xref: /openbmc/linux/fs/nfsd/vfs.c (revision 4ac7249ea5a0ceef9f8269f63f33cc873c3fac61)
1 /*
2  * File operations used by nfsd. Some of these have been ripped from
3  * other parts of the kernel because they weren't exported, others
4  * are partial duplicates with added or changed functionality.
5  *
6  * Note that several functions dget() the dentry upon which they want
7  * to act, most notably those that create directory entries. Response
8  * dentry's are dput()'d if necessary in the release callback.
9  * So if you notice code paths that apparently fail to dput() the
10  * dentry, don't worry--they have been taken care of.
11  *
12  * Copyright (C) 1995-1999 Olaf Kirch <okir@monad.swb.de>
13  * Zerocpy NFS support (C) 2002 Hirokazu Takahashi <taka@valinux.co.jp>
14  */
15 
16 #include <linux/fs.h>
17 #include <linux/file.h>
18 #include <linux/splice.h>
19 #include <linux/fcntl.h>
20 #include <linux/namei.h>
21 #include <linux/delay.h>
22 #include <linux/fsnotify.h>
23 #include <linux/posix_acl_xattr.h>
24 #include <linux/xattr.h>
25 #include <linux/jhash.h>
26 #include <linux/ima.h>
27 #include <linux/slab.h>
28 #include <asm/uaccess.h>
29 #include <linux/exportfs.h>
30 #include <linux/writeback.h>
31 #include <linux/security.h>
32 
33 #ifdef CONFIG_NFSD_V3
34 #include "xdr3.h"
35 #endif /* CONFIG_NFSD_V3 */
36 
37 #ifdef CONFIG_NFSD_V4
38 #include "acl.h"
39 #include "idmap.h"
40 #endif /* CONFIG_NFSD_V4 */
41 
42 #include "nfsd.h"
43 #include "vfs.h"
44 
45 #define NFSDDBG_FACILITY		NFSDDBG_FILEOP
46 
47 
48 /*
49  * This is a cache of readahead params that help us choose the proper
50  * readahead strategy. Initially, we set all readahead parameters to 0
51  * and let the VFS handle things.
52  * If you increase the number of cached files very much, you'll need to
53  * add a hash table here.
54  */
55 struct raparms {
56 	struct raparms		*p_next;
57 	unsigned int		p_count;
58 	ino_t			p_ino;
59 	dev_t			p_dev;
60 	int			p_set;
61 	struct file_ra_state	p_ra;
62 	unsigned int		p_hindex;
63 };
64 
65 struct raparm_hbucket {
66 	struct raparms		*pb_head;
67 	spinlock_t		pb_lock;
68 } ____cacheline_aligned_in_smp;
69 
70 #define RAPARM_HASH_BITS	4
71 #define RAPARM_HASH_SIZE	(1<<RAPARM_HASH_BITS)
72 #define RAPARM_HASH_MASK	(RAPARM_HASH_SIZE-1)
73 static struct raparm_hbucket	raparm_hash[RAPARM_HASH_SIZE];
74 
75 /*
76  * Called from nfsd_lookup and encode_dirent. Check if we have crossed
77  * a mount point.
78  * Returns -EAGAIN or -ETIMEDOUT leaving *dpp and *expp unchanged,
79  *  or nfs_ok having possibly changed *dpp and *expp
80  */
81 int
82 nfsd_cross_mnt(struct svc_rqst *rqstp, struct dentry **dpp,
83 		        struct svc_export **expp)
84 {
85 	struct svc_export *exp = *expp, *exp2 = NULL;
86 	struct dentry *dentry = *dpp;
87 	struct path path = {.mnt = mntget(exp->ex_path.mnt),
88 			    .dentry = dget(dentry)};
89 	int err = 0;
90 
91 	err = follow_down(&path);
92 	if (err < 0)
93 		goto out;
94 
95 	exp2 = rqst_exp_get_by_name(rqstp, &path);
96 	if (IS_ERR(exp2)) {
97 		err = PTR_ERR(exp2);
98 		/*
99 		 * We normally allow NFS clients to continue
100 		 * "underneath" a mountpoint that is not exported.
101 		 * The exception is V4ROOT, where no traversal is ever
102 		 * allowed without an explicit export of the new
103 		 * directory.
104 		 */
105 		if (err == -ENOENT && !(exp->ex_flags & NFSEXP_V4ROOT))
106 			err = 0;
107 		path_put(&path);
108 		goto out;
109 	}
110 	if (nfsd_v4client(rqstp) ||
111 		(exp->ex_flags & NFSEXP_CROSSMOUNT) || EX_NOHIDE(exp2)) {
112 		/* successfully crossed mount point */
113 		/*
114 		 * This is subtle: path.dentry is *not* on path.mnt
115 		 * at this point.  The only reason we are safe is that
116 		 * original mnt is pinned down by exp, so we should
117 		 * put path *before* putting exp
118 		 */
119 		*dpp = path.dentry;
120 		path.dentry = dentry;
121 		*expp = exp2;
122 		exp2 = exp;
123 	}
124 	path_put(&path);
125 	exp_put(exp2);
126 out:
127 	return err;
128 }
129 
130 static void follow_to_parent(struct path *path)
131 {
132 	struct dentry *dp;
133 
134 	while (path->dentry == path->mnt->mnt_root && follow_up(path))
135 		;
136 	dp = dget_parent(path->dentry);
137 	dput(path->dentry);
138 	path->dentry = dp;
139 }
140 
141 static int nfsd_lookup_parent(struct svc_rqst *rqstp, struct dentry *dparent, struct svc_export **exp, struct dentry **dentryp)
142 {
143 	struct svc_export *exp2;
144 	struct path path = {.mnt = mntget((*exp)->ex_path.mnt),
145 			    .dentry = dget(dparent)};
146 
147 	follow_to_parent(&path);
148 
149 	exp2 = rqst_exp_parent(rqstp, &path);
150 	if (PTR_ERR(exp2) == -ENOENT) {
151 		*dentryp = dget(dparent);
152 	} else if (IS_ERR(exp2)) {
153 		path_put(&path);
154 		return PTR_ERR(exp2);
155 	} else {
156 		*dentryp = dget(path.dentry);
157 		exp_put(*exp);
158 		*exp = exp2;
159 	}
160 	path_put(&path);
161 	return 0;
162 }
163 
164 /*
165  * For nfsd purposes, we treat V4ROOT exports as though there was an
166  * export at *every* directory.
167  */
168 int nfsd_mountpoint(struct dentry *dentry, struct svc_export *exp)
169 {
170 	if (d_mountpoint(dentry))
171 		return 1;
172 	if (nfsd4_is_junction(dentry))
173 		return 1;
174 	if (!(exp->ex_flags & NFSEXP_V4ROOT))
175 		return 0;
176 	return dentry->d_inode != NULL;
177 }
178 
179 __be32
180 nfsd_lookup_dentry(struct svc_rqst *rqstp, struct svc_fh *fhp,
181 		   const char *name, unsigned int len,
182 		   struct svc_export **exp_ret, struct dentry **dentry_ret)
183 {
184 	struct svc_export	*exp;
185 	struct dentry		*dparent;
186 	struct dentry		*dentry;
187 	int			host_err;
188 
189 	dprintk("nfsd: nfsd_lookup(fh %s, %.*s)\n", SVCFH_fmt(fhp), len,name);
190 
191 	dparent = fhp->fh_dentry;
192 	exp  = fhp->fh_export;
193 	exp_get(exp);
194 
195 	/* Lookup the name, but don't follow links */
196 	if (isdotent(name, len)) {
197 		if (len==1)
198 			dentry = dget(dparent);
199 		else if (dparent != exp->ex_path.dentry)
200 			dentry = dget_parent(dparent);
201 		else if (!EX_NOHIDE(exp) && !nfsd_v4client(rqstp))
202 			dentry = dget(dparent); /* .. == . just like at / */
203 		else {
204 			/* checking mountpoint crossing is very different when stepping up */
205 			host_err = nfsd_lookup_parent(rqstp, dparent, &exp, &dentry);
206 			if (host_err)
207 				goto out_nfserr;
208 		}
209 	} else {
210 		fh_lock(fhp);
211 		dentry = lookup_one_len(name, dparent, len);
212 		host_err = PTR_ERR(dentry);
213 		if (IS_ERR(dentry))
214 			goto out_nfserr;
215 		/*
216 		 * check if we have crossed a mount point ...
217 		 */
218 		if (nfsd_mountpoint(dentry, exp)) {
219 			if ((host_err = nfsd_cross_mnt(rqstp, &dentry, &exp))) {
220 				dput(dentry);
221 				goto out_nfserr;
222 			}
223 		}
224 	}
225 	*dentry_ret = dentry;
226 	*exp_ret = exp;
227 	return 0;
228 
229 out_nfserr:
230 	exp_put(exp);
231 	return nfserrno(host_err);
232 }
233 
234 /*
235  * Look up one component of a pathname.
236  * N.B. After this call _both_ fhp and resfh need an fh_put
237  *
238  * If the lookup would cross a mountpoint, and the mounted filesystem
239  * is exported to the client with NFSEXP_NOHIDE, then the lookup is
240  * accepted as it stands and the mounted directory is
241  * returned. Otherwise the covered directory is returned.
242  * NOTE: this mountpoint crossing is not supported properly by all
243  *   clients and is explicitly disallowed for NFSv3
244  *      NeilBrown <neilb@cse.unsw.edu.au>
245  */
246 __be32
247 nfsd_lookup(struct svc_rqst *rqstp, struct svc_fh *fhp, const char *name,
248 				unsigned int len, struct svc_fh *resfh)
249 {
250 	struct svc_export	*exp;
251 	struct dentry		*dentry;
252 	__be32 err;
253 
254 	err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_EXEC);
255 	if (err)
256 		return err;
257 	err = nfsd_lookup_dentry(rqstp, fhp, name, len, &exp, &dentry);
258 	if (err)
259 		return err;
260 	err = check_nfsd_access(exp, rqstp);
261 	if (err)
262 		goto out;
263 	/*
264 	 * Note: we compose the file handle now, but as the
265 	 * dentry may be negative, it may need to be updated.
