1 /*
2  *  Server-side XDR for NFSv4
3  *
4  *  Copyright (c) 2002 The Regents of the University of Michigan.
5  *  All rights reserved.
6  *
7  *  Kendrick Smith <kmsmith@umich.edu>
8  *  Andy Adamson   <andros@umich.edu>
9  *
10  *  Redistribution and use in source and binary forms, with or without
11  *  modification, are permitted provided that the following conditions
12  *  are met:
13  *
14  *  1. Redistributions of source code must retain the above copyright
15  *     notice, this list of conditions and the following disclaimer.
16  *  2. Redistributions in binary form must reproduce the above copyright
17  *     notice, this list of conditions and the following disclaimer in the
18  *     documentation and/or other materials provided with the distribution.
19  *  3. Neither the name of the University nor the names of its
20  *     contributors may be used to endorse or promote products derived
21  *     from this software without specific prior written permission.
22  *
23  *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
24  *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
25  *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
26  *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
27  *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
28  *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
29  *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
30  *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31  *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32  *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33  *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 #include <linux/file.h>
37 #include <linux/slab.h>
38 #include <linux/namei.h>
39 #include <linux/statfs.h>
40 #include <linux/utsname.h>
41 #include <linux/pagemap.h>
42 #include <linux/sunrpc/svcauth_gss.h>
43 #include <linux/sunrpc/addr.h>
44 #include <linux/xattr.h>
45 #include <linux/vmalloc.h>
46 
47 #include <uapi/linux/xattr.h>
48 
49 #include "idmap.h"
50 #include "acl.h"
51 #include "xdr4.h"
52 #include "vfs.h"
53 #include "state.h"
54 #include "cache.h"
55 #include "netns.h"
56 #include "pnfs.h"
57 #include "filecache.h"
58 
59 #include "trace.h"
60 
61 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
62 #include <linux/security.h>
63 #endif
64 
65 
66 #define NFSDDBG_FACILITY		NFSDDBG_XDR
67 
68 const u32 nfsd_suppattrs[3][3] = {
69 	{NFSD4_SUPPORTED_ATTRS_WORD0,
70 	 NFSD4_SUPPORTED_ATTRS_WORD1,
71 	 NFSD4_SUPPORTED_ATTRS_WORD2},
72 
73 	{NFSD4_1_SUPPORTED_ATTRS_WORD0,
74 	 NFSD4_1_SUPPORTED_ATTRS_WORD1,
75 	 NFSD4_1_SUPPORTED_ATTRS_WORD2},
76 
77 	{NFSD4_1_SUPPORTED_ATTRS_WORD0,
78 	 NFSD4_1_SUPPORTED_ATTRS_WORD1,
79 	 NFSD4_2_SUPPORTED_ATTRS_WORD2},
80 };
81 
82 /*
83  * As per referral draft, the fsid for a referral MUST be different from the fsid of the containing
84  * directory in order to indicate to the client that a filesystem boundary is present
85  * We use a fixed fsid for a referral
86  */
87 #define NFS4_REFERRAL_FSID_MAJOR	0x8000000ULL
88 #define NFS4_REFERRAL_FSID_MINOR	0x8000000ULL
89 
90 static __be32
check_filename(char * str,int len)91 check_filename(char *str, int len)
92 {
93 	int i;
94 
95 	if (len == 0)
96 		return nfserr_inval;
97 	if (len > NFS4_MAXNAMLEN)
98 		return nfserr_nametoolong;
99 	if (isdotent(str, len))
100 		return nfserr_badname;
101 	for (i = 0; i < len; i++)
102 		if (str[i] == '/')
103 			return nfserr_badname;
104 	return 0;
105 }
106 
zero_clientid(clientid_t * clid)107 static int zero_clientid(clientid_t *clid)
108 {
109 	return (clid->cl_boot == 0) && (clid->cl_id == 0);
110 }
111 
112 /**
113  * svcxdr_tmpalloc - allocate memory to be freed after compound processing
114  * @argp: NFSv4 compound argument structure
115  * @len: length of buffer to allocate
116  *
117  * Allocates a buffer of size @len to be freed when processing the compound
118  * operation described in @argp finishes.
119  */
120 static void *
svcxdr_tmpalloc(struct nfsd4_compoundargs * argp,u32 len)121 svcxdr_tmpalloc(struct nfsd4_compoundargs *argp, u32 len)
122 {
123 	struct svcxdr_tmpbuf *tb;
124 
125 	tb = kmalloc(sizeof(*tb) + len, GFP_KERNEL);
126 	if (!tb)
127 		return NULL;
128 	tb->next = argp->to_free;
129 	argp->to_free = tb;
130 	return tb->buf;
131 }
132 
133 /*
134  * For xdr strings that need to be passed to other kernel api's
135  * as null-terminated strings.
136  *
137  * Note null-terminating in place usually isn't safe since the
138  * buffer might end on a page boundary.
139  */
140 static char *
svcxdr_dupstr(struct nfsd4_compoundargs * argp,void * buf,u32 len)141 svcxdr_dupstr(struct nfsd4_compoundargs *argp, void *buf, u32 len)
142 {
143 	char *p = svcxdr_tmpalloc(argp, len + 1);
144 
145 	if (!p)
146 		return NULL;
147 	memcpy(p, buf, len);
148 	p[len] = '\0';
149 	return p;
150 }
151 
152 static void *
svcxdr_savemem(struct nfsd4_compoundargs * argp,__be32 * p,u32 len)153 svcxdr_savemem(struct nfsd4_compoundargs *argp, __be32 *p, u32 len)
154 {
155 	__be32 *tmp;
156 
157 	/*
158 	 * The location of the decoded data item is stable,
159 	 * so @p is OK to use. This is the common case.
160 	 */
161 	if (p != argp->xdr->scratch.iov_base)
162 		return p;
163 
164 	tmp = svcxdr_tmpalloc(argp, len);
165 	if (!tmp)
166 		return NULL;
167 	memcpy(tmp, p, len);
168 	return tmp;
169 }
170 
171 /*
172  * NFSv4 basic data type decoders
173  */
174 
175 /*
176  * This helper handles variable-length opaques which belong to protocol
177  * elements that this implementation does not support.
178  */
179 static __be32
nfsd4_decode_ignored_string(struct nfsd4_compoundargs * argp,u32 maxlen)180 nfsd4_decode_ignored_string(struct nfsd4_compoundargs *argp, u32 maxlen)
181 {
182 	u32 len;
183 
184 	if (xdr_stream_decode_u32(argp->xdr, &len) < 0)
185 		return nfserr_bad_xdr;
186 	if (maxlen && len > maxlen)
187 		return nfserr_bad_xdr;
188 	if (!xdr_inline_decode(argp->xdr, len))
189 		return nfserr_bad_xdr;
190 
191 	return nfs_ok;
192 }
193 
194 static __be32
nfsd4_decode_opaque(struct nfsd4_compoundargs * argp,struct xdr_netobj * o)195 nfsd4_decode_opaque(struct nfsd4_compoundargs *argp, struct xdr_netobj *o)
196 {
197 	__be32 *p;
198 	u32 len;
199 
200 	if (xdr_stream_decode_u32(argp->xdr, &len) < 0)
201 		return nfserr_bad_xdr;
202 	if (len == 0 || len > NFS4_OPAQUE_LIMIT)
203 		return nfserr_bad_xdr;
204 	p = xdr_inline_decode(argp->xdr, len);
205 	if (!p)
206 		return nfserr_bad_xdr;
207 	o->data = svcxdr_savemem(argp, p, len);
208 	if (!o->data)
209 		return nfserr_jukebox;
210 	o->len = len;
211 
212 	return nfs_ok;
213 }
214 
215 static __be32
nfsd4_decode_component4(struct nfsd4_compoundargs * argp,char ** namp,u32 * lenp)216 nfsd4_decode_component4(struct nfsd4_compoundargs *argp, char **namp, u32 *lenp)
217 {
218 	__be32 *p, status;
219 
220 	if (xdr_stream_decode_u32(argp->xdr, lenp) < 0)
221 		return nfserr_bad_xdr;
222 	p = xdr_inline_decode(argp->xdr, *lenp);
223 	if (!p)
224 		return nfserr_bad_xdr;
225 	status = check_filename((char *)p, *lenp);
226 	if (status)
227 		return status;
228 	*namp = svcxdr_savemem(argp, p, *lenp);
229 	if (!*namp)
230 		return nfserr_jukebox;
231 
232 	return nfs_ok;
233 }
234 
235 static __be32
nfsd4_decode_nfstime4(struct nfsd4_compoundargs * argp,struct timespec64 * tv)236 nfsd4_decode_nfstime4(struct nfsd4_compoundargs *argp, struct timespec64 *tv)
237 {
238 	__be32 *p;
239 
240 	p = xdr_inline_decode(argp->xdr, XDR_UNIT * 3);
241 	if (!p)
242 		return nfserr_bad_xdr;
243 	p = xdr_decode_hyper(p, &tv->tv_sec);
244 	tv->tv_nsec = be32_to_cpup(p++);
245 	if (tv->tv_nsec >= (u32)1000000000)
246 		return nfserr_inval;
247 	return nfs_ok;
248 }
249 
250 static __be32
nfsd4_decode_verifier4(struct nfsd4_compoundargs * argp,nfs4_verifier * verf)251 nfsd4_decode_verifier4(struct nfsd4_compoundargs *argp, nfs4_verifier *verf)
252 {
253 	__be32 *p;
254 
255 	p = xdr_inline_decode(argp->xdr, NFS4_VERIFIER_SIZE);
256 	if (!p)
257 		return nfserr_bad_xdr;
258 	memcpy(verf->data, p, sizeof(verf->data));
259 	return nfs_ok;
260 }
261 
262 /**
263  * nfsd4_decode_bitmap4 - Decode an NFSv4 bitmap4
264  * @argp: NFSv4 compound argument structure
265  * @bmval: pointer to an array of u32's to decode into
266  * @bmlen: size of the @bmval array
267  *
268  * The server needs to return nfs_ok rather than nfserr_bad_xdr when
269  * encountering bitmaps containing bits it does not recognize. This
270  * includes bits in bitmap words past WORDn, where WORDn is the last
271  * bitmap WORD the implementation currently supports. Thus we are
272  * careful here to simply ignore bits in bitmap words that this
273  * implementation has yet to support explicitly.
274  *
275  * Return values:
276  *   %nfs_ok: @bmval populated successfully
277  *   %nfserr_bad_xdr: the encoded bitmap was invalid
278  */
279 static __be32
nfsd4_decode_bitmap4(struct nfsd4_compoundargs * argp,u32 * bmval,u32 bmlen)280 nfsd4_decode_bitmap4(struct nfsd4_compoundargs *argp, u32 *bmval, u32 bmlen)
281 {
282 	ssize_t status;
283 
284 	status = xdr_stream_decode_uint32_array(argp->xdr, bmval, bmlen);
285 	return status == -EBADMSG ? nfserr_bad_xdr : nfs_ok;
286 }
287 
288 static __be32
nfsd4_decode_nfsace4(struct nfsd4_compoundargs * argp,struct nfs4_ace * ace)289 nfsd4_decode_nfsace4(struct nfsd4_compoundargs *argp, struct nfs4_ace *ace)
290 {
291 	__be32 *p, status;
292 	u32 length;
293 
294 	if (xdr_stream_decode_u32(argp->xdr, &ace->type) < 0)
295 		return nfserr_bad_xdr;
296 	if (xdr_stream_decode_u32(argp->xdr, &ace->flag) < 0)
297 		return nfserr_bad_xdr;
298 	if (xdr_stream_decode_u32(argp->xdr, &ace->access_mask) < 0)
299 		return nfserr_bad_xdr;
300 
301 	if (xdr_stream_decode_u32(argp->xdr, &length) < 0)
302 		return nfserr_bad_xdr;
303 	p = xdr_inline_decode(argp->xdr, length);
304 	if (!p)
305 		return nfserr_bad_xdr;
306 	ace->whotype = nfs4_acl_get_whotype((char *)p, length);
307 	if (ace->whotype != NFS4_ACL_WHO_NAMED)
308 		status = nfs_ok;
309 	else if (ace->flag & NFS4_ACE_IDENTIFIER_GROUP)
310 		status = nfsd_map_name_to_gid(argp->rqstp,
311 				(char *)p, length, &ace->who_gid);
312 	else
313 		status = nfsd_map_name_to_uid(argp->rqstp,
314 				(char *)p, length, &ace->who_uid);
315 
316 	return status;
317 }
318 
319 /* A counted array of nfsace4's */
320 static noinline __be32
nfsd4_decode_acl(struct nfsd4_compoundargs * argp,struct nfs4_acl ** acl)321 nfsd4_decode_acl(struct nfsd4_compoundargs *argp, struct nfs4_acl **acl)
322 {
323 	struct nfs4_ace *ace;
324 	__be32 status;
325 	u32 count;
326 
327 	if (xdr_stream_decode_u32(argp->xdr, &count) < 0)
328 		return nfserr_bad_xdr;
329 
330 	if (count > xdr_stream_remaining(argp->xdr) / 20)
331 		/*
332 		 * Even with 4-byte names there wouldn't be
333 		 * space for that many aces; something fishy is
334 		 * going on:
335 		 */
336 		return nfserr_fbig;
337 
338 	*acl = svcxdr_tmpalloc(argp, nfs4_acl_bytes(count));
339 	if (*acl == NULL)
340 		return nfserr_jukebox;
341 
342 	(*acl)->naces = count;
343 	for (ace = (*acl)->aces; ace < (*acl)->aces + count; ace++) {
344 		status = nfsd4_decode_nfsace4(argp, ace);
345 		if (status)
346 			return status;
347 	}
348 
349 	return nfs_ok;
350 }
351 
352 static noinline __be32
nfsd4_decode_security_label(struct nfsd4_compoundargs * argp,struct xdr_netobj * label)353 nfsd4_decode_security_label(struct nfsd4_compoundargs *argp,
354 			    struct xdr_netobj *label)
355 {
356 	u32 lfs, pi, length;
357 	__be32 *p;
358 
359 	if (xdr_stream_decode_u32(argp->xdr, &lfs) < 0)
360 		return nfserr_bad_xdr;
361 	if (xdr_stream_decode_u32(argp->xdr, &pi) < 0)
362 		return nfserr_bad_xdr;
363 
364 	if (xdr_stream_decode_u32(argp->xdr, &length) < 0)
365 		return nfserr_bad_xdr;
366 	if (length > NFS4_MAXLABELLEN)
367 		return nfserr_badlabel;
368 	p = xdr_inline_decode(argp->xdr, length);
369 	if (!p)
370 		return nfserr_bad_xdr;
371 	label->len = length;
372 	label->data = svcxdr_dupstr(argp, p, length);
373 	if (!label->data)
374 		return nfserr_jukebox;
375 
376 	return nfs_ok;
377 }
378 
379 static __be32
nfsd4_decode_fattr4(struct nfsd4_compoundargs * argp,u32 * bmval,u32 bmlen,struct iattr * iattr,struct nfs4_acl ** acl,struct xdr_netobj * label,int * umask)380 nfsd4_decode_fattr4(struct nfsd4_compoundargs *argp, u32 *bmval, u32 bmlen,
381 		    struct iattr *iattr, struct nfs4_acl **acl,
382 		    struct xdr_netobj *label, int *umask)
383 {
384 	unsigned int starting_pos;
385 	u32 attrlist4_count;
386 	__be32 *p, status;
387 
388 	iattr->ia_valid = 0;
389 	status = nfsd4_decode_bitmap4(argp, bmval, bmlen);
390 	if (status)
391 		return nfserr_bad_xdr;
392 
393 	if (bmval[0] & ~NFSD_WRITEABLE_ATTRS_WORD0
394 	    || bmval[1] & ~NFSD_WRITEABLE_ATTRS_WORD1
395 	    || bmval[2] & ~NFSD_WRITEABLE_ATTRS_WORD2) {
396 		if (nfsd_attrs_supported(argp->minorversion, bmval))
