1/*
   2 * File operations used by nfsd. Some of these have been ripped from
   3 * other parts of the kernel because they weren't exported, others
   4 * are partial duplicates with added or changed functionality.
   5 *
   6 * Note that several functions dget() the dentry upon which they want
   7 * to act, most notably those that create directory entries. Response
   8 * dentry's are dput()'d if necessary in the release callback.
   9 * So if you notice code paths that apparently fail to dput() the
  10 * dentry, don't worry--they have been taken care of.
  11 *
  12 * Copyright (C) 1995-1999 Olaf Kirch <okir@monad.swb.de>
  13 * Zerocpy NFS support (C) 2002 Hirokazu Takahashi <taka@valinux.co.jp>
  14 */
  15
  16#include <linux/fs.h>
  17#include <linux/file.h>
  18#include <linux/splice.h>
 
  19#include <linux/fcntl.h>
  20#include <linux/namei.h>
  21#include <linux/delay.h>
  22#include <linux/fsnotify.h>
  23#include <linux/posix_acl_xattr.h>
  24#include <linux/xattr.h>
  25#include <linux/jhash.h>
  26#include <linux/ima.h>
  27#include <linux/slab.h>
  28#include <asm/uaccess.h>
  29#include <linux/exportfs.h>
  30#include <linux/writeback.h>
  31#include <linux/security.h>
  32
  33#ifdef CONFIG_NFSD_V3
  34#include "xdr3.h"
  35#endif /* CONFIG_NFSD_V3 */
  36
  37#ifdef CONFIG_NFSD_V4
 
  38#include "acl.h"
  39#include "idmap.h"
  40#endif /* CONFIG_NFSD_V4 */
  41
  42#include "nfsd.h"
  43#include "vfs.h"
 
  44
  45#define NFSDDBG_FACILITY		NFSDDBG_FILEOP
  46
  47
  48/*
  49 * This is a cache of readahead params that help us choose the proper
  50 * readahead strategy. Initially, we set all readahead parameters to 0
  51 * and let the VFS handle things.
  52 * If you increase the number of cached files very much, you'll need to
  53 * add a hash table here.
  54 */
  55struct raparms {
  56	struct raparms		*p_next;
  57	unsigned int		p_count;
  58	ino_t			p_ino;
  59	dev_t			p_dev;
  60	int			p_set;
  61	struct file_ra_state	p_ra;
  62	unsigned int		p_hindex;
  63};
  64
  65struct raparm_hbucket {
  66	struct raparms		*pb_head;
  67	spinlock_t		pb_lock;
  68} ____cacheline_aligned_in_smp;
  69
  70#define RAPARM_HASH_BITS	4
  71#define RAPARM_HASH_SIZE	(1<<RAPARM_HASH_BITS)
  72#define RAPARM_HASH_MASK	(RAPARM_HASH_SIZE-1)
  73static struct raparm_hbucket	raparm_hash[RAPARM_HASH_SIZE];
  74
  75/* 
  76 * Called from nfsd_lookup and encode_dirent. Check if we have crossed 
  77 * a mount point.
  78 * Returns -EAGAIN or -ETIMEDOUT leaving *dpp and *expp unchanged,
  79 *  or nfs_ok having possibly changed *dpp and *expp
  80 */
  81int
  82nfsd_cross_mnt(struct svc_rqst *rqstp, struct dentry **dpp, 
  83		        struct svc_export **expp)
  84{
  85	struct svc_export *exp = *expp, *exp2 = NULL;
  86	struct dentry *dentry = *dpp;
  87	struct path path = {.mnt = mntget(exp->ex_path.mnt),
  88			    .dentry = dget(dentry)};
  89	int err = 0;
  90
  91	err = follow_down(&path);
  92	if (err < 0)
  93		goto out;
  94
  95	exp2 = rqst_exp_get_by_name(rqstp, &path);
  96	if (IS_ERR(exp2)) {
  97		err = PTR_ERR(exp2);
  98		/*
  99		 * We normally allow NFS clients to continue
 100		 * "underneath" a mountpoint that is not exported.
 101		 * The exception is V4ROOT, where no traversal is ever
 102		 * allowed without an explicit export of the new
 103		 * directory.
 104		 */
 105		if (err == -ENOENT && !(exp->ex_flags & NFSEXP_V4ROOT))
 106			err = 0;
 107		path_put(&path);
 108		goto out;
 109	}
 110	if (nfsd_v4client(rqstp) ||
 111		(exp->ex_flags & NFSEXP_CROSSMOUNT) || EX_NOHIDE(exp2)) {
 112		/* successfully crossed mount point */
 113		/*
 114		 * This is subtle: path.dentry is *not* on path.mnt
 115		 * at this point.  The only reason we are safe is that
 116		 * original mnt is pinned down by exp, so we should
 117		 * put path *before* putting exp
 118		 */
 119		*dpp = path.dentry;
 120		path.dentry = dentry;
 121		*expp = exp2;
 122		exp2 = exp;
 123	}
 124	path_put(&path);
 125	exp_put(exp2);
 126out:
 127	return err;
 128}
 129
 130static void follow_to_parent(struct path *path)
 131{
 132	struct dentry *dp;
 133
 134	while (path->dentry == path->mnt->mnt_root && follow_up(path))
 135		;
 136	dp = dget_parent(path->dentry);
 137	dput(path->dentry);
 138	path->dentry = dp;
 139}
 140
 141static int nfsd_lookup_parent(struct svc_rqst *rqstp, struct dentry *dparent, struct svc_export **exp, struct dentry **dentryp)
 142{
 143	struct svc_export *exp2;
 144	struct path path = {.mnt = mntget((*exp)->ex_path.mnt),
 145			    .dentry = dget(dparent)};
 146
 147	follow_to_parent(&path);
 148
 149	exp2 = rqst_exp_parent(rqstp, &path);
 150	if (PTR_ERR(exp2) == -ENOENT) {
 151		*dentryp = dget(dparent);
 152	} else if (IS_ERR(exp2)) {
 153		path_put(&path);
 154		return PTR_ERR(exp2);
 155	} else {
 156		*dentryp = dget(path.dentry);
 157		exp_put(*exp);
 158		*exp = exp2;
 159	}
 160	path_put(&path);
 161	return 0;
 162}
 163
 164/*
 165 * For nfsd purposes, we treat V4ROOT exports as though there was an
 166 * export at *every* directory.
 167 */
 168int nfsd_mountpoint(struct dentry *dentry, struct svc_export *exp)
 169{
 170	if (d_mountpoint(dentry))
 171		return 1;
 172	if (nfsd4_is_junction(dentry))
 173		return 1;
 174	if (!(exp->ex_flags & NFSEXP_V4ROOT))
 175		return 0;
 176	return dentry->d_inode != NULL;
 177}
 178
 179__be32
 180nfsd_lookup_dentry(struct svc_rqst *rqstp, struct svc_fh *fhp,
 181		   const char *name, unsigned int len,
 182		   struct svc_export **exp_ret, struct dentry **dentry_ret)
 183{
 184	struct svc_export	*exp;
 185	struct dentry		*dparent;
 186	struct dentry		*dentry;
 187	int			host_err;
 188
 189	dprintk("nfsd: nfsd_lookup(fh %s, %.*s)\n", SVCFH_fmt(fhp), len,name);
 190
 191	dparent = fhp->fh_dentry;
 192	exp  = fhp->fh_export;
 193	exp_get(exp);
 194
 195	/* Lookup the name, but don't follow links */
 196	if (isdotent(name, len)) {
 197		if (len==1)
 198			dentry = dget(dparent);
 199		else if (dparent != exp->ex_path.dentry)
 200			dentry = dget_parent(dparent);
 201		else if (!EX_NOHIDE(exp) && !nfsd_v4client(rqstp))
 202			dentry = dget(dparent); /* .. == . just like at / */
 203		else {
 204			/* checking mountpoint crossing is very different when stepping up */
 205			host_err = nfsd_lookup_parent(rqstp, dparent, &exp, &dentry);
 206			if (host_err)
 207				goto out_nfserr;
 208		}
 209	} else {
 210		/*
 211		 * In the nfsd4_open() case, this may be held across
 212		 * subsequent open and delegation acquisition which may
 213		 * need to take the child's i_mutex:
 214		 */
 215		fh_lock_nested(fhp, I_MUTEX_PARENT);
 216		dentry = lookup_one_len(name, dparent, len);
 217		host_err = PTR_ERR(dentry);
 218		if (IS_ERR(dentry))
 219			goto out_nfserr;
 220		/*
 221		 * check if we have crossed a mount point ...
 222		 */
 223		if (nfsd_mountpoint(dentry, exp)) {
 
 
 
 
 
 
 
 
 