266 	 */
267 	err = fh_compose(resfh, exp, dentry, fhp);
268 	if (!err && !dentry->d_inode)
269 		err = nfserr_noent;
270 out:
271 	dput(dentry);
272 	exp_put(exp);
273 	return err;
274 }
275 
276 static int nfsd_break_lease(struct inode *inode)
277 {
278 	if (!S_ISREG(inode->i_mode))
279 		return 0;
280 	return break_lease(inode, O_WRONLY | O_NONBLOCK);
281 }
282 
283 /*
284  * Commit metadata changes to stable storage.
285  */
286 static int
287 commit_metadata(struct svc_fh *fhp)
288 {
289 	struct inode *inode = fhp->fh_dentry->d_inode;
290 	const struct export_operations *export_ops = inode->i_sb->s_export_op;
291 
292 	if (!EX_ISSYNC(fhp->fh_export))
293 		return 0;
294 
295 	if (export_ops->commit_metadata)
296 		return export_ops->commit_metadata(inode);
297 	return sync_inode_metadata(inode, 1);
298 }
299 
300 /*
301  * Go over the attributes and take care of the small differences between
302  * NFS semantics and what Linux expects.
303  */
304 static void
305 nfsd_sanitize_attrs(struct inode *inode, struct iattr *iap)
306 {
307 	/*
308 	 * NFSv2 does not differentiate between "set-[ac]time-to-now"
309 	 * which only requires access, and "set-[ac]time-to-X" which
310 	 * requires ownership.
311 	 * So if it looks like it might be "set both to the same time which
312 	 * is close to now", and if inode_change_ok fails, then we
313 	 * convert to "set to now" instead of "set to explicit time"
314 	 *
315 	 * We only call inode_change_ok as the last test as technically
316 	 * it is not an interface that we should be using.
317 	 */
318 #define BOTH_TIME_SET (ATTR_ATIME_SET | ATTR_MTIME_SET)
319 #define	MAX_TOUCH_TIME_ERROR (30*60)
320 	if ((iap->ia_valid & BOTH_TIME_SET) == BOTH_TIME_SET &&
321 	    iap->ia_mtime.tv_sec == iap->ia_atime.tv_sec) {
322 		/*
323 		 * Looks probable.
324 		 *
325 		 * Now just make sure time is in the right ballpark.
326 		 * Solaris, at least, doesn't seem to care what the time
327 		 * request is.  We require it be within 30 minutes of now.
328 		 */
329 		time_t delta = iap->ia_atime.tv_sec - get_seconds();
330 		if (delta < 0)
331 			delta = -delta;
332 		if (delta < MAX_TOUCH_TIME_ERROR &&
333 		    inode_change_ok(inode, iap) != 0) {
334 			/*
335 			 * Turn off ATTR_[AM]TIME_SET but leave ATTR_[AM]TIME.
336 			 * This will cause notify_change to set these times
337 			 * to "now"
338 			 */
339 			iap->ia_valid &= ~BOTH_TIME_SET;
340 		}
341 	}
342 
343 	/* sanitize the mode change */
344 	if (iap->ia_valid & ATTR_MODE) {
345 		iap->ia_mode &= S_IALLUGO;
346 		iap->ia_mode |= (inode->i_mode & ~S_IALLUGO);
347 	}
348 
349 	/* Revoke setuid/setgid on chown */
350 	if (!S_ISDIR(inode->i_mode) &&
351 	    (((iap->ia_valid & ATTR_UID) && !uid_eq(iap->ia_uid, inode->i_uid)) ||
352 	     ((iap->ia_valid & ATTR_GID) && !gid_eq(iap->ia_gid, inode->i_gid)))) {
353 		iap->ia_valid |= ATTR_KILL_PRIV;
354 		if (iap->ia_valid & ATTR_MODE) {
355 			/* we're setting mode too, just clear the s*id bits */
356 			iap->ia_mode &= ~S_ISUID;
357 			if (iap->ia_mode & S_IXGRP)
358 				iap->ia_mode &= ~S_ISGID;
359 		} else {
360 			/* set ATTR_KILL_* bits and let VFS handle it */
361 			iap->ia_valid |= (ATTR_KILL_SUID | ATTR_KILL_SGID);
362 		}
363 	}
364 }
365 
366 static __be32
367 nfsd_get_write_access(struct svc_rqst *rqstp, struct svc_fh *fhp,
368 		struct iattr *iap)
369 {
370 	struct inode *inode = fhp->fh_dentry->d_inode;
371 	int host_err;
372 
373 	if (iap->ia_size < inode->i_size) {
374 		__be32 err;
375 
376 		err = nfsd_permission(rqstp, fhp->fh_export, fhp->fh_dentry,
377 				NFSD_MAY_TRUNC | NFSD_MAY_OWNER_OVERRIDE);
378 		if (err)
379 			return err;
380 	}
381 
382 	host_err = get_write_access(inode);
383 	if (host_err)
384 		goto out_nfserrno;
385 
386 	host_err = locks_verify_truncate(inode, NULL, iap->ia_size);
387 	if (host_err)
388 		goto out_put_write_access;
389 	return 0;
390 
391 out_put_write_access:
392 	put_write_access(inode);
393 out_nfserrno:
394 	return nfserrno(host_err);
395 }
396 
397 /*
398  * Set various file attributes.  After this call fhp needs an fh_put.
399  */
400 __be32
401 nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
402 	     int check_guard, time_t guardtime)
403 {
404 	struct dentry	*dentry;
405 	struct inode	*inode;
406 	int		accmode = NFSD_MAY_SATTR;
407 	umode_t		ftype = 0;
408 	__be32		err;
409 	int		host_err;
410 	int		size_change = 0;
411 
412 	if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE))
413 		accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE;
414 	if (iap->ia_valid & ATTR_SIZE)
415 		ftype = S_IFREG;
416 
417 	/* Get inode */
418 	err = fh_verify(rqstp, fhp, ftype, accmode);
419 	if (err)
420 		goto out;
421 
422 	dentry = fhp->fh_dentry;
423 	inode = dentry->d_inode;
424 
425 	/* Ignore any mode updates on symlinks */
426 	if (S_ISLNK(inode->i_mode))
427 		iap->ia_valid &= ~ATTR_MODE;
428 
429 	if (!iap->ia_valid)
430 		goto out;
431 
432 	nfsd_sanitize_attrs(inode, iap);
433 
434 	/*
435 	 * The size case is special, it changes the file in addition to the
436 	 * attributes.
437 	 */
438 	if (iap->ia_valid & ATTR_SIZE) {
439 		err = nfsd_get_write_access(rqstp, fhp, iap);
440 		if (err)
441 			goto out;
442 		size_change = 1;
443 	}
444 
445 	iap->ia_valid |= ATTR_CTIME;
446 
447 	if (check_guard && guardtime != inode->i_ctime.tv_sec) {
448 		err = nfserr_notsync;
449 		goto out_put_write_access;
450 	}
451 
452 	host_err = nfsd_break_lease(inode);
453 	if (host_err)
454 		goto out_put_write_access_nfserror;
455 
456 	fh_lock(fhp);
457 	host_err = notify_change(dentry, iap, NULL);
458 	fh_unlock(fhp);
459 
460 out_put_write_access_nfserror:
461 	err = nfserrno(host_err);
462 out_put_write_access:
463 	if (size_change)
464 		put_write_access(inode);
465 	if (!err)
466 		commit_metadata(fhp);
467 out:
468 	return err;
469 }
470 
471 #if defined(CONFIG_NFSD_V4)
472 /*
473  * NFS junction information is stored in an extended attribute.
474  */
475 #define NFSD_JUNCTION_XATTR_NAME	XATTR_TRUSTED_PREFIX "junction.nfs"
476 
477 /**
478  * nfsd4_is_junction - Test if an object could be an NFS junction
479  *
480  * @dentry: object to test
481  *
482  * Returns 1 if "dentry" appears to contain NFS junction information.
483  * Otherwise 0 is returned.
