NULL;
 320}
 321
 322
 323#define	EXPORT_HASHBITS		8
 324#define	EXPORT_HASHMAX		(1<< EXPORT_HASHBITS)
 325
 326static void nfsd4_fslocs_free(struct nfsd4_fs_locations *fsloc)
 327{
 328	struct nfsd4_fs_location *locations = fsloc->locations;
 329	int i;
 330
 331	if (!locations)
 332		return;
 333
 334	for (i = 0; i < fsloc->locations_count; i++) {
 335		kfree(locations[i].path);
 336		kfree(locations[i].hosts);
 337	}
 338
 339	kfree(locations);
 340	fsloc->locations = NULL;
 341}
 342
 343static int export_stats_init(struct export_stats *stats)
 344{
 345	stats->start_time = ktime_get_seconds();
 346	return percpu_counter_init_many(stats->counter, 0, GFP_KERNEL,
 347					EXP_STATS_COUNTERS_NUM);
 348}
 349
 350static void export_stats_reset(struct export_stats *stats)
 351{
 352	if (stats) {
 353		int i;
 354
 355		for (i = 0; i < EXP_STATS_COUNTERS_NUM; i++)
 356			percpu_counter_set(&stats->counter[i], 0);
 357	}
 358}
 359
 360static void export_stats_destroy(struct export_stats *stats)
 361{
 362	if (stats)
 363		percpu_counter_destroy_many(stats->counter,
 364					    EXP_STATS_COUNTERS_NUM);
 365}
 366
 367static void svc_export_release(struct work_struct *work)
 368{
 369	struct svc_export *exp = container_of(to_rcu_work(work),
 370					      struct svc_export, ex_rwork);
 371
 372	path_put(&exp->ex_path);
 373	auth_domain_put(exp->ex_client);
 374	nfsd4_fslocs_free(&exp->ex_fslocs);
 375	export_stats_destroy(exp->ex_stats);
 376	kfree(exp->ex_stats);
 377	kfree(exp->ex_uuid);
 378	kfree(exp);
 379}
 380
 381static void svc_export_put(struct kref *ref)
 382{
 383	struct svc_export *exp = container_of(ref, struct svc_export, h.ref);
 384
 385	INIT_RCU_WORK(&exp->ex_rwork, svc_export_release);
 386	queue_rcu_work(nfsd_export_wq, &exp->ex_rwork);
 387}
 388
 389static int svc_export_upcall(struct cache_detail *cd, struct cache_head *h)
 390{
 391	return sunrpc_cache_pipe_upcall(cd, h);
 392}
 393
 394static void svc_export_request(struct cache_detail *cd,
 395			       struct cache_head *h,
 396			       char **bpp, int *blen)
 397{
 398	/*  client path */
 399	struct svc_export *exp = container_of(h, struct svc_export, h);
 400	char *pth;
 401
 402	qword_add(bpp, blen, exp->ex_client->name);
 403	pth = d_path(&exp->ex_path, *bpp, *blen);
 404	if (IS_ERR(pth)) {
 405		/* is this correct? */
 406		(*bpp)[0] = '\n';
 407		return;
 408	}
 409	qword_add(bpp, blen, pth);
 410	(*bpp)[-1] = '\n';
 411}
 412
 413static struct svc_export *svc_export_update(struct svc_export *new,
 414					    struct svc_export *old);
 415static struct svc_export *svc_export_lookup(struct svc_export *);
 416
 417static int check_export(const struct path *path, int *flags, unsigned char *uuid)
 418{
 419	struct inode *inode = d_inode(path->dentry);
 420
 421	/*
 422	 * We currently export only dirs, regular files, and (for v4
 423	 * pseudoroot) symlinks.
 424	 */
 425	if (!S_ISDIR(inode->i_mode) &&
 426	    !S_ISLNK(inode->i_mode) &&
 427	    !S_ISREG(inode->i_mode))
 428		return -ENOTDIR;
 429
 430	/*
 431	 * Mountd should never pass down a writeable V4ROOT export, but,
 432	 * just to make sure:
 433	 */
 434	if (*flags & NFSEXP_V4ROOT)
 435		*flags |= NFSEXP_READONLY;
 436
 437	/* There are two requirements on a filesystem to be exportable.
 438	 * 1:  We must be able to identify the filesystem from a number.
 439	 *       either a device number (so FS_REQUIRES_DEV needed)
 440	 *       or an FSID number (so NFSEXP_FSID or ->uuid is needed).
 441	 * 2:  We must be able to find an inode from a filehandle.
 442	 *       This means that s_export_op must be set and comply with
 443	 *       the requirements for remote filesystem export.
 444	 * 3: We must not currently be on an idmapped mount.