397 			return nfserr_inval;
398 		return nfserr_attrnotsupp;
399 	}
400 
401 	if (xdr_stream_decode_u32(argp->xdr, &attrlist4_count) < 0)
402 		return nfserr_bad_xdr;
403 	starting_pos = xdr_stream_pos(argp->xdr);
404 
405 	if (bmval[0] & FATTR4_WORD0_SIZE) {
406 		u64 size;
407 
408 		if (xdr_stream_decode_u64(argp->xdr, &size) < 0)
409 			return nfserr_bad_xdr;
410 		iattr->ia_size = size;
411 		iattr->ia_valid |= ATTR_SIZE;
412 	}
413 	if (bmval[0] & FATTR4_WORD0_ACL) {
414 		status = nfsd4_decode_acl(argp, acl);
415 		if (status)
416 			return status;
417 	} else
418 		*acl = NULL;
419 	if (bmval[1] & FATTR4_WORD1_MODE) {
420 		u32 mode;
421 
422 		if (xdr_stream_decode_u32(argp->xdr, &mode) < 0)
423 			return nfserr_bad_xdr;
424 		iattr->ia_mode = mode;
425 		iattr->ia_mode &= (S_IFMT | S_IALLUGO);
426 		iattr->ia_valid |= ATTR_MODE;
427 	}
428 	if (bmval[1] & FATTR4_WORD1_OWNER) {
429 		u32 length;
430 
431 		if (xdr_stream_decode_u32(argp->xdr, &length) < 0)
432 			return nfserr_bad_xdr;
433 		p = xdr_inline_decode(argp->xdr, length);
434 		if (!p)
435 			return nfserr_bad_xdr;
436 		status = nfsd_map_name_to_uid(argp->rqstp, (char *)p, length,
437 					      &iattr->ia_uid);
438 		if (status)
439 			return status;
440 		iattr->ia_valid |= ATTR_UID;
441 	}
442 	if (bmval[1] & FATTR4_WORD1_OWNER_GROUP) {
443 		u32 length;
444 
445 		if (xdr_stream_decode_u32(argp->xdr, &length) < 0)
446 			return nfserr_bad_xdr;
447 		p = xdr_inline_decode(argp->xdr, length);
448 		if (!p)
449 			return nfserr_bad_xdr;
450 		status = nfsd_map_name_to_gid(argp->rqstp, (char *)p, length,
451 					      &iattr->ia_gid);
452 		if (status)
453 			return status;
454 		iattr->ia_valid |= ATTR_GID;
455 	}
456 	if (bmval[1] & FATTR4_WORD1_TIME_ACCESS_SET) {
457 		u32 set_it;
458 
459 		if (xdr_stream_decode_u32(argp->xdr, &set_it) < 0)
460 			return nfserr_bad_xdr;
461 		switch (set_it) {
462 		case NFS4_SET_TO_CLIENT_TIME:
463 			status = nfsd4_decode_nfstime4(argp, &iattr->ia_atime);
464 			if (status)
465 				return status;
466 			iattr->ia_valid |= (ATTR_ATIME | ATTR_ATIME_SET);
467 			break;
468 		case NFS4_SET_TO_SERVER_TIME:
469 			iattr->ia_valid |= ATTR_ATIME;
470 			break;
471 		default:
472 			return nfserr_bad_xdr;
473 		}
474 	}
475 	if (bmval[1] & FATTR4_WORD1_TIME_CREATE) {
476 		struct timespec64 ts;
477 
478 		/* No Linux filesystem supports setting this attribute. */
479 		bmval[1] &= ~FATTR4_WORD1_TIME_CREATE;
480 		status = nfsd4_decode_nfstime4(argp, &ts);
481 		if (status)
482 			return status;
483 	}
484 	if (bmval[1] & FATTR4_WORD1_TIME_MODIFY_SET) {
485 		u32 set_it;
486 
487 		if (xdr_stream_decode_u32(argp->xdr, &set_it) < 0)
488 			return nfserr_bad_xdr;
489 		switch (set_it) {
490 		case NFS4_SET_TO_CLIENT_TIME:
491 			status = nfsd4_decode_nfstime4(argp, &iattr->ia_mtime);
492 			if (status)
493 				return status;
494 			iattr->ia_valid |= (ATTR_MTIME | ATTR_MTIME_SET);
495 			break;
496 		case NFS4_SET_TO_SERVER_TIME:
497 			iattr->ia_valid |= ATTR_MTIME;
498 			break;
499 		default:
500 			return nfserr_bad_xdr;
501 		}
502 	}
503 	label->len = 0;
504 	if (IS_ENABLED(CONFIG_NFSD_V4_SECURITY_LABEL) &&
505 	    bmval[2] & FATTR4_WORD2_SECURITY_LABEL) {
506 		status = nfsd4_decode_security_label(argp, label);
507 		if (status)
508 			return status;
509 	}
510 	if (bmval[2] & FATTR4_WORD2_MODE_UMASK) {
511 		u32 mode, mask;
512 
513 		if (!umask)
514 			return nfserr_bad_xdr;
515 		if (xdr_stream_decode_u32(argp->xdr, &mode) < 0)
516 			return nfserr_bad_xdr;
517 		iattr->ia_mode = mode & (S_IFMT | S_IALLUGO);
518 		if (xdr_stream_decode_u32(argp->xdr, &mask) < 0)
519 			return nfserr_bad_xdr;
520 		*umask = mask & S_IRWXUGO;
521 		iattr->ia_valid |= ATTR_MODE;
522 	}
523 
524 	/* request sanity: did attrlist4 contain the expected number of words? */
525 	if (attrlist4_count != xdr_stream_pos(argp->xdr) - starting_pos)
526 		return nfserr_bad_xdr;
527 
528 	return nfs_ok;
529 }
530 
531 static __be32
nfsd4_decode_stateid4(struct nfsd4_compoundargs * argp,stateid_t * sid)532 nfsd4_decode_stateid4(struct nfsd4_compoundargs *argp, stateid_t *sid)
533 {
534 	__be32 *p;
535 
536 	p = xdr_inline_decode(argp->xdr, NFS4_STATEID_SIZE);
537 	if (!p)
538 		return nfserr_bad_xdr;
539 	sid->si_generation = be32_to_cpup(p++);
540 	memcpy(&sid->si_opaque, p, sizeof(sid->si_opaque));
541 	return nfs_ok;
542 }
543 
544 static __be32
nfsd4_decode_clientid4(struct nfsd4_compoundargs * argp,clientid_t * clientid)545 nfsd4_decode_clientid4(struct nfsd4_compoundargs *argp, clientid_t *clientid)
546 {
547 	__be32 *p;
548 
549 	p = xdr_inline_decode(argp->xdr, sizeof(__be64));
550 	if (!p)
551 		return nfserr_bad_xdr;
552 	memcpy(clientid, p, sizeof(*clientid));
553 	return nfs_ok;
554 }
555 
556 static __be32
nfsd4_decode_state_owner4(struct nfsd4_compoundargs * argp,clientid_t * clientid,struct xdr_netobj * owner)557 nfsd4_decode_state_owner4(struct nfsd4_compoundargs *argp,
558 			  clientid_t *clientid, struct xdr_netobj *owner)
559 {
560 	__be32 status;
561 
562 	status = nfsd4_decode_clientid4(argp, clientid);
563 	if (status)
564 		return status;
565 	return nfsd4_decode_opaque(argp, owner);
566 }
567 
568 #ifdef CONFIG_NFSD_PNFS
569 static __be32
nfsd4_decode_deviceid4(struct nfsd4_compoundargs * argp,struct nfsd4_deviceid * devid)570 nfsd4_decode_deviceid4(struct nfsd4_compoundargs *argp,
571 		       struct nfsd4_deviceid *devid)
572 {
573 	__be32 *p;
574 
575 	p = xdr_inline_decode(argp->xdr, NFS4_DEVICEID4_SIZE);
576 	if (!p)
577 		return nfserr_bad_xdr;
578 	memcpy(devid, p, sizeof(*devid));
579 	return nfs_ok;
580 }
581 
582 static __be32
nfsd4_decode_layoutupdate4(struct nfsd4_compoundargs * argp,struct nfsd4_layoutcommit * lcp)583 nfsd4_decode_layoutupdate4(struct nfsd4_compoundargs *argp,
584 			   struct nfsd4_layoutcommit *lcp)
585 {
586 	if (xdr_stream_decode_u32(argp->xdr, &lcp->lc_layout_type) < 0)
587 		return nfserr_bad_xdr;
588 	if (lcp->lc_layout_type < LAYOUT_NFSV4_1_FILES)
589 		return nfserr_bad_xdr;
590 	if (lcp->lc_layout_type >= LAYOUT_TYPE_MAX)
591 		return nfserr_bad_xdr;
592 
593 	if (xdr_stream_decode_u32(argp->xdr, &lcp->lc_up_len) < 0)
594 		return nfserr_bad_xdr;
595 	if (lcp->lc_up_len > 0) {
596 		lcp->lc_up_layout = xdr_inline_decode(argp->xdr, lcp->lc_up_len);
597 		if (!lcp->lc_up_layout)
598 			return nfserr_bad_xdr;
599 	}
600 
601 	return nfs_ok;
602 }
603 
604 static __be32
nfsd4_decode_layoutreturn4(struct nfsd4_compoundargs * argp,struct nfsd4_layoutreturn * lrp)605 nfsd4_decode_layoutreturn4(struct nfsd4_compoundargs *argp,
606 			   struct nfsd4_layoutreturn *lrp)
607 {
608 	__be32 status;
609 
610 	if (xdr_stream_decode_u32(argp->xdr, &lrp->lr_return_type) < 0)
611 		return nfserr_bad_xdr;
612 	switch (lrp->lr_return_type) {
613 	case RETURN_FILE:
614 		if (xdr_stream_decode_u64(argp->xdr, &lrp->lr_seg.offset) < 0)
615 			return nfserr_bad_xdr;
616 		if (xdr_stream_decode_u64(argp->xdr, &lrp->lr_seg.length) < 0)
617 			return nfserr_bad_xdr;
618 		status = nfsd4_decode_stateid4(argp, &lrp->lr_sid);
619 		if (status)
620 			return status;
621 		if (xdr_stream_decode_u32(argp->xdr, &lrp->lrf_body_len) < 0)
622 			return nfserr_bad_xdr;
623 		if (lrp->lrf_body_len > 0) {
624 			lrp->lrf_body = xdr_inline_decode(argp->xdr, lrp->lrf_body_len);
625 			if (!lrp->lrf_body)
626 				return nfserr_bad_xdr;
627 		}
628 		break;
629 	case RETURN_FSID:
630 	case RETURN_ALL:
631 		lrp->lr_seg.offset = 0;
632 		lrp->lr_seg.length = NFS4_MAX_UINT64;
633 		break;
634 	default:
635 		return nfserr_bad_xdr;
636 	}
637 
638 	return nfs_ok;
639 }
640 
641 #endif /* CONFIG_NFSD_PNFS */
642 
643 static __be32
nfsd4_decode_sessionid4(struct nfsd4_compoundargs * argp,struct nfs4_sessionid * sessionid)644 nfsd4_decode_sessionid4(struct nfsd4_compoundargs *argp,
645 			struct nfs4_sessionid *sessionid)
646 {
647 	__be32 *p;
648 
649 	p = xdr_inline_decode(argp->xdr, NFS4_MAX_SESSIONID_LEN);
650 	if (!p)
651 		return nfserr_bad_xdr;
652 	memcpy(sessionid->data, p, sizeof(sessionid->data));
653 	return nfs_ok;
654 }
655 
656 /* Defined in Appendix A of RFC 5531 */
657 static __be32
nfsd4_decode_authsys_parms(struct nfsd4_compoundargs * argp,struct nfsd4_cb_sec * cbs)658 nfsd4_decode_authsys_parms(struct nfsd4_compoundargs *argp,
659 			   struct nfsd4_cb_sec *cbs)
660 {
661 	u32 stamp, gidcount, uid, gid;
662 	__be32 *p, status;
663 
664 	if (xdr_stream_decode_u32(argp->xdr, &stamp) < 0)
665 		return nfserr_bad_xdr;
666 	/* machine name */
667 	status = nfsd4_decode_ignored_string(argp, 255);
668 	if (status)
669 		return status;
670 	if (xdr_stream_decode_u32(argp->xdr, &uid) < 0)
671 		return nfserr_bad_xdr;
672 	if (xdr_stream_decode_u32(argp->xdr, &gid) < 0)
673 		return nfserr_bad_xdr;
674 	if (xdr_stream_decode_u32(argp->xdr, &gidcount) < 0)
675 		return nfserr_bad_xdr;
676 	if (gidcount > 16)
677 		return nfserr_bad_xdr;
678 	p = xdr_inline_decode(argp->xdr, gidcount << 2);
679 	if (!p)
680 		return nfserr_bad_xdr;
681 	if (cbs->flavor == (u32)(-1)) {
682 		struct user_namespace *userns = nfsd_user_namespace(argp->rqstp);
683 
684 		kuid_t kuid = make_kuid(userns, uid);
685 		kgid_t kgid = make_kgid(userns, gid);
686 		if (uid_valid(kuid) && gid_valid(kgid)) {
687 			cbs->uid = kuid;
688 			cbs->gid = kgid;
689 			cbs->flavor = RPC_AUTH_UNIX;
690 		} else {
691 			dprintk("RPC_AUTH_UNIX with invalid uid or gid, ignoring!\n");
692 		}
693 	}
694 
695 	return nfs_ok;
696 }
697 
698 static __be32
nfsd4_decode_gss_cb_handles4(struct nfsd4_compoundargs * argp,struct nfsd4_cb_sec * cbs)699 nfsd4_decode_gss_cb_handles4(struct nfsd4_compoundargs *argp,
700 			     struct nfsd4_cb_sec *cbs)
701 {
702 	__be32 status;
703 	u32 service;
704 
705 	dprintk("RPC_AUTH_GSS callback secflavor not supported!\n");
706 
707 	if (xdr_stream_decode_u32(argp->xdr, &service) < 0)
708 		return nfserr_bad_xdr;
709 	if (service < RPC_GSS_SVC_NONE || service > RPC_GSS_SVC_PRIVACY)
710 		return nfserr_bad_xdr;
711 	/* gcbp_handle_from_server */
712 	status = nfsd4_decode_ignored_string(argp, 0);
713 	if (status)
714 		return status;
715 	/* gcbp_handle_from_client */
716 	status = nfsd4_decode_ignored_string(argp, 0);
717 	if (status)
718 		return status;
719 
720 	return nfs_ok;
721 }
722 
723 /* a counted array of callback_sec_parms4 items */
724 static __be32
nfsd4_decode_cb_sec(struct nfsd4_compoundargs * argp,struct nfsd4_cb_sec * cbs)725 nfsd4_decode_cb_sec(struct nfsd4_compoundargs *argp, struct nfsd4_cb_sec *cbs)
726 {
727 	u32 i, secflavor, nr_secflavs;
728 	__be32 status;
729 
730 	/* callback_sec_params4 */
731 	if (xdr_stream_decode_u32(argp->xdr, &nr_secflavs) < 0)
732 		return nfserr_bad_xdr;
733 	if (nr_secflavs)
734 		cbs->flavor = (u32)(-1);
735 	else
736 		/* Is this legal? Be generous, take it to mean AUTH_NONE: */
737 		cbs->flavor = 0;
738 
739 	for (i = 0; i < nr_secflavs; ++i) {
740 		if (xdr_stream_decode_u32(argp->xdr, &secflavor) < 0)
741 			return nfserr_bad_xdr;
742 		switch (secflavor) {
743 		case RPC_AUTH_NULL:
744 			/* void */
745 			if (cbs->flavor == (u32)(-1))
746 				cbs->flavor = RPC_AUTH_NULL;
747 			break;
748 		case RPC_AUTH_UNIX:
749 			status = nfsd4_decode_authsys_parms(argp, cbs);
750 			if (status)
751 				return status;
752 			break;
753 		case RPC_AUTH_GSS:
754 			status = nfsd4_decode_gss_cb_handles4(argp, cbs);
755 			if (status)
756 				return status;
757 			break;
758 		default:
759 			return nfserr_inval;
760 		}
761 	}
762 
763 	return nfs_ok;
764 }
765 
766 
767 /*
768  * NFSv4 operation argument decoders
769  */
770 
771 static __be32
nfsd4_decode_access(struct nfsd4_compoundargs * argp,struct nfsd4_access * access)772 nfsd4_decode_access(struct nfsd4_compoundargs *argp,
773 		    struct nfsd4_access *access)
774 {
775 	if (xdr_stream_decode_u32(argp->xdr, &access->ac_req_access) < 0)
776 		return nfserr_bad_xdr;
777 	return nfs_ok;
778 }
779 
780 static __be32
nfsd4_decode_close(struct nfsd4_compoundargs * argp,struct nfsd4_close * close)781 nfsd4_decode_close(struct nfsd4_compoundargs *argp, struct nfsd4_close *close)
782 {
783 	if (xdr_stream_decode_u32(argp->xdr, &close->cl_seqid) < 0)
784 		return nfserr_bad_xdr;
785 	return nfsd4_decode_stateid4(argp, &close->cl_stateid);
786 }
787 
788 
789 static __be32
nfsd4_decode_commit(struct nfsd4_compoundargs * argp,struct nfsd4_commit * commit)790 nfsd4_decode_commit(struct nfsd4_compoundargs *argp, struct nfsd4_commit *commit)
791 {
792 	if (xdr_stream_decode_u64(argp->xdr, &commit->co_offset) < 0)
793 		return nfserr_bad_xdr;
794 	if (xdr_stream_decode_u32(argp->xdr, &commit->co_count) < 0)
795 		return nfserr_bad_xdr;
796 	memset(&commit->co_verf, 0, sizeof(commit->co_verf));
797 	return nfs_ok;
798 }
799 
800 static __be32