 224			if ((host_err = nfsd_cross_mnt(rqstp, &dentry, &exp))) {
 225				dput(dentry);
 226				goto out_nfserr;
 227			}
 228		}
 229	}
 230	*dentry_ret = dentry;
 231	*exp_ret = exp;
 232	return 0;
 233
 234out_nfserr:
 235	exp_put(exp);
 236	return nfserrno(host_err);
 237}
 238
 239/*
 240 * Look up one component of a pathname.
 241 * N.B. After this call _both_ fhp and resfh need an fh_put
 242 *
 243 * If the lookup would cross a mountpoint, and the mounted filesystem
 244 * is exported to the client with NFSEXP_NOHIDE, then the lookup is
 245 * accepted as it stands and the mounted directory is
 246 * returned. Otherwise the covered directory is returned.
 247 * NOTE: this mountpoint crossing is not supported properly by all
 248 *   clients and is explicitly disallowed for NFSv3
 249 *      NeilBrown <neilb@cse.unsw.edu.au>
 250 */
 251__be32
 252nfsd_lookup(struct svc_rqst *rqstp, struct svc_fh *fhp, const char *name,
 253				unsigned int len, struct svc_fh *resfh)
 254{
 255	struct svc_export	*exp;
 256	struct dentry		*dentry;
 257	__be32 err;
 258
 259	err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_EXEC);
 260	if (err)
 261		return err;
 262	err = nfsd_lookup_dentry(rqstp, fhp, name, len, &exp, &dentry);
 263	if (err)
 264		return err;
 265	err = check_nfsd_access(exp, rqstp);
 266	if (err)
 267		goto out;
 268	/*
 269	 * Note: we compose the file handle now, but as the
 270	 * dentry may be negative, it may need to be updated.
 271	 */
 272	err = fh_compose(resfh, exp, dentry, fhp);
 273	if (!err && !dentry->d_inode)
 274		err = nfserr_noent;
 275out:
 276	dput(dentry);
 277	exp_put(exp);
 278	return err;
 279}
 280
 281/*
 282 * Commit metadata changes to stable storage.
 283 */
 284static int
 285commit_metadata(struct svc_fh *fhp)
 286{
 287	struct inode *inode = fhp->fh_dentry->d_inode;
 288	const struct export_operations *export_ops = inode->i_sb->s_export_op;
 289
 290	if (!EX_ISSYNC(fhp->fh_export))
 291		return 0;
 292
 293	if (export_ops->commit_metadata)
 294		return export_ops->commit_metadata(inode);
 295	return sync_inode_metadata(inode, 1);
 296}
 297
 298/*
 299 * Go over the attributes and take care of the small differences between
 300 * NFS semantics and what Linux expects.
 301 */
 302static void
 303nfsd_sanitize_attrs(struct inode *inode, struct iattr *iap)
 304{
 305	/*
 306	 * NFSv2 does not differentiate between "set-[ac]time-to-now"
 307	 * which only requires access, and "set-[ac]time-to-X" which
 308	 * requires ownership.
 309	 * So if it looks like it might be "set both to the same time which
 310	 * is close to now", and if inode_change_ok fails, then we
 311	 * convert to "set to now" instead of "set to explicit time"
 312	 *
 313	 * We only call inode_change_ok as the last test as technically
 314	 * it is not an interface that we should be using.
 315	 */
 316#define BOTH_TIME_SET (ATTR_ATIME_SET | ATTR_MTIME_SET)
 317#define	MAX_TOUCH_TIME_ERROR (30*60)
 318	if ((iap->ia_valid & BOTH_TIME_SET) == BOTH_TIME_SET &&
 319	    iap->ia_mtime.tv_sec == iap->ia_atime.tv_sec) {
 320		/*
 321		 * Looks probable.
 322		 *
 323		 * Now just make sure time is in the right ballpark.
 324		 * Solaris, at least, doesn't seem to care what the time
 325		 * request is.  We require it be within 30 minutes of now.
 326		 */
 327		time_t delta = iap->ia_atime.tv_sec - get_seconds();
 328		if (delta < 0)
 329			delta = -delta;
 330		if (delta < MAX_TOUCH_TIME_ERROR &&
 331		    inode_change_ok(inode, iap) != 0) {
 332			/*
 333			 * Turn off ATTR_[AM]TIME_SET but leave ATTR_[AM]TIME.
 334			 * This will cause notify_change to set these times
 335			 * to "now"
 336			 */
 337			iap->ia_valid &= ~BOTH_TIME_SET;
 338		}
 339	}
 340
 341	/* sanitize the mode change */
 342	if (iap->ia_valid & ATTR_MODE) {
 343		iap->ia_mode &= S_IALLUGO;
 344		iap->ia_mode |= (inode->i_mode & ~S_IALLUGO);
 345	}
 346
 347	/* Revoke setuid/setgid on chown */
 348	if (!S_ISDIR(inode->i_mode) &&
 349	    ((iap->ia_valid & ATTR_UID) || (iap->ia_valid & ATTR_GID))) {
 350		iap->ia_valid |= ATTR_KILL_PRIV;
 351		if (iap->ia_valid & ATTR_MODE) {
 352			/* we're setting mode too, just clear the s*id bits */
 353			iap->ia_mode &= ~S_ISUID;
 354			if (iap->ia_mode & S_IXGRP)
 355				iap->ia_mode &= ~S_ISGID;
 356		} else {
 357			/* set ATTR_KILL_* bits and let VFS handle it */
 358			iap->ia_valid |= (ATTR_KILL_SUID | ATTR_KILL_SGID);
 359		}
 360	}
 361}
 362
 363static __be32
 364nfsd_get_write_access(struct svc_rqst *rqstp, struct svc_fh *fhp,
 365		struct iattr *iap)
 366{
 367	struct inode *inode = fhp->fh_dentry->d_inode;
 368	int host_err;
 369
 370	if (iap->ia_size < inode->i_size) {
 371		__be32 err;
 372
 373		err = nfsd_permission(rqstp, fhp->fh_export, fhp->fh_dentry,
 374				NFSD_MAY_TRUNC | NFSD_MAY_OWNER_OVERRIDE);
 375		if (err)
 376			return err;
 377	}
 378
 379	host_err = get_write_access(inode);
 380	if (host_err)
 381		goto out_nfserrno;
 382
 383	host_err = locks_verify_truncate(inode, NULL, iap->ia_size);
 384	if (host_err)
 385		goto out_put_write_access;
 386	return 0;
 387
 388out_put_write_access:
 389	put_write_access(inode);
 390out_nfserrno:
 391	return nfserrno(host_err);
 392}
 393
 394/*
 395 * Set various file attributes.  After this call fhp needs an fh_put.
 396 */
 397__be32
 398nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
 399	     int check_guard, time_t guardtime)
 400{
 401	struct dentry	*dentry;
 402	struct inode	*inode;
 403	int		accmode = NFSD_MAY_SATTR;
 404	umode_t		ftype = 0;
 405	__be32		err;
 406	int		host_err;
 407	bool		get_write_count;
 408	int		size_change = 0;
 409
 410	if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE))
 411		accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE;
 412	if (iap->ia_valid & ATTR_SIZE)
 413		ftype = S_IFREG;
 414
 415	/* Callers that do fh_verify should do the fh_want_write: */
 416	get_write_count = !fhp->fh_dentry;
 417
 418	/* Get inode */
 419	err = fh_verify(rqstp, fhp, ftype, accmode);
 420	if (err)
 421		goto out;
 422	if (get_write_count) {
 423		host_err = fh_want_write(fhp);
 424		if (host_err)
 425			return nfserrno(host_err);
 426	}
 427
 428	dentry = fhp->fh_dentry;
 429	inode = dentry->d_inode;
 430
 431	/* Ignore any mode updates on symlinks */
 432	if (S_ISLNK(inode->i_mode))
 433		iap->ia_valid &= ~ATTR_MODE;
 434
 435	if (!iap->ia_valid)
 436		goto out;
 437
 438	nfsd_sanitize_attrs(inode, iap);
 439
 440	/*
 441	 * The size case is special, it changes the file in addition to the
 442	 * attributes.
 443	 */
 444	if (iap->ia_valid & ATTR_SIZE) {
 445		err = nfsd_get_write_access(rqstp, fhp, iap);
 446		if (err)
 447			goto out;
 448		size_change = 1;
 
 
 
 
 
 
 
 
 