 445	 */
 446	if (!(inode->i_sb->s_type->fs_flags & FS_REQUIRES_DEV) &&
 447	    !(*flags & NFSEXP_FSID) &&
 448	    uuid == NULL) {
 449		dprintk("exp_export: export of non-dev fs without fsid\n");
 450		return -EINVAL;
 451	}
 452
 453	if (!exportfs_may_export(inode->i_sb->s_export_op)) {
 454		dprintk("exp_export: export of invalid fs type (%s).\n",
 455			inode->i_sb->s_type->name);
 456		return -EINVAL;
 457	}
 458
 459	if (is_idmapped_mnt(path->mnt)) {
 460		dprintk("exp_export: export of idmapped mounts not yet supported.\n");
 461		return -EINVAL;
 462	}
 463
 464	if (inode->i_sb->s_export_op->flags & EXPORT_OP_NOSUBTREECHK &&
 465	    !(*flags & NFSEXP_NOSUBTREECHECK)) {
 466		dprintk("%s: %s does not support subtree checking!\n",
 467			__func__, inode->i_sb->s_type->name);
 468		return -EINVAL;
 469	}
 470	return 0;
 471}
 472
 473#ifdef CONFIG_NFSD_V4
 474
 475static int
 476fsloc_parse(char **mesg, char *buf, struct nfsd4_fs_locations *fsloc)
 477{
 478	int len;
 479	int migrated, i, err;
 480
 481	/* more than one fsloc */
 482	if (fsloc->locations)
 483		return -EINVAL;
 484
 485	/* listsize */
 486	err = get_uint(mesg, &fsloc->locations_count);
 487	if (err)
 488		return err;
 489	if (fsloc->locations_count > MAX_FS_LOCATIONS)
 490		return -EINVAL;
 491	if (fsloc->locations_count == 0)
 492		return 0;
 493
 494	fsloc->locations = kcalloc(fsloc->locations_count,
 495				   sizeof(struct nfsd4_fs_location),
 496				   GFP_KERNEL);
 497	if (!fsloc->locations)
 498		return -ENOMEM;
 499	for (i=0; i < fsloc->locations_count; i++) {
 500		/* colon separated host list */
 501		err = -EINVAL;
 502		len = qword_get(mesg, buf, PAGE_SIZE);
 503		if (len <= 0)
 504			goto out_free_all;
 505		err = -ENOMEM;
 506		fsloc->locations[i].hosts = kstrdup(buf, GFP_KERNEL);
 507		if (!fsloc->locations[i].hosts)
 508			goto out_free_all;
 509		err = -EINVAL;
 510		/* slash separated path component list */
 511		len = qword_get(mesg, buf, PAGE_SIZE);
 512		if (len <= 0)
 513			goto out_free_all;
 514		err = -ENOMEM;
 515		fsloc->locations[i].path = kstrdup(buf, GFP_KERNEL);
 516		if (!fsloc->locations[i].path)
 517			goto out_free_all;
 518	}
 519	/* migrated */
 520	err = get_int(mesg, &migrated);
 521	if (err)
 522		goto out_free_all;
 523	err = -EINVAL;
 524	if (migrated < 0 || migrated > 1)
 525		goto out_free_all;
 526	fsloc->migrated = migrated;
 527	return 0;
 528out_free_all:
 529	nfsd4_fslocs_free(fsloc);
 530	return err;
 531}
 532
 533static int secinfo_parse(char **mesg, char *buf, struct svc_export *exp)
 534{
 535	struct exp_flavor_info *f;
 536	u32 listsize;
 537	int err;
 538
 539	/* more than one secinfo */
 540	if (exp->ex_nflavors)
 541		return -EINVAL;
 542
 543	err = get_uint(mesg, &listsize);
 544	if (err)
 545		return err;
 546	if (listsize > MAX_SECINFO_LIST)
 547		return -EINVAL;
 548
 549	for (f = exp->ex_flavors; f < exp->ex_flavors + listsize; f++) {
 550		err = get_uint(mesg, &f->pseudoflavor);
 551		if (err)
 552			return err;
 553		/*
 554		 * XXX: It would be nice to also check whether this
 555		 * pseudoflavor is supported, so we can discover the
 556		 * problem at export time instead of when a client fails
 557		 * to authenticate.
 558		 */
 559		err = get_uint(mesg, &f->flags);
 560		if (err)
 561			return err;
 562		/* Only some flags are allowed to differ between flavors: */
 563		if (~NFSEXP_SECINFO_FLAGS & (f->flags ^ exp->ex_flags))
 564			return -EINVAL;
 565	}
 566	exp->ex_nflavors = listsize;
 567	return 0;
 568}
 569
 570#else /* CONFIG_NFSD_V4 */
 571static inline int
 572fsloc_parse(char **mesg, char *buf, struct nfsd4_fs_locations *fsloc){return 0;}
 573static inline int
 574secinfo_parse(char **mesg, char *buf, struct svc_export *exp) { return 0; }
 575#endif
 576
 577static int xprtsec_parse(char **mesg, char *buf, struct svc_export *exp)
 578{
 579	unsigned int i, mode, listsize;
 580	int err;
 581
 582	err = get_uint(mesg, &listsize);
 583	if (err)
 584		return err;
 585	if (listsize > NFSEXP_XPRTSEC_NUM)
 586		return -EINVAL;
 587
 588	exp->ex_xprtsec_modes = 0;
 589	for (i = 0; i < listsize; i++) {
 590		err = get_uint(mesg, &mode);
 591		if (err)
 592			return err;
 593		if (mode > NFSEXP_XPRTSEC_MTLS)
 594			return -EINVAL;
 595		exp->ex_xprtsec_modes |= mode;
 596	}
 597	return 0;
 598}
 599
 600static inline int
 601nfsd_uuid_parse(char **mesg, char *buf, unsigned char **puuid)
 602{
 603	int len;
 604
 605	/* more than one uuid */
 606	if (*puuid)
 607		return -EINVAL;
 608
 609	/* expect a 16 byte uuid encoded as \xXXXX... */
 610	len = qword_get(mesg, buf, PAGE_SIZE);
 611	if (len != EX_UUID_LEN)
 612		return -EINVAL;
 613
 614	*puuid = kmemdup(buf, EX_UUID_LEN, GFP_KERNEL);
 615	if (*puuid == NULL)
 616		return -ENOMEM;
 617
 618	return 0;
 619}
 620
 621static int svc_export_parse(struct cache_detail *cd, char *mesg, int mlen)
 622{
 623	/* client path expiry [flags anonuid anongid fsid] */
 624	char *buf;
 625	int err;
 626	struct auth_domain *dom = NULL;
 627	struct svc_export exp = {}, *expp;
 628	int an_int;
 629
 630	if (mesg[mlen-1] != '\n')
 631		return -EINVAL;
 632	mesg[mlen-1] = 0;
 633
 634	buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
 635	if (!buf)
 636		return -ENOMEM;
 637
 638	/* client */
 639	err = -EINVAL;
 640	if (qword_get(&mesg, buf, PAGE_SIZE) <= 0)
 641		goto out;
 642
 643	err = -ENOENT;
 644	dom = auth_domain_find(buf);
 645	if (!dom)
 646		goto out;
 647
 648	/* path */
 649	err = -EINVAL;
 650	if (qword_get(&mesg, buf, PAGE_SIZE) <= 0)
 651		goto out1;
 652
 653	err = kern_path(buf, 0, &exp.ex_path);
 654	if (err)
 655		goto out1;
 656
 657	exp.ex_client = dom;
 658	exp.cd = cd;
 659	exp.ex_devid_map = NULL;
 660	exp.ex_xprtsec_modes = NFSEXP_XPRTSEC_ALL;
 661
 662	/* expiry */
 663	err = get_expiry(&mesg, &exp.h.expiry_time);
 664	if (err)
 665		goto out3;
 666
 667	/* flags */
 668	err = get_int(&mesg, &an_int);
 669	if (err == -ENOENT) {
 670		err = 0;
 671		set_bit(CACHE_NEGATIVE, &exp.h.flags);
 672	} else {
 673		if (err || an_int < 0)
 674			goto out3;
 675		exp.ex_flags= an_int;
 676
 677		/* anon uid */
 678		err = get_int(&mesg, &an_int);
 679		if (err)
 680			goto out3;
 681		exp.ex_anon_uid= make_kuid(current_user_ns(), an_int);
 682
 683		/* anon gid */
 684		err = get_int(&mesg, &an_int);
 685		if (err)
 686			goto out3;
 687		exp.ex_anon_gid= make_kgid(current_user_ns(), an_int);
 688
 689		/* fsid */
 690		err = get_int(&mesg, &an_int);
 691		if (err)
 692			goto out3;
 693		exp.ex_fsid = an_int;
 694
 695		while (qword_get(&mesg, buf, PAGE_SIZE) > 0) {
 696			if (strcmp(buf, "fsloc") == 0)
 697				err = fsloc_parse(&mesg, buf, &exp.ex_fslocs);
 698			else if (strcmp(buf, "uuid") == 0)
 699				err = nfsd_uuid_parse(&mesg, buf, &exp.ex_uuid);
 700			else if (strcmp(buf, "secinfo") == 0)
 701				err = secinfo_parse(&mesg, buf, &exp);
 702			else if (strcmp(buf, "xprtsec") == 0)
 703				err = xprtsec_parse(&mesg, buf, &exp);
 704			else
 705				/* quietly ignore unknown words and anything
 706				 * following. Newer user-space can try to set
 707				 * new values, then see what the result was.