nfsd4_decode_create(struct nfsd4_compoundargs * argp,struct nfsd4_create * create)801 nfsd4_decode_create(struct nfsd4_compoundargs *argp, struct nfsd4_create *create)
802 {
803 	__be32 *p, status;
804 
805 	memset(create, 0, sizeof(*create));
806 	if (xdr_stream_decode_u32(argp->xdr, &create->cr_type) < 0)
807 		return nfserr_bad_xdr;
808 	switch (create->cr_type) {
809 	case NF4LNK:
810 		if (xdr_stream_decode_u32(argp->xdr, &create->cr_datalen) < 0)
811 			return nfserr_bad_xdr;
812 		p = xdr_inline_decode(argp->xdr, create->cr_datalen);
813 		if (!p)
814 			return nfserr_bad_xdr;
815 		create->cr_data = svcxdr_dupstr(argp, p, create->cr_datalen);
816 		if (!create->cr_data)
817 			return nfserr_jukebox;
818 		break;
819 	case NF4BLK:
820 	case NF4CHR:
821 		if (xdr_stream_decode_u32(argp->xdr, &create->cr_specdata1) < 0)
822 			return nfserr_bad_xdr;
823 		if (xdr_stream_decode_u32(argp->xdr, &create->cr_specdata2) < 0)
824 			return nfserr_bad_xdr;
825 		break;
826 	case NF4SOCK:
827 	case NF4FIFO:
828 	case NF4DIR:
829 	default:
830 		break;
831 	}
832 	status = nfsd4_decode_component4(argp, &create->cr_name,
833 					 &create->cr_namelen);
834 	if (status)
835 		return status;
836 	status = nfsd4_decode_fattr4(argp, create->cr_bmval,
837 				    ARRAY_SIZE(create->cr_bmval),
838 				    &create->cr_iattr, &create->cr_acl,
839 				    &create->cr_label, &create->cr_umask);
840 	if (status)
841 		return status;
842 
843 	return nfs_ok;
844 }
845 
846 static inline __be32
nfsd4_decode_delegreturn(struct nfsd4_compoundargs * argp,struct nfsd4_delegreturn * dr)847 nfsd4_decode_delegreturn(struct nfsd4_compoundargs *argp, struct nfsd4_delegreturn *dr)
848 {
849 	return nfsd4_decode_stateid4(argp, &dr->dr_stateid);
850 }
851 
852 static inline __be32
nfsd4_decode_getattr(struct nfsd4_compoundargs * argp,struct nfsd4_getattr * getattr)853 nfsd4_decode_getattr(struct nfsd4_compoundargs *argp, struct nfsd4_getattr *getattr)
854 {
855 	memset(getattr, 0, sizeof(*getattr));
856 	return nfsd4_decode_bitmap4(argp, getattr->ga_bmval,
857 				    ARRAY_SIZE(getattr->ga_bmval));
858 }
859 
860 static __be32
nfsd4_decode_link(struct nfsd4_compoundargs * argp,struct nfsd4_link * link)861 nfsd4_decode_link(struct nfsd4_compoundargs *argp, struct nfsd4_link *link)
862 {
863 	memset(link, 0, sizeof(*link));
864 	return nfsd4_decode_component4(argp, &link->li_name, &link->li_namelen);
865 }
866 
867 static __be32
nfsd4_decode_open_to_lock_owner4(struct nfsd4_compoundargs * argp,struct nfsd4_lock * lock)868 nfsd4_decode_open_to_lock_owner4(struct nfsd4_compoundargs *argp,
869 				 struct nfsd4_lock *lock)
870 {
871 	__be32 status;
872 
873 	if (xdr_stream_decode_u32(argp->xdr, &lock->lk_new_open_seqid) < 0)
874 		return nfserr_bad_xdr;
875 	status = nfsd4_decode_stateid4(argp, &lock->lk_new_open_stateid);
876 	if (status)
877 		return status;
878 	if (xdr_stream_decode_u32(argp->xdr, &lock->lk_new_lock_seqid) < 0)
879 		return nfserr_bad_xdr;
880 	return nfsd4_decode_state_owner4(argp, &lock->lk_new_clientid,
881 					 &lock->lk_new_owner);
882 }
883 
884 static __be32
nfsd4_decode_exist_lock_owner4(struct nfsd4_compoundargs * argp,struct nfsd4_lock * lock)885 nfsd4_decode_exist_lock_owner4(struct nfsd4_compoundargs *argp,
886 			       struct nfsd4_lock *lock)
887 {
888 	__be32 status;
889 
890 	status = nfsd4_decode_stateid4(argp, &lock->lk_old_lock_stateid);
891 	if (status)
892 		return status;
893 	if (xdr_stream_decode_u32(argp->xdr, &lock->lk_old_lock_seqid) < 0)
894 		return nfserr_bad_xdr;
895 
896 	return nfs_ok;
897 }
898 
899 static __be32
nfsd4_decode_locker4(struct nfsd4_compoundargs * argp,struct nfsd4_lock * lock)900 nfsd4_decode_locker4(struct nfsd4_compoundargs *argp, struct nfsd4_lock *lock)
901 {
902 	if (xdr_stream_decode_bool(argp->xdr, &lock->lk_is_new) < 0)
903 		return nfserr_bad_xdr;
904 	if (lock->lk_is_new)
905 		return nfsd4_decode_open_to_lock_owner4(argp, lock);
906 	return nfsd4_decode_exist_lock_owner4(argp, lock);
907 }
908 
909 static __be32
nfsd4_decode_lock(struct nfsd4_compoundargs * argp,struct nfsd4_lock * lock)910 nfsd4_decode_lock(struct nfsd4_compoundargs *argp, struct nfsd4_lock *lock)
911 {
912 	memset(lock, 0, sizeof(*lock));
913 	if (xdr_stream_decode_u32(argp->xdr, &lock->lk_type) < 0)
914 		return nfserr_bad_xdr;
915 	if ((lock->lk_type < NFS4_READ_LT) || (lock->lk_type > NFS4_WRITEW_LT))
916 		return nfserr_bad_xdr;
917 	if (xdr_stream_decode_bool(argp->xdr, &lock->lk_reclaim) < 0)
918 		return nfserr_bad_xdr;
919 	if (xdr_stream_decode_u64(argp->xdr, &lock->lk_offset) < 0)
920 		return nfserr_bad_xdr;
921 	if (xdr_stream_decode_u64(argp->xdr, &lock->lk_length) < 0)
922 		return nfserr_bad_xdr;
923 	return nfsd4_decode_locker4(argp, lock);
924 }
925 
926 static __be32
nfsd4_decode_lockt(struct nfsd4_compoundargs * argp,struct nfsd4_lockt * lockt)927 nfsd4_decode_lockt(struct nfsd4_compoundargs *argp, struct nfsd4_lockt *lockt)
928 {
929 	memset(lockt, 0, sizeof(*lockt));
930 	if (xdr_stream_decode_u32(argp->xdr, &lockt->lt_type) < 0)
931 		return nfserr_bad_xdr;
932 	if ((lockt->lt_type < NFS4_READ_LT) || (lockt->lt_type > NFS4_WRITEW_LT))
933 		return nfserr_bad_xdr;
934 	if (xdr_stream_decode_u64(argp->xdr, &lockt->lt_offset) < 0)
935 		return nfserr_bad_xdr;
936 	if (xdr_stream_decode_u64(argp->xdr, &lockt->lt_length) < 0)
937 		return nfserr_bad_xdr;
938 	return nfsd4_decode_state_owner4(argp, &lockt->lt_clientid,
939 					 &lockt->lt_owner);
940 }
941 
942 static __be32
nfsd4_decode_locku(struct nfsd4_compoundargs * argp,struct nfsd4_locku * locku)943 nfsd4_decode_locku(struct nfsd4_compoundargs *argp, struct nfsd4_locku *locku)
944 {
945 	__be32 status;
946 
947 	if (xdr_stream_decode_u32(argp->xdr, &locku->lu_type) < 0)
948 		return nfserr_bad_xdr;
949 	if ((locku->lu_type < NFS4_READ_LT) || (locku->lu_type > NFS4_WRITEW_LT))
950 		return nfserr_bad_xdr;
951 	if (xdr_stream_decode_u32(argp->xdr, &locku->lu_seqid) < 0)
952 		return nfserr_bad_xdr;
953 	status = nfsd4_decode_stateid4(argp, &locku->lu_stateid);
954 	if (status)
955 		return status;
956 	if (xdr_stream_decode_u64(argp->xdr, &locku->lu_offset) < 0)
957 		return nfserr_bad_xdr;
958 	if (xdr_stream_decode_u64(argp->xdr, &locku->lu_length) < 0)
959 		return nfserr_bad_xdr;
960 
961 	return nfs_ok;
962 }
963 
964 static __be32
nfsd4_decode_lookup(struct nfsd4_compoundargs * argp,struct nfsd4_lookup * lookup)965 nfsd4_decode_lookup(struct nfsd4_compoundargs *argp, struct nfsd4_lookup *lookup)
966 {
967 	return nfsd4_decode_component4(argp, &lookup->lo_name, &lookup->lo_len);
968 }
969 
970 static __be32
nfsd4_decode_createhow4(struct nfsd4_compoundargs * argp,struct nfsd4_open * open)971 nfsd4_decode_createhow4(struct nfsd4_compoundargs *argp, struct nfsd4_open *open)
972 {
973 	__be32 status;
974 
975 	if (xdr_stream_decode_u32(argp->xdr, &open->op_createmode) < 0)
976 		return nfserr_bad_xdr;
977 	switch (open->op_createmode) {
978 	case NFS4_CREATE_UNCHECKED:
979 	case NFS4_CREATE_GUARDED:
980 		status = nfsd4_decode_fattr4(argp, open->op_bmval,
981 					     ARRAY_SIZE(open->op_bmval),
982 					     &open->op_iattr, &open->op_acl,
983 					     &open->op_label, &open->op_umask);
984 		if (status)
985 			return status;
986 		break;
987 	case NFS4_CREATE_EXCLUSIVE:
988 		status = nfsd4_decode_verifier4(argp, &open->op_verf);
989 		if (status)
990 			return status;
991 		break;
992 	case NFS4_CREATE_EXCLUSIVE4_1:
993 		if (argp->minorversion < 1)
994 			return nfserr_bad_xdr;
995 		status = nfsd4_decode_verifier4(argp, &open->op_verf);
996 		if (status)
997 			return status;
998 		status = nfsd4_decode_fattr4(argp, open->op_bmval,
999 					     ARRAY_SIZE(open->op_bmval),
1000 					     &open->op_iattr, &open->op_acl,
1001 					     &open->op_label, &open->op_umask);
1002 		if (status)
1003 			return status;
1004 		break;
1005 	default:
1006 		return nfserr_bad_xdr;
1007 	}
1008 
1009 	return nfs_ok;
1010 }
1011 
1012 static __be32
nfsd4_decode_openflag4(struct nfsd4_compoundargs * argp,struct nfsd4_open * open)1013 nfsd4_decode_openflag4(struct nfsd4_compoundargs *argp, struct nfsd4_open *open)
1014 {
1015 	__be32 status;
1016 
1017 	if (xdr_stream_decode_u32(argp->xdr, &open->op_create) < 0)
1018 		return nfserr_bad_xdr;
1019 	switch (open->op_create) {
1020 	case NFS4_OPEN_NOCREATE:
1021 		break;
1022 	case NFS4_OPEN_CREATE:
1023 		status = nfsd4_decode_createhow4(argp, open);
1024 		if (status)
1025 			return status;
1026 		break;
1027 	default:
1028 		return nfserr_bad_xdr;
1029 	}
1030 
1031 	return nfs_ok;
1032 }
1033 
nfsd4_decode_share_access(struct nfsd4_compoundargs * argp,u32 * share_access,u32 * deleg_want,u32 * deleg_when)1034 static __be32 nfsd4_decode_share_access(struct nfsd4_compoundargs *argp, u32 *share_access, u32 *deleg_want, u32 *deleg_when)
1035 {
1036 	u32 w;
1037 
1038 	if (xdr_stream_decode_u32(argp->xdr, &w) < 0)
1039 		return nfserr_bad_xdr;
1040 	*share_access = w & NFS4_SHARE_ACCESS_MASK;
1041 	*deleg_want = w & NFS4_SHARE_WANT_MASK;
1042 	if (deleg_when)
1043 		*deleg_when = w & NFS4_SHARE_WHEN_MASK;
1044 
1045 	switch (w & NFS4_SHARE_ACCESS_MASK) {
1046 	case NFS4_SHARE_ACCESS_READ:
1047 	case NFS4_SHARE_ACCESS_WRITE:
1048 	case NFS4_SHARE_ACCESS_BOTH:
1049 		break;
1050 	default:
1051 		return nfserr_bad_xdr;
1052 	}
1053 	w &= ~NFS4_SHARE_ACCESS_MASK;
1054 	if (!w)
1055 		return nfs_ok;
1056 	if (!argp->minorversion)
1057 		return nfserr_bad_xdr;
1058 	switch (w & NFS4_SHARE_WANT_MASK) {
1059 	case NFS4_SHARE_WANT_NO_PREFERENCE:
1060 	case NFS4_SHARE_WANT_READ_DELEG:
1061 	case NFS4_SHARE_WANT_WRITE_DELEG:
1062 	case NFS4_SHARE_WANT_ANY_DELEG:
1063 	case NFS4_SHARE_WANT_NO_DELEG:
1064 	case NFS4_SHARE_WANT_CANCEL:
1065 		break;
1066 	default:
1067 		return nfserr_bad_xdr;
1068 	}
1069 	w &= ~NFS4_SHARE_WANT_MASK;
1070 	if (!w)
1071 		return nfs_ok;
1072 
1073 	if (!deleg_when)	/* open_downgrade */
1074 		return nfserr_inval;
1075 	switch (w) {
1076 	case NFS4_SHARE_SIGNAL_DELEG_WHEN_RESRC_AVAIL:
1077 	case NFS4_SHARE_PUSH_DELEG_WHEN_UNCONTENDED:
1078 	case (NFS4_SHARE_SIGNAL_DELEG_WHEN_RESRC_AVAIL |
1079 	      NFS4_SHARE_PUSH_DELEG_WHEN_UNCONTENDED):
1080 		return nfs_ok;
1081 	}
1082 	return nfserr_bad_xdr;
1083 }
1084 
nfsd4_decode_share_deny(struct nfsd4_compoundargs * argp,u32 * x)1085 static __be32 nfsd4_decode_share_deny(struct nfsd4_compoundargs *argp, u32 *x)
1086 {
1087 	if (xdr_stream_decode_u32(argp->xdr, x) < 0)
1088 		return nfserr_bad_xdr;
1089 	/* Note: unlike access bits, deny bits may be zero. */
1090 	if (*x & ~NFS4_SHARE_DENY_BOTH)
1091 		return nfserr_bad_xdr;
1092 
1093 	return nfs_ok;
1094 }
1095 
1096 static __be32
nfsd4_decode_open_claim4(struct nfsd4_compoundargs * argp,struct nfsd4_open * open)1097 nfsd4_decode_open_claim4(struct nfsd4_compoundargs *argp,
1098 			 struct nfsd4_open *open)
1099 {
1100 	__be32 status;
1101 
1102 	if (xdr_stream_decode_u32(argp->xdr, &open->op_claim_type) < 0)
1103 		return nfserr_bad_xdr;
1104 	switch (open->op_claim_type) {
1105 	case NFS4_OPEN_CLAIM_NULL:
1106 	case NFS4_OPEN_CLAIM_DELEGATE_PREV:
1107 		status = nfsd4_decode_component4(argp, &open->op_fname,
1108 						 &open->op_fnamelen);
1109 		if (status)
1110 			return status;
1111 		break;
1112 	case NFS4_OPEN_CLAIM_PREVIOUS:
1113 		if (xdr_stream_decode_u32(argp->xdr, &open->op_delegate_type) < 0)
1114 			return nfserr_bad_xdr;
1115 		break;
1116 	case NFS4_OPEN_CLAIM_DELEGATE_CUR:
1117 		status = nfsd4_decode_stateid4(argp, &open->op_delegate_stateid);
1118 		if (status)
1119 			return status;
1120 		status = nfsd4_decode_component4(argp, &open->op_fname,
1121 						 &open->op_fnamelen);
1122 		if (status)
1123 			return status;
1124 		break;
1125 	case NFS4_OPEN_CLAIM_FH:
1126 	case NFS4_OPEN_CLAIM_DELEG_PREV_FH:
1127 		if (argp->minorversion < 1)
1128 			return nfserr_bad_xdr;
1129 		/* void */
1130 		break;
1131 	case NFS4_OPEN_CLAIM_DELEG_CUR_FH:
1132 		if (argp->minorversion < 1)
1133 			return nfserr_bad_xdr;
1134 		status = nfsd4_decode_stateid4(argp, &open->op_delegate_stateid);
1135 		if (status)
1136 			return status;
1137 		break;
1138 	default:
1139 		return nfserr_bad_xdr;
1140 	}
1141 
1142 	return nfs_ok;
1143 }
1144 
1145 static __be32
nfsd4_decode_open(struct nfsd4_compoundargs * argp,struct nfsd4_open * open)1146 nfsd4_decode_open(struct nfsd4_compoundargs *argp, struct nfsd4_open *open)
1147 {
1148 	__be32 status;
1149 	u32 dummy;
1150 
1151 	memset(open, 0, sizeof(*open));
1152 
1153 	if (xdr_stream_decode_u32(argp->xdr, &open->op_seqid) < 0)
1154 		return nfserr_bad_xdr;
1155 	/* deleg_want is ignored */
1156 	status = nfsd4_decode_share_access(argp, &open->op_share_access,
1157 					   &open->op_deleg_want, &dummy);
1158 	if (status)
1159 		return status;
1160 	status = nfsd4_decode_share_deny(argp, &open->op_share_deny);
1161 	if (status)