484  */
485 int nfsd4_is_junction(struct dentry *dentry)
486 {
487 	struct inode *inode = dentry->d_inode;
488 
489 	if (inode == NULL)
490 		return 0;
491 	if (inode->i_mode & S_IXUGO)
492 		return 0;
493 	if (!(inode->i_mode & S_ISVTX))
494 		return 0;
495 	if (vfs_getxattr(dentry, NFSD_JUNCTION_XATTR_NAME, NULL, 0) <= 0)
496 		return 0;
497 	return 1;
498 }
499 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
500 __be32 nfsd4_set_nfs4_label(struct svc_rqst *rqstp, struct svc_fh *fhp,
501 		struct xdr_netobj *label)
502 {
503 	__be32 error;
504 	int host_error;
505 	struct dentry *dentry;
506 
507 	error = fh_verify(rqstp, fhp, 0 /* S_IFREG */, NFSD_MAY_SATTR);
508 	if (error)
509 		return error;
510 
511 	dentry = fhp->fh_dentry;
512 
513 	mutex_lock(&dentry->d_inode->i_mutex);
514 	host_error = security_inode_setsecctx(dentry, label->data, label->len);
515 	mutex_unlock(&dentry->d_inode->i_mutex);
516 	return nfserrno(host_error);
517 }
518 #else
519 __be32 nfsd4_set_nfs4_label(struct svc_rqst *rqstp, struct svc_fh *fhp,
520 		struct xdr_netobj *label)
521 {
522 	return nfserr_notsupp;
523 }
524 #endif
525 
526 #endif /* defined(CONFIG_NFSD_V4) */
527 
528 #ifdef CONFIG_NFSD_V3
529 /*
530  * Check server access rights to a file system object
531  */
532 struct accessmap {
533 	u32		access;
534 	int		how;
535 };
536 static struct accessmap	nfs3_regaccess[] = {
537     {	NFS3_ACCESS_READ,	NFSD_MAY_READ			},
538     {	NFS3_ACCESS_EXECUTE,	NFSD_MAY_EXEC			},
539     {	NFS3_ACCESS_MODIFY,	NFSD_MAY_WRITE|NFSD_MAY_TRUNC	},
540     {	NFS3_ACCESS_EXTEND,	NFSD_MAY_WRITE			},
541 
542     {	0,			0				}
543 };
544 
545 static struct accessmap	nfs3_diraccess[] = {
546     {	NFS3_ACCESS_READ,	NFSD_MAY_READ			},
547     {	NFS3_ACCESS_LOOKUP,	NFSD_MAY_EXEC			},
548     {	NFS3_ACCESS_MODIFY,	NFSD_MAY_EXEC|NFSD_MAY_WRITE|NFSD_MAY_TRUNC},
549     {	NFS3_ACCESS_EXTEND,	NFSD_MAY_EXEC|NFSD_MAY_WRITE	},
550     {	NFS3_ACCESS_DELETE,	NFSD_MAY_REMOVE			},
551 
552     {	0,			0				}
553 };
554 
555 static struct accessmap	nfs3_anyaccess[] = {
556 	/* Some clients - Solaris 2.6 at least, make an access call
557 	 * to the server to check for access for things like /dev/null
558 	 * (which really, the server doesn't care about).  So
559 	 * We provide simple access checking for them, looking
560 	 * mainly at mode bits, and we make sure to ignore read-only
561 	 * filesystem checks
562 	 */
563     {	NFS3_ACCESS_READ,	NFSD_MAY_READ			},
564     {	NFS3_ACCESS_EXECUTE,	NFSD_MAY_EXEC			},
565     {	NFS3_ACCESS_MODIFY,	NFSD_MAY_WRITE|NFSD_MAY_LOCAL_ACCESS	},
566     {	NFS3_ACCESS_EXTEND,	NFSD_MAY_WRITE|NFSD_MAY_LOCAL_ACCESS	},
567 
568     {	0,			0				}
569 };
570 
571 __be32
572 nfsd_access(struct svc_rqst *rqstp, struct svc_fh *fhp, u32 *access, u32 *supported)
573 {
574 	struct accessmap	*map;
575 	struct svc_export	*export;
576 	struct dentry		*dentry;
577 	u32			query, result = 0, sresult = 0;
578 	__be32			error;
579 
580 	error = fh_verify(rqstp, fhp, 0, NFSD_MAY_NOP);
581 	if (error)
582 		goto out;
583 
584 	export = fhp->fh_export;
585 	dentry = fhp->fh_dentry;
586 
587 	if (S_ISREG(dentry->d_inode->i_mode))
588 		map = nfs3_regaccess;
589 	else if (S_ISDIR(dentry->d_inode->i_mode))
590 		map = nfs3_diraccess;
591 	else
592 		map = nfs3_anyaccess;
593 
594 
595 	query = *access;
596 	for  (; map->access; map++) {
597 		if (map->access & query) {
598 			__be32 err2;
599 
600 			sresult |= map->access;
601 
602 			err2 = nfsd_permission(rqstp, export, dentry, map->how);
603 			switch (err2) {
604 			case nfs_ok:
605 				result |= map->access;
606 				break;
607 
608 			/* the following error codes just mean the access was not allowed,
609 			 * rather than an error occurred */
610 			case nfserr_rofs:
611 			case nfserr_acces:
612 			case nfserr_perm:
613 				/* simply don't "or" in the access bit. */
614 				break;
615 			default:
616 				error = err2;
617 				goto out;
618 			}
619 		}
620 	}
621 	*access = result;
622 	if (supported)
623 		*supported = sresult;
624 
625  out:
626 	return error;
627 }
628 #endif /* CONFIG_NFSD_V3 */
629 
630 static int nfsd_open_break_lease(struct inode *inode, int access)
631 {
632 	unsigned int mode;
633 
634 	if (access & NFSD_MAY_NOT_BREAK_LEASE)
635 		return 0;
636 	mode = (access & NFSD_MAY_WRITE) ? O_WRONLY : O_RDONLY;
637 	return break_lease(inode, mode | O_NONBLOCK);
638 }
639 
640 /*
641  * Open an existing file or directory.
642  * The may_flags argument indicates the type of open (read/write/lock)
643  * and additional flags.
644  * N.B. After this call fhp needs an fh_put
645  */
646 __be32
647 nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, umode_t type,
648 			int may_flags, struct file **filp)
649 {
650 	struct path	path;
651 	struct inode	*inode;
652 	int		flags = O_RDONLY|O_LARGEFILE;
653 	__be32		err;
654 	int		host_err = 0;
655 
656 	validate_process_creds();
657 
658 	/*
659 	 * If we get here, then the client has already done an "open",
660 	 * and (hopefully) checked permission - so allow OWNER_OVERRIDE
661 	 * in case a chmod has now revoked permission.
662 	 *
663 	 * Arguably we should also allow the owner override for
664 	 * directories, but we never have and it doesn't seem to have
665 	 * caused anyone a problem.  If we were to change this, note
666 	 * also that our filldir callbacks would need a variant of
667 	 * lookup_one_len that doesn't check permissions.
668 	 */
669 	if (type == S_IFREG)
670 		may_flags |= NFSD_MAY_OWNER_OVERRIDE;
671 	err = fh_verify(rqstp, fhp, type, may_flags);
672 	if (err)
673 		goto out;
674 
675 	path.mnt = fhp->fh_export->ex_path.mnt;
676 	path.dentry = fhp->fh_dentry;
677 	inode = path.dentry->d_inode;
678 
679 	/* Disallow write access to files with the append-only bit set
680 	 * or any access when mandatory locking enabled
681 	 */
682 	err = nfserr_perm;
683 	if (IS_APPEND(inode) && (may_flags & NFSD_MAY_WRITE))
684 		goto out;
685 	/*
686 	 * We must ignore files (but only files) which might have mandatory
687 	 * locks on them because there is no way to know if the accesser has
688 	 * the lock.
689 	 */
690 	if (S_ISREG((inode)->i_mode) && mandatory_lock(inode))
691 		goto out;
692 
693 	if (!inode->i_fop)
694 		goto out;
695 
696 	host_err = nfsd_open_break_lease(inode, may_flags);
697 	if (host_err) /* NOMEM or WOULDBLOCK */
698 		goto out_nfserr;
699 
700 	if (may_flags & NFSD_MAY_WRITE) {
701 		if (may_flags & NFSD_MAY_READ)
702 			flags = O_RDWR|O_LARGEFILE;
703 		else
704 			flags = O_WRONLY|O_LARGEFILE;
705 	}
706 	*filp = dentry_open(&path, flags, current_cred());
707 	if (IS_ERR(*filp)) {
708 		host_err = PTR_ERR(*filp);
709 		*filp = NULL;
710 	} else {
711 		host_err = ima_file_check(*filp, may_flags);
712 
713 		if (may_flags & NFSD_MAY_64BIT_COOKIE)
714 			(*filp)->f_mode |= FMODE_64BITHASH;
715 		else
716 			(*filp)->f_mode |= FMODE_32BITHASH;
717 	}
718 
719 out_nfserr:
720 	err = nfserrno(host_err);
721 out:
722 	validate_process_creds();
723 	return err;
724 }
725 
726 /*
727  * Close a file.
728  */
729 void
730 nfsd_close(struct file *filp)
731 {
732 	fput(filp);
733 }
734 
735 /*
736  * Obtain the readahead parameters for the file
737  * specified by (dev, ino).
738  */
739 
740 static inline struct raparms *
741 nfsd_get_raparms(dev_t dev, ino_t ino)
742 {
743 	struct raparms	*ra, **rap, **frap = NULL;
744 	int depth = 0;
745 	unsigned int hash;
746 	struct raparm_hbucket *rab;
747 
748 	hash = jhash_2words(dev, ino, 0xfeedbeef) & RAPARM_HASH_MASK;
749 	rab = &raparm_hash[hash];
750 
751 	spin_lock(&rab->pb_lock);
752 	for (rap = &rab->pb_head; (ra = *rap); rap = &ra->p_next) {
753 		if (ra->p_ino == ino && ra->p_dev == dev)
754 			goto found;
755 		depth++;
756 		if (ra->p_count == 0)
757 			frap = rap;
758 	}
759 	depth = nfsdstats.ra_size;
760 	if (!frap) {
761 		spin_unlock(&rab->pb_lock);
762 		return NULL;
763 	}
764 	rap = frap;
765 	ra = *frap;
766 	ra->p_dev = dev;
767 	ra->p_ino = ino;
768 	ra->p_set = 0;
769 	ra->p_hindex = hash;
770 found:
771 	if (rap != &rab->pb_head) {
772 		*rap = ra->p_next;
773 		ra->p_next   = rab->pb_head;
774 		rab->pb_head = ra;
775 	}
776 	ra->p_count++;
777 	nfsdstats.ra_depth[depth*10/nfsdstats.ra_size]++;
778 	spin_unlock(&rab->pb_lock);
779 	return ra;
780 }
781 
782 /*
783  * Grab and keep cached pages associated with a file in the svc_rqst
784  * so that they can be passed to the network sendmsg/sendpage routines
785  * directly. They will be released after the sending has completed.