 708				 */
 709				break;
 710			if (err)
 711				goto out4;
 712		}
 713
 714		err = check_export(&exp.ex_path, &exp.ex_flags, exp.ex_uuid);
 715		if (err)
 716			goto out4;
 717
 718		/*
 719		 * No point caching this if it would immediately expire.
 720		 * Also, this protects exportfs's dummy export from the
 721		 * anon_uid/anon_gid checks:
 722		 */
 723		if (exp.h.expiry_time < seconds_since_boot())
 724			goto out4;
 725		/*
 726		 * For some reason exportfs has been passing down an
 727		 * invalid (-1) uid & gid on the "dummy" export which it
 728		 * uses to test export support.  To make sure exportfs
 729		 * sees errors from check_export we therefore need to
 730		 * delay these checks till after check_export:
 731		 */
 732		err = -EINVAL;
 733		if (!uid_valid(exp.ex_anon_uid))
 734			goto out4;
 735		if (!gid_valid(exp.ex_anon_gid))
 736			goto out4;
 737		err = 0;
 738
 739		nfsd4_setup_layout_type(&exp);
 740	}
 741
 742	expp = svc_export_lookup(&exp);
 743	if (!expp) {
 744		err = -ENOMEM;
 745		goto out4;
 746	}
 747	expp = svc_export_update(&exp, expp);
 748	if (expp) {
 749		trace_nfsd_export_update(expp);
 750		cache_flush();
 751		exp_put(expp);
 752	} else
 753		err = -ENOMEM;
 754out4:
 755	nfsd4_fslocs_free(&exp.ex_fslocs);
 756	kfree(exp.ex_uuid);
 757out3:
 758	path_put(&exp.ex_path);
 759out1:
 760	auth_domain_put(dom);
 761out:
 762	kfree(buf);
 763	return err;
 764}
 765
 766static void exp_flags(struct seq_file *m, int flag, int fsid,
 767		kuid_t anonu, kgid_t anong, struct nfsd4_fs_locations *fslocs);
 768static void show_secinfo(struct seq_file *m, struct svc_export *exp);
 769
 770static int is_export_stats_file(struct seq_file *m)
 771{
 772	/*
 773	 * The export_stats file uses the same ops as the exports file.
 774	 * We use the file's name to determine the reported info per export.
 775	 * There is no rename in nsfdfs, so d_name.name is stable.
 776	 */
 777	return !strcmp(m->file->f_path.dentry->d_name.name, "export_stats");
 778}
 779
 780static int svc_export_show(struct seq_file *m,
 781			   struct cache_detail *cd,
 782			   struct cache_head *h)
 783{
 784	struct svc_export *exp;
 785	bool export_stats = is_export_stats_file(m);
 786
 787	if (h == NULL) {
 788		if (export_stats)
 789			seq_puts(m, "#path domain start-time\n#\tstats\n");
 790		else
 791			seq_puts(m, "#path domain(flags)\n");
 792		return 0;
 793	}
 794	exp = container_of(h, struct svc_export, h);
 795	seq_path(m, &exp->ex_path, " \t\n\\");
 796	seq_putc(m, '\t');
 797	seq_escape(m, exp->ex_client->name, " \t\n\\");
 798	if (export_stats) {
 799		struct percpu_counter *counter = exp->ex_stats->counter;
 800
 801		seq_printf(m, "\t%lld\n", exp->ex_stats->start_time);
 802		seq_printf(m, "\tfh_stale: %lld\n",
 803			   percpu_counter_sum_positive(&counter[EXP_STATS_FH_STALE]));
 804		seq_printf(m, "\tio_read: %lld\n",
 805			   percpu_counter_sum_positive(&counter[EXP_STATS_IO_READ]));
 806		seq_printf(m, "\tio_write: %lld\n",
 807			   percpu_counter_sum_positive(&counter[EXP_STATS_IO_WRITE]));
 808		seq_putc(m, '\n');
 809		return 0;
 810	}
 811	seq_putc(m, '(');
 812	if (test_bit(CACHE_VALID, &h->flags) &&
 813	    !test_bit(CACHE_NEGATIVE, &h->flags)) {
 814		exp_flags(m, exp->ex_flags, exp->ex_fsid,
 815			  exp->ex_anon_uid, exp->ex_anon_gid, &exp->ex_fslocs);
 816		if (exp->ex_uuid) {
 817			int i;
 818			seq_puts(m, ",uuid=");
 819			for (i = 0; i < EX_UUID_LEN; i++) {
 820				if ((i&3) == 0 && i)
 821					seq_putc(m, ':');
 822				seq_printf(m, "%02x", exp->ex_uuid[i]);
 823			}
 824		}
 825		show_secinfo(m, exp);
 826	}
 827	seq_puts(m, ")\n");
 828	return 0;
 829}
 830static int svc_export_match(struct cache_head *a, struct cache_head *b)
 831{
 832	struct svc_export *orig = container_of(a, struct svc_export, h);
 833	struct svc_export *new = container_of(b, struct svc_export, h);
 834	return orig->ex_client == new->ex_client &&
 835		path_equal(&orig->ex_path, &new->ex_path);
 836}
 837
 838static void svc_export_init(struct cache_head *cnew, struct cache_head *citem)
 839{
 840	struct svc_export *new = container_of(cnew, struct svc_export, h);
 841	struct svc_export *item = container_of(citem, struct svc_export, h);
 842
 843	kref_get(&item->ex_client->ref);
 844	new->ex_client = item->ex_client;
 845	new->ex_path = item->ex_path;
 846	path_get(&item->ex_path);
 847	new->ex_fslocs.locations = NULL;
 848	new->ex_fslocs.locations_count = 0;