1162 		return status;
1163 	status = nfsd4_decode_state_owner4(argp, &open->op_clientid,
1164 					   &open->op_owner);
1165 	if (status)
1166 		return status;
1167 	status = nfsd4_decode_openflag4(argp, open);
1168 	if (status)
1169 		return status;
1170 	return nfsd4_decode_open_claim4(argp, open);
1171 }
1172 
1173 static __be32
nfsd4_decode_open_confirm(struct nfsd4_compoundargs * argp,struct nfsd4_open_confirm * open_conf)1174 nfsd4_decode_open_confirm(struct nfsd4_compoundargs *argp, struct nfsd4_open_confirm *open_conf)
1175 {
1176 	__be32 status;
1177 
1178 	if (argp->minorversion >= 1)
1179 		return nfserr_notsupp;
1180 
1181 	status = nfsd4_decode_stateid4(argp, &open_conf->oc_req_stateid);
1182 	if (status)
1183 		return status;
1184 	if (xdr_stream_decode_u32(argp->xdr, &open_conf->oc_seqid) < 0)
1185 		return nfserr_bad_xdr;
1186 
1187 	memset(&open_conf->oc_resp_stateid, 0,
1188 	       sizeof(open_conf->oc_resp_stateid));
1189 	return nfs_ok;
1190 }
1191 
1192 static __be32
nfsd4_decode_open_downgrade(struct nfsd4_compoundargs * argp,struct nfsd4_open_downgrade * open_down)1193 nfsd4_decode_open_downgrade(struct nfsd4_compoundargs *argp, struct nfsd4_open_downgrade *open_down)
1194 {
1195 	__be32 status;
1196 
1197 	memset(open_down, 0, sizeof(*open_down));
1198 	status = nfsd4_decode_stateid4(argp, &open_down->od_stateid);
1199 	if (status)
1200 		return status;
1201 	if (xdr_stream_decode_u32(argp->xdr, &open_down->od_seqid) < 0)
1202 		return nfserr_bad_xdr;
1203 	/* deleg_want is ignored */
1204 	status = nfsd4_decode_share_access(argp, &open_down->od_share_access,
1205 					   &open_down->od_deleg_want, NULL);
1206 	if (status)
1207 		return status;
1208 	return nfsd4_decode_share_deny(argp, &open_down->od_share_deny);
1209 }
1210 
1211 static __be32
nfsd4_decode_putfh(struct nfsd4_compoundargs * argp,struct nfsd4_putfh * putfh)1212 nfsd4_decode_putfh(struct nfsd4_compoundargs *argp, struct nfsd4_putfh *putfh)
1213 {
1214 	__be32 *p;
1215 
1216 	if (xdr_stream_decode_u32(argp->xdr, &putfh->pf_fhlen) < 0)
1217 		return nfserr_bad_xdr;
1218 	if (putfh->pf_fhlen > NFS4_FHSIZE)
1219 		return nfserr_bad_xdr;
1220 	p = xdr_inline_decode(argp->xdr, putfh->pf_fhlen);
1221 	if (!p)
1222 		return nfserr_bad_xdr;
1223 	putfh->pf_fhval = svcxdr_savemem(argp, p, putfh->pf_fhlen);
1224 	if (!putfh->pf_fhval)
1225 		return nfserr_jukebox;
1226 
1227 	putfh->no_verify = false;
1228 	return nfs_ok;
1229 }
1230 
1231 static __be32
nfsd4_decode_putpubfh(struct nfsd4_compoundargs * argp,void * p)1232 nfsd4_decode_putpubfh(struct nfsd4_compoundargs *argp, void *p)
1233 {
1234 	if (argp->minorversion == 0)
1235 		return nfs_ok;
1236 	return nfserr_notsupp;
1237 }
1238 
1239 static __be32
nfsd4_decode_read(struct nfsd4_compoundargs * argp,struct nfsd4_read * read)1240 nfsd4_decode_read(struct nfsd4_compoundargs *argp, struct nfsd4_read *read)
1241 {
1242 	__be32 status;
1243 
1244 	memset(read, 0, sizeof(*read));
1245 	status = nfsd4_decode_stateid4(argp, &read->rd_stateid);
1246 	if (status)
1247 		return status;
1248 	if (xdr_stream_decode_u64(argp->xdr, &read->rd_offset) < 0)
1249 		return nfserr_bad_xdr;
1250 	if (xdr_stream_decode_u32(argp->xdr, &read->rd_length) < 0)
1251 		return nfserr_bad_xdr;
1252 
1253 	return nfs_ok;
1254 }
1255 
1256 static __be32
nfsd4_decode_readdir(struct nfsd4_compoundargs * argp,struct nfsd4_readdir * readdir)1257 nfsd4_decode_readdir(struct nfsd4_compoundargs *argp, struct nfsd4_readdir *readdir)
1258 {
1259 	__be32 status;
1260 
1261 	memset(readdir, 0, sizeof(*readdir));
1262 	if (xdr_stream_decode_u64(argp->xdr, &readdir->rd_cookie) < 0)
1263 		return nfserr_bad_xdr;
1264 	status = nfsd4_decode_verifier4(argp, &readdir->rd_verf);
1265 	if (status)
1266 		return status;
1267 	if (xdr_stream_decode_u32(argp->xdr, &readdir->rd_dircount) < 0)
1268 		return nfserr_bad_xdr;
1269 	if (xdr_stream_decode_u32(argp->xdr, &readdir->rd_maxcount) < 0)
1270 		return nfserr_bad_xdr;
1271 	if (xdr_stream_decode_uint32_array(argp->xdr, readdir->rd_bmval,
1272 					   ARRAY_SIZE(readdir->rd_bmval)) < 0)
1273 		return nfserr_bad_xdr;
1274 
1275 	return nfs_ok;
1276 }
1277 
1278 static __be32
nfsd4_decode_remove(struct nfsd4_compoundargs * argp,struct nfsd4_remove * remove)1279 nfsd4_decode_remove(struct nfsd4_compoundargs *argp, struct nfsd4_remove *remove)
1280 {
1281 	memset(&remove->rm_cinfo, 0, sizeof(remove->rm_cinfo));
1282 	return nfsd4_decode_component4(argp, &remove->rm_name, &remove->rm_namelen);
1283 }
1284 
1285 static __be32
nfsd4_decode_rename(struct nfsd4_compoundargs * argp,struct nfsd4_rename * rename)1286 nfsd4_decode_rename(struct nfsd4_compoundargs *argp, struct nfsd4_rename *rename)
1287 {
1288 	__be32 status;
1289 
1290 	memset(rename, 0, sizeof(*rename));
1291 	status = nfsd4_decode_component4(argp, &rename->rn_sname, &rename->rn_snamelen);
1292 	if (status)
1293 		return status;
1294 	return nfsd4_decode_component4(argp, &rename->rn_tname, &rename->rn_tnamelen);
1295 }
1296 
1297 static __be32
nfsd4_decode_renew(struct nfsd4_compoundargs * argp,clientid_t * clientid)1298 nfsd4_decode_renew(struct nfsd4_compoundargs *argp, clientid_t *clientid)
1299 {
1300 	return nfsd4_decode_clientid4(argp, clientid);
1301 }
1302 
1303 static __be32
nfsd4_decode_secinfo(struct nfsd4_compoundargs * argp,struct nfsd4_secinfo * secinfo)1304 nfsd4_decode_secinfo(struct nfsd4_compoundargs *argp,
1305 		     struct nfsd4_secinfo *secinfo)
1306 {
1307 	secinfo->si_exp = NULL;
1308 	return nfsd4_decode_component4(argp, &secinfo->si_name, &secinfo->si_namelen);
1309 }
1310 
1311 static __be32
nfsd4_decode_setattr(struct nfsd4_compoundargs * argp,struct nfsd4_setattr * setattr)1312 nfsd4_decode_setattr(struct nfsd4_compoundargs *argp, struct nfsd4_setattr *setattr)
1313 {
1314 	__be32 status;
1315 
1316 	memset(setattr, 0, sizeof(*setattr));
1317 	status = nfsd4_decode_stateid4(argp, &setattr->sa_stateid);
1318 	if (status)
1319 		return status;
1320 	return nfsd4_decode_fattr4(argp, setattr->sa_bmval,
1321 				   ARRAY_SIZE(setattr->sa_bmval),
1322 				   &setattr->sa_iattr, &setattr->sa_acl,
1323 				   &setattr->sa_label, NULL);
1324 }
1325 
1326 static __be32
nfsd4_decode_setclientid(struct nfsd4_compoundargs * argp,struct nfsd4_setclientid * setclientid)1327 nfsd4_decode_setclientid(struct nfsd4_compoundargs *argp, struct nfsd4_setclientid *setclientid)
1328 {
1329 	__be32 *p, status;
1330 
1331 	memset(setclientid, 0, sizeof(*setclientid));
1332 
1333 	if (argp->minorversion >= 1)
1334 		return nfserr_notsupp;
1335 
1336 	status = nfsd4_decode_verifier4(argp, &setclientid->se_verf);
1337 	if (status)
1338 		return status;
1339 	status = nfsd4_decode_opaque(argp, &setclientid->se_name);
1340 	if (status)
1341 		return status;
1342 	if (xdr_stream_decode_u32(argp->xdr, &setclientid->se_callback_prog) < 0)
1343 		return nfserr_bad_xdr;
1344 	if (xdr_stream_decode_u32(argp->xdr, &setclientid->se_callback_netid_len) < 0)
1345 		return nfserr_bad_xdr;
1346 	p = xdr_inline_decode(argp->xdr, setclientid->se_callback_netid_len);
1347 	if (!p)
1348 		return nfserr_bad_xdr;
1349 	setclientid->se_callback_netid_val = svcxdr_savemem(argp, p,
1350 						setclientid->se_callback_netid_len);
1351 	if (!setclientid->se_callback_netid_val)
1352 		return nfserr_jukebox;
1353 
1354 	if (xdr_stream_decode_u32(argp->xdr, &setclientid->se_callback_addr_len) < 0)
1355 		return nfserr_bad_xdr;
1356 	p = xdr_inline_decode(argp->xdr, setclientid->se_callback_addr_len);
1357 	if (!p)
1358 		return nfserr_bad_xdr;
1359 	setclientid->se_callback_addr_val = svcxdr_savemem(argp, p,
1360 						setclientid->se_callback_addr_len);
1361 	if (!setclientid->se_callback_addr_val)
1362 		return nfserr_jukebox;
1363 	if (xdr_stream_decode_u32(argp->xdr, &setclientid->se_callback_ident) < 0)
1364 		return nfserr_bad_xdr;
1365 
1366 	return nfs_ok;
1367 }
1368 
1369 static __be32
nfsd4_decode_setclientid_confirm(struct nfsd4_compoundargs * argp,struct nfsd4_setclientid_confirm * scd_c)1370 nfsd4_decode_setclientid_confirm(struct nfsd4_compoundargs *argp, struct nfsd4_setclientid_confirm *scd_c)
1371 {
1372 	__be32 status;
1373 
1374 	if (argp->minorversion >= 1)
1375 		return nfserr_notsupp;
1376 
1377 	status = nfsd4_decode_clientid4(argp, &scd_c->sc_clientid);
1378 	if (status)
1379 		return status;
1380 	return nfsd4_decode_verifier4(argp, &scd_c->sc_confirm);
1381 }
1382 
1383 /* Also used for NVERIFY */
1384 static __be32
nfsd4_decode_verify(struct nfsd4_compoundargs * argp,struct nfsd4_verify * verify)1385 nfsd4_decode_verify(struct nfsd4_compoundargs *argp, struct nfsd4_verify *verify)
1386 {
1387 	__be32 *p, status;
1388 
1389 	memset(verify, 0, sizeof(*verify));
1390 
1391 	status = nfsd4_decode_bitmap4(argp, verify->ve_bmval,
1392 				      ARRAY_SIZE(verify->ve_bmval));
1393 	if (status)
1394 		return status;
1395 
1396 	/* For convenience's sake, we compare raw xdr'd attributes in
1397 	 * nfsd4_proc_verify */
1398 
1399 	if (xdr_stream_decode_u32(argp->xdr, &verify->ve_attrlen) < 0)
1400 		return nfserr_bad_xdr;
1401 	p = xdr_inline_decode(argp->xdr, verify->ve_attrlen);
1402 	if (!p)
1403 		return nfserr_bad_xdr;
1404 	verify->ve_attrval = svcxdr_savemem(argp, p, verify->ve_attrlen);
1405 	if (!verify->ve_attrval)
1406 		return nfserr_jukebox;
1407 
1408 	return nfs_ok;
1409 }
1410 
1411 static __be32
nfsd4_decode_write(struct nfsd4_compoundargs * argp,struct nfsd4_write * write)1412 nfsd4_decode_write(struct nfsd4_compoundargs *argp, struct nfsd4_write *write)
1413 {
1414 	__be32 status;
1415 
1416 	status = nfsd4_decode_stateid4(argp, &write->wr_stateid);
1417 	if (status)
1418 		return status;
1419 	if (xdr_stream_decode_u64(argp->xdr, &write->wr_offset) < 0)
1420 		return nfserr_bad_xdr;
1421 	if (xdr_stream_decode_u32(argp->xdr, &write->wr_stable_how) < 0)
1422 		return nfserr_bad_xdr;
1423 	if (write->wr_stable_how > NFS_FILE_SYNC)
1424 		return nfserr_bad_xdr;
1425 	if (xdr_stream_decode_u32(argp->xdr, &write->wr_buflen) < 0)
1426 		return nfserr_bad_xdr;
1427 	if (!xdr_stream_subsegment(argp->xdr, &write->wr_payload, write->wr_buflen))
1428 		return nfserr_bad_xdr;
1429 
1430 	write->wr_bytes_written = 0;
1431 	write->wr_how_written = 0;
1432 	memset(&write->wr_verifier, 0, sizeof(write->wr_verifier));
1433 	return nfs_ok;
1434 }
1435 
1436 static __be32
nfsd4_decode_release_lockowner(struct nfsd4_compoundargs * argp,struct nfsd4_release_lockowner * rlockowner)1437 nfsd4_decode_release_lockowner(struct nfsd4_compoundargs *argp, struct nfsd4_release_lockowner *rlockowner)
1438 {
1439 	__be32 status;
1440 
1441 	if (argp->minorversion >= 1)
1442 		return nfserr_notsupp;
1443 
1444 	status = nfsd4_decode_state_owner4(argp, &rlockowner->rl_clientid,
1445 					   &rlockowner->rl_owner);
1446 	if (status)
1447 		return status;
1448 
1449 	if (argp->minorversion && !zero_clientid(&rlockowner->rl_clientid))
1450 		return nfserr_inval;
1451 
1452 	return nfs_ok;
1453 }
1454 
nfsd4_decode_backchannel_ctl(struct nfsd4_compoundargs * argp,struct nfsd4_backchannel_ctl * bc)1455 static __be32 nfsd4_decode_backchannel_ctl(struct nfsd4_compoundargs *argp, struct nfsd4_backchannel_ctl *bc)
1456 {
1457 	memset(bc, 0, sizeof(*bc));
1458 	if (xdr_stream_decode_u32(argp->xdr, &bc->bc_cb_program) < 0)
1459 		return nfserr_bad_xdr;
1460 	return nfsd4_decode_cb_sec(argp, &bc->bc_cb_sec);
1461 }
1462 
nfsd4_decode_bind_conn_to_session(struct nfsd4_compoundargs * argp,struct nfsd4_bind_conn_to_session * bcts)1463 static __be32 nfsd4_decode_bind_conn_to_session(struct nfsd4_compoundargs *argp, struct nfsd4_bind_conn_to_session *bcts)
1464 {
1465 	u32 use_conn_in_rdma_mode;
1466 	__be32 status;
1467 
1468 	memset(bcts, 0, sizeof(*bcts));
1469 	status = nfsd4_decode_sessionid4(argp, &bcts->sessionid);
1470 	if (status)
1471 		return status;
1472 	if (xdr_stream_decode_u32(argp->xdr, &bcts->dir) < 0)
1473 		return nfserr_bad_xdr;
1474 	if (xdr_stream_decode_u32(argp->xdr, &use_conn_in_rdma_mode) < 0)
1475 		return nfserr_bad_xdr;
1476 
1477 	return nfs_ok;
1478 }
1479 
1480 static __be32
nfsd4_decode_state_protect_ops(struct nfsd4_compoundargs * argp,struct nfsd4_exchange_id * exid)1481 nfsd4_decode_state_protect_ops(struct nfsd4_compoundargs *argp,
1482 			       struct nfsd4_exchange_id *exid)
1483 {
1484 	__be32 status;
1485 
1486 	status = nfsd4_decode_bitmap4(argp, exid->spo_must_enforce,
1487 				      ARRAY_SIZE(exid->spo_must_enforce));
1488 	if (status)
1489 		return nfserr_bad_xdr;
1490 	status = nfsd4_decode_bitmap4(argp, exid->spo_must_allow,
1491 				      ARRAY_SIZE(exid->spo_must_allow));
1492 	if (status)
1493 		return nfserr_bad_xdr;
1494 
1495 	return nfs_ok;
1496 }
1497 
1498 /*
1499  * This implementation currently does not support SP4_SSV.
1500  * This decoder simply skips over these arguments.