786  */
787 static int
788 nfsd_splice_actor(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
789 		  struct splice_desc *sd)
790 {
791 	struct svc_rqst *rqstp = sd->u.data;
792 	struct page **pp = rqstp->rq_next_page;
793 	struct page *page = buf->page;
794 	size_t size;
795 
796 	size = sd->len;
797 
798 	if (rqstp->rq_res.page_len == 0) {
799 		get_page(page);
800 		put_page(*rqstp->rq_next_page);
801 		*(rqstp->rq_next_page++) = page;
802 		rqstp->rq_res.page_base = buf->offset;
803 		rqstp->rq_res.page_len = size;
804 	} else if (page != pp[-1]) {
805 		get_page(page);
806 		if (*rqstp->rq_next_page)
807 			put_page(*rqstp->rq_next_page);
808 		*(rqstp->rq_next_page++) = page;
809 		rqstp->rq_res.page_len += size;
810 	} else
811 		rqstp->rq_res.page_len += size;
812 
813 	return size;
814 }
815 
816 static int nfsd_direct_splice_actor(struct pipe_inode_info *pipe,
817 				    struct splice_desc *sd)
818 {
819 	return __splice_from_pipe(pipe, sd, nfsd_splice_actor);
820 }
821 
822 static __be32
823 nfsd_vfs_read(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
824               loff_t offset, struct kvec *vec, int vlen, unsigned long *count)
825 {
826 	mm_segment_t	oldfs;
827 	__be32		err;
828 	int		host_err;
829 
830 	err = nfserr_perm;
831 
832 	if (file->f_op->splice_read && rqstp->rq_splice_ok) {
833 		struct splice_desc sd = {
834 			.len		= 0,
835 			.total_len	= *count,
836 			.pos		= offset,
837 			.u.data		= rqstp,
838 		};
839 
840 		rqstp->rq_next_page = rqstp->rq_respages + 1;
841 		host_err = splice_direct_to_actor(file, &sd, nfsd_direct_splice_actor);
842 	} else {
843 		oldfs = get_fs();
844 		set_fs(KERNEL_DS);
845 		host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
846 		set_fs(oldfs);
847 	}
848 
849 	if (host_err >= 0) {
850 		nfsdstats.io_read += host_err;
851 		*count = host_err;
852 		err = 0;
853 		fsnotify_access(file);
854 	} else
855 		err = nfserrno(host_err);
856 	return err;
857 }
858 
859 static void kill_suid(struct dentry *dentry)
860 {
861 	struct iattr	ia;
862 	ia.ia_valid = ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_KILL_PRIV;
863 
864 	mutex_lock(&dentry->d_inode->i_mutex);
865 	/*
866 	 * Note we call this on write, so notify_change will not
867 	 * encounter any conflicting delegations:
868 	 */
869 	notify_change(dentry, &ia, NULL);
870 	mutex_unlock(&dentry->d_inode->i_mutex);
871 }
872 
873 /*
874  * Gathered writes: If another process is currently writing to the file,
875  * there's a high chance this is another nfsd (triggered by a bulk write
876  * from a client's biod). Rather than syncing the file with each write
877  * request, we sleep for 10 msec.
878  *
879  * I don't know if this roughly approximates C. Juszak's idea of
880  * gathered writes, but it's a nice and simple solution (IMHO), and it
881  * seems to work:-)
882  *
883  * Note: we do this only in the NFSv2 case, since v3 and higher have a
884  * better tool (separate unstable writes and commits) for solving this
885  * problem.
886  */
887 static int wait_for_concurrent_writes(struct file *file)
888 {
889 	struct inode *inode = file_inode(file);
890 	static ino_t last_ino;
891 	static dev_t last_dev;
892 	int err = 0;
893 
894 	if (atomic_read(&inode->i_writecount) > 1
895 	    || (last_ino == inode->i_ino && last_dev == inode->i_sb->s_dev)) {
896 		dprintk("nfsd: write defer %d\n", task_pid_nr(current));
897 		msleep(10);
898 		dprintk("nfsd: write resume %d\n", task_pid_nr(current));
899 	}
900 
901 	if (inode->i_state & I_DIRTY) {
902 		dprintk("nfsd: write sync %d\n", task_pid_nr(current));
903 		err = vfs_fsync(file, 0);
904 	}
905 	last_ino = inode->i_ino;
906 	last_dev = inode->i_sb->s_dev;
907 	return err;
908 }
909 
910 static __be32
911 nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
912 				loff_t offset, struct kvec *vec, int vlen,
913 				unsigned long *cnt, int *stablep)
914 {
915 	struct svc_export	*exp;
916 	struct dentry		*dentry;
917 	struct inode		*inode;
918 	mm_segment_t		oldfs;
919 	__be32			err = 0;
920 	int			host_err;
921 	int			stable = *stablep;
922 	int			use_wgather;
923 	loff_t			pos = offset;
924 
925 	dentry = file->f_path.dentry;
926 	inode = dentry->d_inode;
927 	exp   = fhp->fh_export;
928 
929 	use_wgather = (rqstp->rq_vers == 2) && EX_WGATHER(exp);
930 
931 	if (!EX_ISSYNC(exp))
932 		stable = 0;
933 
934 	/* Write the data. */
935 	oldfs = get_fs(); set_fs(KERNEL_DS);
936 	host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &pos);
937 	set_fs(oldfs);
938 	if (host_err < 0)
939 		goto out_nfserr;
940 	*cnt = host_err;
941 	nfsdstats.io_write += host_err;
942 	fsnotify_modify(file);
943 
944 	/* clear setuid/setgid flag after write */
945 	if (inode->i_mode & (S_ISUID | S_ISGID))
946 		kill_suid(dentry);
947 
948 	if (stable) {
949 		if (use_wgather)
950 			host_err = wait_for_concurrent_writes(file);
951 		else
952 			host_err = vfs_fsync_range(file, offset, offset+*cnt, 0);
953 	}
954 
955 out_nfserr:
956 	dprintk("nfsd: write complete host_err=%d\n", host_err);
957 	if (host_err >= 0)
958 		err = 0;
959 	else
960 		err = nfserrno(host_err);
961 	return err;
962 }
963 
964 /*
965  * Read data from a file. count must contain the requested read count
966  * on entry. On return, *count contains the number of bytes actually read.
967  * N.B. After this call fhp needs an fh_put
968  */
969 __be32 nfsd_read(struct svc_rqst *rqstp, struct svc_fh *fhp,
970 	loff_t offset, struct kvec *vec, int vlen, unsigned long *count)
971 {
972 	struct file *file;
973 	struct inode *inode;
974 	struct raparms	*ra;
975 	__be32 err;
976 
977 	err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
978 	if (err)
979 		return err;
980 
981 	inode = file_inode(file);
982 
983 	/* Get readahead parameters */
984 	ra = nfsd_get_raparms(inode->i_sb->s_dev, inode->i_ino);
985 
986 	if (ra && ra->p_set)
987 		file->f_ra = ra->p_ra;
988 
989 	err = nfsd_vfs_read(rqstp, fhp, file, offset, vec, vlen, count);
990 
991 	/* Write back readahead params */
992 	if (ra) {
993 		struct raparm_hbucket *rab = &raparm_hash[ra->p_hindex];
994 		spin_lock(&rab->pb_lock);
995 		ra->p_ra = file->f_ra;
996 		ra->p_set = 1;
997 		ra->p_count--;
998 		spin_unlock(&rab->pb_lock);
999 	}
1000 
1001 	nfsd_close(file);
1002 	return err;
1003 }
1004 
1005 /* As above, but use the provided file descriptor. */
1006 __be32
1007 nfsd_read_file(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
1008 		loff_t offset, struct kvec *vec, int vlen,
1009 		unsigned long *count)
1010 {
1011 	__be32		err;
1012 
1013 	if (file) {
1014 		err = nfsd_permission(rqstp, fhp->fh_export, fhp->fh_dentry,
1015 				NFSD_MAY_READ|NFSD_MAY_OWNER_OVERRIDE);
1016 		if (err)
1017 			goto out;
1018 		err = nfsd_vfs_read(rqstp, fhp, file, offset, vec, vlen, count);
1019 	} else /* Note file may still be NULL in NFSv4 special stateid case: */
1020 		err = nfsd_read(rqstp, fhp, offset, vec, vlen, count);
1021 out:
1022 	return err;
1023 }
1024 
1025 /*
1026  * Write data to a file.
1027  * The stable flag requests synchronous writes.
1028  * N.B. After this call fhp needs an fh_put
1029  */
1030 __be32
1031 nfsd_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
1032 		loff_t offset, struct kvec *vec, int vlen, unsigned long *cnt,
1033 		int *stablep)
1034 {
1035 	__be32			err = 0;
1036 
1037 	if (file) {
1038 		err = nfsd_permission(rqstp, fhp->fh_export, fhp->fh_dentry,
1039 				NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE);
1040 		if (err)
1041 			goto out;
1042 		err = nfsd_vfs_write(rqstp, fhp, file, offset, vec, vlen, cnt,
1043 				stablep);
1044 	} else {
1045 		err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_WRITE, &file);
1046 		if (err)
1047 			goto out;
1048 
1049 		if (cnt)
1050 			err = nfsd_vfs_write(rqstp, fhp, file, offset, vec, vlen,
1051 					     cnt, stablep);
1052 		nfsd_close(file);
1053 	}
1054 out:
1055 	return err;
1056 }
1057 
1058 #ifdef CONFIG_NFSD_V3
1059 /*
1060  * Commit all pending writes to stable storage.
1061  *
1062  * Note: we only guarantee that data that lies within the range specified
1063  * by the 'offset' and 'count' parameters will be synced.
1064  *
1065  * Unfortunately we cannot lock the file to make sure we return full WCC
1066  * data to the client, as locking happens lower down in the filesystem.