 
 449	}
 450
 451	iap->ia_valid |= ATTR_CTIME;
 452
 453	if (check_guard && guardtime != inode->i_ctime.tv_sec) {
 454		err = nfserr_notsync;
 455		goto out_put_write_access;
 456	}
 457
 458	fh_lock(fhp);
 459	host_err = notify_change(dentry, iap, NULL);
 460	fh_unlock(fhp);
 461	err = nfserrno(host_err);
 462
 463out_put_write_access:
 464	if (size_change)
 465		put_write_access(inode);
 466	if (!err)
 467		commit_metadata(fhp);
 468out:
 469	return err;
 470}
 471
 472#if defined(CONFIG_NFSD_V4)
 473/*
 474 * NFS junction information is stored in an extended attribute.
 475 */
 476#define NFSD_JUNCTION_XATTR_NAME	XATTR_TRUSTED_PREFIX "junction.nfs"
 477
 478/**
 479 * nfsd4_is_junction - Test if an object could be an NFS junction
 480 *
 481 * @dentry: object to test
 482 *
 483 * Returns 1 if "dentry" appears to contain NFS junction information.
 484 * Otherwise 0 is returned.
 485 */
 486int nfsd4_is_junction(struct dentry *dentry)
 487{
 488	struct inode *inode = dentry->d_inode;
 489
 490	if (inode == NULL)
 491		return 0;
 492	if (inode->i_mode & S_IXUGO)
 493		return 0;
 494	if (!(inode->i_mode & S_ISVTX))
 495		return 0;
 496	if (vfs_getxattr(dentry, NFSD_JUNCTION_XATTR_NAME, NULL, 0) <= 0)
 497		return 0;
 498	return 1;
 499}
 500#ifdef CONFIG_NFSD_V4_SECURITY_LABEL
 501__be32 nfsd4_set_nfs4_label(struct svc_rqst *rqstp, struct svc_fh *fhp,
 502		struct xdr_netobj *label)
 503{
 504	__be32 error;
 505	int host_error;
 506	struct dentry *dentry;
 507
 508	error = fh_verify(rqstp, fhp, 0 /* S_IFREG */, NFSD_MAY_SATTR);
 509	if (error)
 510		return error;
 511
 512	dentry = fhp->fh_dentry;
 513
 514	mutex_lock(&dentry->d_inode->i_mutex);
 515	host_error = security_inode_setsecctx(dentry, label->data, label->len);
 516	mutex_unlock(&dentry->d_inode->i_mutex);
 517	return nfserrno(host_error);
 518}
 519#else
 520__be32 nfsd4_set_nfs4_label(struct svc_rqst *rqstp, struct svc_fh *fhp,
 521		struct xdr_netobj *label)
 522{
 523	return nfserr_notsupp;
 524}
 525#endif
 526
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 527#endif /* defined(CONFIG_NFSD_V4) */
 528
 529#ifdef CONFIG_NFSD_V3
 530/*
 531 * Check server access rights to a file system object
 532 */
 533struct accessmap {
 534	u32		access;
 535	int		how;
 536};
 537static struct accessmap	nfs3_regaccess[] = {
 538    {	NFS3_ACCESS_READ,	NFSD_MAY_READ			},
 539    {	NFS3_ACCESS_EXECUTE,	NFSD_MAY_EXEC			},
 540    {	NFS3_ACCESS_MODIFY,	NFSD_MAY_WRITE|NFSD_MAY_TRUNC	},
 541    {	NFS3_ACCESS_EXTEND,	NFSD_MAY_WRITE			},
 542
 543    {	0,			0				}
 544};
 545
 546static struct accessmap	nfs3_diraccess[] = {
 547    {	NFS3_ACCESS_READ,	NFSD_MAY_READ			},
 548    {	NFS3_ACCESS_LOOKUP,	NFSD_MAY_EXEC			},
 549    {	NFS3_ACCESS_MODIFY,	NFSD_MAY_EXEC|NFSD_MAY_WRITE|NFSD_MAY_TRUNC},
 550    {	NFS3_ACCESS_EXTEND,	NFSD_MAY_EXEC|NFSD_MAY_WRITE	},
 551    {	NFS3_ACCESS_DELETE,	NFSD_MAY_REMOVE			},
 552
 553    {	0,			0				}
 554};
 555
 556static struct accessmap	nfs3_anyaccess[] = {
 557	/* Some clients - Solaris 2.6 at least, make an access call
 558	 * to the server to check for access for things like /dev/null
 559	 * (which really, the server doesn't care about).  So
 560	 * We provide simple access checking for them, looking
 561	 * mainly at mode bits, and we make sure to ignore read-only
 562	 * filesystem checks
 563	 */
 564    {	NFS3_ACCESS_READ,	NFSD_MAY_READ			},
 565    {	NFS3_ACCESS_EXECUTE,	NFSD_MAY_EXEC			},
 566    {	NFS3_ACCESS_MODIFY,	NFSD_MAY_WRITE|NFSD_MAY_LOCAL_ACCESS	},
 567    {	NFS3_ACCESS_EXTEND,	NFSD_MAY_WRITE|NFSD_MAY_LOCAL_ACCESS	},
 568
 569    {	0,			0				}
 570};
 571
 572__be32
 573nfsd_access(struct svc_rqst *rqstp, struct svc_fh *fhp, u32 *access, u32 *supported)
 574{
 575	struct accessmap	*map;
 576	struct svc_export	*export;
 577	struct dentry		*dentry;
 578	u32			query, result = 0, sresult = 0;
 579	__be32			error;
 580
 581	error = fh_verify(rqstp, fhp, 0, NFSD_MAY_NOP);
 582	if (error)
 583		goto out;
 584
 585	export = fhp->fh_export;
 586	dentry = fhp->fh_dentry;
 587
 588	if (S_ISREG(dentry->d_inode->i_mode))
 589		map = nfs3_regaccess;
 590	else if (S_ISDIR(dentry->d_inode->i_mode))
 591		map = nfs3_diraccess;
 592	else
 593		map = nfs3_anyaccess;
 594
 595
 596	query = *access;
 597	for  (; map->access; map++) {
 598		if (map->access & query) {
 599			__be32 err2;
 600
 601			sresult |= map->access;
 602
 603			err2 = nfsd_permission(rqstp, export, dentry, map->how);
 604			switch (err2) {
 605			case nfs_ok:
 606				result |= map->access;
 607				break;
 608				
 609			/* the following error codes just mean the access was not allowed,
 610			 * rather than an error occurred */
 611			case nfserr_rofs:
 612			case nfserr_acces:
 613			case nfserr_perm:
 614				/* simply don't "or" in the access bit. */
 615				break;
 616			default:
 617				error = err2;
 618				goto out;
 619			}
 620		}
 621	}
 622	*access = result;
 623	if (supported)
 624		*supported = sresult;
 625
 626 out:
 627	return error;
 628}
 629#endif /* CONFIG_NFSD_V3 */
 630
 631static int nfsd_open_break_lease(struct inode *inode, int access)
 632{
 633	unsigned int mode;
 634
 635	if (access & NFSD_MAY_NOT_BREAK_LEASE)
 636		return 0;
 637	mode = (access & NFSD_MAY_WRITE) ? O_WRONLY : O_RDONLY;
 638	return break_lease(inode, mode | O_NONBLOCK);
 639}
 640
 641/*
 642 * Open an existing file or directory.
 643 * The may_flags argument indicates the type of open (read/write/lock)
 644 * and additional flags.
 645 * N.B. After this call fhp needs an fh_put
 646 */
 647__be32
 648nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, umode_t type,
 649			int may_flags, struct file **filp)
 650{
 651	struct path	path;
 652	struct inode	*inode;
 
 653	int		flags = O_RDONLY|O_LARGEFILE;
 654	__be32		err;
 655	int		host_err = 0;
 656
 657	validate_process_creds();
 658
 659	/*
 660	 * If we get here, then the client has already done an "open",
 661	 * and (hopefully) checked permission - so allow OWNER_OVERRIDE
 662	 * in case a chmod has now revoked permission.
 663	 *
 664	 * Arguably we should also allow the owner override for
 665	 * directories, but we never have and it doesn't seem to have
 666	 * caused anyone a problem.  If we were to change this, note
 667	 * also that our filldir callbacks would need a variant of
 668	 * lookup_one_len that doesn't check permissions.
 669	 */
 670	if (type == S_IFREG)
 671		may_flags |= NFSD_MAY_OWNER_OVERRIDE;
 672	err = fh_verify(rqstp, fhp, type, may_flags);
 673	if (err)
 674		goto out;
 675
 676	path.mnt = fhp->fh_export->ex_path.mnt;
 677	path.dentry = fhp->fh_dentry;
 678	inode = path.dentry->d_inode;
 679
 680	/* Disallow write access to files with the append-only bit set
 681	 * or any access when mandatory locking enabled
 682	 */
 683	err = nfserr_perm;
 684	if (IS_APPEND(inode) && (may_flags & NFSD_MAY_WRITE))
 685		goto out;
 686	/*
 687	 * We must ignore files (but only files) which might have mandatory
 688	 * locks on them because there is no way to know if the accesser has
 689	 * the lock.
 690	 */
 691	if (S_ISREG((inode)->i_mode) && mandatory_lock(inode))
 692		goto out;
 693
 694	if (!inode->i_fop)
 695		goto out;
 696
 697	host_err = nfsd_open_break_lease(inode, may_flags);
 698	if (host_err) /* NOMEM or WOULDBLOCK */
 699		goto out_nfserr;
 700
 701	if (may_flags & NFSD_MAY_WRITE) {
 702		if (may_flags & NFSD_MAY_READ)
 703			flags = O_RDWR|O_LARGEFILE;
 704		else
 705			flags = O_WRONLY|O_LARGEFILE;
 706	}
 707	*filp = dentry_open(&path, flags, current_cred());
 708	if (IS_ERR(*filp)) {
 709		host_err = PTR_ERR(*filp);
 710		*filp = NULL;
 711	} else {
 712		host_err = ima_file_check(*filp, may_flags);
 713
 714		if (may_flags & NFSD_MAY_64BIT_COOKIE)
 715			(*filp)->f_mode |= FMODE_64BITHASH;
 716		else
 717			(*filp)->f_mode |= FMODE_32BITHASH;
 718	}
 719
 
 
 
 
 
 
 
 
 
 
 
 
 720out_nfserr:
 721	err = nfserrno(host_err);
 722out:
 723	validate_process_creds();
 724	return err;
 725}
 726
 727/*
 728 * Close a file.
 729 */
 730void
 731nfsd_close(struct file *filp)
 732{
 733	fput(filp);
 734}
 735
 736/*
 737 * Obtain the readahead parameters for the file
 738 * specified by (dev, ino).
 739 */
 740
 741static inline struct raparms *
 742nfsd_get_raparms(dev_t dev, ino_t ino)
 743{
 
 
 
 744	struct raparms	*ra, **rap, **frap = NULL;
 745	int depth = 0;
 746	unsigned int hash;
 747	struct raparm_hbucket *rab;
 748
 749	hash = jhash_2words(dev, ino, 0xfeedbeef) & RAPARM_HASH_MASK;
 750	rab = &raparm_hash[hash];
 751
 752	spin_lock(&rab->pb_lock);
 753	for (rap = &rab->pb_head; (ra = *rap); rap = &ra->p_next) {
 754		if (ra->p_ino == ino && ra->p_dev == dev)
 755			goto found;
 756		depth++;
 757		if (ra->p_count == 0)
 758			frap = rap;
 759	}
 760	depth = nfsdstats.ra_size;
 761	if (!frap) {	
 762		spin_unlock(&rab->pb_lock);
 763		return NULL;
 764	}
 765	rap = frap;
 766	ra = *frap;
 767	ra->p_dev = dev;
 768	ra->p_ino = ino;
 769	ra->p_set = 0;
 770	ra->p_hindex = hash;
 771found:
 772	if (rap != &rab->pb_head) {
 773		*rap = ra->p_next;
 774		ra->p_next   = rab->pb_head;
 775		rab->pb_head = ra;
 776	}
 777	ra->p_count++;
 778	nfsdstats.ra_depth[depth*10/nfsdstats.ra_size]++;
 779	spin_unlock(&rab->pb_lock);
 