 849	new->ex_fslocs.migrated = 0;
 850	new->ex_layout_types = 0;
 851	new->ex_uuid = NULL;
 852	new->cd = item->cd;
 853	export_stats_reset(new->ex_stats);
 854}
 855
 856static void export_update(struct cache_head *cnew, struct cache_head *citem)
 857{
 858	struct svc_export *new = container_of(cnew, struct svc_export, h);
 859	struct svc_export *item = container_of(citem, struct svc_export, h);
 860	int i;
 861
 862	new->ex_flags = item->ex_flags;
 863	new->ex_anon_uid = item->ex_anon_uid;
 864	new->ex_anon_gid = item->ex_anon_gid;
 865	new->ex_fsid = item->ex_fsid;
 866	new->ex_devid_map = item->ex_devid_map;
 867	item->ex_devid_map = NULL;
 868	new->ex_uuid = item->ex_uuid;
 869	item->ex_uuid = NULL;
 870	new->ex_fslocs.locations = item->ex_fslocs.locations;
 871	item->ex_fslocs.locations = NULL;
 872	new->ex_fslocs.locations_count = item->ex_fslocs.locations_count;
 873	item->ex_fslocs.locations_count = 0;
 874	new->ex_fslocs.migrated = item->ex_fslocs.migrated;
 875	item->ex_fslocs.migrated = 0;
 876	new->ex_layout_types = item->ex_layout_types;
 877	new->ex_nflavors = item->ex_nflavors;
 878	for (i = 0; i < MAX_SECINFO_LIST; i++) {
 879		new->ex_flavors[i] = item->ex_flavors[i];
 880	}
 881	new->ex_xprtsec_modes = item->ex_xprtsec_modes;
 882}
 883
 884static struct cache_head *svc_export_alloc(void)
 885{
 886	struct svc_export *i = kmalloc(sizeof(*i), GFP_KERNEL);
 887	if (!i)
 888		return NULL;
 889
 890	i->ex_stats = kmalloc(sizeof(*(i->ex_stats)), GFP_KERNEL);
 891	if (!i->ex_stats) {
 892		kfree(i);
 893		return NULL;
 894	}
 895
 896	if (export_stats_init(i->ex_stats)) {
 897		kfree(i->ex_stats);
 898		kfree(i);
 899		return NULL;
 900	}
 901
 902	return &i->h;
 903}
 904
 905static const struct cache_detail svc_export_cache_template = {
 906	.owner		= THIS_MODULE,
 907	.hash_size	= EXPORT_HASHMAX,
 908	.name		= "nfsd.export",
 909	.cache_put	= svc_export_put,
 910	.cache_upcall	= svc_export_upcall,
 911	.cache_request	= svc_export_request,
 912	.cache_parse	= svc_export_parse,
 913	.cache_show	= svc_export_show,
 914	.match		= svc_export_match,
 915	.init		= svc_export_init,
 916	.update		= export_update,
 917	.alloc		= svc_export_alloc,
 918};
 919
 920static int
 921svc_export_hash(struct svc_export *exp)
 922{
 923	int hash;
 924
 925	hash = hash_ptr(exp->ex_client, EXPORT_HASHBITS);
 926	hash ^= hash_ptr(exp->ex_path.dentry, EXPORT_HASHBITS);
 927	hash ^= hash_ptr(exp->ex_path.mnt, EXPORT_HASHBITS);
 928	return hash;
 929}
 930
 931static struct svc_export *
 932svc_export_lookup(struct svc_export *exp)
 933{
 934	struct cache_head *ch;
 935	int hash = svc_export_hash(exp);
 936
 937	ch = sunrpc_cache_lookup_rcu(exp->cd, &exp->h, hash);
 938	if (ch)
 939		return container_of(ch, struct svc_export, h);
 940	else
 941		return NULL;
 942}
 943
 944static struct svc_export *
 945svc_export_update(struct svc_export *new, struct svc_export *old)
 946{
 947	struct cache_head *ch;
 948	int hash = svc_export_hash(old);
 949
 950	ch = sunrpc_cache_update(old->cd, &new->h, &old->h, hash);
 951	if (ch)
 952		return container_of(ch, struct svc_export, h);
 953	else
 954		return NULL;
 955}
 956
 957
 958static struct svc_expkey *
 959exp_find_key(struct cache_detail *cd, struct auth_domain *clp, int fsid_type,
 960	     u32 *fsidv, struct cache_req *reqp)
 961{
 962	struct svc_expkey key, *ek;
 963	int err;
 964	
 965	if (!clp)
 966		return ERR_PTR(-ENOENT);
 967
 968	key.ek_client = clp;
 969	key.ek_fsidtype = fsid_type;
 970	memcpy(key.ek_fsid, fsidv, key_len(fsid_type));
 971
 972	ek = svc_expkey_lookup(cd, &key);
 973	if (ek == NULL)
 974		return ERR_PTR(-ENOMEM);
 975	err = cache_check(cd, &ek->h, reqp);
 976	if (err) {
 977		trace_nfsd_exp_find_key(&key, err);
 978		return ERR_PTR(err);
 979	}
 980	return ek;
 981}
 982
 983static struct svc_export *
 984exp_get_by_name(struct cache_detail *cd, struct auth_domain *clp,
 985		const struct path *path, struct cache_req *reqp)
 986{
 987	struct svc_export *exp, key;
 988	int err;
 989
 990	if (!clp)
 991		return ERR_PTR(-ENOENT);
 992
 993	key.ex_client = clp;
 994	key.ex_path = *path;
 995	key.cd = cd;
 996
 997	exp = svc_export_lookup(&key);
 998	if (exp == NULL)
 999		return ERR_PTR(-ENOMEM);
1000	err = cache_check(cd, &exp->h, reqp);
1001	if (err) {
1002		trace_nfsd_exp_get_by_name(&key, err);
1003		return ERR_PTR(err);
1004	}
1005	return exp;
1006}
1007
1008/*
1009 * Find the export entry for a given dentry.