1067  */
1068 __be32
1069 nfsd_commit(struct svc_rqst *rqstp, struct svc_fh *fhp,
1070                loff_t offset, unsigned long count)
1071 {
1072 	struct file	*file;
1073 	loff_t		end = LLONG_MAX;
1074 	__be32		err = nfserr_inval;
1075 
1076 	if (offset < 0)
1077 		goto out;
1078 	if (count != 0) {
1079 		end = offset + (loff_t)count - 1;
1080 		if (end < offset)
1081 			goto out;
1082 	}
1083 
1084 	err = nfsd_open(rqstp, fhp, S_IFREG,
1085 			NFSD_MAY_WRITE|NFSD_MAY_NOT_BREAK_LEASE, &file);
1086 	if (err)
1087 		goto out;
1088 	if (EX_ISSYNC(fhp->fh_export)) {
1089 		int err2 = vfs_fsync_range(file, offset, end, 0);
1090 
1091 		if (err2 != -EINVAL)
1092 			err = nfserrno(err2);
1093 		else
1094 			err = nfserr_notsupp;
1095 	}
1096 
1097 	nfsd_close(file);
1098 out:
1099 	return err;
1100 }
1101 #endif /* CONFIG_NFSD_V3 */
1102 
1103 static __be32
1104 nfsd_create_setattr(struct svc_rqst *rqstp, struct svc_fh *resfhp,
1105 			struct iattr *iap)
1106 {
1107 	/*
1108 	 * Mode has already been set earlier in create:
1109 	 */
1110 	iap->ia_valid &= ~ATTR_MODE;
1111 	/*
1112 	 * Setting uid/gid works only for root.  Irix appears to
1113 	 * send along the gid on create when it tries to implement
1114 	 * setgid directories via NFS:
1115 	 */
1116 	if (!uid_eq(current_fsuid(), GLOBAL_ROOT_UID))
1117 		iap->ia_valid &= ~(ATTR_UID|ATTR_GID);
1118 	if (iap->ia_valid)
1119 		return nfsd_setattr(rqstp, resfhp, iap, 0, (time_t)0);
1120 	return 0;
1121 }
1122 
1123 /* HPUX client sometimes creates a file in mode 000, and sets size to 0.
1124  * setting size to 0 may fail for some specific file systems by the permission
1125  * checking which requires WRITE permission but the mode is 000.
1126  * we ignore the resizing(to 0) on the just new created file, since the size is
1127  * 0 after file created.
1128  *
1129  * call this only after vfs_create() is called.
1130  * */
1131 static void
1132 nfsd_check_ignore_resizing(struct iattr *iap)
1133 {
1134 	if ((iap->ia_valid & ATTR_SIZE) && (iap->ia_size == 0))
1135 		iap->ia_valid &= ~ATTR_SIZE;
1136 }
1137 
1138 /*
1139  * Create a file (regular, directory, device, fifo); UNIX sockets
1140  * not yet implemented.
1141  * If the response fh has been verified, the parent directory should
1142  * already be locked. Note that the parent directory is left locked.
1143  *
1144  * N.B. Every call to nfsd_create needs an fh_put for _both_ fhp and resfhp
1145  */
1146 __be32
1147 nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
1148 		char *fname, int flen, struct iattr *iap,
1149 		int type, dev_t rdev, struct svc_fh *resfhp)
1150 {
1151 	struct dentry	*dentry, *dchild = NULL;
1152 	struct inode	*dirp;
1153 	__be32		err;
1154 	__be32		err2;
1155 	int		host_err;
1156 
1157 	err = nfserr_perm;
1158 	if (!flen)
1159 		goto out;
1160 	err = nfserr_exist;
1161 	if (isdotent(fname, flen))
1162 		goto out;
1163 
1164 	err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
1165 	if (err)
1166 		goto out;
1167 
1168 	dentry = fhp->fh_dentry;
1169 	dirp = dentry->d_inode;
1170 
1171 	err = nfserr_notdir;
1172 	if (!dirp->i_op->lookup)
1173 		goto out;
1174 	/*
1175 	 * Check whether the response file handle has been verified yet.
1176 	 * If it has, the parent directory should already be locked.
1177 	 */
1178 	if (!resfhp->fh_dentry) {
1179 		host_err = fh_want_write(fhp);
1180 		if (host_err)
1181 			goto out_nfserr;
1182 
1183 		/* called from nfsd_proc_mkdir, or possibly nfsd3_proc_create */
1184 		fh_lock_nested(fhp, I_MUTEX_PARENT);
1185 		dchild = lookup_one_len(fname, dentry, flen);
1186 		host_err = PTR_ERR(dchild);
1187 		if (IS_ERR(dchild))
1188 			goto out_nfserr;
1189 		err = fh_compose(resfhp, fhp->fh_export, dchild, fhp);
1190 		if (err)
1191 			goto out;
1192 	} else {
1193 		/* called from nfsd_proc_create */
1194 		dchild = dget(resfhp->fh_dentry);
1195 		if (!fhp->fh_locked) {
1196 			/* not actually possible */
1197 			printk(KERN_ERR
1198 				"nfsd_create: parent %pd2 not locked!\n",
1199 				dentry);
1200 			err = nfserr_io;
1201 			goto out;
1202 		}
1203 	}
1204 	/*
1205 	 * Make sure the child dentry is still negative ...
1206 	 */
1207 	err = nfserr_exist;
1208 	if (dchild->d_inode) {
1209 		dprintk("nfsd_create: dentry %pd/%pd not negative!\n",
1210 			dentry, dchild);
1211 		goto out;
1212 	}
1213 
1214 	if (!(iap->ia_valid & ATTR_MODE))
1215 		iap->ia_mode = 0;
1216 	iap->ia_mode = (iap->ia_mode & S_IALLUGO) | type;
1217 
1218 	err = nfserr_inval;
1219 	if (!S_ISREG(type) && !S_ISDIR(type) && !special_file(type)) {
1220 		printk(KERN_WARNING "nfsd: bad file type %o in nfsd_create\n",
1221 		       type);
1222 		goto out;
1223 	}
1224 
1225 	/*
1226 	 * Get the dir op function pointer.
1227 	 */
1228 	err = 0;
1229 	host_err = 0;
1230 	switch (type) {
1231 	case S_IFREG:
1232 		host_err = vfs_create(dirp, dchild, iap->ia_mode, true);
1233 		if (!host_err)
1234 			nfsd_check_ignore_resizing(iap);
1235 		break;
1236 	case S_IFDIR:
1237 		host_err = vfs_mkdir(dirp, dchild, iap->ia_mode);
1238 		break;
1239 	case S_IFCHR:
1240 	case S_IFBLK:
1241 	case S_IFIFO:
1242 	case S_IFSOCK:
1243 		host_err = vfs_mknod(dirp, dchild, iap->ia_mode, rdev);
1244 		break;
1245 	}
1246 	if (host_err < 0)
1247 		goto out_nfserr;
1248 
1249 	err = nfsd_create_setattr(rqstp, resfhp, iap);
1250 
1251 	/*
1252 	 * nfsd_setattr already committed the child.  Transactional filesystems
1253 	 * had a chance to commit changes for both parent and child
1254 	 * simultaneously making the following commit_metadata a noop.
1255 	 */
1256 	err2 = nfserrno(commit_metadata(fhp));
1257 	if (err2)
1258 		err = err2;
1259 	/*
1260 	 * Update the file handle to get the new inode info.
1261 	 */
1262 	if (!err)
1263 		err = fh_update(resfhp);
1264 out:
1265 	if (dchild && !IS_ERR(dchild))
1266 		dput(dchild);
1267 	return err;
1268 
1269 out_nfserr:
1270 	err = nfserrno(host_err);
1271 	goto out;
1272 }
1273 
1274 #ifdef CONFIG_NFSD_V3
1275 
1276 static inline int nfsd_create_is_exclusive(int createmode)
1277 {
1278 	return createmode == NFS3_CREATE_EXCLUSIVE
1279 	       || createmode == NFS4_CREATE_EXCLUSIVE4_1;
1280 }
1281 
1282 /*
1283  * NFSv3 and NFSv4 version of nfsd_create
1284  */
1285 __be32
1286 do_nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
1287 		char *fname, int flen, struct iattr *iap,
1288 		struct svc_fh *resfhp, int createmode, u32 *verifier,
1289 	        bool *truncp, bool *created)
1290 {
1291 	struct dentry	*dentry, *dchild = NULL;
1292 	struct inode	*dirp;
1293 	__be32		err;
1294 	int		host_err;
1295 	__u32		v_mtime=0, v_atime=0;
1296 
1297 	err = nfserr_perm;
1298 	if (!flen)
1299 		goto out;
1300 	err = nfserr_exist;
1301 	if (isdotent(fname, flen))
1302 		goto out;
1303 	if (!(iap->ia_valid & ATTR_MODE))
1304 		iap->ia_mode = 0;
1305 	err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_EXEC);
1306 	if (err)
1307 		goto out;
1308 
1309 	dentry = fhp->fh_dentry;
1310 	dirp = dentry->d_inode;
1311 
1312 	/* Get all the sanity checks out of the way before
1313 	 * we lock the parent. */
1314 	err = nfserr_notdir;
1315 	if (!dirp->i_op->lookup)
1316 		goto out;
1317 
1318 	host_err = fh_want_write(fhp);
1319 	if (host_err)
1320 		goto out_nfserr;
1321 
1322 	fh_lock_nested(fhp, I_MUTEX_PARENT);
1323 
1324 	/*
1325 	 * Compose the response file handle.
1326 	 */
1327 	dchild = lookup_one_len(fname, dentry, flen);
1328 	host_err = PTR_ERR(dchild);
1329 	if (IS_ERR(dchild))
1330 		goto out_nfserr;
1331 
1332 	/* If file doesn't exist, check for permissions to create one */
1333 	if (!dchild->d_inode) {
1334 		err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
1335 		if (err)
1336 			goto out;
1337 	}
1338 
1339 	err = fh_compose(resfhp, fhp->fh_export, dchild, fhp);
1340 	if (err)
1341 		goto out;
1342 
1343 	if (nfsd_create_is_exclusive(createmode)) {
1344 		/* solaris7 gets confused (bugid 4218508) if these have
1345 		 * the high bit set, so just clear the high bits. If this is
1346 		 * ever changed to use different attrs for storing the
1347 		 * verifier, then do_open_lookup() will also need to be fixed
1348 		 * accordingly.