1501  */
1502 static noinline __be32
nfsd4_decode_ssv_sp_parms(struct nfsd4_compoundargs * argp,struct nfsd4_exchange_id * exid)1503 nfsd4_decode_ssv_sp_parms(struct nfsd4_compoundargs *argp,
1504 			  struct nfsd4_exchange_id *exid)
1505 {
1506 	u32 count, window, num_gss_handles;
1507 	__be32 status;
1508 
1509 	/* ssp_ops */
1510 	status = nfsd4_decode_state_protect_ops(argp, exid);
1511 	if (status)
1512 		return status;
1513 
1514 	/* ssp_hash_algs<> */
1515 	if (xdr_stream_decode_u32(argp->xdr, &count) < 0)
1516 		return nfserr_bad_xdr;
1517 	while (count--) {
1518 		status = nfsd4_decode_ignored_string(argp, 0);
1519 		if (status)
1520 			return status;
1521 	}
1522 
1523 	/* ssp_encr_algs<> */
1524 	if (xdr_stream_decode_u32(argp->xdr, &count) < 0)
1525 		return nfserr_bad_xdr;
1526 	while (count--) {
1527 		status = nfsd4_decode_ignored_string(argp, 0);
1528 		if (status)
1529 			return status;
1530 	}
1531 
1532 	if (xdr_stream_decode_u32(argp->xdr, &window) < 0)
1533 		return nfserr_bad_xdr;
1534 	if (xdr_stream_decode_u32(argp->xdr, &num_gss_handles) < 0)
1535 		return nfserr_bad_xdr;
1536 
1537 	return nfs_ok;
1538 }
1539 
1540 static __be32
nfsd4_decode_state_protect4_a(struct nfsd4_compoundargs * argp,struct nfsd4_exchange_id * exid)1541 nfsd4_decode_state_protect4_a(struct nfsd4_compoundargs *argp,
1542 			      struct nfsd4_exchange_id *exid)
1543 {
1544 	__be32 status;
1545 
1546 	if (xdr_stream_decode_u32(argp->xdr, &exid->spa_how) < 0)
1547 		return nfserr_bad_xdr;
1548 	switch (exid->spa_how) {
1549 	case SP4_NONE:
1550 		break;
1551 	case SP4_MACH_CRED:
1552 		status = nfsd4_decode_state_protect_ops(argp, exid);
1553 		if (status)
1554 			return status;
1555 		break;
1556 	case SP4_SSV:
1557 		status = nfsd4_decode_ssv_sp_parms(argp, exid);
1558 		if (status)
1559 			return status;
1560 		break;
1561 	default:
1562 		return nfserr_bad_xdr;
1563 	}
1564 
1565 	return nfs_ok;
1566 }
1567 
1568 static __be32
nfsd4_decode_nfs_impl_id4(struct nfsd4_compoundargs * argp,struct nfsd4_exchange_id * exid)1569 nfsd4_decode_nfs_impl_id4(struct nfsd4_compoundargs *argp,
1570 			  struct nfsd4_exchange_id *exid)
1571 {
1572 	__be32 status;
1573 	u32 count;
1574 
1575 	if (xdr_stream_decode_u32(argp->xdr, &count) < 0)
1576 		return nfserr_bad_xdr;
1577 	switch (count) {
1578 	case 0:
1579 		break;
1580 	case 1:
1581 		/* Note that RFC 8881 places no length limit on
1582 		 * nii_domain, but this implementation permits no
1583 		 * more than NFS4_OPAQUE_LIMIT bytes */
1584 		status = nfsd4_decode_opaque(argp, &exid->nii_domain);
1585 		if (status)
1586 			return status;
1587 		/* Note that RFC 8881 places no length limit on
1588 		 * nii_name, but this implementation permits no
1589 		 * more than NFS4_OPAQUE_LIMIT bytes */
1590 		status = nfsd4_decode_opaque(argp, &exid->nii_name);
1591 		if (status)
1592 			return status;
1593 		status = nfsd4_decode_nfstime4(argp, &exid->nii_time);
1594 		if (status)
1595 			return status;
1596 		break;
1597 	default:
1598 		return nfserr_bad_xdr;
1599 	}
1600 
1601 	return nfs_ok;
1602 }
1603 
1604 static __be32
nfsd4_decode_exchange_id(struct nfsd4_compoundargs * argp,struct nfsd4_exchange_id * exid)1605 nfsd4_decode_exchange_id(struct nfsd4_compoundargs *argp,
1606 			 struct nfsd4_exchange_id *exid)
1607 {
1608 	__be32 status;
1609 
1610 	memset(exid, 0, sizeof(*exid));
1611 	status = nfsd4_decode_verifier4(argp, &exid->verifier);
1612 	if (status)
1613 		return status;
1614 	status = nfsd4_decode_opaque(argp, &exid->clname);
1615 	if (status)
1616 		return status;
1617 	if (xdr_stream_decode_u32(argp->xdr, &exid->flags) < 0)
1618 		return nfserr_bad_xdr;
1619 	status = nfsd4_decode_state_protect4_a(argp, exid);
1620 	if (status)
1621 		return status;
1622 	return nfsd4_decode_nfs_impl_id4(argp, exid);
1623 }
1624 
1625 static __be32
nfsd4_decode_channel_attrs4(struct nfsd4_compoundargs * argp,struct nfsd4_channel_attrs * ca)1626 nfsd4_decode_channel_attrs4(struct nfsd4_compoundargs *argp,
1627 			    struct nfsd4_channel_attrs *ca)
1628 {
1629 	__be32 *p;
1630 
1631 	p = xdr_inline_decode(argp->xdr, XDR_UNIT * 7);
1632 	if (!p)
1633 		return nfserr_bad_xdr;
1634 
1635 	/* headerpadsz is ignored */
1636 	p++;
1637 	ca->maxreq_sz = be32_to_cpup(p++);
1638 	ca->maxresp_sz = be32_to_cpup(p++);
1639 	ca->maxresp_cached = be32_to_cpup(p++);
1640 	ca->maxops = be32_to_cpup(p++);
1641 	ca->maxreqs = be32_to_cpup(p++);
1642 	ca->nr_rdma_attrs = be32_to_cpup(p);
1643 	switch (ca->nr_rdma_attrs) {
1644 	case 0:
1645 		break;
1646 	case 1:
1647 		if (xdr_stream_decode_u32(argp->xdr, &ca->rdma_attrs) < 0)
1648 			return nfserr_bad_xdr;
1649 		break;
1650 	default:
1651 		return nfserr_bad_xdr;
1652 	}
1653 
1654 	return nfs_ok;
1655 }
1656 
1657 static __be32
nfsd4_decode_create_session(struct nfsd4_compoundargs * argp,struct nfsd4_create_session * sess)1658 nfsd4_decode_create_session(struct nfsd4_compoundargs *argp,
1659 			    struct nfsd4_create_session *sess)
1660 {
1661 	__be32 status;
1662 
1663 	memset(sess, 0, sizeof(*sess));
1664 	status = nfsd4_decode_clientid4(argp, &sess->clientid);
1665 	if (status)
1666 		return status;
1667 	if (xdr_stream_decode_u32(argp->xdr, &sess->seqid) < 0)
1668 		return nfserr_bad_xdr;
1669 	if (xdr_stream_decode_u32(argp->xdr, &sess->flags) < 0)
1670 		return nfserr_bad_xdr;
1671 	status = nfsd4_decode_channel_attrs4(argp, &sess->fore_channel);
1672 	if (status)
1673 		return status;
1674 	status = nfsd4_decode_channel_attrs4(argp, &sess->back_channel);
1675 	if (status)
1676 		return status;
1677 	if (xdr_stream_decode_u32(argp->xdr, &sess->callback_prog) < 0)
1678 		return nfserr_bad_xdr;
1679 	return nfsd4_decode_cb_sec(argp, &sess->cb_sec);
1680 }
1681 
1682 static __be32
nfsd4_decode_destroy_session(struct nfsd4_compoundargs * argp,struct nfsd4_destroy_session * destroy_session)1683 nfsd4_decode_destroy_session(struct nfsd4_compoundargs *argp,
1684 			     struct nfsd4_destroy_session *destroy_session)
1685 {
1686 	return nfsd4_decode_sessionid4(argp, &destroy_session->sessionid);
1687 }
1688 
1689 static __be32
nfsd4_decode_free_stateid(struct nfsd4_compoundargs * argp,struct nfsd4_free_stateid * free_stateid)1690 nfsd4_decode_free_stateid(struct nfsd4_compoundargs *argp,
1691 			  struct nfsd4_free_stateid *free_stateid)
1692 {
1693 	return nfsd4_decode_stateid4(argp, &free_stateid->fr_stateid);
1694 }
1695 
1696 #ifdef CONFIG_NFSD_PNFS
1697 static __be32
nfsd4_decode_getdeviceinfo(struct nfsd4_compoundargs * argp,struct nfsd4_getdeviceinfo * gdev)1698 nfsd4_decode_getdeviceinfo(struct nfsd4_compoundargs *argp,
1699 		struct nfsd4_getdeviceinfo *gdev)
1700 {
1701 	__be32 status;
1702 
1703 	memset(gdev, 0, sizeof(*gdev));
1704 	status = nfsd4_decode_deviceid4(argp, &gdev->gd_devid);
1705 	if (status)
1706 		return status;
1707 	if (xdr_stream_decode_u32(argp->xdr, &gdev->gd_layout_type) < 0)
1708 		return nfserr_bad_xdr;
1709 	if (xdr_stream_decode_u32(argp->xdr, &gdev->gd_maxcount) < 0)
1710 		return nfserr_bad_xdr;
1711 	if (xdr_stream_decode_uint32_array(argp->xdr,
1712 					   &gdev->gd_notify_types, 1) < 0)
1713 		return nfserr_bad_xdr;
1714 
1715 	return nfs_ok;
1716 }
1717 
1718 static __be32
nfsd4_decode_layoutcommit(struct nfsd4_compoundargs * argp,struct nfsd4_layoutcommit * lcp)1719 nfsd4_decode_layoutcommit(struct nfsd4_compoundargs *argp,
1720 			  struct nfsd4_layoutcommit *lcp)
1721 {
1722 	__be32 *p, status;
1723 
1724 	memset(lcp, 0, sizeof(*lcp));
1725 	if (xdr_stream_decode_u64(argp->xdr, &lcp->lc_seg.offset) < 0)
1726 		return nfserr_bad_xdr;
1727 	if (xdr_stream_decode_u64(argp->xdr, &lcp->lc_seg.length) < 0)
1728 		return nfserr_bad_xdr;
1729 	if (xdr_stream_decode_bool(argp->xdr, &lcp->lc_reclaim) < 0)
1730 		return nfserr_bad_xdr;
1731 	status = nfsd4_decode_stateid4(argp, &lcp->lc_sid);
1732 	if (status)
1733 		return status;
1734 	if (xdr_stream_decode_u32(argp->xdr, &lcp->lc_newoffset) < 0)
1735 		return nfserr_bad_xdr;
1736 	if (lcp->lc_newoffset) {
1737 		if (xdr_stream_decode_u64(argp->xdr, &lcp->lc_last_wr) < 0)
1738 			return nfserr_bad_xdr;
1739 	} else
1740 		lcp->lc_last_wr = 0;
1741 	p = xdr_inline_decode(argp->xdr, XDR_UNIT);
1742 	if (!p)
1743 		return nfserr_bad_xdr;
1744 	if (xdr_item_is_present(p)) {
1745 		status = nfsd4_decode_nfstime4(argp, &lcp->lc_mtime);
1746 		if (status)
1747 			return status;
1748 	} else {
1749 		lcp->lc_mtime.tv_nsec = UTIME_NOW;
1750 	}
1751 	return nfsd4_decode_layoutupdate4(argp, lcp);
1752 }
1753 
1754 static __be32
nfsd4_decode_layoutget(struct nfsd4_compoundargs * argp,struct nfsd4_layoutget * lgp)1755 nfsd4_decode_layoutget(struct nfsd4_compoundargs *argp,
1756 		struct nfsd4_layoutget *lgp)
1757 {
1758 	__be32 status;
1759 
1760 	memset(lgp, 0, sizeof(*lgp));
1761 	if (xdr_stream_decode_u32(argp->xdr, &lgp->lg_signal) < 0)
1762 		return nfserr_bad_xdr;
1763 	if (xdr_stream_decode_u32(argp->xdr, &lgp->lg_layout_type) < 0)
1764 		return nfserr_bad_xdr;
1765 	if (xdr_stream_decode_u32(argp->xdr, &lgp->lg_seg.iomode) < 0)
1766 		return nfserr_bad_xdr;
1767 	if (xdr_stream_decode_u64(argp->xdr, &lgp->lg_seg.offset) < 0)
1768 		return nfserr_bad_xdr;
1769 	if (xdr_stream_decode_u64(argp->xdr, &lgp->lg_seg.length) < 0)
1770 		return nfserr_bad_xdr;
1771 	if (xdr_stream_decode_u64(argp->xdr, &lgp->lg_minlength) < 0)
1772 		return nfserr_bad_xdr;
1773 	status = nfsd4_decode_stateid4(argp, &lgp->lg_sid);
1774 	if (status)
1775 		return status;
1776 	if (xdr_stream_decode_u32(argp->xdr, &lgp->lg_maxcount) < 0)
1777 		return nfserr_bad_xdr;
1778 
1779 	return nfs_ok;
1780 }
1781 
1782 static __be32
nfsd4_decode_layoutreturn(struct nfsd4_compoundargs * argp,struct nfsd4_layoutreturn * lrp)1783 nfsd4_decode_layoutreturn(struct nfsd4_compoundargs *argp,
1784 		struct nfsd4_layoutreturn *lrp)
1785 {
1786 	memset(lrp, 0, sizeof(*lrp));
1787 	if (xdr_stream_decode_bool(argp->xdr, &lrp->lr_reclaim) < 0)
1788 		return nfserr_bad_xdr;
1789 	if (xdr_stream_decode_u32(argp->xdr, &lrp->lr_layout_type) < 0)
1790 		return nfserr_bad_xdr;
1791 	if (xdr_stream_decode_u32(argp->xdr, &lrp->lr_seg.iomode) < 0)
1792 		return nfserr_bad_xdr;
1793 	return nfsd4_decode_layoutreturn4(argp, lrp);
1794 }
1795 #endif /* CONFIG_NFSD_PNFS */
1796 
nfsd4_decode_secinfo_no_name(struct nfsd4_compoundargs * argp,struct nfsd4_secinfo_no_name * sin)1797 static __be32 nfsd4_decode_secinfo_no_name(struct nfsd4_compoundargs *argp,
1798 					   struct nfsd4_secinfo_no_name *sin)
1799 {
1800 	if (xdr_stream_decode_u32(argp->xdr, &sin->sin_style) < 0)
1801 		return nfserr_bad_xdr;
1802 
1803 	sin->sin_exp = NULL;
1804 	return nfs_ok;
1805 }
1806 
1807 static __be32
nfsd4_decode_sequence(struct nfsd4_compoundargs * argp,struct nfsd4_sequence * seq)1808 nfsd4_decode_sequence(struct nfsd4_compoundargs *argp,
1809 		      struct nfsd4_sequence *seq)
1810 {
1811 	__be32 *p, status;
1812 
1813 	status = nfsd4_decode_sessionid4(argp, &seq->sessionid);
1814 	if (status)
1815 		return status;
1816 	p = xdr_inline_decode(argp->xdr, XDR_UNIT * 4);
1817 	if (!p)
1818 		return nfserr_bad_xdr;
1819 	seq->seqid = be32_to_cpup(p++);
1820 	seq->slotid = be32_to_cpup(p++);
1821 	seq->maxslots = be32_to_cpup(p++);
1822 	seq->cachethis = be32_to_cpup(p);
1823 
1824 	seq->status_flags = 0;
1825 	return nfs_ok;
1826 }
1827 
1828 static __be32
nfsd4_decode_test_stateid(struct nfsd4_compoundargs * argp,struct nfsd4_test_stateid * test_stateid)1829 nfsd4_decode_test_stateid(struct nfsd4_compoundargs *argp, struct nfsd4_test_stateid *test_stateid)
1830 {
1831 	struct nfsd4_test_stateid_id *stateid;
1832 	__be32 status;
1833 	u32 i;
1834 
1835 	memset(test_stateid, 0, sizeof(*test_stateid));
1836 	if (xdr_stream_decode_u32(argp->xdr, &test_stateid->ts_num_ids) < 0)
1837 		return nfserr_bad_xdr;
1838 
1839 	INIT_LIST_HEAD(&test_stateid->ts_stateid_list);
1840 	for (i = 0; i < test_stateid->ts_num_ids; i++) {
1841 		stateid = svcxdr_tmpalloc(argp, sizeof(*stateid));
1842 		if (!stateid)
1843 			return nfserr_jukebox;
1844 		INIT_LIST_HEAD(&stateid->ts_id_list);
1845 		list_add_tail(&stateid->ts_id_list, &test_stateid->ts_stateid_list);
1846 		status = nfsd4_decode_stateid4(argp, &stateid->ts_id_stateid);
1847 		if (status)
1848 			return status;
1849 	}
1850 
1851 	return nfs_ok;
1852 }
1853 
nfsd4_decode_destroy_clientid(struct nfsd4_compoundargs * argp,struct nfsd4_destroy_clientid * dc)1854 static __be32 nfsd4_decode_destroy_clientid(struct nfsd4_compoundargs *argp,
1855 					    struct nfsd4_destroy_clientid *dc)
1856 {
1857 	return nfsd4_decode_clientid4(argp, &dc->clientid);
1858 }
1859 
nfsd4_decode_reclaim_complete(struct nfsd4_compoundargs * argp,struct nfsd4_reclaim_complete * rc)1860 static __be32 nfsd4_decode_reclaim_complete(struct nfsd4_compoundargs *argp,
1861 					    struct nfsd4_reclaim_complete *rc)
1862 {
1863 	if (xdr_stream_decode_bool(argp->xdr, &rc->rca_one_fs) < 0)
1864 		return nfserr_bad_xdr;
1865 	return nfs_ok;
1866 }
1867 
1868 static __be32
nfsd4_decode_fallocate(struct nfsd4_compoundargs * argp,struct nfsd4_fallocate * fallocate)1869 nfsd4_decode_fallocate(struct nfsd4_compoundargs *argp,
1870 		       struct nfsd4_fallocate *fallocate)
1871 {
1872 	__be32 status;
1873 
1874 	status = nfsd4_decode_stateid4(argp, &fallocate->falloc_stateid);
1875 	if (status)
1876 		return status;
1877 	if (xdr_stream_decode_u64(argp->xdr, &fallocate->falloc_offset) < 0)
1878 		return nfserr_bad_xdr;
1879 	if (xdr_stream_decode_u64(argp->xdr, &fallocate->falloc_length) < 0)
1880 		return nfserr_bad_xdr;
1881 
1882 	return nfs_ok;
1883 }
1884 
nfsd4_decode_nl4_server(struct nfsd4_compoundargs * argp,struct nl4_server * ns)1885 static __be32 nfsd4_decode_nl4_server(struct nfsd4_compoundargs *argp,
1886 				      struct nl4_server *ns)
1887 {
1888 	struct nfs42_netaddr *naddr;
1889 	__be32 *p;
1890 
1891 	if (xdr_stream_decode_u32(argp->xdr, &ns->nl4_type) < 0)
1892 		return nfserr_bad_xdr;
1893 
1894 	/* currently support for 1 inter-server source server */
1895 	switch (ns->nl4_type) {
1896 	case NL4_NETADDR:
1897 		naddr = &ns->u.nl4_addr;
1898 
1899 		if (xdr_stream_decode_u32(argp->xdr, &naddr->netid_len) < 0)
1900 			return nfserr_bad_xdr;
1901 		if (naddr->netid_len > RPCBIND_MAXNETIDLEN)
1902 			return nfserr_bad_xdr;
1903 
1904 		p = xdr_inline_decode(argp->xdr, naddr->netid_len);
1905 		if (!p)
1906 			return nfserr_bad_xdr;
1907 		memcpy(naddr->netid, p, naddr->netid_len);
1908 
1909 		if (xdr_stream_decode_u32(argp->xdr, &naddr->addr_len) < 0)
1910 			return nfserr_bad_xdr;
1911 		if (naddr->addr_len > RPCBIND_MAXUADDRLEN)
1912 			return nfserr_bad_xdr;
1913 
1914 		p = xdr_inline_decode(argp->xdr, naddr->addr_len);
1915 		if (!p)
1916 			return nfserr_bad_xdr;
1917 		memcpy(naddr->addr, p, naddr->addr_len);
1918 		break;
1919 	default:
1920 		return nfserr_bad_xdr;
1921 	}
1922 
1923 	return nfs_ok;
1924 }
1925 
1926 static __be32
nfsd4_decode_copy(struct nfsd4_compoundargs * argp,struct nfsd4_copy * copy)1927 nfsd4_decode_copy(struct nfsd4_compoundargs *argp, struct nfsd4_copy *copy)
1928 {
1929 	u32 consecutive, i, count, sync;
1930 	struct nl4_server *ns_dummy;
1931 	__be32 status;
1932 
1933 	memset(copy, 0, sizeof(*copy));
1934 	status = nfsd4_decode_stateid4(argp, &copy->cp_src_stateid);
1935 	if (status)
1936 		return status;
1937 	status = nfsd4_decode_stateid4(argp, &copy->cp_dst_stateid);
1938 	if (status)
1939 		return status;
1940 	if (xdr_stream_decode_u64(argp->xdr, &copy->cp_src_pos) < 0)
1941 		return nfserr_bad_xdr;
1942 	if (xdr_stream_decode_u64(argp->xdr, &copy->cp_dst_pos) < 0)
1943 		return nfserr_bad_xdr;
1944 	if (xdr_stream_decode_u64(argp->xdr, &copy->cp_count) < 0)
1945 		return nfserr_bad_xdr;
1946 	/* ca_consecutive: we always do consecutive copies */
1947 	if (xdr_stream_decode_u32(argp->xdr, &consecutive) < 0)
1948 		return nfserr_bad_xdr;
1949 	if (xdr_stream_decode_bool(argp->xdr, &sync) < 0)
1950 		return nfserr_bad_xdr;
1951 	nfsd4_copy_set_sync(copy, sync);
1952 
1953 	if (xdr_stream_decode_u32(argp->xdr, &count) < 0)
1954 		return nfserr_bad_xdr;
1955 	copy->cp_src = svcxdr_tmpalloc(argp, sizeof(*copy->cp_src));
1956 	if (copy->cp_src == NULL)
1957 		return nfserr_jukebox;
1958 	if (count == 0) { /* intra-server copy */
1959 		__set_bit(NFSD4_COPY_F_INTRA, &copy->cp_flags);
1960 		return nfs_ok;
1961 	}
1962 
1963 	/* decode all the supplied server addresses but use only the first */
1964 	status = nfsd4_decode_nl4_server(argp, copy->cp_src);
1965 	if (status)
1966 		return status;
1967 
1968 	ns_dummy = kmalloc(sizeof(struct nl4_server), GFP_KERNEL);
1969 	if (ns_dummy == NULL)
1970 		return nfserr_jukebox;
1971 	for (i = 0; i < count - 1; i++) {
1972 		status = nfsd4_decode_nl4_server(argp, ns_dummy);
1973 		if (status) {
1974 			kfree(ns_dummy);
1975 			return status;
1976 		}
1977 	}
1978 	kfree(ns_dummy);
1979 
1980 	return nfs_ok;
1981 }
1982 
1983 static __be32
nfsd4_decode_copy_notify(struct nfsd4_compoundargs * argp,struct nfsd4_copy_notify * cn)1984 nfsd4_decode_copy_notify(struct nfsd4_compoundargs *argp,
1985 			 struct nfsd4_copy_notify *cn)
1986 {
1987 	__be32 status;
1988 
1989 	memset(cn, 0, sizeof(*cn));
1990 	cn->cpn_src = svcxdr_tmpalloc(argp, sizeof(*cn->cpn_src));
1991 	if (cn->cpn_src == NULL)
1992 		return nfserr_jukebox;
1993 	cn->cpn_dst = svcxdr_tmpalloc(argp, sizeof(*cn->cpn_dst));
1994 	if (cn->cpn_dst == NULL)
1995 		return nfserr_jukebox;
1996 
1997 	status = nfsd4_decode_stateid4(argp, &cn->cpn_src_stateid);
1998 	if (status)
1999 		return status;
2000 	return nfsd4_decode_nl4_server(argp, cn->cpn_dst);
2001 }
2002 
2003 static __be32
nfsd4_decode_offload_status(struct nfsd4_compoundargs * argp,struct nfsd4_offload_status * os)2004 nfsd4_decode_offload_status(struct nfsd4_compoundargs *argp,
2005 			    struct nfsd4_offload_status *os)
2006 {
2007 	os->count = 0;
2008 	os->status = 0;
2009 	return nfsd4_decode_stateid4(argp, &os->stateid);
2010 }
2011 
2012 static __be32
nfsd4_decode_seek(struct nfsd4_compoundargs * argp,struct nfsd4_seek * seek)2013 nfsd4_decode_seek(struct nfsd4_compoundargs *argp, struct nfsd4_seek *seek)
2014 {
2015 	__be32 status;
2016 
2017 	status = nfsd4_decode_stateid4(argp, &seek->seek_stateid);
2018 	if (status)
2019 		return status;
2020 	if (xdr_stream_decode_u64(argp->xdr, &seek->seek_offset) < 0)
2021 		return nfserr_bad_xdr;
2022 	if (xdr_stream_decode_u32(argp->xdr, &seek->seek_whence) < 0)
2023 		return nfserr_bad_xdr;
2024 
2025 	seek->seek_eof = 0;
2026 	seek->seek_pos = 0;
2027 	return nfs_ok;
2028 }
2029 
2030 static __be32
nfsd4_decode_clone(struct nfsd4_compoundargs * argp,struct nfsd4_clone * clone)2031 nfsd4_decode_clone(struct nfsd4_compoundargs *argp, struct nfsd4_clone *clone)
2032 {
2033 	__be32 status;
2034 
2035 	status = nfsd4_decode_stateid4(argp, &clone->cl_src_stateid);
2036 	if (status)
2037 		return status;
2038 	status = nfsd4_decode_stateid4(argp, &clone->cl_dst_stateid);
2039 	if (status)
2040 		return status;
2041 	if (xdr_stream_decode_u64(argp->xdr, &clone->cl_src_pos) < 0)
2042 		return nfserr_bad_xdr;
2043 	if (xdr_stream_decode_u64(argp->xdr, &clone->cl_dst_pos) < 0)
2044 		return nfserr_bad_xdr;
2045 	if (xdr_stream_decode_u64(argp->xdr, &clone->cl_count) < 0)
2046 		return nfserr_bad_xdr;
2047 
2048 	return nfs_ok;
2049 }
2050 
2051 /*
2052  * XDR data that is more than PAGE_SIZE in size is normally part of a
2053  * read or write. However, the size of extended attributes is limited
2054  * by the maximum request size, and then further limited by the underlying
2055  * filesystem limits. This can exceed PAGE_SIZE (currently, XATTR_SIZE_MAX
2056  * is 64k). Since there is no kvec- or page-based interface to xattrs,
2057  * and we're not dealing with contiguous pages, we need to do some copying.