1010 */
1011static struct svc_export *
1012exp_parent(struct cache_detail *cd, struct auth_domain *clp, struct path *path)
1013{
1014	struct dentry *saved = dget(path->dentry);
1015	struct svc_export *exp = exp_get_by_name(cd, clp, path, NULL);
1016
1017	while (PTR_ERR(exp) == -ENOENT && !IS_ROOT(path->dentry)) {
1018		struct dentry *parent = dget_parent(path->dentry);
1019		dput(path->dentry);
1020		path->dentry = parent;
1021		exp = exp_get_by_name(cd, clp, path, NULL);
1022	}
1023	dput(path->dentry);
1024	path->dentry = saved;
1025	return exp;
1026}
1027
1028
1029
1030/*
1031 * Obtain the root fh on behalf of a client.
1032 * This could be done in user space, but I feel that it adds some safety
1033 * since its harder to fool a kernel module than a user space program.
1034 */
1035int
1036exp_rootfh(struct net *net, struct auth_domain *clp, char *name,
1037	   struct knfsd_fh *f, int maxsize)
1038{
1039	struct svc_export	*exp;
1040	struct path		path;
1041	struct inode		*inode __maybe_unused;
1042	struct svc_fh		fh;
1043	int			err;
1044	struct nfsd_net		*nn = net_generic(net, nfsd_net_id);
1045	struct cache_detail	*cd = nn->svc_export_cache;
1046
1047	err = -EPERM;
1048	/* NB: we probably ought to check that it's NUL-terminated */
1049	if (kern_path(name, 0, &path)) {
1050		printk("nfsd: exp_rootfh path not found %s", name);
1051		return err;
1052	}
1053	inode = d_inode(path.dentry);
1054
1055	dprintk("nfsd: exp_rootfh(%s [%p] %s:%s/%ld)\n",
1056		 name, path.dentry, clp->name,
1057		 inode->i_sb->s_id, inode->i_ino);
1058	exp = exp_parent(cd, clp, &path);
1059	if (IS_ERR(exp)) {
1060		err = PTR_ERR(exp);
1061		goto out;
1062	}
1063
1064	/*
1065	 * fh must be initialized before calling fh_compose
1066	 */
1067	fh_init(&fh, maxsize);
1068	if (fh_compose(&fh, exp, path.dentry, NULL))
1069		err = -EINVAL;
1070	else
1071		err = 0;
1072	memcpy(f, &fh.fh_handle, sizeof(struct knfsd_fh));
1073	fh_put(&fh);
1074	exp_put(exp);
1075out:
1076	path_put(&path);
1077	return err;
1078}
1079
1080static struct svc_export *exp_find(struct cache_detail *cd,
1081				   struct auth_domain *clp, int fsid_type,
1082				   u32 *fsidv, struct cache_req *reqp)
1083{
1084	struct svc_export *exp;
1085	struct nfsd_net *nn = net_generic(cd->net, nfsd_net_id);
1086	struct svc_expkey *ek = exp_find_key(nn->svc_expkey_cache, clp, fsid_type, fsidv, reqp);
1087	if (IS_ERR(ek))
1088		return ERR_CAST(ek);
1089
1090	exp = exp_get_by_name(cd, clp, &ek->ek_path, reqp);
1091	cache_put(&ek->h, nn->svc_expkey_cache);
1092
1093	if (IS_ERR(exp))
1094		return ERR_CAST(exp);
1095	return exp;
1096}
1097
1098/**
1099 * check_xprtsec_policy - check if access to export is allowed by the
1100 *			  xprtsec policy
1101 * @exp: svc_export that is being accessed.
1102 * @rqstp: svc_rqst attempting to access @exp.
1103 *
1104 * Helper function for check_nfsd_access().  Note that callers should be
1105 * using check_nfsd_access() instead of calling this function directly.  The
1106 * one exception is __fh_verify() since it has logic that may result in one
1107 * or both of the helpers being skipped.
1108 *
1109 * Return values:
1110 *   %nfs_ok if access is granted, or
1111 *   %nfserr_wrongsec if access is denied
1112 */
1113__be32 check_xprtsec_policy(struct svc_export *exp, struct svc_rqst *rqstp)
1114{
1115	struct svc_xprt *xprt = rqstp->rq_xprt;
1116
1117	if (exp->ex_xprtsec_modes & NFSEXP_XPRTSEC_NONE) {
1118		if (!test_bit(XPT_TLS_SESSION, &xprt->xpt_flags))
1119			return nfs_ok;
1120	}
1121	if (exp->ex_xprtsec_modes & NFSEXP_XPRTSEC_TLS) {
1122		if (test_bit(XPT_TLS_SESSION, &xprt->xpt_flags) &&
1123		    !test_bit(XPT_PEER_AUTH, &xprt->xpt_flags))
1124			return nfs_ok;
1125	}
1126	if (exp->ex_xprtsec_modes & NFSEXP_XPRTSEC_MTLS) {
1127		if (test_bit(XPT_TLS_SESSION, &xprt->xpt_flags) &&
1128		    test_bit(XPT_PEER_AUTH, &xprt->xpt_flags))
1129			return nfs_ok;
1130	}
1131	return nfserr_wrongsec;
1132}
1133
1134/**
1135 * check_security_flavor - check if access to export is allowed by the
1136 *			   security flavor
1137 * @exp: svc_export that is being accessed.
1138 * @rqstp: svc_rqst attempting to access @exp.