1349 		 */
1350 		v_mtime = verifier[0]&0x7fffffff;
1351 		v_atime = verifier[1]&0x7fffffff;
1352 	}
1353 
1354 	if (dchild->d_inode) {
1355 		err = 0;
1356 
1357 		switch (createmode) {
1358 		case NFS3_CREATE_UNCHECKED:
1359 			if (! S_ISREG(dchild->d_inode->i_mode))
1360 				goto out;
1361 			else if (truncp) {
1362 				/* in nfsv4, we need to treat this case a little
1363 				 * differently.  we don't want to truncate the
1364 				 * file now; this would be wrong if the OPEN
1365 				 * fails for some other reason.  furthermore,
1366 				 * if the size is nonzero, we should ignore it
1367 				 * according to spec!
1368 				 */
1369 				*truncp = (iap->ia_valid & ATTR_SIZE) && !iap->ia_size;
1370 			}
1371 			else {
1372 				iap->ia_valid &= ATTR_SIZE;
1373 				goto set_attr;
1374 			}
1375 			break;
1376 		case NFS3_CREATE_EXCLUSIVE:
1377 			if (   dchild->d_inode->i_mtime.tv_sec == v_mtime
1378 			    && dchild->d_inode->i_atime.tv_sec == v_atime
1379 			    && dchild->d_inode->i_size  == 0 ) {
1380 				if (created)
1381 					*created = 1;
1382 				break;
1383 			}
1384 		case NFS4_CREATE_EXCLUSIVE4_1:
1385 			if (   dchild->d_inode->i_mtime.tv_sec == v_mtime
1386 			    && dchild->d_inode->i_atime.tv_sec == v_atime
1387 			    && dchild->d_inode->i_size  == 0 ) {
1388 				if (created)
1389 					*created = 1;
1390 				goto set_attr;
1391 			}
1392 			 /* fallthru */
1393 		case NFS3_CREATE_GUARDED:
1394 			err = nfserr_exist;
1395 		}
1396 		fh_drop_write(fhp);
1397 		goto out;
1398 	}
1399 
1400 	host_err = vfs_create(dirp, dchild, iap->ia_mode, true);
1401 	if (host_err < 0) {
1402 		fh_drop_write(fhp);
1403 		goto out_nfserr;
1404 	}
1405 	if (created)
1406 		*created = 1;
1407 
1408 	nfsd_check_ignore_resizing(iap);
1409 
1410 	if (nfsd_create_is_exclusive(createmode)) {
1411 		/* Cram the verifier into atime/mtime */
1412 		iap->ia_valid = ATTR_MTIME|ATTR_ATIME
1413 			| ATTR_MTIME_SET|ATTR_ATIME_SET;
1414 		/* XXX someone who knows this better please fix it for nsec */
1415 		iap->ia_mtime.tv_sec = v_mtime;
1416 		iap->ia_atime.tv_sec = v_atime;
1417 		iap->ia_mtime.tv_nsec = 0;
1418 		iap->ia_atime.tv_nsec = 0;
1419 	}
1420 
1421  set_attr:
1422 	err = nfsd_create_setattr(rqstp, resfhp, iap);
1423 
1424 	/*
1425 	 * nfsd_setattr already committed the child (and possibly also the parent).
1426 	 */
1427 	if (!err)
1428 		err = nfserrno(commit_metadata(fhp));
1429 
1430 	/*
1431 	 * Update the filehandle to get the new inode info.
1432 	 */
1433 	if (!err)
1434 		err = fh_update(resfhp);
1435 
1436  out:
1437 	fh_unlock(fhp);
1438 	if (dchild && !IS_ERR(dchild))
1439 		dput(dchild);
1440 	fh_drop_write(fhp);
1441  	return err;
1442 
1443  out_nfserr:
1444 	err = nfserrno(host_err);
1445 	goto out;
1446 }
1447 #endif /* CONFIG_NFSD_V3 */
1448 
1449 /*
1450  * Read a symlink. On entry, *lenp must contain the maximum path length that
1451  * fits into the buffer. On return, it contains the true length.
1452  * N.B. After this call fhp needs an fh_put
1453  */
1454 __be32
1455 nfsd_readlink(struct svc_rqst *rqstp, struct svc_fh *fhp, char *buf, int *lenp)
1456 {
1457 	struct inode	*inode;
1458 	mm_segment_t	oldfs;
1459 	__be32		err;
1460 	int		host_err;
1461 	struct path path;
1462 
1463 	err = fh_verify(rqstp, fhp, S_IFLNK, NFSD_MAY_NOP);
1464 	if (err)
1465 		goto out;
1466 
1467 	path.mnt = fhp->fh_export->ex_path.mnt;
1468 	path.dentry = fhp->fh_dentry;
1469 	inode = path.dentry->d_inode;
1470 
1471 	err = nfserr_inval;
1472 	if (!inode->i_op->readlink)
1473 		goto out;
1474 
1475 	touch_atime(&path);
1476 	/* N.B. Why does this call need a get_fs()??
1477 	 * Remove the set_fs and watch the fireworks:-) --okir
1478 	 */
1479 
1480 	oldfs = get_fs(); set_fs(KERNEL_DS);
1481 	host_err = inode->i_op->readlink(path.dentry, (char __user *)buf, *lenp);
1482 	set_fs(oldfs);
1483 
1484 	if (host_err < 0)
1485 		goto out_nfserr;
1486 	*lenp = host_err;
1487 	err = 0;
1488 out:
1489 	return err;
1490 
1491 out_nfserr:
1492 	err = nfserrno(host_err);
1493 	goto out;
1494 }
1495 
1496 /*
1497  * Create a symlink and look up its inode
1498  * N.B. After this call _both_ fhp and resfhp need an fh_put
1499  */
1500 __be32
1501 nfsd_symlink(struct svc_rqst *rqstp, struct svc_fh *fhp,
1502 				char *fname, int flen,
1503 				char *path,  int plen,
1504 				struct svc_fh *resfhp,
1505 				struct iattr *iap)
1506 {
1507 	struct dentry	*dentry, *dnew;
1508 	__be32		err, cerr;
1509 	int		host_err;
1510 
1511 	err = nfserr_noent;
1512 	if (!flen || !plen)
1513 		goto out;
1514 	err = nfserr_exist;
1515 	if (isdotent(fname, flen))
1516 		goto out;
1517 
1518 	err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
1519 	if (err)
1520 		goto out;
1521 
1522 	host_err = fh_want_write(fhp);
1523 	if (host_err)
1524 		goto out_nfserr;
1525 
1526 	fh_lock(fhp);
1527 	dentry = fhp->fh_dentry;
1528 	dnew = lookup_one_len(fname, dentry, flen);
1529 	host_err = PTR_ERR(dnew);
1530 	if (IS_ERR(dnew))
1531 		goto out_nfserr;
1532 
1533 	if (unlikely(path[plen] != 0)) {
1534 		char *path_alloced = kmalloc(plen+1, GFP_KERNEL);
1535 		if (path_alloced == NULL)
1536 			host_err = -ENOMEM;
1537 		else {
1538 			strncpy(path_alloced, path, plen);
1539 			path_alloced[plen] = 0;
1540 			host_err = vfs_symlink(dentry->d_inode, dnew, path_alloced);
1541 			kfree(path_alloced);
1542 		}
1543 	} else
1544 		host_err = vfs_symlink(dentry->d_inode, dnew, path);
1545 	err = nfserrno(host_err);
1546 	if (!err)
1547 		err = nfserrno(commit_metadata(fhp));
1548 	fh_unlock(fhp);
1549 
1550 	fh_drop_write(fhp);
1551 
1552 	cerr = fh_compose(resfhp, fhp->fh_export, dnew, fhp);
1553 	dput(dnew);
1554 	if (err==0) err = cerr;
1555 out:
1556 	return err;
1557 
1558 out_nfserr:
1559 	err = nfserrno(host_err);
1560 	goto out;
1561 }
1562 
1563 /*
1564  * Create a hardlink
1565  * N.B. After this call _both_ ffhp and tfhp need an fh_put
1566  */
1567 __be32
1568 nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp,
1569 				char *name, int len, struct svc_fh *tfhp)
1570 {
1571 	struct dentry	*ddir, *dnew, *dold;
1572 	struct inode	*dirp;
1573 	__be32		err;
1574 	int		host_err;
1575 
1576 	err = fh_verify(rqstp, ffhp, S_IFDIR, NFSD_MAY_CREATE);
1577 	if (err)
1578 		goto out;
1579 	err = fh_verify(rqstp, tfhp, 0, NFSD_MAY_NOP);
1580 	if (err)
1581 		goto out;
1582 	err = nfserr_isdir;
1583 	if (S_ISDIR(tfhp->fh_dentry->d_inode->i_mode))
1584 		goto out;
1585 	err = nfserr_perm;
1586 	if (!len)
1587 		goto out;
1588 	err = nfserr_exist;
1589 	if (isdotent(name, len))
1590 		goto out;
1591 
1592 	host_err = fh_want_write(tfhp);
1593 	if (host_err) {
1594 		err = nfserrno(host_err);
1595 		goto out;
1596 	}
1597 
1598 	fh_lock_nested(ffhp, I_MUTEX_PARENT);
1599 	ddir = ffhp->fh_dentry;
1600 	dirp = ddir->d_inode;
1601 
1602 	dnew = lookup_one_len(name, ddir, len);
1603 	host_err = PTR_ERR(dnew);
1604 	if (IS_ERR(dnew))
1605 		goto out_nfserr;
1606 
1607 	dold = tfhp->fh_dentry;
1608 
1609 	err = nfserr_noent;
1610 	if (!dold->d_inode)
1611 		goto out_dput;
1612 	host_err = nfsd_break_lease(dold->d_inode);
1613 	if (host_err) {
1614 		err = nfserrno(host_err);
1615 		goto out_dput;
1616 	}
1617 	host_err = vfs_link(dold, dirp, dnew, NULL);
1618 	if (!host_err) {