2058  */
2059 
2060 /*
2061  * Decode data into buffer.
2062  */
2063 static __be32
nfsd4_vbuf_from_vector(struct nfsd4_compoundargs * argp,struct xdr_buf * xdr,char ** bufp,u32 buflen)2064 nfsd4_vbuf_from_vector(struct nfsd4_compoundargs *argp, struct xdr_buf *xdr,
2065 		       char **bufp, u32 buflen)
2066 {
2067 	struct page **pages = xdr->pages;
2068 	struct kvec *head = xdr->head;
2069 	char *tmp, *dp;
2070 	u32 len;
2071 
2072 	if (buflen <= head->iov_len) {
2073 		/*
2074 		 * We're in luck, the head has enough space. Just return
2075 		 * the head, no need for copying.
2076 		 */
2077 		*bufp = head->iov_base;
2078 		return 0;
2079 	}
2080 
2081 	tmp = svcxdr_tmpalloc(argp, buflen);
2082 	if (tmp == NULL)
2083 		return nfserr_jukebox;
2084 
2085 	dp = tmp;
2086 	memcpy(dp, head->iov_base, head->iov_len);
2087 	buflen -= head->iov_len;
2088 	dp += head->iov_len;
2089 
2090 	while (buflen > 0) {
2091 		len = min_t(u32, buflen, PAGE_SIZE);
2092 		memcpy(dp, page_address(*pages), len);
2093 
2094 		buflen -= len;
2095 		dp += len;
2096 		pages++;
2097 	}
2098 
2099 	*bufp = tmp;
2100 	return 0;
2101 }
2102 
2103 /*
2104  * Get a user extended attribute name from the XDR buffer.
2105  * It will not have the "user." prefix, so prepend it.
2106  * Lastly, check for nul characters in the name.
2107  */
2108 static __be32
nfsd4_decode_xattr_name(struct nfsd4_compoundargs * argp,char ** namep)2109 nfsd4_decode_xattr_name(struct nfsd4_compoundargs *argp, char **namep)
2110 {
2111 	char *name, *sp, *dp;
2112 	u32 namelen, cnt;
2113 	__be32 *p;
2114 
2115 	if (xdr_stream_decode_u32(argp->xdr, &namelen) < 0)
2116 		return nfserr_bad_xdr;
2117 	if (namelen > (XATTR_NAME_MAX - XATTR_USER_PREFIX_LEN))
2118 		return nfserr_nametoolong;
2119 	if (namelen == 0)
2120 		return nfserr_bad_xdr;
2121 	p = xdr_inline_decode(argp->xdr, namelen);
2122 	if (!p)
2123 		return nfserr_bad_xdr;
2124 	name = svcxdr_tmpalloc(argp, namelen + XATTR_USER_PREFIX_LEN + 1);
2125 	if (!name)
2126 		return nfserr_jukebox;
2127 	memcpy(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN);
2128 
2129 	/*
2130 	 * Copy the extended attribute name over while checking for 0
2131 	 * characters.
2132 	 */
2133 	sp = (char *)p;
2134 	dp = name + XATTR_USER_PREFIX_LEN;
2135 	cnt = namelen;
2136 
2137 	while (cnt-- > 0) {
2138 		if (*sp == '\0')
2139 			return nfserr_bad_xdr;
2140 		*dp++ = *sp++;
2141 	}
2142 	*dp = '\0';
2143 
2144 	*namep = name;
2145 
2146 	return nfs_ok;
2147 }
2148 
2149 /*
2150  * A GETXATTR op request comes without a length specifier. We just set the
2151  * maximum length for the reply based on XATTR_SIZE_MAX and the maximum
2152  * channel reply size. nfsd_getxattr will probe the length of the xattr,
2153  * check it against getxa_len, and allocate + return the value.
2154  */
2155 static __be32
nfsd4_decode_getxattr(struct nfsd4_compoundargs * argp,struct nfsd4_getxattr * getxattr)2156 nfsd4_decode_getxattr(struct nfsd4_compoundargs *argp,
2157 		      struct nfsd4_getxattr *getxattr)
2158 {
2159 	__be32 status;
2160 	u32 maxcount;
2161 
2162 	memset(getxattr, 0, sizeof(*getxattr));
2163 	status = nfsd4_decode_xattr_name(argp, &getxattr->getxa_name);
2164 	if (status)
2165 		return status;
2166 
2167 	maxcount = svc_max_payload(argp->rqstp);
2168 	maxcount = min_t(u32, XATTR_SIZE_MAX, maxcount);
2169 
2170 	getxattr->getxa_len = maxcount;
2171 	return nfs_ok;
2172 }
2173 
2174 static __be32
nfsd4_decode_setxattr(struct nfsd4_compoundargs * argp,struct nfsd4_setxattr * setxattr)2175 nfsd4_decode_setxattr(struct nfsd4_compoundargs *argp,
2176 		      struct nfsd4_setxattr *setxattr)
2177 {
2178 	u32 flags, maxcount, size;
2179 	__be32 status;
2180 
2181 	memset(setxattr, 0, sizeof(*setxattr));
2182 
2183 	if (xdr_stream_decode_u32(argp->xdr, &flags) < 0)
2184 		return nfserr_bad_xdr;
2185 
2186 	if (flags > SETXATTR4_REPLACE)
2187 		return nfserr_inval;
2188 	setxattr->setxa_flags = flags;
2189 
2190 	status = nfsd4_decode_xattr_name(argp, &setxattr->setxa_name);
2191 	if (status)
2192 		return status;
2193 
2194 	maxcount = svc_max_payload(argp->rqstp);
2195 	maxcount = min_t(u32, XATTR_SIZE_MAX, maxcount);
2196 
2197 	if (xdr_stream_decode_u32(argp->xdr, &size) < 0)
2198 		return nfserr_bad_xdr;
2199 	if (size > maxcount)
2200 		return nfserr_xattr2big;
2201 
2202 	setxattr->setxa_len = size;
2203 	if (size > 0) {
2204 		struct xdr_buf payload;
2205 
2206 		if (!xdr_stream_subsegment(argp->xdr, &payload, size))
2207 			return nfserr_bad_xdr;
2208 		status = nfsd4_vbuf_from_vector(argp, &payload,
2209 						&setxattr->setxa_buf, size);
2210 	}
2211 
2212 	return nfs_ok;
2213 }
2214 
2215 static __be32
nfsd4_decode_listxattrs(struct nfsd4_compoundargs * argp,struct nfsd4_listxattrs * listxattrs)2216 nfsd4_decode_listxattrs(struct nfsd4_compoundargs *argp,
2217 			struct nfsd4_listxattrs *listxattrs)
2218 {
2219 	u32 maxcount;
2220 
2221 	memset(listxattrs, 0, sizeof(*listxattrs));
2222 
2223 	if (xdr_stream_decode_u64(argp->xdr, &listxattrs->lsxa_cookie) < 0)
2224 		return nfserr_bad_xdr;
2225 
2226 	/*
2227 	 * If the cookie  is too large to have even one user.x attribute
2228 	 * plus trailing '\0' left in a maximum size buffer, it's invalid.
2229 	 */
2230 	if (listxattrs->lsxa_cookie >=
2231 	    (XATTR_LIST_MAX / (XATTR_USER_PREFIX_LEN + 2)))
2232 		return nfserr_badcookie;
2233 
2234 	if (xdr_stream_decode_u32(argp->xdr, &maxcount) < 0)
2235 		return nfserr_bad_xdr;
2236 	if (maxcount < 8)
2237 		/* Always need at least 2 words (length and one character) */
2238 		return nfserr_inval;
2239 
2240 	maxcount = min(maxcount, svc_max_payload(argp->rqstp));
2241 	listxattrs->lsxa_maxcount = maxcount;
2242 
2243 	return nfs_ok;
2244 }
2245 
2246 static __be32
nfsd4_decode_removexattr(struct nfsd4_compoundargs * argp,struct nfsd4_removexattr * removexattr)2247 nfsd4_decode_removexattr(struct nfsd4_compoundargs *argp,
2248 			 struct nfsd4_removexattr *removexattr)
2249 {
2250 	memset(removexattr, 0, sizeof(*removexattr));
2251 	return nfsd4_decode_xattr_name(argp, &removexattr->rmxa_name);
2252 }
2253 
2254 static __be32
nfsd4_decode_noop(struct nfsd4_compoundargs * argp,void * p)2255 nfsd4_decode_noop(struct nfsd4_compoundargs *argp, void *p)
2256 {
2257 	return nfs_ok;
2258 }
2259 
2260 static __be32
nfsd4_decode_notsupp(struct nfsd4_compoundargs * argp,void * p)2261 nfsd4_decode_notsupp(struct nfsd4_compoundargs *argp, void *p)
2262 {
2263 	return nfserr_notsupp;
2264 }
2265 
2266 typedef __be32(*nfsd4_dec)(struct nfsd4_compoundargs *argp, void *);
2267 
2268 static const nfsd4_dec nfsd4_dec_ops[] = {
2269 	[OP_ACCESS]		= (nfsd4_dec)nfsd4_decode_access,
2270 	[OP_CLOSE]		= (nfsd4_dec)nfsd4_decode_close,
2271 	[OP_COMMIT]		= (nfsd4_dec)nfsd4_decode_commit,
2272 	[OP_CREATE]		= (nfsd4_dec)nfsd4_decode_create,
2273 	[OP_DELEGPURGE]		= (nfsd4_dec)nfsd4_decode_notsupp,
2274 	[OP_DELEGRETURN]	= (nfsd4_dec)nfsd4_decode_delegreturn,
2275 	[OP_GETATTR]		= (nfsd4_dec)nfsd4_decode_getattr,
2276 	[OP_GETFH]		= (nfsd4_dec)nfsd4_decode_noop,
2277 	[OP_LINK]		= (nfsd4_dec)nfsd4_decode_link,
2278 	[OP_LOCK]		= (nfsd4_dec)nfsd4_decode_lock,
2279 	[OP_LOCKT]		= (nfsd4_dec)nfsd4_decode_lockt,
2280 	[OP_LOCKU]		= (nfsd4_dec)nfsd4_decode_locku,
2281 	[OP_LOOKUP]		= (nfsd4_dec)nfsd4_decode_lookup,
2282 	[OP_LOOKUPP]		= (nfsd4_dec)nfsd4_decode_noop,
2283 	[OP_NVERIFY]		= (nfsd4_dec)nfsd4_decode_verify,
2284 	[OP_OPEN]		= (nfsd4_dec)nfsd4_decode_open,
2285 	[OP_OPENATTR]		= (nfsd4_dec)nfsd4_decode_notsupp,
2286 	[OP_OPEN_CONFIRM]	= (nfsd4_dec)nfsd4_decode_open_confirm,
2287 	[OP_OPEN_DOWNGRADE]	= (nfsd4_dec)nfsd4_decode_open_downgrade,
2288 	[OP_PUTFH]		= (nfsd4_dec)nfsd4_decode_putfh,
2289 	[OP_PUTPUBFH]		= (nfsd4_dec)nfsd4_decode_putpubfh,
2290 	[OP_PUTROOTFH]		= (nfsd4_dec)nfsd4_decode_noop,
2291 	[OP_READ]		= (nfsd4_dec)nfsd4_decode_read,
2292 	[OP_READDIR]		= (nfsd4_dec)nfsd4_decode_readdir,
2293 	[OP_READLINK]		= (nfsd4_dec)nfsd4_decode_noop,
2294 	[OP_REMOVE]		= (nfsd4_dec)nfsd4_decode_remove,
2295 	[OP_RENAME]		= (nfsd4_dec)nfsd4_decode_rename,
2296 	[OP_RENEW]		= (nfsd4_dec)nfsd4_decode_renew,
2297 	[OP_RESTOREFH]		= (nfsd4_dec)nfsd4_decode_noop,
2298 	[OP_SAVEFH]		= (nfsd4_dec)nfsd4_decode_noop,
2299 	[OP_SECINFO]		= (nfsd4_dec)nfsd4_decode_secinfo,
2300 	[OP_SETATTR]		= (nfsd4_dec)nfsd4_decode_setattr,
2301 	[OP_SETCLIENTID]	= (nfsd4_dec)nfsd4_decode_setclientid,
2302 	[OP_SETCLIENTID_CONFIRM] = (nfsd4_dec)nfsd4_decode_setclientid_confirm,
2303 	[OP_VERIFY]		= (nfsd4_dec)nfsd4_decode_verify,
2304 	[OP_WRITE]		= (nfsd4_dec)nfsd4_decode_write,
2305 	[OP_RELEASE_LOCKOWNER]	= (nfsd4_dec)nfsd4_decode_release_lockowner,
2306 
2307 	/* new operations for NFSv4.1 */
2308 	[OP_BACKCHANNEL_CTL]	= (nfsd4_dec)nfsd4_decode_backchannel_ctl,
2309 	[OP_BIND_CONN_TO_SESSION]= (nfsd4_dec)nfsd4_decode_bind_conn_to_session,
2310 	[OP_EXCHANGE_ID]	= (nfsd4_dec)nfsd4_decode_exchange_id,
2311 	[OP_CREATE_SESSION]	= (nfsd4_dec)nfsd4_decode_create_session,
2312 	[OP_DESTROY_SESSION]	= (nfsd4_dec)nfsd4_decode_destroy_session,
2313 	[OP_FREE_STATEID]	= (nfsd4_dec)nfsd4_decode_free_stateid,
2314 	[OP_GET_DIR_DELEGATION]	= (nfsd4_dec)nfsd4_decode_notsupp,
2315 #ifdef CONFIG_NFSD_PNFS
2316 	[OP_GETDEVICEINFO]	= (nfsd4_dec)nfsd4_decode_getdeviceinfo,
2317 	[OP_GETDEVICELIST]	= (nfsd4_dec)nfsd4_decode_notsupp,
2318 	[OP_LAYOUTCOMMIT]	= (nfsd4_dec)nfsd4_decode_layoutcommit,
2319 	[OP_LAYOUTGET]		= (nfsd4_dec)nfsd4_decode_layoutget,
2320 	[OP_LAYOUTRETURN]	= (nfsd4_dec)nfsd4_decode_layoutreturn,
2321 #else
2322 	[OP_GETDEVICEINFO]	= (nfsd4_dec)nfsd4_decode_notsupp,
2323 	[OP_GETDEVICELIST]	= (nfsd4_dec)nfsd4_decode_notsupp,
2324 	[OP_LAYOUTCOMMIT]	= (nfsd4_dec)nfsd4_decode_notsupp,
2325 	[OP_LAYOUTGET]		= (nfsd4_dec)nfsd4_decode_notsupp,
2326 	[OP_LAYOUTRETURN]	= (nfsd4_dec)nfsd4_decode_notsupp,
2327 #endif
2328 	[OP_SECINFO_NO_NAME]	= (nfsd4_dec)nfsd4_decode_secinfo_no_name,
2329 	[OP_SEQUENCE]		= (nfsd4_dec)nfsd4_decode_sequence,
2330 	[OP_SET_SSV]		= (nfsd4_dec)nfsd4_decode_notsupp,
2331 	[OP_TEST_STATEID]	= (nfsd4_dec)nfsd4_decode_test_stateid,
2332 	[OP_WANT_DELEGATION]	= (nfsd4_dec)nfsd4_decode_notsupp,