1139 * @may_bypass_gss: reduce strictness of authorization check
1140 *
1141 * Helper function for check_nfsd_access().  Note that callers should be
1142 * using check_nfsd_access() instead of calling this function directly.  The
1143 * one exception is __fh_verify() since it has logic that may result in one
1144 * or both of the helpers being skipped.
1145 *
1146 * Return values:
1147 *   %nfs_ok if access is granted, or
1148 *   %nfserr_wrongsec if access is denied
1149 */
1150__be32 check_security_flavor(struct svc_export *exp, struct svc_rqst *rqstp,
1151			     bool may_bypass_gss)
1152{
1153	struct exp_flavor_info *f, *end = exp->ex_flavors + exp->ex_nflavors;
1154
1155	/* legacy gss-only clients are always OK: */
1156	if (exp->ex_client == rqstp->rq_gssclient)
1157		return nfs_ok;
1158	/* ip-address based client; check sec= export option: */
1159	for (f = exp->ex_flavors; f < end; f++) {
1160		if (f->pseudoflavor == rqstp->rq_cred.cr_flavor)
1161			return nfs_ok;
1162	}
1163	/* defaults in absence of sec= options: */
1164	if (exp->ex_nflavors == 0) {
1165		if (rqstp->rq_cred.cr_flavor == RPC_AUTH_NULL ||
1166		    rqstp->rq_cred.cr_flavor == RPC_AUTH_UNIX)
1167			return nfs_ok;
1168	}
1169
1170	/* If the compound op contains a spo_must_allowed op,
1171	 * it will be sent with integrity/protection which
1172	 * will have to be expressly allowed on mounts that
1173	 * don't support it
1174	 */
1175
1176	if (nfsd4_spo_must_allow(rqstp))
1177		return nfs_ok;
1178
1179	/* Some calls may be processed without authentication
1180	 * on GSS exports. For example NFS2/3 calls on root
1181	 * directory, see section 2.3.2 of rfc 2623.
1182	 * For "may_bypass_gss" check that export has really
1183	 * enabled some flavor with authentication (GSS or any
1184	 * other) and also check that the used auth flavor is
1185	 * without authentication (none or sys).
1186	 */
1187	if (may_bypass_gss && (
1188	     rqstp->rq_cred.cr_flavor == RPC_AUTH_NULL ||
1189	     rqstp->rq_cred.cr_flavor == RPC_AUTH_UNIX)) {
1190		for (f = exp->ex_flavors; f < end; f++) {
1191			if (f->pseudoflavor >= RPC_AUTH_DES)
1192				return 0;
1193		}
1194	}
1195
1196	return nfserr_wrongsec;
1197}
1198
1199/**
1200 * check_nfsd_access - check if access to export is allowed.
1201 * @exp: svc_export that is being accessed.
1202 * @rqstp: svc_rqst attempting to access @exp.
1203 * @may_bypass_gss: reduce strictness of authorization check
1204 *
1205 * Return values:
1206 *   %nfs_ok if access is granted, or
1207 *   %nfserr_wrongsec if access is denied
1208 */
1209__be32 check_nfsd_access(struct svc_export *exp, struct svc_rqst *rqstp,
1210			 bool may_bypass_gss)
1211{
1212	__be32 status;
1213
1214	status = check_xprtsec_policy(exp, rqstp);
1215	if (status != nfs_ok)
1216		return status;
1217	return check_security_flavor(exp, rqstp, may_bypass_gss);
1218}
1219
1220/*
1221 * Uses rq_client and rq_gssclient to find an export; uses rq_client (an
1222 * auth_unix client) if it's available and has secinfo information;
1223 * otherwise, will try to use rq_gssclient.
1224 *
1225 * Called from functions that handle requests; functions that do work on
1226 * behalf of mountd are passed a single client name to use, and should
1227 * use exp_get_by_name() or exp_find().
1228 */
1229struct svc_export *
1230rqst_exp_get_by_name(struct svc_rqst *rqstp, const struct path *path)
1231{
1232	struct svc_export *gssexp, *exp = ERR_PTR(-ENOENT);
1233	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
1234	struct cache_detail *cd = nn->svc_export_cache;
1235
1236	if (rqstp->rq_client == NULL)
1237		goto gss;
1238
1239	/* First try the auth_unix client: */
1240	exp = exp_get_by_name(cd, rqstp->rq_client, path, &rqstp->rq_chandle);
1241	if (PTR_ERR(exp) == -ENOENT)
1242		goto gss;
1243	if (IS_ERR(exp))
1244		return exp;
1245	/* If it has secinfo, assume there are no gss/... clients */
1246	if (exp->ex_nflavors > 0)
1247		return exp;
1248gss:
1249	/* Otherwise, try falling back on gss client */
1250	if (rqstp->rq_gssclient == NULL)
1251		return exp;
1252	gssexp = exp_get_by_name(cd, rqstp->rq_gssclient, path, &rqstp->rq_chandle);
1253	if (PTR_ERR(gssexp) == -ENOENT)
1254		return exp;
1255	if (!IS_ERR(exp))
1256		exp_put(exp);
1257	return gssexp;
1258}
1259
1260/**
1261 * rqst_exp_find - Find an svc_export in the context of a rqst or similar
1262 * @reqp:	The handle to be used to suspend the request if a cache-upcall is needed
1263 *		If NULL, missing in-cache information will result in failure.
1264 * @net:	The network namespace in which the request exists
1265 * @cl:		default auth_domain to use for looking up the export
1266 * @gsscl:	an alternate auth_domain defined using deprecated gss/krb5 format.
1267 * @fsid_type:	The type of fsid to look for
1268 * @fsidv:	The actual fsid to look up in the context of either client.
1269 *
1270 * Perform a lookup for @cl/@fsidv in the given @net for an export.  If
1271 * none found and @gsscl specified, repeat the lookup.
1272 *
1273 * Returns an export, or an error pointer.