1619 		err = nfserrno(commit_metadata(ffhp));
1620 		if (!err)
1621 			err = nfserrno(commit_metadata(tfhp));
1622 	} else {
1623 		if (host_err == -EXDEV && rqstp->rq_vers == 2)
1624 			err = nfserr_acces;
1625 		else
1626 			err = nfserrno(host_err);
1627 	}
1628 out_dput:
1629 	dput(dnew);
1630 out_unlock:
1631 	fh_unlock(ffhp);
1632 	fh_drop_write(tfhp);
1633 out:
1634 	return err;
1635 
1636 out_nfserr:
1637 	err = nfserrno(host_err);
1638 	goto out_unlock;
1639 }
1640 
1641 /*
1642  * Rename a file
1643  * N.B. After this call _both_ ffhp and tfhp need an fh_put
1644  */
1645 __be32
1646 nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen,
1647 			    struct svc_fh *tfhp, char *tname, int tlen)
1648 {
1649 	struct dentry	*fdentry, *tdentry, *odentry, *ndentry, *trap;
1650 	struct inode	*fdir, *tdir;
1651 	__be32		err;
1652 	int		host_err;
1653 
1654 	err = fh_verify(rqstp, ffhp, S_IFDIR, NFSD_MAY_REMOVE);
1655 	if (err)
1656 		goto out;
1657 	err = fh_verify(rqstp, tfhp, S_IFDIR, NFSD_MAY_CREATE);
1658 	if (err)
1659 		goto out;
1660 
1661 	fdentry = ffhp->fh_dentry;
1662 	fdir = fdentry->d_inode;
1663 
1664 	tdentry = tfhp->fh_dentry;
1665 	tdir = tdentry->d_inode;
1666 
1667 	err = nfserr_perm;
1668 	if (!flen || isdotent(fname, flen) || !tlen || isdotent(tname, tlen))
1669 		goto out;
1670 
1671 	host_err = fh_want_write(ffhp);
1672 	if (host_err) {
1673 		err = nfserrno(host_err);
1674 		goto out;
1675 	}
1676 
1677 	/* cannot use fh_lock as we need deadlock protective ordering
1678 	 * so do it by hand */
1679 	trap = lock_rename(tdentry, fdentry);
1680 	ffhp->fh_locked = tfhp->fh_locked = 1;
1681 	fill_pre_wcc(ffhp);
1682 	fill_pre_wcc(tfhp);
1683 
1684 	odentry = lookup_one_len(fname, fdentry, flen);
1685 	host_err = PTR_ERR(odentry);
1686 	if (IS_ERR(odentry))
1687 		goto out_nfserr;
1688 
1689 	host_err = -ENOENT;
1690 	if (!odentry->d_inode)
1691 		goto out_dput_old;
1692 	host_err = -EINVAL;
1693 	if (odentry == trap)
1694 		goto out_dput_old;
1695 
1696 	ndentry = lookup_one_len(tname, tdentry, tlen);
1697 	host_err = PTR_ERR(ndentry);
1698 	if (IS_ERR(ndentry))
1699 		goto out_dput_old;
1700 	host_err = -ENOTEMPTY;
1701 	if (ndentry == trap)
1702 		goto out_dput_new;
1703 
1704 	host_err = -EXDEV;
1705 	if (ffhp->fh_export->ex_path.mnt != tfhp->fh_export->ex_path.mnt)
1706 		goto out_dput_new;
1707 	if (ffhp->fh_export->ex_path.dentry != tfhp->fh_export->ex_path.dentry)
1708 		goto out_dput_new;
1709 
1710 	host_err = nfsd_break_lease(odentry->d_inode);
1711 	if (host_err)
1712 		goto out_dput_new;
1713 	if (ndentry->d_inode) {
1714 		host_err = nfsd_break_lease(ndentry->d_inode);
1715 		if (host_err)
1716 			goto out_dput_new;
1717 	}
1718 	host_err = vfs_rename(fdir, odentry, tdir, ndentry, NULL);
1719 	if (!host_err) {
1720 		host_err = commit_metadata(tfhp);
1721 		if (!host_err)
1722 			host_err = commit_metadata(ffhp);
1723 	}
1724  out_dput_new:
1725 	dput(ndentry);
1726  out_dput_old:
1727 	dput(odentry);
1728  out_nfserr:
1729 	err = nfserrno(host_err);
1730 
1731 	/* we cannot reply on fh_unlock on the two filehandles,
1732 	 * as that would do the wrong thing if the two directories
1733 	 * were the same, so again we do it by hand
1734 	 */
1735 	fill_post_wcc(ffhp);
1736 	fill_post_wcc(tfhp);
1737 	unlock_rename(tdentry, fdentry);
1738 	ffhp->fh_locked = tfhp->fh_locked = 0;
1739 	fh_drop_write(ffhp);
1740 
1741 out:
1742 	return err;
1743 }
1744 
1745 /*
1746  * Unlink a file or directory
1747  * N.B. After this call fhp needs an fh_put
1748  */
1749 __be32
1750 nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
1751 				char *fname, int flen)
1752 {
1753 	struct dentry	*dentry, *rdentry;
1754 	struct inode	*dirp;
1755 	__be32		err;
1756 	int		host_err;
1757 
1758 	err = nfserr_acces;
1759 	if (!flen || isdotent(fname, flen))
1760 		goto out;
1761 	err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_REMOVE);
1762 	if (err)
1763 		goto out;
1764 
1765 	host_err = fh_want_write(fhp);
1766 	if (host_err)
1767 		goto out_nfserr;
1768 
1769 	fh_lock_nested(fhp, I_MUTEX_PARENT);
1770 	dentry = fhp->fh_dentry;
1771 	dirp = dentry->d_inode;
1772 
1773 	rdentry = lookup_one_len(fname, dentry, flen);
1774 	host_err = PTR_ERR(rdentry);
1775 	if (IS_ERR(rdentry))
1776 		goto out_nfserr;
1777 
1778 	if (!rdentry->d_inode) {
1779 		dput(rdentry);
1780 		err = nfserr_noent;
1781 		goto out;
1782 	}
1783 
1784 	if (!type)
1785 		type = rdentry->d_inode->i_mode & S_IFMT;
1786 
1787 	host_err = nfsd_break_lease(rdentry->d_inode);
1788 	if (host_err)
1789 		goto out_put;
1790 	if (type != S_IFDIR)
1791 		host_err = vfs_unlink(dirp, rdentry, NULL);
1792 	else
1793 		host_err = vfs_rmdir(dirp, rdentry);
1794 	if (!host_err)
1795 		host_err = commit_metadata(fhp);
1796 out_put:
1797 	dput(rdentry);
1798 
1799 out_nfserr:
1800 	err = nfserrno(host_err);
1801 out:
1802 	return err;
1803 }
1804 
1805 /*
1806  * We do this buffering because we must not call back into the file
1807  * system's ->lookup() method from the filldir callback. That may well
1808  * deadlock a number of file systems.
1809  *
1810  * This is based heavily on the implementation of same in XFS.
1811  */
1812 struct buffered_dirent {
1813 	u64		ino;
1814 	loff_t		offset;
1815 	int		namlen;
1816 	unsigned int	d_type;
1817 	char		name[];
1818 };
1819 
1820 struct readdir_data {
1821 	struct dir_context ctx;
1822 	char		*dirent;
1823 	size_t		used;
1824 	int		full;
1825 };
1826 
1827 static int nfsd_buffered_filldir(void *__buf, const char *name, int namlen,
1828 				 loff_t offset, u64 ino, unsigned int d_type)
1829 {
1830 	struct readdir_data *buf = __buf;
1831 	struct buffered_dirent *de = (void *)(buf->dirent + buf->used);
1832 	unsigned int reclen;
1833 
1834 	reclen = ALIGN(sizeof(struct buffered_dirent) + namlen, sizeof(u64));
1835 	if (buf->used + reclen > PAGE_SIZE) {
1836 		buf->full = 1;
1837 		return -EINVAL;
1838 	}
1839 
1840 	de->namlen = namlen;
1841 	de->offset = offset;
1842 	de->ino = ino;
1843 	de->d_type = d_type;
1844 	memcpy(de->name, name, namlen);
1845 	buf->used += reclen;
1846 
1847 	return 0;
1848 }
1849 
1850 static __be32 nfsd_buffered_readdir(struct file *file, filldir_t func,
1851 				    struct readdir_cd *cdp, loff_t *offsetp)
1852 {
1853 	struct buffered_dirent *de;
1854 	int host_err;
1855 	int size;
1856 	loff_t offset;
1857 	struct readdir_data buf = {
1858 		.ctx.actor = nfsd_buffered_filldir,
1859 		.dirent = (void *)__get_free_page(GFP_KERNEL)
1860 	};
1861 
1862 	if (!buf.dirent)
1863 		return nfserrno(-ENOMEM);
1864 
1865 	offset = *offsetp;
1866 
1867 	while (1) {
1868 		struct inode *dir_inode = file_inode(file);
1869 		unsigned int reclen;
1870 
1871 		cdp->err = nfserr_eof; /* will be cleared on successful read */
1872 		buf.used = 0;
1873 		buf.full = 0;
1874 
1875 		host_err = iterate_dir(file, &buf.ctx);
1876 		if (buf.full)
1877 			host_err = 0;
1878 
1879 		if (host_err < 0)
1880 			break;
1881 
1882 		size = buf.used;
1883 
1884 		if (!size)
1885 			break;
1886 
1887 		/*
1888 		 * Various filldir functions may end up calling back into
1889 		 * lookup_one_len() and the file system's ->lookup() method.
1890 		 * These expect i_mutex to be held, as it would within readdir.