 
 
 780	return ra;
 781}
 782
 
 
 
 
 
 
 
 
 
 
 
 783/*
 784 * Grab and keep cached pages associated with a file in the svc_rqst
 785 * so that they can be passed to the network sendmsg/sendpage routines
 786 * directly. They will be released after the sending has completed.
 787 */
 788static int
 789nfsd_splice_actor(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
 790		  struct splice_desc *sd)
 791{
 792	struct svc_rqst *rqstp = sd->u.data;
 793	struct page **pp = rqstp->rq_next_page;
 794	struct page *page = buf->page;
 795	size_t size;
 796
 797	size = sd->len;
 798
 799	if (rqstp->rq_res.page_len == 0) {
 800		get_page(page);
 801		put_page(*rqstp->rq_next_page);
 802		*(rqstp->rq_next_page++) = page;
 803		rqstp->rq_res.page_base = buf->offset;
 804		rqstp->rq_res.page_len = size;
 805	} else if (page != pp[-1]) {
 806		get_page(page);
 807		if (*rqstp->rq_next_page)
 808			put_page(*rqstp->rq_next_page);
 809		*(rqstp->rq_next_page++) = page;
 810		rqstp->rq_res.page_len += size;
 811	} else
 812		rqstp->rq_res.page_len += size;
 813
 814	return size;
 815}
 816
 817static int nfsd_direct_splice_actor(struct pipe_inode_info *pipe,
 818				    struct splice_desc *sd)
 819{
 820	return __splice_from_pipe(pipe, sd, nfsd_splice_actor);
 821}
 822
 823static __be32
 824nfsd_vfs_read(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
 825              loff_t offset, struct kvec *vec, int vlen, unsigned long *count)
 826{
 827	mm_segment_t	oldfs;
 828	__be32		err;
 829	int		host_err;
 830
 831	err = nfserr_perm;
 832
 833	if (file->f_op->splice_read && rqstp->rq_splice_ok) {
 834		struct splice_desc sd = {
 835			.len		= 0,
 836			.total_len	= *count,
 837			.pos		= offset,
 838			.u.data		= rqstp,
 839		};
 840
 841		rqstp->rq_next_page = rqstp->rq_respages + 1;
 842		host_err = splice_direct_to_actor(file, &sd, nfsd_direct_splice_actor);
 843	} else {
 844		oldfs = get_fs();
 845		set_fs(KERNEL_DS);
 846		host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
 847		set_fs(oldfs);
 848	}
 849
 850	if (host_err >= 0) {
 851		nfsdstats.io_read += host_err;
 852		*count = host_err;
 853		err = 0;
 854		fsnotify_access(file);
 
 855	} else 
 856		err = nfserrno(host_err);
 857	return err;
 858}
 859
 860static void kill_suid(struct dentry *dentry)
 
 861{
 862	struct iattr	ia;
 863	ia.ia_valid = ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_KILL_PRIV;
 
 
 
 
 
 864
 865	mutex_lock(&dentry->d_inode->i_mutex);
 866	/*
 867	 * Note we call this on write, so notify_change will not
 868	 * encounter any conflicting delegations:
 869	 */
 870	notify_change(dentry, &ia, NULL);
 871	mutex_unlock(&dentry->d_inode->i_mutex);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 872}
 873
 874/*
 875 * Gathered writes: If another process is currently writing to the file,
 876 * there's a high chance this is another nfsd (triggered by a bulk write
 877 * from a client's biod). Rather than syncing the file with each write
 878 * request, we sleep for 10 msec.
 879 *
 880 * I don't know if this roughly approximates C. Juszak's idea of
 881 * gathered writes, but it's a nice and simple solution (IMHO), and it
 882 * seems to work:-)
 883 *
 884 * Note: we do this only in the NFSv2 case, since v3 and higher have a
 885 * better tool (separate unstable writes and commits) for solving this
 886 * problem.
 887 */
 888static int wait_for_concurrent_writes(struct file *file)
 889{
 890	struct inode *inode = file_inode(file);
 891	static ino_t last_ino;
 892	static dev_t last_dev;
 893	int err = 0;
 894
 895	if (atomic_read(&inode->i_writecount) > 1
 896	    || (last_ino == inode->i_ino && last_dev == inode->i_sb->s_dev)) {
 897		dprintk("nfsd: write defer %d\n", task_pid_nr(current));
 898		msleep(10);
 899		dprintk("nfsd: write resume %d\n", task_pid_nr(current));
 900	}
 901
 902	if (inode->i_state & I_DIRTY) {
 903		dprintk("nfsd: write sync %d\n", task_pid_nr(current));
 904		err = vfs_fsync(file, 0);
 905	}
 906	last_ino = inode->i_ino;
 907	last_dev = inode->i_sb->s_dev;
 908	return err;
 909}
 910
 911static __be32
 912nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
 913				loff_t offset, struct kvec *vec, int vlen,
 914				unsigned long *cnt, int *stablep)
 915{
 916	struct svc_export	*exp;
 917	struct dentry		*dentry;
 918	struct inode		*inode;
 919	mm_segment_t		oldfs;
 920	__be32			err = 0;
 921	int			host_err;
 922	int			stable = *stablep;
 923	int			use_wgather;
 924	loff_t			pos = offset;
 
 
 
 
 
 
 
 
 
 
 
 925
 926	dentry = file->f_path.dentry;
 927	inode = dentry->d_inode;
 928	exp   = fhp->fh_export;
 929
 930	use_wgather = (rqstp->rq_vers == 2) && EX_WGATHER(exp);
 931
 932	if (!EX_ISSYNC(exp))
 933		stable = 0;
 934
 935	/* Write the data. */
 936	oldfs = get_fs(); set_fs(KERNEL_DS);
 937	host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &pos);
 938	set_fs(oldfs);
 939	if (host_err < 0)
 940		goto out_nfserr;
 941	*cnt = host_err;
 942	nfsdstats.io_write += host_err;
 943	fsnotify_modify(file);
 944
 945	/* clear setuid/setgid flag after write */
 946	if (inode->i_mode & (S_ISUID | S_ISGID))
 947		kill_suid(dentry);
 948
 949	if (stable) {
 950		if (use_wgather)
 951			host_err = wait_for_concurrent_writes(file);
 952		else
 953			host_err = vfs_fsync_range(file, offset, offset+*cnt, 0);
 
 
 
 954	}
 955
 956out_nfserr:
 957	dprintk("nfsd: write complete host_err=%d\n", host_err);
 958	if (host_err >= 0)
 959		err = 0;
 960	else
 961		err = nfserrno(host_err);
 
 
 962	return err;
 963}
 964
 965/*
 966 * Read data from a file. count must contain the requested read count
 967 * on entry. On return, *count contains the number of bytes actually read.
 968 * N.B. After this call fhp needs an fh_put
 969 */
 970__be32 nfsd_read(struct svc_rqst *rqstp, struct svc_fh *fhp,
 971	loff_t offset, struct kvec *vec, int vlen, unsigned long *count)
 972{
 973	struct file *file;
 974	struct inode *inode;
 975	struct raparms	*ra;
 976	__be32 err;
 977
 
 978	err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
 979	if (err)
 980		return err;
 981
 982	inode = file_inode(file);
 983
 984	/* Get readahead parameters */
 985	ra = nfsd_get_raparms(inode->i_sb->s_dev, inode->i_ino);
 986
 987	if (ra && ra->p_set)
 988		file->f_ra = ra->p_ra;
 989
 990	err = nfsd_vfs_read(rqstp, fhp, file, offset, vec, vlen, count);
 991
 992	/* Write back readahead params */
 993	if (ra) {
 994		struct raparm_hbucket *rab = &raparm_hash[ra->p_hindex];
 995		spin_lock(&rab->pb_lock);
 996		ra->p_ra = file->f_ra;
 997		ra->p_set = 1;
 998		ra->p_count--;
 999		spin_unlock(&rab->pb_lock);
1000	}
1001
1002	nfsd_close(file);
1003	return err;
1004}
1005
1006/* As above, but use the provided file descriptor. */
1007__be32
1008nfsd_read_file(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
1009		loff_t offset, struct kvec *vec, int vlen,
1010		unsigned long *count)
1011{
1012	__be32		err;
1013
1014	if (file) {
1015		err = nfsd_permission(rqstp, fhp->fh_export, fhp->fh_dentry,
1016				NFSD_MAY_READ|NFSD_MAY_OWNER_OVERRIDE);
1017		if (err)
1018			goto out;
1019		err = nfsd_vfs_read(rqstp, fhp, file, offset, vec, vlen, count);
1020	} else /* Note file may still be NULL in NFSv4 special stateid case: */
1021		err = nfsd_read(rqstp, fhp, offset, vec, vlen, count);
1022out:
1023	return err;
1024}
1025
1026/*
1027 * Write data to a file.
1028 * The stable flag requests synchronous writes.
1029 * N.B. After this call fhp needs an fh_put
1030 */
1031__be32
1032nfsd_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
1033		loff_t offset, struct kvec *vec, int vlen, unsigned long *cnt,
1034		int *stablep)
1035{
1036	__be32			err = 0;
1037
 