1274 */
1275struct svc_export *
1276rqst_exp_find(struct cache_req *reqp, struct net *net,
1277	      struct auth_domain *cl, struct auth_domain *gsscl,
1278	      int fsid_type, u32 *fsidv)
1279{
1280	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
1281	struct svc_export *gssexp, *exp = ERR_PTR(-ENOENT);
1282	struct cache_detail *cd = nn->svc_export_cache;
1283
1284	if (!cl)
1285		goto gss;
1286
1287	/* First try the auth_unix client: */
1288	exp = exp_find(cd, cl, fsid_type, fsidv, reqp);
1289	if (PTR_ERR(exp) == -ENOENT)
1290		goto gss;
1291	if (IS_ERR(exp))
1292		return exp;
1293	/* If it has secinfo, assume there are no gss/... clients */
1294	if (exp->ex_nflavors > 0)
1295		return exp;
1296gss:
1297	/* Otherwise, try falling back on gss client */
1298	if (!gsscl)
1299		return exp;
1300	gssexp = exp_find(cd, gsscl, fsid_type, fsidv, reqp);
1301	if (PTR_ERR(gssexp) == -ENOENT)
1302		return exp;
1303	if (!IS_ERR(exp))
1304		exp_put(exp);
1305	return gssexp;
1306}
1307
1308struct svc_export *
1309rqst_exp_parent(struct svc_rqst *rqstp, struct path *path)
1310{
1311	struct dentry *saved = dget(path->dentry);
1312	struct svc_export *exp = rqst_exp_get_by_name(rqstp, path);
1313
1314	while (PTR_ERR(exp) == -ENOENT && !IS_ROOT(path->dentry)) {
1315		struct dentry *parent = dget_parent(path->dentry);
1316		dput(path->dentry);
1317		path->dentry = parent;
1318		exp = rqst_exp_get_by_name(rqstp, path);
1319	}
1320	dput(path->dentry);
1321	path->dentry = saved;
1322	return exp;
1323}
1324
1325struct svc_export *rqst_find_fsidzero_export(struct svc_rqst *rqstp)
1326{
1327	u32 fsidv[2];
1328
1329	mk_fsid(FSID_NUM, fsidv, 0, 0, 0, NULL);
1330
1331	return rqst_exp_find(&rqstp->rq_chandle, SVC_NET(rqstp),
1332			     rqstp->rq_client, rqstp->rq_gssclient,
1333			     FSID_NUM, fsidv);
1334}
1335
1336/*
1337 * Called when we need the filehandle for the root of the pseudofs,
1338 * for a given NFSv4 client.   The root is defined to be the
1339 * export point with fsid==0
1340 */
1341__be32
1342exp_pseudoroot(struct svc_rqst *rqstp, struct svc_fh *fhp)
1343{
1344	struct svc_export *exp;
1345	__be32 rv;
1346
1347	exp = rqst_find_fsidzero_export(rqstp);
1348	if (IS_ERR(exp))
1349		return nfserrno(PTR_ERR(exp));
1350	rv = fh_compose(fhp, exp, exp->ex_path.dentry, NULL);
1351	exp_put(exp);
1352	return rv;
1353}
1354
1355static struct flags {
1356	int flag;
1357	char *name[2];
1358} expflags[] = {
1359	{ NFSEXP_READONLY, {"ro", "rw"}},
1360	{ NFSEXP_INSECURE_PORT, {"insecure", ""}},
1361	{ NFSEXP_ROOTSQUASH, {"root_squash", "no_root_squash"}},
1362	{ NFSEXP_ALLSQUASH, {"all_squash", ""}},
1363	{ NFSEXP_ASYNC, {"async", "sync"}},
1364	{ NFSEXP_GATHERED_WRITES, {"wdelay", "no_wdelay"}},
1365	{ NFSEXP_NOREADDIRPLUS, {"nordirplus", ""}},
1366	{ NFSEXP_NOHIDE, {"nohide", ""}},
1367	{ NFSEXP_CROSSMOUNT, {"crossmnt", ""}},
1368	{ NFSEXP_NOSUBTREECHECK, {"no_subtree_check", ""}},
1369	{ NFSEXP_NOAUTHNLM, {"insecure_locks", ""}},
1370	{ NFSEXP_V4ROOT, {"v4root", ""}},
1371	{ NFSEXP_PNFS, {"pnfs", ""}},
1372	{ NFSEXP_SECURITY_LABEL, {"security_label", ""}},
1373	{ 0, {"", ""}}
1374};
1375
1376static void show_expflags(struct seq_file *m, int flags, int mask)
1377{
1378	struct flags *flg;
1379	int state, first = 0;
1380
1381	for (flg = expflags; flg->flag; flg++) {
1382		if (flg->flag & ~mask)
1383			continue;
1384		state = (flg->flag & flags) ? 0 : 1;
1385		if (*flg->name[state])
1386			seq_printf(m, "%s%s", first++?",":"", flg->name[state]);
1387	}
1388}
1389
1390static void show_secinfo_flags(struct seq_file *m, int flags)
1391{
1392	seq_printf(m, ",");
1393	show_expflags(m, flags, NFSEXP_SECINFO_FLAGS);
1394}
1395
1396static bool secinfo_flags_equal(int f, int g)
1397{
1398	f &= NFSEXP_SECINFO_FLAGS;
1399	g &= NFSEXP_SECINFO_FLAGS;
1400	return f == g;
1401}
1402
1403static int show_secinfo_run(struct seq_file *m, struct exp_flavor_info **fp, struct exp_flavor_info *end)
1404{
1405	int flags;
1406
1407	flags = (*fp)->flags;
1408	seq_printf(m, ",sec=%d", (*fp)->pseudoflavor);
1409	(*fp)++;
1410	while (*fp != end && secinfo_flags_equal(flags, (*fp)->flags)) {
1411		seq_printf(m, ":%d", (*fp)->pseudoflavor);
1412		(*fp)++;
1413	}
1414	return flags;
1415}
1416
1417static void show_secinfo(struct seq_file *m, struct svc_export *exp)
1418{
1419	struct exp_flavor_info *f;
1420	struct exp_flavor_info *end = exp->ex_flavors + exp->ex_nflavors;
1421	int flags;
1422
1423	if (exp->ex_nflavors == 0)
1424		return;
1425	f = exp->ex_flavors;
1426	flags = show_secinfo_run(m, &f, end);
1427	if (!secinfo_flags_equal(flags, exp->ex_flags))
1428		show_secinfo_flags(m, flags);
1429	while (f != end) {
1430		flags = show_secinfo_run(m, &f, end);
1431		show_secinfo_flags(m, flags);
1432	}
1433}
1434
1435static void exp_flags(struct seq_file *m, int flag, int fsid,
1436		kuid_t anonu, kgid_t anong, struct nfsd4_fs_locations *fsloc)
1437{