2333 	[OP_DESTROY_CLIENTID]	= (nfsd4_dec)nfsd4_decode_destroy_clientid,
2334 	[OP_RECLAIM_COMPLETE]	= (nfsd4_dec)nfsd4_decode_reclaim_complete,
2335 
2336 	/* new operations for NFSv4.2 */
2337 	[OP_ALLOCATE]		= (nfsd4_dec)nfsd4_decode_fallocate,
2338 	[OP_COPY]		= (nfsd4_dec)nfsd4_decode_copy,
2339 	[OP_COPY_NOTIFY]	= (nfsd4_dec)nfsd4_decode_copy_notify,
2340 	[OP_DEALLOCATE]		= (nfsd4_dec)nfsd4_decode_fallocate,
2341 	[OP_IO_ADVISE]		= (nfsd4_dec)nfsd4_decode_notsupp,
2342 	[OP_LAYOUTERROR]	= (nfsd4_dec)nfsd4_decode_notsupp,
2343 	[OP_LAYOUTSTATS]	= (nfsd4_dec)nfsd4_decode_notsupp,
2344 	[OP_OFFLOAD_CANCEL]	= (nfsd4_dec)nfsd4_decode_offload_status,
2345 	[OP_OFFLOAD_STATUS]	= (nfsd4_dec)nfsd4_decode_offload_status,
2346 	[OP_READ_PLUS]		= (nfsd4_dec)nfsd4_decode_read,
2347 	[OP_SEEK]		= (nfsd4_dec)nfsd4_decode_seek,
2348 	[OP_WRITE_SAME]		= (nfsd4_dec)nfsd4_decode_notsupp,
2349 	[OP_CLONE]		= (nfsd4_dec)nfsd4_decode_clone,
2350 	/* RFC 8276 extended atributes operations */
2351 	[OP_GETXATTR]		= (nfsd4_dec)nfsd4_decode_getxattr,
2352 	[OP_SETXATTR]		= (nfsd4_dec)nfsd4_decode_setxattr,
2353 	[OP_LISTXATTRS]		= (nfsd4_dec)nfsd4_decode_listxattrs,
2354 	[OP_REMOVEXATTR]	= (nfsd4_dec)nfsd4_decode_removexattr,
2355 };
2356 
2357 static inline bool
nfsd4_opnum_in_range(struct nfsd4_compoundargs * argp,struct nfsd4_op * op)2358 nfsd4_opnum_in_range(struct nfsd4_compoundargs *argp, struct nfsd4_op *op)
2359 {
2360 	if (op->opnum < FIRST_NFS4_OP)
2361 		return false;
2362 	else if (argp->minorversion == 0 && op->opnum > LAST_NFS40_OP)
2363 		return false;
2364 	else if (argp->minorversion == 1 && op->opnum > LAST_NFS41_OP)
2365 		return false;
2366 	else if (argp->minorversion == 2 && op->opnum > LAST_NFS42_OP)
2367 		return false;
2368 	return true;
2369 }
2370 
2371 static bool
nfsd4_decode_compound(struct nfsd4_compoundargs * argp)2372 nfsd4_decode_compound(struct nfsd4_compoundargs *argp)
2373 {
2374 	struct nfsd4_op *op;
2375 	bool cachethis = false;
2376 	int auth_slack= argp->rqstp->rq_auth_slack;
2377 	int max_reply = auth_slack + 8; /* opcnt, status */
2378 	int readcount = 0;
2379 	int readbytes = 0;
2380 	__be32 *p;
2381 	int i;
2382 
2383 	if (xdr_stream_decode_u32(argp->xdr, &argp->taglen) < 0)
2384 		return false;
2385 	max_reply += XDR_UNIT;
2386 	argp->tag = NULL;
2387 	if (unlikely(argp->taglen)) {
2388 		if (argp->taglen > NFSD4_MAX_TAGLEN)
2389 			return false;
2390 		p = xdr_inline_decode(argp->xdr, argp->taglen);
2391 		if (!p)
2392 			return false;
2393 		argp->tag = svcxdr_savemem(argp, p, argp->taglen);
2394 		if (!argp->tag)
2395 			return false;
2396 		max_reply += xdr_align_size(argp->taglen);
2397 	}
2398 
2399 	if (xdr_stream_decode_u32(argp->xdr, &argp->minorversion) < 0)
2400 		return false;
2401 	if (xdr_stream_decode_u32(argp->xdr, &argp->client_opcnt) < 0)
2402 		return false;
2403 	argp->opcnt = min_t(u32, argp->client_opcnt,
2404 			    NFSD_MAX_OPS_PER_COMPOUND);
2405 
2406 	if (argp->opcnt > ARRAY_SIZE(argp->iops)) {
2407 		argp->ops = vcalloc(argp->opcnt, sizeof(*argp->ops));
2408 		if (!argp->ops) {
2409 			argp->ops = argp->iops;
2410 			return false;
2411 		}
2412 	}
2413 
2414 	if (argp->minorversion > NFSD_SUPPORTED_MINOR_VERSION)
2415 		argp->opcnt = 0;
2416 
2417 	for (i = 0; i < argp->opcnt; i++) {
2418 		op = &argp->ops[i];
2419 		op->replay = NULL;
2420 
2421 		if (xdr_stream_decode_u32(argp->xdr, &op->opnum) < 0)
2422 			return false;
2423 		if (nfsd4_opnum_in_range(argp, op)) {
2424 			op->status = nfsd4_dec_ops[op->opnum](argp, &op->u);
2425 			if (op->status != nfs_ok)
2426 				trace_nfsd_compound_decode_err(argp->rqstp,
2427 							       argp->opcnt, i,
2428 							       op->opnum,
2429 							       op->status);
2430 		} else {
2431 			op->opnum = OP_ILLEGAL;
2432 			op->status = nfserr_op_illegal;
2433 		}
2434 		op->opdesc = OPDESC(op);
2435 		/*
2436 		 * We'll try to cache the result in the DRC if any one
2437 		 * op in the compound wants to be cached:
2438 		 */
2439 		cachethis |= nfsd4_cache_this_op(op);
2440 
2441 		if (op->opnum == OP_READ || op->opnum == OP_READ_PLUS) {
2442 			readcount++;
2443 			readbytes += nfsd4_max_reply(argp->rqstp, op);
2444 		} else
2445 			max_reply += nfsd4_max_reply(argp->rqstp, op);
2446 		/*
2447 		 * OP_LOCK and OP_LOCKT may return a conflicting lock.
2448 		 * (Special case because it will just skip encoding this
2449 		 * if it runs out of xdr buffer space, and it is the only
2450 		 * operation that behaves this way.)
2451 		 */
2452 		if (op->opnum == OP_LOCK || op->opnum == OP_LOCKT)
2453 			max_reply += NFS4_OPAQUE_LIMIT;
2454 
2455 		if (op->status) {
2456 			argp->opcnt = i+1;
2457 			break;
2458 		}
2459 	}
2460 	/* Sessions make the DRC unnecessary: */
2461 	if (argp->minorversion)
2462 		cachethis = false;
2463 	svc_reserve(argp->rqstp, max_reply + readbytes);
2464 	argp->rqstp->rq_cachetype = cachethis ? RC_REPLBUFF : RC_NOCACHE;
2465 
2466 	if (readcount > 1 || max_reply > PAGE_SIZE - auth_slack)
2467 		clear_bit(RQ_SPLICE_OK, &argp->rqstp->rq_flags);
2468 
2469 	return true;
2470 }
2471 
encode_change(__be32 * p,struct kstat * stat,struct inode * inode,struct svc_export * exp)2472 static __be32 *encode_change(__be32 *p, struct kstat *stat, struct inode *inode,
2473 			     struct svc_export *exp)
2474 {
2475 	if (exp->ex_flags & NFSEXP_V4ROOT) {
2476 		*p++ = cpu_to_be32(convert_to_wallclock(exp->cd->flush_time));
2477 		*p++ = 0;
2478 	} else
2479 		p = xdr_encode_hyper(p, nfsd4_change_attribute(stat, inode));
2480 	return p;
2481 }
2482 
2483 /*
2484  * ctime (in NFSv4, time_metadata) is not writeable, and the client
2485  * doesn't really care what resolution could theoretically be stored by
2486  * the filesystem.
2487  *
2488  * The client cares how close together changes can be while still
2489  * guaranteeing ctime changes.  For most filesystems (which have
2490  * timestamps with nanosecond fields) that is limited by the resolution
2491  * of the time returned from current_time() (which I'm assuming to be
2492  * 1/HZ).
2493  */
encode_time_delta(__be32 * p,struct inode * inode)2494 static __be32 *encode_time_delta(__be32 *p, struct inode *inode)
2495 {
2496 	struct timespec64 ts;
2497 	u32 ns;
2498 
2499 	ns = max_t(u32, NSEC_PER_SEC/HZ, inode->i_sb->s_time_gran);
2500 	ts = ns_to_timespec64(ns);
2501 
2502 	p = xdr_encode_hyper(p, ts.tv_sec);
2503 	*p++ = cpu_to_be32(ts.tv_nsec);
2504 
2505 	return p;
2506 }
2507 
encode_cinfo(__be32 * p,struct nfsd4_change_info * c)2508 static __be32 *encode_cinfo(__be32 *p, struct nfsd4_change_info *c)
2509 {
2510 	*p++ = cpu_to_be32(c->atomic);
2511 	p = xdr_encode_hyper(p, c->before_change);
2512 	p = xdr_encode_hyper(p, c->after_change);
2513 	return p;
2514 }
2515 
2516 /* Encode as an array of strings the string given with components
2517  * separated @sep, escaped with esc_enter and esc_exit.
2518  */
nfsd4_encode_components_esc(struct xdr_stream * xdr,char sep,char * components,char esc_enter,char esc_exit)2519 static __be32 nfsd4_encode_components_esc(struct xdr_stream *xdr, char sep,
2520 					  char *components, char esc_enter,
2521 					  char esc_exit)
2522 {
2523 	__be32 *p;
2524 	__be32 pathlen;
2525 	int pathlen_offset;
2526 	int strlen, count=0;
2527 	char *str, *end, *next;
2528 
2529 	dprintk("nfsd4_encode_components(%s)\n", components);
2530 
2531 	pathlen_offset = xdr->buf->len;
2532 	p = xdr_reserve_space(xdr, 4);
2533 	if (!p)
2534 		return nfserr_resource;
2535 	p++; /* We will fill this in with @count later */
2536 
2537 	end = str = components;
2538 	while (*end) {
2539 		bool found_esc = false;
2540 
2541 		/* try to parse as esc_start, ..., esc_end, sep */
2542 		if (*str == esc_enter) {
2543 			for (; *end && (*end != esc_exit); end++)
2544 				/* find esc_exit or end of string */;
2545 			next = end + 1;
2546 			if (*end && (!*next || *next == sep)) {
2547 				str++;
2548 				found_esc = true;
2549 			}
2550 		}
2551 
2552 		if (!found_esc)
2553 			for (; *end && (*end != sep); end++)
2554 				/* find sep or end of string */;
2555 
2556 		strlen = end - str;
2557 		if (strlen) {
2558 			p = xdr_reserve_space(xdr, strlen + 4);
2559 			if (!p)
2560 				return nfserr_resource;
2561 			p = xdr_encode_opaque(p, str, strlen);
2562 			count++;
2563 		}
2564 		else
2565 			end++;
2566 		if (found_esc)
2567 			end = next;
2568 
2569 		str = end;
2570 	}
2571 	pathlen = htonl(count);
2572 	write_bytes_to_xdr_buf(xdr->buf, pathlen_offset, &pathlen, 4);
2573 	return 0;
2574 }
2575 
2576 /* Encode as an array of strings the string given with components
2577  * separated @sep.
2578  */
nfsd4_encode_components(struct xdr_stream * xdr,char sep,char * components)2579 static __be32 nfsd4_encode_components(struct xdr_stream *xdr, char sep,
2580 				      char *components)
2581 {
2582 	return nfsd4_encode_components_esc(xdr, sep, components, 0, 0);
2583 }
2584 
2585 /*
2586  * encode a location element of a fs_locations structure
2587  */
nfsd4_encode_fs_location4(struct xdr_stream * xdr,struct nfsd4_fs_location * location)2588 static __be32 nfsd4_encode_fs_location4(struct xdr_stream *xdr,
2589 					struct nfsd4_fs_location *location)
2590 {
2591 	__be32 status;
2592 
2593 	status = nfsd4_encode_components_esc(xdr, ':', location->hosts,
2594 						'[', ']');
2595 	if (status)
2596 		return status;
2597 	status = nfsd4_encode_components(xdr, '/', location->path);
2598 	if (status)
2599 		return status;
2600 	return 0;
2601 }
2602 
2603 /*
2604  * Encode a path in RFC3530 'pathname4' format
2605  */
nfsd4_encode_path(struct xdr_stream * xdr,const struct path * root,const struct path * path)2606 static __be32 nfsd4_encode_path(struct xdr_stream *xdr,
2607 				const struct path *root,
2608 				const struct path *path)
2609 {
2610 	struct path cur = *path;
2611 	__be32 *p;
2612 	struct dentry **components = NULL;
2613 	unsigned int ncomponents = 0;
2614 	__be32 err = nfserr_jukebox;
2615 
2616 	dprintk("nfsd4_encode_components(");
2617 
2618 	path_get(&cur);
2619 	/* First walk the path up to the nfsd root, and store the
2620 	 * dentries/path components in an array.