 
1038	if (file) {
1039		err = nfsd_permission(rqstp, fhp->fh_export, fhp->fh_dentry,
1040				NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE);
1041		if (err)
1042			goto out;
 
1043		err = nfsd_vfs_write(rqstp, fhp, file, offset, vec, vlen, cnt,
1044				stablep);
 
1045	} else {
1046		err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_WRITE, &file);
1047		if (err)
1048			goto out;
1049
 
1050		if (cnt)
1051			err = nfsd_vfs_write(rqstp, fhp, file, offset, vec, vlen,
1052					     cnt, stablep);
1053		nfsd_close(file);
 
1054	}
1055out:
 
1056	return err;
1057}
1058
1059#ifdef CONFIG_NFSD_V3
1060/*
1061 * Commit all pending writes to stable storage.
1062 *
1063 * Note: we only guarantee that data that lies within the range specified
1064 * by the 'offset' and 'count' parameters will be synced.
1065 *
1066 * Unfortunately we cannot lock the file to make sure we return full WCC
1067 * data to the client, as locking happens lower down in the filesystem.
1068 */
1069__be32
1070nfsd_commit(struct svc_rqst *rqstp, struct svc_fh *fhp,
1071               loff_t offset, unsigned long count)
1072{
1073	struct file	*file;
1074	loff_t		end = LLONG_MAX;
1075	__be32		err = nfserr_inval;
1076
1077	if (offset < 0)
1078		goto out;
1079	if (count != 0) {
1080		end = offset + (loff_t)count - 1;
1081		if (end < offset)
1082			goto out;
1083	}
1084
1085	err = nfsd_open(rqstp, fhp, S_IFREG,
1086			NFSD_MAY_WRITE|NFSD_MAY_NOT_BREAK_LEASE, &file);
1087	if (err)
1088		goto out;
1089	if (EX_ISSYNC(fhp->fh_export)) {
1090		int err2 = vfs_fsync_range(file, offset, end, 0);
1091
1092		if (err2 != -EINVAL)
1093			err = nfserrno(err2);
1094		else
1095			err = nfserr_notsupp;
1096	}
1097
1098	nfsd_close(file);
1099out:
1100	return err;
1101}
1102#endif /* CONFIG_NFSD_V3 */
1103
1104static __be32
1105nfsd_create_setattr(struct svc_rqst *rqstp, struct svc_fh *resfhp,
1106			struct iattr *iap)
1107{
1108	/*
1109	 * Mode has already been set earlier in create:
1110	 */
1111	iap->ia_valid &= ~ATTR_MODE;
1112	/*
1113	 * Setting uid/gid works only for root.  Irix appears to
1114	 * send along the gid on create when it tries to implement
1115	 * setgid directories via NFS:
1116	 */
1117	if (!uid_eq(current_fsuid(), GLOBAL_ROOT_UID))
1118		iap->ia_valid &= ~(ATTR_UID|ATTR_GID);
1119	if (iap->ia_valid)
1120		return nfsd_setattr(rqstp, resfhp, iap, 0, (time_t)0);
1121	return 0;
 
1122}
1123
1124/* HPUX client sometimes creates a file in mode 000, and sets size to 0.
1125 * setting size to 0 may fail for some specific file systems by the permission
1126 * checking which requires WRITE permission but the mode is 000.
1127 * we ignore the resizing(to 0) on the just new created file, since the size is
1128 * 0 after file created.
1129 *
1130 * call this only after vfs_create() is called.
1131 * */
1132static void
1133nfsd_check_ignore_resizing(struct iattr *iap)
1134{
1135	if ((iap->ia_valid & ATTR_SIZE) && (iap->ia_size == 0))
1136		iap->ia_valid &= ~ATTR_SIZE;
1137}
1138
1139/*
1140 * Create a file (regular, directory, device, fifo); UNIX sockets 
1141 * not yet implemented.
1142 * If the response fh has been verified, the parent directory should
1143 * already be locked. Note that the parent directory is left locked.
1144 *
1145 * N.B. Every call to nfsd_create needs an fh_put for _both_ fhp and resfhp
1146 */
1147__be32
1148nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
1149		char *fname, int flen, struct iattr *iap,
1150		int type, dev_t rdev, struct svc_fh *resfhp)
1151{
1152	struct dentry	*dentry, *dchild = NULL;
1153	struct inode	*dirp;
1154	__be32		err;
1155	__be32		err2;
1156	int		host_err;
1157
1158	err = nfserr_perm;
1159	if (!flen)
1160		goto out;
1161	err = nfserr_exist;
1162	if (isdotent(fname, flen))
1163		goto out;
1164
1165	err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
1166	if (err)
1167		goto out;
1168
1169	dentry = fhp->fh_dentry;
1170	dirp = dentry->d_inode;
1171
1172	err = nfserr_notdir;
1173	if (!dirp->i_op->lookup)
1174		goto out;
1175	/*
1176	 * Check whether the response file handle has been verified yet.
1177	 * If it has, the parent directory should already be locked.
1178	 */
1179	if (!resfhp->fh_dentry) {
1180		host_err = fh_want_write(fhp);
1181		if (host_err)
1182			goto out_nfserr;
1183
1184		/* called from nfsd_proc_mkdir, or possibly nfsd3_proc_create */
1185		fh_lock_nested(fhp, I_MUTEX_PARENT);
1186		dchild = lookup_one_len(fname, dentry, flen);
1187		host_err = PTR_ERR(dchild);
1188		if (IS_ERR(dchild))
1189			goto out_nfserr;
1190		err = fh_compose(resfhp, fhp->fh_export, dchild, fhp);
1191		if (err)
1192			goto out;
1193	} else {
1194		/* called from nfsd_proc_create */
1195		dchild = dget(resfhp->fh_dentry);
1196		if (!fhp->fh_locked) {
1197			/* not actually possible */
1198			printk(KERN_ERR
1199				"nfsd_create: parent %pd2 not locked!\n",
1200				dentry);
1201			err = nfserr_io;
1202			goto out;
1203		}
1204	}
1205	/*
1206	 * Make sure the child dentry is still negative ...
1207	 */
1208	err = nfserr_exist;
1209	if (dchild->d_inode) {
1210		dprintk("nfsd_create: dentry %pd/%pd not negative!\n",
1211			dentry, dchild);
1212		goto out; 
1213	}
1214
1215	if (!(iap->ia_valid & ATTR_MODE))
1216		iap->ia_mode = 0;
1217	iap->ia_mode = (iap->ia_mode & S_IALLUGO) | type;
1218
1219	err = nfserr_inval;
1220	if (!S_ISREG(type) && !S_ISDIR(type) && !special_file(type)) {
1221		printk(KERN_WARNING "nfsd: bad file type %o in nfsd_create\n",
1222		       type);
1223		goto out;
1224	}
1225
1226	/*
1227	 * Get the dir op function pointer.
1228	 */
1229	err = 0;
1230	host_err = 0;
1231	switch (type) {
1232	case S_IFREG:
1233		host_err = vfs_create(dirp, dchild, iap->ia_mode, true);
1234		if (!host_err)
1235			nfsd_check_ignore_resizing(iap);
1236		break;
1237	case S_IFDIR:
1238		host_err = vfs_mkdir(dirp, dchild, iap->ia_mode);
1239		break;
1240	case S_IFCHR:
1241	case S_IFBLK:
1242	case S_IFIFO:
1243	case S_IFSOCK:
1244		host_err = vfs_mknod(dirp, dchild, iap->ia_mode, rdev);
1245		break;
1246	}
1247	if (host_err < 0)
1248		goto out_nfserr;
1249
1250	err = nfsd_create_setattr(rqstp, resfhp, iap);
1251
1252	/*
1253	 * nfsd_setattr already committed the child.  Transactional filesystems
1254	 * had a chance to commit changes for both parent and child
1255	 * simultaneously making the following commit_metadata a noop.
 