1438	struct user_namespace *userns = m->file->f_cred->user_ns;
1439
1440	show_expflags(m, flag, NFSEXP_ALLFLAGS);
1441	if (flag & NFSEXP_FSID)
1442		seq_printf(m, ",fsid=%d", fsid);
1443	if (!uid_eq(anonu, make_kuid(userns, (uid_t)-2)) &&
1444	    !uid_eq(anonu, make_kuid(userns, 0x10000-2)))
1445		seq_printf(m, ",anonuid=%u", from_kuid_munged(userns, anonu));
1446	if (!gid_eq(anong, make_kgid(userns, (gid_t)-2)) &&
1447	    !gid_eq(anong, make_kgid(userns, 0x10000-2)))
1448		seq_printf(m, ",anongid=%u", from_kgid_munged(userns, anong));
1449	if (fsloc && fsloc->locations_count > 0) {
1450		char *loctype = (fsloc->migrated) ? "refer" : "replicas";
1451		int i;
1452
1453		seq_printf(m, ",%s=", loctype);
1454		seq_escape(m, fsloc->locations[0].path, ",;@ \t\n\\");
1455		seq_putc(m, '@');
1456		seq_escape(m, fsloc->locations[0].hosts, ",;@ \t\n\\");
1457		for (i = 1; i < fsloc->locations_count; i++) {
1458			seq_putc(m, ';');
1459			seq_escape(m, fsloc->locations[i].path, ",;@ \t\n\\");
1460			seq_putc(m, '@');
1461			seq_escape(m, fsloc->locations[i].hosts, ",;@ \t\n\\");
1462		}
1463	}
1464}
1465
1466static int e_show(struct seq_file *m, void *p)
1467{
1468	struct cache_head *cp = p;
1469	struct svc_export *exp = container_of(cp, struct svc_export, h);
1470	struct cache_detail *cd = m->private;
1471	bool export_stats = is_export_stats_file(m);
1472
1473	if (p == SEQ_START_TOKEN) {
1474		seq_puts(m, "# Version 1.1\n");
1475		if (export_stats)
1476			seq_puts(m, "# Path Client Start-time\n#\tStats\n");
1477		else
1478			seq_puts(m, "# Path Client(Flags) # IPs\n");
1479		return 0;
1480	}
1481
1482	if (cache_check_rcu(cd, &exp->h, NULL))
1483		return 0;
1484
1485	return svc_export_show(m, cd, cp);
1486}
1487
1488const struct seq_operations nfs_exports_op = {
1489	.start	= cache_seq_start_rcu,
1490	.next	= cache_seq_next_rcu,
1491	.stop	= cache_seq_stop_rcu,
1492	.show	= e_show,
1493};
1494
1495/**
1496 * nfsd_export_wq_init - allocate the export release workqueue
1497 *
1498 * Called once at module load. The workqueue runs deferred svc_export and
1499 * svc_expkey release work scheduled by queue_rcu_work() in the cache put
1500 * callbacks.
1501 *
1502 * Return values:
1503 *   %0: workqueue allocated
1504 *   %-ENOMEM: allocation failed
1505 */
1506int nfsd_export_wq_init(void)
1507{
1508	nfsd_export_wq = alloc_workqueue("nfsd_export", WQ_UNBOUND, 0);
1509	if (!nfsd_export_wq)
1510		return -ENOMEM;
1511	return 0;
1512}
1513
1514/**
1515 * nfsd_export_wq_shutdown - drain and free the export release workqueue
1516 *
1517 * Called once at module unload. Per-namespace teardown in
1518 * nfsd_export_shutdown() has already drained all deferred work.
1519 */
1520void nfsd_export_wq_shutdown(void)
1521{
1522	destroy_workqueue(nfsd_export_wq);
1523}
1524
1525/*
1526 * Initialize the exports module.
1527 */
1528int
1529nfsd_export_init(struct net *net)
1530{
1531	int rv;
1532	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
1533
1534	dprintk("nfsd: initializing export module (net: %x).\n", net->ns.inum);
1535
1536	nn->svc_export_cache = cache_create_net(&svc_export_cache_template, net);
1537	if (IS_ERR(nn->svc_export_cache))
1538		return PTR_ERR(nn->svc_export_cache);
1539	rv = cache_register_net(nn->svc_export_cache, net);
1540	if (rv)
1541		goto destroy_export_cache;
1542
1543	nn->svc_expkey_cache = cache_create_net(&svc_expkey_cache_template, net);
1544	if (IS_ERR(nn->svc_expkey_cache)) {
1545		rv = PTR_ERR(nn->svc_expkey_cache);
1546		goto unregister_export_cache;
1547	}
1548	rv = cache_register_net(nn->svc_expkey_cache, net);
1549	if (rv)
1550		goto destroy_expkey_cache;
1551	return 0;
1552
1553destroy_expkey_cache:
1554	cache_destroy_net(nn->svc_expkey_cache, net);
1555unregister_export_cache:
1556	cache_unregister_net(nn->svc_export_cache, net);
1557destroy_export_cache:
1558	cache_destroy_net(nn->svc_export_cache, net);
1559	return rv;
1560}
1561
1562/*
1563 * Flush exports table - called when last nfsd thread is killed
1564 */
1565void
1566nfsd_export_flush(struct net *net)
1567{
1568	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
1569
1570	cache_purge(nn->svc_expkey_cache);
1571	cache_purge(nn->svc_export_cache);
1572}
1573
1574/*
1575 * Shutdown the exports module.
1576 */
1577void
1578nfsd_export_shutdown(struct net *net)
1579{
1580	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
1581
1582	dprintk("nfsd: shutting down export module (net: %x).\n", net->ns.inum);
1583
1584	cache_unregister_net(nn->svc_expkey_cache, net);
1585	cache_unregister_net(nn->svc_export_cache, net);
1586	/* Drain deferred export and expkey release work. */
1587	rcu_barrier();
1588	flush_workqueue(nfsd_export_wq);
1589	cache_destroy_net(nn->svc_expkey_cache, net);
1590	cache_destroy_net(nn->svc_export_cache, net);
1591	svcauth_unix_purge(net);
1592
1593	dprintk("nfsd: export shutdown complete (net: %x).\n", net->ns.inum);
1594}