1891 		 */
1892 		host_err = mutex_lock_killable(&dir_inode->i_mutex);
1893 		if (host_err)
1894 			break;
1895 
1896 		de = (struct buffered_dirent *)buf.dirent;
1897 		while (size > 0) {
1898 			offset = de->offset;
1899 
1900 			if (func(cdp, de->name, de->namlen, de->offset,
1901 				 de->ino, de->d_type))
1902 				break;
1903 
1904 			if (cdp->err != nfs_ok)
1905 				break;
1906 
1907 			reclen = ALIGN(sizeof(*de) + de->namlen,
1908 				       sizeof(u64));
1909 			size -= reclen;
1910 			de = (struct buffered_dirent *)((char *)de + reclen);
1911 		}
1912 		mutex_unlock(&dir_inode->i_mutex);
1913 		if (size > 0) /* We bailed out early */
1914 			break;
1915 
1916 		offset = vfs_llseek(file, 0, SEEK_CUR);
1917 	}
1918 
1919 	free_page((unsigned long)(buf.dirent));
1920 
1921 	if (host_err)
1922 		return nfserrno(host_err);
1923 
1924 	*offsetp = offset;
1925 	return cdp->err;
1926 }
1927 
1928 /*
1929  * Read entries from a directory.
1930  * The  NFSv3/4 verifier we ignore for now.
1931  */
1932 __be32
1933 nfsd_readdir(struct svc_rqst *rqstp, struct svc_fh *fhp, loff_t *offsetp,
1934 	     struct readdir_cd *cdp, filldir_t func)
1935 {
1936 	__be32		err;
1937 	struct file	*file;
1938 	loff_t		offset = *offsetp;
1939 	int             may_flags = NFSD_MAY_READ;
1940 
1941 	/* NFSv2 only supports 32 bit cookies */
1942 	if (rqstp->rq_vers > 2)
1943 		may_flags |= NFSD_MAY_64BIT_COOKIE;
1944 
1945 	err = nfsd_open(rqstp, fhp, S_IFDIR, may_flags, &file);
1946 	if (err)
1947 		goto out;
1948 
1949 	offset = vfs_llseek(file, offset, SEEK_SET);
1950 	if (offset < 0) {
1951 		err = nfserrno((int)offset);
1952 		goto out_close;
1953 	}
1954 
1955 	err = nfsd_buffered_readdir(file, func, cdp, offsetp);
1956 
1957 	if (err == nfserr_eof || err == nfserr_toosmall)
1958 		err = nfs_ok; /* can still be found in ->err */
1959 out_close:
1960 	nfsd_close(file);
1961 out:
1962 	return err;
1963 }
1964 
1965 /*
1966  * Get file system stats
1967  * N.B. After this call fhp needs an fh_put
1968  */
1969 __be32
1970 nfsd_statfs(struct svc_rqst *rqstp, struct svc_fh *fhp, struct kstatfs *stat, int access)
1971 {
1972 	__be32 err;
1973 
1974 	err = fh_verify(rqstp, fhp, 0, NFSD_MAY_NOP | access);
1975 	if (!err) {
1976 		struct path path = {
1977 			.mnt	= fhp->fh_export->ex_path.mnt,
1978 			.dentry	= fhp->fh_dentry,
1979 		};
1980 		if (vfs_statfs(&path, stat))
1981 			err = nfserr_io;
1982 	}
1983 	return err;
1984 }
1985 
1986 static int exp_rdonly(struct svc_rqst *rqstp, struct svc_export *exp)
1987 {
1988 	return nfsexp_flags(rqstp, exp) & NFSEXP_READONLY;
1989 }
1990 
1991 /*
1992  * Check for a user's access permissions to this inode.
1993  */
1994 __be32
1995 nfsd_permission(struct svc_rqst *rqstp, struct svc_export *exp,
1996 					struct dentry *dentry, int acc)
1997 {
1998 	struct inode	*inode = dentry->d_inode;
1999 	int		err;
2000 
2001 	if ((acc & NFSD_MAY_MASK) == NFSD_MAY_NOP)
2002 		return 0;
2003 #if 0
2004 	dprintk("nfsd: permission 0x%x%s%s%s%s%s%s%s mode 0%o%s%s%s\n",
2005 		acc,
2006 		(acc & NFSD_MAY_READ)?	" read"  : "",
2007 		(acc & NFSD_MAY_WRITE)?	" write" : "",
2008 		(acc & NFSD_MAY_EXEC)?	" exec"  : "",
2009 		(acc & NFSD_MAY_SATTR)?	" sattr" : "",
2010 		(acc & NFSD_MAY_TRUNC)?	" trunc" : "",
2011 		(acc & NFSD_MAY_LOCK)?	" lock"  : "",
2012 		(acc & NFSD_MAY_OWNER_OVERRIDE)? " owneroverride" : "",
2013 		inode->i_mode,
2014 		IS_IMMUTABLE(inode)?	" immut" : "",
2015 		IS_APPEND(inode)?	" append" : "",
2016 		__mnt_is_readonly(exp->ex_path.mnt)?	" ro" : "");
2017 	dprintk("      owner %d/%d user %d/%d\n",
2018 		inode->i_uid, inode->i_gid, current_fsuid(), current_fsgid());
2019 #endif
2020 
2021 	/* Normally we reject any write/sattr etc access on a read-only file
2022 	 * system.  But if it is IRIX doing check on write-access for a
2023 	 * device special file, we ignore rofs.
2024 	 */
2025 	if (!(acc & NFSD_MAY_LOCAL_ACCESS))
2026 		if (acc & (NFSD_MAY_WRITE | NFSD_MAY_SATTR | NFSD_MAY_TRUNC)) {
2027 			if (exp_rdonly(rqstp, exp) ||
2028 			    __mnt_is_readonly(exp->ex_path.mnt))
2029 				return nfserr_rofs;
2030 			if (/* (acc & NFSD_MAY_WRITE) && */ IS_IMMUTABLE(inode))
2031 				return nfserr_perm;
2032 		}
2033 	if ((acc & NFSD_MAY_TRUNC) && IS_APPEND(inode))
2034 		return nfserr_perm;
2035 
2036 	if (acc & NFSD_MAY_LOCK) {
2037 		/* If we cannot rely on authentication in NLM requests,
2038 		 * just allow locks, otherwise require read permission, or
2039 		 * ownership
2040 		 */
2041 		if (exp->ex_flags & NFSEXP_NOAUTHNLM)
2042 			return 0;
2043 		else
2044 			acc = NFSD_MAY_READ | NFSD_MAY_OWNER_OVERRIDE;
2045 	}
2046 	/*
2047 	 * The file owner always gets access permission for accesses that
2048 	 * would normally be checked at open time. This is to make
2049 	 * file access work even when the client has done a fchmod(fd, 0).
2050 	 *
2051 	 * However, `cp foo bar' should fail nevertheless when bar is
2052 	 * readonly. A sensible way to do this might be to reject all
2053 	 * attempts to truncate a read-only file, because a creat() call
2054 	 * always implies file truncation.
2055 	 * ... but this isn't really fair.  A process may reasonably call
2056 	 * ftruncate on an open file descriptor on a file with perm 000.
2057 	 * We must trust the client to do permission checking - using "ACCESS"
2058 	 * with NFSv3.
2059 	 */
2060 	if ((acc & NFSD_MAY_OWNER_OVERRIDE) &&
2061 	    uid_eq(inode->i_uid, current_fsuid()))
2062 		return 0;
2063 
2064 	/* This assumes  NFSD_MAY_{READ,WRITE,EXEC} == MAY_{READ,WRITE,EXEC} */
2065 	err = inode_permission(inode, acc & (MAY_READ|MAY_WRITE|MAY_EXEC));
2066 
2067 	/* Allow read access to binaries even when mode 111 */
2068 	if (err == -EACCES && S_ISREG(inode->i_mode) &&
2069 	     (acc == (NFSD_MAY_READ | NFSD_MAY_OWNER_OVERRIDE) ||
2070 	      acc == (NFSD_MAY_READ | NFSD_MAY_READ_IF_EXEC)))
2071 		err = inode_permission(inode, MAY_EXEC);
2072 
2073 	return err? nfserrno(err) : 0;
2074 }
2075 
2076 void
2077 nfsd_racache_shutdown(void)
2078 {
2079 	struct raparms *raparm, *last_raparm;
2080 	unsigned int i;
2081 
2082 	dprintk("nfsd: freeing readahead buffers.\n");
2083 
2084 	for (i = 0; i < RAPARM_HASH_SIZE; i++) {
2085 		raparm = raparm_hash[i].pb_head;
2086 		while(raparm) {
2087 			last_raparm = raparm;
2088 			raparm = raparm->p_next;
2089 			kfree(last_raparm);
2090 		}
2091 		raparm_hash[i].pb_head = NULL;
2092 	}
2093 }
2094 /*
2095  * Initialize readahead param cache
2096  */
2097 int
2098 nfsd_racache_init(int cache_size)
2099 {
2100 	int	i;
2101 	int	j = 0;
2102 	int	nperbucket;
2103 	struct raparms **raparm = NULL;
2104 
2105 
2106 	if (raparm_hash[0].pb_head)
2107 		return 0;
2108 	nperbucket = DIV_ROUND_UP(cache_size, RAPARM_HASH_SIZE);
2109 	if (nperbucket < 2)
2110 		nperbucket = 2;
2111 	cache_size = nperbucket * RAPARM_HASH_SIZE;
2112 
2113 	dprintk("nfsd: allocating %d readahead buffers.\n", cache_size);
2114 
2115 	for (i = 0; i < RAPARM_HASH_SIZE; i++) {
2116 		spin_lock_init(&raparm_hash[i].pb_lock);
2117 
2118 		raparm = &raparm_hash[i].pb_head;
2119 		for (j = 0; j < nperbucket; j++) {
2120 			*raparm = kzalloc(sizeof(struct raparms), GFP_KERNEL);
2121 			if (!*raparm)
2122 				goto out_nomem;
2123 			raparm = &(*raparm)->p_next;
2124 		}
2125 		*raparm = NULL;
2126 	}
2127 
2128 	nfsdstats.ra_size = cache_size;
2129 	return 0;
2130 
2131 out_nomem:
2132 	dprintk("nfsd: kmalloc failed, freeing readahead buffers\n");
2133 	nfsd_racache_shutdown();
2134 	return -ENOMEM;
2135 }
2136