1256	 */
1257	err2 = nfserrno(commit_metadata(fhp));
1258	if (err2)
1259		err = err2;
1260	/*
1261	 * Update the file handle to get the new inode info.
1262	 */
1263	if (!err)
1264		err = fh_update(resfhp);
1265out:
1266	if (dchild && !IS_ERR(dchild))
1267		dput(dchild);
1268	return err;
1269
1270out_nfserr:
1271	err = nfserrno(host_err);
1272	goto out;
1273}
1274
1275#ifdef CONFIG_NFSD_V3
1276
1277static inline int nfsd_create_is_exclusive(int createmode)
1278{
1279	return createmode == NFS3_CREATE_EXCLUSIVE
1280	       || createmode == NFS4_CREATE_EXCLUSIVE4_1;
1281}
1282
1283/*
1284 * NFSv3 and NFSv4 version of nfsd_create
1285 */
1286__be32
1287do_nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
1288		char *fname, int flen, struct iattr *iap,
1289		struct svc_fh *resfhp, int createmode, u32 *verifier,
1290	        bool *truncp, bool *created)
1291{
1292	struct dentry	*dentry, *dchild = NULL;
1293	struct inode	*dirp;
1294	__be32		err;
1295	int		host_err;
1296	__u32		v_mtime=0, v_atime=0;
1297
1298	err = nfserr_perm;
1299	if (!flen)
1300		goto out;
1301	err = nfserr_exist;
1302	if (isdotent(fname, flen))
1303		goto out;
1304	if (!(iap->ia_valid & ATTR_MODE))
1305		iap->ia_mode = 0;
1306	err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_EXEC);
1307	if (err)
1308		goto out;
1309
1310	dentry = fhp->fh_dentry;
1311	dirp = dentry->d_inode;
1312
1313	/* Get all the sanity checks out of the way before
1314	 * we lock the parent. */
1315	err = nfserr_notdir;
1316	if (!dirp->i_op->lookup)
1317		goto out;
1318
1319	host_err = fh_want_write(fhp);
1320	if (host_err)
1321		goto out_nfserr;
1322
1323	fh_lock_nested(fhp, I_MUTEX_PARENT);
1324
1325	/*
1326	 * Compose the response file handle.
1327	 */
1328	dchild = lookup_one_len(fname, dentry, flen);
1329	host_err = PTR_ERR(dchild);
1330	if (IS_ERR(dchild))
1331		goto out_nfserr;
1332
1333	/* If file doesn't exist, check for permissions to create one */
1334	if (!dchild->d_inode) {
1335		err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
1336		if (err)
1337			goto out;
1338	}
1339
1340	err = fh_compose(resfhp, fhp->fh_export, dchild, fhp);
1341	if (err)
1342		goto out;
1343
1344	if (nfsd_create_is_exclusive(createmode)) {
1345		/* solaris7 gets confused (bugid 4218508) if these have
1346		 * the high bit set, so just clear the high bits. If this is
1347		 * ever changed to use different attrs for storing the
1348		 * verifier, then do_open_lookup() will also need to be fixed
1349		 * accordingly.
1350		 */
1351		v_mtime = verifier[0]&0x7fffffff;
1352		v_atime = verifier[1]&0x7fffffff;
1353	}
1354	
1355	if (dchild->d_inode) {
1356		err = 0;
1357
1358		switch (createmode) {
1359		case NFS3_CREATE_UNCHECKED:
1360			if (! S_ISREG(dchild->d_inode->i_mode))
1361				goto out;
1362			else if (truncp) {
1363				/* in nfsv4, we need to treat this case a little
1364				 * differently.  we don't want to truncate the
1365				 * file now; this would be wrong if the OPEN
1366				 * fails for some other reason.  furthermore,
1367				 * if the size is nonzero, we should ignore it
1368				 * according to spec!
1369				 */
1370				*truncp = (iap->ia_valid & ATTR_SIZE) && !iap->ia_size;
1371			}
1372			else {
1373				iap->ia_valid &= ATTR_SIZE;
1374				goto set_attr;
1375			}
1376			break;
1377		case NFS3_CREATE_EXCLUSIVE:
1378			if (   dchild->d_inode->i_mtime.tv_sec == v_mtime
1379			    && dchild->d_inode->i_atime.tv_sec == v_atime
1380			    && dchild->d_inode->i_size  == 0 ) {
1381				if (created)
1382					*created = 1;
1383				break;
1384			}
1385		case NFS4_CREATE_EXCLUSIVE4_1:
1386			if (   dchild->d_inode->i_mtime.tv_sec == v_mtime
1387			    && dchild->d_inode->i_atime.tv_sec == v_atime
1388			    && dchild->d_inode->i_size  == 0 ) {
1389				if (created)
1390					*created = 1;
1391				goto set_attr;
1392			}
1393			 /* fallthru */
1394		case NFS3_CREATE_GUARDED:
1395			err = nfserr_exist;
1396		}
1397		fh_drop_write(fhp);
1398		goto out;
1399	}
1400
1401	host_err = vfs_create(dirp, dchild, iap->ia_mode, true);
1402	if (host_err < 0) {
1403		fh_drop_write(fhp);
1404		goto out_nfserr;
1405	}
1406	if (created)
1407		*created = 1;
1408
1409	nfsd_check_ignore_resizing(iap);
1410
1411	if (nfsd_create_is_exclusive(createmode)) {
1412		/* Cram the verifier into atime/mtime */
1413		iap->ia_valid = ATTR_MTIME|ATTR_ATIME
1414			| ATTR_MTIME_SET|ATTR_ATIME_SET;
1415		/* XXX someone who knows this better please fix it for nsec */ 
1416		iap->ia_mtime.tv_sec = v_mtime;
1417		iap->ia_atime.tv_sec = v_atime;
1418		iap->ia_mtime.tv_nsec = 0;
1419		iap->ia_atime.tv_nsec = 0;
1420	}
1421
1422 set_attr:
1423	err = nfsd_create_setattr(rqstp, resfhp, iap);
1424
1425	/*
1426	 * nfsd_setattr already committed the child (and possibly also the parent).
 
1427	 */
1428	if (!err)
1429		err = nfserrno(commit_metadata(fhp));
1430
1431	/*
1432	 * Update the filehandle to get the new inode info.
1433	 */
1434	if (!err)
1435		err = fh_update(resfhp);
1436
1437 out:
1438	fh_unlock(fhp);
1439	if (dchild && !IS_ERR(dchild))
1440		dput(dchild);
1441	fh_drop_write(fhp);
1442 	return err;
1443 
1444 out_nfserr:
1445	err = nfserrno(host_err);
1446	goto out;
1447}
1448#endif /* CONFIG_NFSD_V3 */
1449
1450/*
1451 * Read a symlink. On entry, *lenp must contain the maximum path length that
1452 * fits into the buffer. On return, it contains the true length.
1453 * N.B. After this call fhp needs an fh_put
1454 */
1455__be32
1456nfsd_readlink(struct svc_rqst *rqstp, struct svc_fh *fhp, char *buf, int *lenp)
1457{
1458	struct inode	*inode;
1459	mm_segment_t	oldfs;
1460	__be32		err;
1461	int		host_err;
1462	struct path path;
1463
1464	err = fh_verify(rqstp, fhp, S_IFLNK, NFSD_MAY_NOP);
1465	if (err)
1466		goto out;
1467
1468	path.mnt = fhp->fh_export->ex_path.mnt;
1469	path.dentry = fhp->fh_dentry;
1470	inode = path.dentry->d_inode;
1471
1472	err = nfserr_inval;
1473	if (!inode->i_op->readlink)
1474		goto out;
1475
1476	touch_atime(&path);
1477	/* N.B. Why does this call need a get_fs()??
1478	 * Remove the set_fs and watch the fireworks:-) --okir
1479	 */
1480
1481	oldfs = get_fs(); set_fs(KERNEL_DS);
1482	host_err = inode->i_op->readlink(path.dentry, (char __user *)buf, *lenp);
1483	set_fs(oldfs);
1484
1485	if (host_err < 0)
1486		goto out_nfserr;
1487	*lenp = host_err;
1488	err = 0;
1489out:
1490	return err;
1491
1492out_nfserr:
1493	err = nfserrno(host_err);
1494	goto out;
1495}
1496
1497/*
1498 * Create a symlink and look up its inode
1499 * N.B. After this call _both_ fhp and resfhp need an fh_put
1500 */
1501__be32
1502nfsd_symlink(struct svc_rqst *rqstp, struct svc_fh *fhp,
1503				char *fname, int flen,
1504				char *path,  int plen,
1505				struct svc_fh *resfhp,
1506				struct iattr *iap)
1507{
1508	struct dentry	*dentry, *dnew;
1509	__be32		err, cerr;
1510	int		host_err;
1511
1512	err = nfserr_noent;
1513	if (!flen || !plen)
1514		goto out;
1515	err = nfserr_exist;
1516	if (isdotent(fname, flen))
1517		goto out;
1518
1519	err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
1520	if (err)
1521		goto out;
1522
1523	host_err = fh_want_write(fhp);
1524	if (host_err)
1525		goto out_nfserr;
1526
1527	fh_lock(fhp);
1528	dentry = fhp->fh_dentry;
1529	dnew = lookup_one_len(fname, dentry, flen);
1530	host_err = PTR_ERR(dnew);
1531	if (IS_ERR(dnew))
1532		goto out_nfserr;
1533
1534	if (unlikely(path[plen] != 0)) {
1535		char *path_alloced = kmalloc(plen+1, GFP_KERNEL);
1536		if (path_alloced == NULL)
1537			host_err = -ENOMEM;
1538		else {
1539			strncpy(path_alloced, path, plen);
1540			path_alloced[plen] = 0;
1541			host_err = vfs_symlink(dentry->d_inode, dnew, path_alloced);
1542			kfree(path_alloced);
1543		}
1544	} else
1545		host_err = vfs_symlink(dentry->d_inode, dnew, path);
1546	err = nfserrno(host_err);
1547	if (!err)
1548		err = nfserrno(commit_metadata(fhp));
1549	fh_unlock(fhp);
1550
1551	fh_drop_write(fhp);
1552
1553	cerr = fh_compose(resfhp, fhp->fh_export, dnew, fhp);
1554	dput(dnew);
1555	if (err==0) err = cerr;
1556out:
1557	return err;
1558
1559out_nfserr:
1560	err = nfserrno(host_err);
1561	goto out;
1562}
1563
1564/*
1565 * Create a hardlink
1566 * N.B. After this call _both_ ffhp and tfhp need an fh_put
1567 */
1568__be32
1569nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp,
1570				char *name, int len, struct svc_fh *tfhp)
1571{
1572	struct dentry	*ddir, *dnew, *dold;
1573	struct inode	*dirp;
1574	__be32		err;
1575	int		host_err;
1576
1577	err = fh_verify(rqstp, ffhp, S_IFDIR, NFSD_MAY_CREATE);
1578	if (err)
1579		goto out;
1580	err = fh_verify(rqstp, tfhp, 0, NFSD_MAY_NOP);
1581	if (err)
1582		goto out;
1583	err = nfserr_isdir;
1584	if (S_ISDIR(tfhp->fh_dentry->d_inode->i_mode))
1585		goto out;
1586	err = nfserr_perm;
1587	if (!len)
1588		goto out;
1589	err = nfserr_exist;
1590	if (isdotent(name, len))
1591		goto out;
1592
1593	host_err = fh_want_write(tfhp);
1594	if (host_err) {
1595		err = nfserrno(host_err);
1596		goto out;
1597	}
1598
1599	fh_lock_nested(ffhp, I_MUTEX_PARENT);
1600	ddir = ffhp->fh_dentry;
1601	dirp = ddir->d_inode;
1602
1603	dnew = lookup_one_len(name, ddir, len);
1604	host_err = PTR_ERR(dnew);
1605	if (IS_ERR(dnew))
1606		goto out_nfserr;
1607
1608	dold = tfhp->fh_dentry;
1609
1610	err = nfserr_noent;
1611	if (!dold->d_inode)
1612		goto out_dput;
1613	host_err = vfs_link(dold, dirp, dnew, NULL);
1614	if (!host_err) {
1615		err = nfserrno(commit_metadata(ffhp));
1616		if (!err)
1617			err = nfserrno(commit_metadata(tfhp));
1618	} else {
1619		if (host_err == -EXDEV && rqstp->rq_vers == 2)
1620			err = nfserr_acces;
1621		else
1622			err = nfserrno(host_err);
1623	}
1624out_dput:
1625	dput(dnew);
1626out_unlock:
1627	fh_unlock(ffhp);
1628	fh_drop_write(tfhp);
1629out:
1630	return err;
1631
1632out_nfserr:
1633	err = nfserrno(host_err);
1634	goto out_unlock;
1635}
1636
1637/*
1638 * Rename a file
1639 * N.B. After this call _both_ ffhp and tfhp need an fh_put
1640 */
1641__be32
1642nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen,
1643			    struct svc_fh *tfhp, char *tname, int tlen)
1644{
1645	struct dentry	*fdentry, *tdentry, *odentry, *ndentry, *trap;
1646	struct inode	*fdir, *tdir;
1647	__be32		err;
1648	int		host_err;
1649
1650	err = fh_verify(rqstp, ffhp, S_IFDIR, NFSD_MAY_REMOVE);
1651	if (err)
1652		goto out;
1653	err = fh_verify(rqstp, tfhp, S_IFDIR, NFSD_MAY_CREATE);
1654	if (err)
1655		goto out;
1656
1657	fdentry = ffhp->fh_dentry;
1658	fdir = fdentry->d_inode;
1659
1660	tdentry = tfhp->fh_dentry;
1661	tdir = tdentry->d_inode;
1662
1663	err = nfserr_perm;
1664	if (!flen || isdotent(fname, flen) || !tlen || isdotent(tname, tlen))
1665		goto out;
1666
1667	host_err = fh_want_write(ffhp);
1668	if (host_err) {
1669		err = nfserrno(host_err);
1670		goto out;
1671	}
1672
1673	/* cannot use fh_lock as we need deadlock protective ordering
1674	 * so do it by hand */
1675	trap = lock_rename(tdentry, fdentry);
1676	ffhp->fh_locked = tfhp->fh_locked = 1;
1677	fill_pre_wcc(ffhp);
1678	fill_pre_wcc(tfhp);
1679
1680	odentry = lookup_one_len(fname, fdentry, flen);
1681	host_err = PTR_ERR(odentry);
1682	if (IS_ERR(odentry))
1683		goto out_nfserr;
1684
1685	host_err = -ENOENT;
1686	if (!odentry->d_inode)
1687		goto out_dput_old;
1688	host_err = -EINVAL;
1689	if (odentry == trap)
1690		goto out_dput_old;
1691
1692	ndentry = lookup_one_len(tname, tdentry, tlen);
1693	host_err = PTR_ERR(ndentry);
1694	if (IS_ERR(ndentry))
1695		goto out_dput_old;
1696	host_err = -ENOTEMPTY;
1697	if (ndentry == trap)
1698		goto out_dput_new;
1699
1700	host_err = -EXDEV;
1701	if (ffhp->fh_export->ex_path.mnt != tfhp->fh_export->ex_path.mnt)
1702		goto out_dput_new;
1703	if (ffhp->fh_export->ex_path.dentry != tfhp->fh_export->ex_path.dentry)
1704		goto out_dput_new;
1705
1706	host_err = vfs_rename(fdir, odentry, tdir, ndentry, NULL, 0);
1707	if (!host_err) {
1708		host_err = commit_metadata(tfhp);
1709		if (!host_err)
1710			host_err = commit_metadata(ffhp);
1711	}
1712 out_dput_new:
1713	dput(ndentry);
1714 out_dput_old:
1715	dput(odentry);
1716 out_nfserr:
1717	err = nfserrno(host_err);
1718	/*
1719	 * We cannot rely on fh_unlock on the two filehandles,
1720	 * as that would do the wrong thing if the two directories
1721	 * were the same, so again we do it by hand.
1722	 */
1723	fill_post_wcc(ffhp);
1724	fill_post_wcc(tfhp);
1725	unlock_rename(tdentry, fdentry);
1726	ffhp->fh_locked = tfhp->fh_locked = 0;
1727	fh_drop_write(ffhp);
1728
1729out:
1730	return err;
1731}
1732
1733/*
1734 * Unlink a file or directory
1735 * N.B. After this call fhp needs an fh_put
1736 */
1737__be32
1738nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
1739				char *fname, int flen)
1740{
1741	struct dentry	*dentry, *rdentry;
1742	struct inode	*dirp;
1743	__be32		err;
1744	int		host_err;
1745
1746	err = nfserr_acces;
1747	if (!flen || isdotent(fname, flen))
1748		goto out;
1749	err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_REMOVE);
1750	if (err)
1751		goto out;
1752
1753	host_err = fh_want_write(fhp);
1754	if (host_err)
1755		goto out_nfserr;
1756
1757	fh_lock_nested(fhp, I_MUTEX_PARENT);
1758	dentry = fhp->fh_dentry;
1759	dirp = dentry->d_inode;
1760
1761	rdentry = lookup_one_len(fname, dentry, flen);
1762	host_err = PTR_ERR(rdentry);
1763	if (IS_ERR(rdentry))
1764		goto out_nfserr;
1765
1766	if (!rdentry->d_inode) {
1767		dput(rdentry);
1768		err = nfserr_noent;
1769		goto out;
1770	}
1771
1772	if (!type)
1773		type = rdentry->d_inode->i_mode & S_IFMT;
1774
1775	if (type != S_IFDIR)
1776		host_err = vfs_unlink(dirp, rdentry, NULL);
1777	else
1778		host_err = vfs_rmdir(dirp, rdentry);
1779	if (!host_err)
1780		host_err = commit_metadata(fhp);
1781	dput(rdentry);
1782
1783out_nfserr:
1784	err = nfserrno(host_err);
1785out:
1786	return err;
1787}
1788
1789/*
1790 * We do this buffering because we must not call back into the file
1791 * system's ->lookup() method from the filldir callback. That may well
1792 * deadlock a number of file systems.
1793 *
1794 * This is based heavily on the implementation of same in XFS.
1795 */
1796struct buffered_dirent {
1797	u64		ino;
1798	loff_t		offset;
1799	int		namlen;
1800	unsigned int	d_type;
1801	char		name[];
1802};
1803
1804struct readdir_data {
1805	struct dir_context ctx;
1806	char		*dirent;
1807	size_t		used;
1808	int		full;
1809};
1810
1811static int nfsd_buffered_filldir(void *__buf, const char *name, int namlen,
1812				 loff_t offset, u64 ino, unsigned int d_type)
 
1813{
1814	struct readdir_data *buf = __buf;
 
1815	struct buffered_dirent *de = (void *)(buf->dirent + buf->used);
1816	unsigned int reclen;
1817
1818	reclen = ALIGN(sizeof(struct buffered_dirent) + namlen, sizeof(u64));
1819	if (buf->used + reclen > PAGE_SIZE) {
1820		buf->full = 1;
1821		return -EINVAL;
1822	}
1823
1824	de->namlen = namlen;
1825	de->offset = offset;
1826	de->ino = ino;
1827	de->d_type = d_type;
1828	memcpy(de->name, name, namlen);
1829	buf->used += reclen;
1830
1831	return 0;
1832}
1833
1834static __be32 nfsd_buffered_readdir(struct file *file, filldir_t func,
1835				    struct readdir_cd *cdp, loff_t *offsetp)
1836{
1837	struct buffered_dirent *de;
1838	int host_err;
1839	int size;
1840	loff_t offset;
1841	struct readdir_data buf = {
1842		.ctx.actor = nfsd_buffered_filldir,
1843		.dirent = (void *)__get_free_page(GFP_KERNEL)
1844	};
1845
1846	if (!buf.dirent)
1847		return nfserrno(-ENOMEM);
1848
1849	offset = *offsetp;
1850
1851	while (1) {
1852		struct inode *dir_inode = file_inode(file);
1853		unsigned int reclen;
1854
1855		cdp->err = nfserr_eof; /* will be cleared on successful read */
1856		buf.used = 0;
1857		buf.full = 0;
1858
1859		host_err = iterate_dir(file, &buf.ctx);
1860		if (buf.full)
1861			host_err = 0;
1862
1863		if (host_err < 0)
1864			break;
1865
1866		size = buf.used;
1867
1868		if (!size)
1869			break;
1870
1871		/*
1872		 * Various filldir functions may end up calling back into
1873		 * lookup_one_len() and the file system's ->lookup() method.
1874		 * These expect i_mutex to be held, as it would within readdir.
1875		 */
1876		host_err = mutex_lock_killable(&dir_inode->i_mutex);
1877		if (host_err)
1878			break;
1879
1880		de = (struct buffered_dirent *)buf.dirent;
1881		while (size > 0) {
1882			offset = de->offset;
1883
1884			if (func(cdp, de->name, de->namlen, de->offset,
1885				 de->ino, de->d_type))
1886				break;
1887
1888			if (cdp->err != nfs_ok)
1889				break;
1890
1891			reclen = ALIGN(sizeof(*de) + de->namlen,
1892				       sizeof(u64));
1893			size -= reclen;
1894			de = (struct buffered_dirent *)((char *)de + reclen);
1895		}
1896		mutex_unlock(&dir_inode->i_mutex);
1897		if (size > 0) /* We bailed out early */
1898			break;
1899
1900		offset = vfs_llseek(file, 0, SEEK_CUR);
1901	}
1902
1903	free_page((unsigned long)(buf.dirent));
1904
1905	if (host_err)
1906		return nfserrno(host_err);
1907
1908	*offsetp = offset;
1909	return cdp->err;
1910}
1911
1912/*
1913 * Read entries from a directory.
1914 * The  NFSv3/4 verifier we ignore for now.
1915 */
1916__be32
1917nfsd_readdir(struct svc_rqst *rqstp, struct svc_fh *fhp, loff_t *offsetp, 
1918	     struct readdir_cd *cdp, filldir_t func)
1919{
1920	__be32		err;
1921	struct file	*file;
1922	loff_t		offset = *offsetp;
1923	int             may_flags = NFSD_MAY_READ;
1924
1925	/* NFSv2 only supports 32 bit cookies */
1926	if (rqstp->rq_vers > 2)
1927		may_flags |= NFSD_MAY_64BIT_COOKIE;
1928
1929	err = nfsd_open(rqstp, fhp, S_IFDIR, may_flags, &file);
1930	if (err)
1931		goto out;
1932
1933	offset = vfs_llseek(file, offset, SEEK_SET);
1934	if (offset < 0) {
1935		err = nfserrno((int)offset);
1936		goto out_close;
1937	}
1938
1939	err = nfsd_buffered_readdir(file, func, cdp, offsetp);
1940
1941	if (err == nfserr_eof || err == nfserr_toosmall)
1942		err = nfs_ok; /* can still be found in ->err */
1943out_close:
1944	nfsd_close(file);
1945out:
1946	return err;
1947}
1948
1949/*
1950 * Get file system stats
1951 * N.B. After this call fhp needs an fh_put
1952 */
1953__be32
1954nfsd_statfs(struct svc_rqst *rqstp, struct svc_fh *fhp, struct kstatfs *stat, int access)
1955{
1956	__be32 err;
1957
1958	err = fh_verify(rqstp, fhp, 0, NFSD_MAY_NOP | access);
1959	if (!err) {
1960		struct path path = {
1961			.mnt	= fhp->fh_export->ex_path.mnt,
1962			.dentry	= fhp->fh_dentry,
1963		};
1964		if (vfs_statfs(&path, stat))
1965			err = nfserr_io;
1966	}
1967	return err;
1968}
1969
1970static int exp_rdonly(struct svc_rqst *rqstp, struct svc_export *exp)
1971{
1972	return nfsexp_flags(rqstp, exp) & NFSEXP_READONLY;
1973}
1974
1975/*
1976 * Check for a user's access permissions to this inode.
1977 */
1978__be32
1979nfsd_permission(struct svc_rqst *rqstp, struct svc_export *exp,
1980					struct dentry *dentry, int acc)
1981{
1982	struct inode	*inode = dentry->d_inode;
1983	int		err;
1984
1985	if ((acc & NFSD_MAY_MASK) == NFSD_MAY_NOP)
1986		return 0;
1987#if 0
1988	dprintk("nfsd: permission 0x%x%s%s%s%s%s%s%s mode 0%o%s%s%s\n",
1989		acc,
1990		(acc & NFSD_MAY_READ)?	" read"  : "",
1991		(acc & NFSD_MAY_WRITE)?	" write" : "",
1992		(acc & NFSD_MAY_EXEC)?	" exec"  : "",
1993		(acc & NFSD_MAY_SATTR)?	" sattr" : "",
1994		(acc & NFSD_MAY_TRUNC)?	" trunc" : "",
1995		(acc & NFSD_MAY_LOCK)?	" lock"  : "",
1996		(acc & NFSD_MAY_OWNER_OVERRIDE)? " owneroverride" : "",
1997		inode->i_mode,
1998		IS_IMMUTABLE(inode)?	" immut" : "",
1999		IS_APPEND(inode)?	" append" : "",
2000		__mnt_is_readonly(exp->ex_path.mnt)?	" ro" : "");
2001	dprintk("      owner %d/%d user %d/%d\n",
2002		inode->i_uid, inode->i_gid, current_fsuid(), current_fsgid());
2003#endif
2004
2005	/* Normally we reject any write/sattr etc access on a read-only file
2006	 * system.  But if it is IRIX doing check on write-access for a 
2007	 * device special file, we ignore rofs.
2008	 */
2009	if (!(acc & NFSD_MAY_LOCAL_ACCESS))
2010		if (acc & (NFSD_MAY_WRITE | NFSD_MAY_SATTR | NFSD_MAY_TRUNC)) {
2011			if (exp_rdonly(rqstp, exp) ||
2012			    __mnt_is_readonly(exp->ex_path.mnt))
2013				return nfserr_rofs;
2014			if (/* (acc & NFSD_MAY_WRITE) && */ IS_IMMUTABLE(inode))
2015				return nfserr_perm;
2016		}
2017	if ((acc & NFSD_MAY_TRUNC) && IS_APPEND(inode))
2018		return nfserr_perm;
2019
2020	if (acc & NFSD_MAY_LOCK) {
2021		/* If we cannot rely on authentication in NLM requests,
2022		 * just allow locks, otherwise require read permission, or
2023		 * ownership
2024		 */
2025		if (exp->ex_flags & NFSEXP_NOAUTHNLM)
2026			return 0;
2027		else
2028			acc = NFSD_MAY_READ | NFSD_MAY_OWNER_OVERRIDE;
2029	}
2030	/*
2031	 * The file owner always gets access permission for accesses that
2032	 * would normally be checked at open time. This is to make
2033	 * file access work even when the client has done a fchmod(fd, 0).
2034	 *
2035	 * However, `cp foo bar' should fail nevertheless when bar is
2036	 * readonly. A sensible way to do this might be to reject all
2037	 * attempts to truncate a read-only file, because a creat() call
2038	 * always implies file truncation.
2039	 * ... but this isn't really fair.  A process may reasonably call
2040	 * ftruncate on an open file descriptor on a file with perm 000.
2041	 * We must trust the client to do permission checking - using "ACCESS"
2042	 * with NFSv3.
2043	 */
2044	if ((acc & NFSD_MAY_OWNER_OVERRIDE) &&
2045	    uid_eq(inode->i_uid, current_fsuid()))
2046		return 0;
2047
2048	/* This assumes  NFSD_MAY_{READ,WRITE,EXEC} == MAY_{READ,WRITE,EXEC} */
2049	err = inode_permission(inode, acc & (MAY_READ|MAY_WRITE|MAY_EXEC));
2050
2051	/* Allow read access to binaries even when mode 111 */
2052	if (err == -EACCES && S_ISREG(inode->i_mode) &&
2053	     (acc == (NFSD_MAY_READ | NFSD_MAY_OWNER_OVERRIDE) ||
2054	      acc == (NFSD_MAY_READ | NFSD_MAY_READ_IF_EXEC)))
2055		err = inode_permission(inode, MAY_EXEC);
2056
2057	return err? nfserrno(err) : 0;
2058}
2059
2060void
2061nfsd_racache_shutdown(void)
2062{
2063	struct raparms *raparm, *last_raparm;
2064	unsigned int i;
2065
2066	dprintk("nfsd: freeing readahead buffers.\n");
2067
2068	for (i = 0; i < RAPARM_HASH_SIZE; i++) {
2069		raparm = raparm_hash[i].pb_head;
2070		while(raparm) {
2071			last_raparm = raparm;
2072			raparm = raparm->p_next;
2073			kfree(last_raparm);
2074		}
2075		raparm_hash[i].pb_head = NULL;
2076	}
2077}
2078/*
2079 * Initialize readahead param cache
2080 */
2081int
2082nfsd_racache_init(int cache_size)
2083{
2084	int	i;
2085	int	j = 0;
2086	int	nperbucket;
2087	struct raparms **raparm = NULL;
2088
2089
2090	if (raparm_hash[0].pb_head)
2091		return 0;
2092	nperbucket = DIV_ROUND_UP(cache_size, RAPARM_HASH_SIZE);
2093	if (nperbucket < 2)
2094		nperbucket = 2;
2095	cache_size = nperbucket * RAPARM_HASH_SIZE;
2096
2097	dprintk("nfsd: allocating %d readahead buffers.\n", cache_size);
2098
2099	for (i = 0; i < RAPARM_HASH_SIZE; i++) {
2100		spin_lock_init(&raparm_hash[i].pb_lock);
2101
2102		raparm = &raparm_hash[i].pb_head;
2103		for (j = 0; j < nperbucket; j++) {
2104			*raparm = kzalloc(sizeof(struct raparms), GFP_KERNEL);
2105			if (!*raparm)
2106				goto out_nomem;
2107			raparm = &(*raparm)->p_next;
2108		}
2109		*raparm = NULL;
2110	}
2111
2112	nfsdstats.ra_size = cache_size;
2113	return 0;
2114
2115out_nomem:
2116	dprintk("nfsd: kmalloc failed, freeing readahead buffers\n");
2117	nfsd_racache_shutdown();
2118	return -ENOMEM;
2119}