2621 	 */
2622 	for (;;) {
2623 		if (path_equal(&cur, root))
2624 			break;
2625 		if (cur.dentry == cur.mnt->mnt_root) {
2626 			if (follow_up(&cur))
2627 				continue;
2628 			goto out_free;
2629 		}
2630 		if ((ncomponents & 15) == 0) {
2631 			struct dentry **new;
2632 			new = krealloc(components,
2633 					sizeof(*new) * (ncomponents + 16),
2634 					GFP_KERNEL);
2635 			if (!new)
2636 				goto out_free;
2637 			components = new;
2638 		}
2639 		components[ncomponents++] = cur.dentry;
2640 		cur.dentry = dget_parent(cur.dentry);
2641 	}
2642 	err = nfserr_resource;
2643 	p = xdr_reserve_space(xdr, 4);
2644 	if (!p)
2645 		goto out_free;
2646 	*p++ = cpu_to_be32(ncomponents);
2647 
2648 	while (ncomponents) {
2649 		struct dentry *dentry = components[ncomponents - 1];
2650 		unsigned int len;
2651 
2652 		spin_lock(&dentry->d_lock);
2653 		len = dentry->d_name.len;
2654 		p = xdr_reserve_space(xdr, len + 4);
2655 		if (!p) {
2656 			spin_unlock(&dentry->d_lock);
2657 			goto out_free;
2658 		}
2659 		p = xdr_encode_opaque(p, dentry->d_name.name, len);
2660 		dprintk("/%pd", dentry);
2661 		spin_unlock(&dentry->d_lock);
2662 		dput(dentry);
2663 		ncomponents--;
2664 	}
2665 
2666 	err = 0;
2667 out_free:
2668 	dprintk(")\n");
2669 	while (ncomponents)
2670 		dput(components[--ncomponents]);
2671 	kfree(components);
2672 	path_put(&cur);
2673 	return err;
2674 }
2675 
nfsd4_encode_fsloc_fsroot(struct xdr_stream * xdr,struct svc_rqst * rqstp,const struct path * path)2676 static __be32 nfsd4_encode_fsloc_fsroot(struct xdr_stream *xdr,
2677 			struct svc_rqst *rqstp, const struct path *path)
2678 {
2679 	struct svc_export *exp_ps;
2680 	__be32 res;
2681 
2682 	exp_ps = rqst_find_fsidzero_export(rqstp);
2683 	if (IS_ERR(exp_ps))
2684 		return nfserrno(PTR_ERR(exp_ps));
2685 	res = nfsd4_encode_path(xdr, &exp_ps->ex_path, path);
2686 	exp_put(exp_ps);
2687 	return res;
2688 }
2689 
2690 /*
2691  *  encode a fs_locations structure
2692  */
nfsd4_encode_fs_locations(struct xdr_stream * xdr,struct svc_rqst * rqstp,struct svc_export * exp)2693 static __be32 nfsd4_encode_fs_locations(struct xdr_stream *xdr,
2694 			struct svc_rqst *rqstp, struct svc_export *exp)
2695 {
2696 	__be32 status;
2697 	int i;
2698 	__be32 *p;
2699 	struct nfsd4_fs_locations *fslocs = &exp->ex_fslocs;
2700 
2701 	status = nfsd4_encode_fsloc_fsroot(xdr, rqstp, &exp->ex_path);
2702 	if (status)
2703 		return status;
2704 	p = xdr_reserve_space(xdr, 4);
2705 	if (!p)
2706 		return nfserr_resource;
2707 	*p++ = cpu_to_be32(fslocs->locations_count);
2708 	for (i=0; i<fslocs->locations_count; i++) {
2709 		status = nfsd4_encode_fs_location4(xdr, &fslocs->locations[i]);
2710 		if (status)
2711 			return status;
2712 	}
2713 	return 0;
2714 }
2715 
nfs4_file_type(umode_t mode)2716 static u32 nfs4_file_type(umode_t mode)
2717 {
2718 	switch (mode & S_IFMT) {
2719 	case S_IFIFO:	return NF4FIFO;
2720 	case S_IFCHR:	return NF4CHR;
2721 	case S_IFDIR:	return NF4DIR;
2722 	case S_IFBLK:	return NF4BLK;
2723 	case S_IFLNK:	return NF4LNK;
2724 	case S_IFREG:	return NF4REG;
2725 	case S_IFSOCK:	return NF4SOCK;
2726 	default:	return NF4BAD;
2727 	}
2728 }
2729 
2730 static inline __be32
nfsd4_encode_aclname(struct xdr_stream * xdr,struct svc_rqst * rqstp,struct nfs4_ace * ace)2731 nfsd4_encode_aclname(struct xdr_stream *xdr, struct svc_rqst *rqstp,
2732 		     struct nfs4_ace *ace)
2733 {
2734 	if (ace->whotype != NFS4_ACL_WHO_NAMED)
2735 		return nfs4_acl_write_who(xdr, ace->whotype);
2736 	else if (ace->flag & NFS4_ACE_IDENTIFIER_GROUP)
2737 		return nfsd4_encode_group(xdr, rqstp, ace->who_gid);
2738 	else
2739 		return nfsd4_encode_user(xdr, rqstp, ace->who_uid);
2740 }
2741 
2742 static inline __be32
nfsd4_encode_layout_types(struct xdr_stream * xdr,u32 layout_types)2743 nfsd4_encode_layout_types(struct xdr_stream *xdr, u32 layout_types)
2744 {
2745 	__be32		*p;
2746 	unsigned long	i = hweight_long(layout_types);
2747 
2748 	p = xdr_reserve_space(xdr, 4 + 4 * i);
2749 	if (!p)
2750 		return nfserr_resource;
2751 
2752 	*p++ = cpu_to_be32(i);
2753 
2754 	for (i = LAYOUT_NFSV4_1_FILES; i < LAYOUT_TYPE_MAX; ++i)
2755 		if (layout_types & (1 << i))
2756 			*p++ = cpu_to_be32(i);
2757 
2758 	return 0;
2759 }
2760 
2761 #define WORD0_ABSENT_FS_ATTRS (FATTR4_WORD0_FS_LOCATIONS | FATTR4_WORD0_FSID | \
2762 			      FATTR4_WORD0_RDATTR_ERROR)
2763 #define WORD1_ABSENT_FS_ATTRS FATTR4_WORD1_MOUNTED_ON_FILEID
2764 #define WORD2_ABSENT_FS_ATTRS 0
2765 
2766 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
2767 static inline __be32
nfsd4_encode_security_label(struct xdr_stream * xdr,struct svc_rqst * rqstp,void * context,int len)2768 nfsd4_encode_security_label(struct xdr_stream *xdr, struct svc_rqst *rqstp,
2769 			    void *context, int len)
2770 {
2771 	__be32 *p;
2772 
2773 	p = xdr_reserve_space(xdr, len + 4 + 4 + 4);
2774 	if (!p)
2775 		return nfserr_resource;
2776 
2777 	/*
2778 	 * For now we use a 0 here to indicate the null translation; in
2779 	 * the future we may place a call to translation code here.
2780 	 */
2781 	*p++ = cpu_to_be32(0); /* lfs */
2782 	*p++ = cpu_to_be32(0); /* pi */
2783 	p = xdr_encode_opaque(p, context, len);
2784 	return 0;
2785 }
2786 #else
2787 static inline __be32
nfsd4_encode_security_label(struct xdr_stream * xdr,struct svc_rqst * rqstp,void * context,int len)2788 nfsd4_encode_security_label(struct xdr_stream *xdr, struct svc_rqst *rqstp,
2789 			    void *context, int len)
2790 { return 0; }
2791 #endif
2792 
fattr_handle_absent_fs(u32 * bmval0,u32 * bmval1,u32 * bmval2,u32 * rdattr_err)2793 static __be32 fattr_handle_absent_fs(u32 *bmval0, u32 *bmval1, u32 *bmval2, u32 *rdattr_err)
2794 {
2795 	/* As per referral draft:  */
2796 	if (*bmval0 & ~WORD0_ABSENT_FS_ATTRS ||
2797 	    *bmval1 & ~WORD1_ABSENT_FS_ATTRS) {
2798 		if (*bmval0 & FATTR4_WORD0_RDATTR_ERROR ||
2799 	            *bmval0 & FATTR4_WORD0_FS_LOCATIONS)
2800 			*rdattr_err = NFSERR_MOVED;
2801 		else
2802 			return nfserr_moved;
2803 	}
2804 	*bmval0 &= WORD0_ABSENT_FS_ATTRS;
2805 	*bmval1 &= WORD1_ABSENT_FS_ATTRS;
2806 	*bmval2 &= WORD2_ABSENT_FS_ATTRS;
2807 	return 0;
2808 }
2809 
2810 
nfsd4_get_mounted_on_ino(struct svc_export * exp,u64 * pino)2811 static int nfsd4_get_mounted_on_ino(struct svc_export *exp, u64 *pino)
2812 {
2813 	struct path path = exp->ex_path;
2814 	struct kstat stat;
2815 	int err;
2816 
2817 	path_get(&path);
2818 	while (follow_up(&path)) {
2819 		if (path.dentry != path.mnt->mnt_root)
2820 			break;
2821 	}
2822 	err = vfs_getattr(&path, &stat, STATX_INO, AT_STATX_SYNC_AS_STAT);
2823 	path_put(&path);
2824 	if (!err)
2825 		*pino = stat.ino;
2826 	return err;
2827 }
2828 
2829 static __be32
nfsd4_encode_bitmap(struct xdr_stream * xdr,u32 bmval0,u32 bmval1,u32 bmval2)2830 nfsd4_encode_bitmap(struct xdr_stream *xdr, u32 bmval0, u32 bmval1, u32 bmval2)
2831 {
2832 	__be32 *p;
2833 
2834 	if (bmval2) {
2835 		p = xdr_reserve_space(xdr, 16);
2836 		if (!p)
2837 			goto out_resource;
2838 		*p++ = cpu_to_be32(3);
2839 		*p++ = cpu_to_be32(bmval0);
2840 		*p++ = cpu_to_be32(bmval1);
2841 		*p++ = cpu_to_be32(bmval2);
2842 	} else if (bmval1) {
2843 		p = xdr_reserve_space(xdr, 12);
2844 		if (!p)
2845 			goto out_resource;
2846 		*p++ = cpu_to_be32(2);
2847 		*p++ = cpu_to_be32(bmval0);
2848 		*p++ = cpu_to_be32(bmval1);
2849 	} else {
2850 		p = xdr_reserve_space(xdr, 8);
2851 		if (!p)
2852 			goto out_resource;
2853 		*p++ = cpu_to_be32(1);
2854 		*p++ = cpu_to_be32(bmval0);
2855 	}
2856 
2857 	return 0;
2858 out_resource:
2859 	return nfserr_resource;
2860 }
2861 
2862 /*
2863  * Note: @fhp can be NULL; in this case, we might have to compose the filehandle
2864  * ourselves.
2865  */
2866 static __be32
nfsd4_encode_fattr(struct xdr_stream * xdr,struct svc_fh * fhp,struct svc_export * exp,struct dentry * dentry,u32 * bmval,struct svc_rqst * rqstp,int ignore_crossmnt)2867 nfsd4_encode_fattr(struct xdr_stream *xdr, struct svc_fh *fhp,
2868 		struct svc_export *exp,
2869 		struct dentry *dentry, u32 *bmval,
2870 		struct svc_rqst *rqstp, int ignore_crossmnt)
2871 {
2872 	u32 bmval0 = bmval[0];
2873 	u32 bmval1 = bmval[1];
2874 	u32 bmval2 = bmval[2];
2875 	struct kstat stat;
2876 	struct svc_fh *tempfh = NULL;
2877 	struct kstatfs statfs;
2878 	__be32 *p, *attrlen_p;
2879 	int starting_len = xdr->buf->len;
2880 	int attrlen_offset;
2881 	u32 dummy;
2882 	u64 dummy64;
2883 	u32 rdattr_err = 0;
2884 	__be32 status;
2885 	int err;
2886 	struct nfs4_acl *acl = NULL;
2887 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
2888 	void *context = NULL;
2889 	int contextlen;
2890 #endif
2891 	bool contextsupport = false;
2892 	struct nfsd4_compoundres *resp = rqstp->rq_resp;
2893 	u32 minorversion = resp->cstate.minorversion;
2894 	struct path path = {
2895 		.mnt	= exp->ex_path.mnt,
2896 		.dentry	= dentry,
2897 	};
2898 	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2899 
2900 	BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1);
2901 	BUG_ON(!nfsd_attrs_supported(minorversion, bmval));
2902 
2903 	if (exp->ex_fslocs.migrated) {
2904 		status = fattr_handle_absent_fs(&bmval0, &bmval1, &bmval2, &rdattr_err);
2905 		if (status)
2906 			goto out;
2907 	}
2908 
2909 	err = vfs_getattr(&path, &stat, STATX_BASIC_STATS, AT_STATX_SYNC_AS_STAT);
2910 	if (err)
2911 		goto out_nfserr;
2912 	if (!(stat.result_mask & STATX_BTIME))
2913 		/* underlying FS does not offer btime so we can't share it */
2914 		bmval1 &= ~FATTR4_WORD1_TIME_CREATE;
2915 	if ((bmval0 & (FATTR4_WORD0_FILES_AVAIL | FATTR4_WORD0_FILES_FREE |
2916 			FATTR4_WORD0_FILES_TOTAL | FATTR4_WORD0_MAXNAME)) ||
2917 	    (bmval1 & (FATTR4_WORD1_SPACE_AVAIL | FATTR4_WORD1_SPACE_FREE |
2918 		       FATTR4_WORD1_SPACE_TOTAL))) {
2919 		err = vfs_statfs(&path, &statfs);
2920 		if (err)
2921 			goto out_nfserr;
2922 	}
2923 	if ((bmval0 & (FATTR4_WORD0_FILEHANDLE | FATTR4_WORD0_FSID)) && !fhp) {
2924 		tempfh = kmalloc(sizeof(struct svc_fh), GFP_KERNEL);
2925 		status = nfserr_jukebox;
2926 		if (!tempfh)
2927 			goto out;
2928 		fh_init(tempfh, NFS4_FHSIZE);
2929 		status = fh_compose(tempfh, exp, dentry, NULL);
2930 		if (status)
2931 			goto out;
2932 		fhp = tempfh;
2933 	}
2934 	if (bmval0 & FATTR4_WORD0_ACL) {
2935 		err = nfsd4_get_nfs4_acl(rqstp, dentry, &acl);
2936 		if (err == -EOPNOTSUPP)
2937 			bmval0 &= ~FATTR4_WORD0_ACL;
2938 		else if (err == -EINVAL) {
2939 			status = nfserr_attrnotsupp;
2940 			goto out;
2941 		} else if (err != 0)
2942 			goto out_nfserr;
2943 	}
2944 
2945 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
2946 	if ((bmval2 & FATTR4_WORD2_SECURITY_LABEL) ||
2947 	     bmval0 & FATTR4_WORD0_SUPPORTED_ATTRS) {
2948 		if (exp->ex_flags & NFSEXP_SECURITY_LABEL)
2949 			err = security_inode_getsecctx(d_inode(dentry),
2950 						&context, &contextlen);
2951 		else
2952 			err = -EOPNOTSUPP;
2953 		contextsupport = (err == 0);
2954 		if (bmval2 & FATTR4_WORD2_SECURITY_LABEL) {
2955 			if (err == -EOPNOTSUPP)
2956 				bmval2 &= ~FATTR4_WORD2_SECURITY_LABEL;
2957 			else if (err)
2958 				goto out_nfserr;
2959 		}
2960 	}
2961 #endif /* CONFIG_NFSD_V4_SECURITY_LABEL */
2962 
2963 	status = nfsd4_encode_bitmap(xdr, bmval0, bmval1, bmval2);
2964 	if (status)
2965 		goto out;
2966 
2967 	attrlen_offset = xdr->buf->len;
2968 	attrlen_p = xdr_reserve_space(xdr, XDR_UNIT);
2969 	if (!attrlen_p)
2970 		goto out_resource;
2971 
2972 	if (bmval0 & FATTR4_WORD0_SUPPORTED_ATTRS) {
2973 		u32 supp[3];
2974 
2975 		memcpy(supp, nfsd_suppattrs[minorversion], sizeof(supp));
2976 
2977 		if (!IS_POSIXACL(dentry->d_inode))
2978 			supp[0] &= ~FATTR4_WORD0_ACL;
2979 		if (!contextsupport)
2980 			supp[2] &= ~FATTR4_WORD2_SECURITY_LABEL;
2981 		if (!supp[2]) {
2982 			p = xdr_reserve_space(xdr, 12);
2983 			if (!p)
2984 				goto out_resource;
2985 			*p++ = cpu_to_be32(2);
2986 			*p++ = cpu_to_be32(supp[0]);
2987 			*p++ = cpu_to_be32(supp[1]);
2988 		} else {
2989 			p = xdr_reserve_space(xdr, 16);
2990 			if (!p)
2991 				goto out_resource;
2992 			*p++ = cpu_to_be32(3);
2993 			*p++ = cpu_to_be32(supp[0]);
2994 			*p++ = cpu_to_be32(supp[1]);
2995 			*p++ = cpu_to_be32(supp[2]);
2996 		}
2997 	}
2998 	if (bmval0 & FATTR4_WORD0_TYPE) {
2999 		p = xdr_reserve_space(xdr, 4);
3000 		if (!p)
3001 			goto out_resource;
3002 		dummy = nfs4_file_type(stat.mode);
3003 		if (dummy == NF4BAD) {
3004 			status = nfserr_serverfault;
3005 			goto out;
3006 		}
3007 		*p++ = cpu_to_be32(dummy);
3008 	}
3009 	if (bmval0 & FATTR4_WORD0_FH_EXPIRE_TYPE) {
3010 		p = xdr_reserve_space(xdr, 4);
3011 		if (!p)
3012 			goto out_resource;
3013 		if (exp->ex_flags & NFSEXP_NOSUBTREECHECK)
3014 			*p++ = cpu_to_be32(NFS4_FH_PERSISTENT);
3015 		else
3016 			*p++ = cpu_to_be32(NFS4_FH_PERSISTENT|
3017 						NFS4_FH_VOL_RENAME);
3018 	}
3019 	if (bmval0 & FATTR4_WORD0_CHANGE) {
3020 		p = xdr_reserve_space(xdr, 8);
3021 		if (!p)
3022 			goto out_resource;
3023 		p = encode_change(p, &stat, d_inode(dentry), exp);
3024 	}
3025 	if (bmval0 & FATTR4_WORD0_SIZE) {
3026 		p = xdr_reserve_space(xdr, 8);
3027 		if (!p)
3028 			goto out_resource;
3029 		p = xdr_encode_hyper(p, stat.size);
3030 	}
3031 	if (bmval0 & FATTR4_WORD0_LINK_SUPPORT) {
3032 		p = xdr_reserve_space(xdr, 4);
3033 		if (!p)
3034 			goto out_resource;
3035 		*p++ = cpu_to_be32(1);
3036 	}
3037 	if (bmval0 & FATTR4_WORD0_SYMLINK_SUPPORT) {
3038 		p = xdr_reserve_space(xdr, 4);
3039 		if (!p)
3040 			goto out_resource;
3041 		*p++ = cpu_to_be32(1);
3042 	}
3043 	if (bmval0 & FATTR4_WORD0_NAMED_ATTR) {
3044 		p = xdr_reserve_space(xdr, 4);
3045 		if (!p)
3046 			goto out_resource;
3047 		*p++ = cpu_to_be32(0);
3048 	}
3049 	if (bmval0 & FATTR4_WORD0_FSID) {
3050 		p = xdr_reserve_space(xdr, 16);
3051 		if (!p)
3052 			goto out_resource;
3053 		if (exp->ex_fslocs.migrated) {
3054 			p = xdr_encode_hyper(p, NFS4_REFERRAL_FSID_MAJOR);
3055 			p = xdr_encode_hyper(p, NFS4_REFERRAL_FSID_MINOR);
3056 		} else switch(fsid_source(fhp)) {
3057 		case FSIDSOURCE_FSID:
3058 			p = xdr_encode_hyper(p, (u64)exp->ex_fsid);
3059 			p = xdr_encode_hyper(p, (u64)0);
3060 			break;
3061 		case FSIDSOURCE_DEV:
3062 			*p++ = cpu_to_be32(0);
3063 			*p++ = cpu_to_be32(MAJOR(stat.dev));
3064 			*p++ = cpu_to_be32(0);
3065 			*p++ = cpu_to_be32(MINOR(stat.dev));
3066 			break;
3067 		case FSIDSOURCE_UUID:
3068 			p = xdr_encode_opaque_fixed(p, exp->ex_uuid,
3069 								EX_UUID_LEN);
3070 			break;
3071 		}
3072 	}
3073 	if (bmval0 & FATTR4_WORD0_UNIQUE_HANDLES) {
3074 		p = xdr_reserve_space(xdr, 4);
3075 		if (!p)
3076 			goto out_resource;
3077 		*p++ = cpu_to_be32(0);
3078 	}
3079 	if (bmval0 & FATTR4_WORD0_LEASE_TIME) {
3080 		p = xdr_reserve_space(xdr, 4);
3081 		if (!p)
3082 			goto out_resource;
3083 		*p++ = cpu_to_be32(nn->nfsd4_lease);
3084 	}
3085 	if (bmval0 & FATTR4_WORD0_RDATTR_ERROR) {
3086 		p = xdr_reserve_space(xdr, 4);
3087 		if (!p)
3088 			goto out_resource;
3089 		*p++ = cpu_to_be32(rdattr_err);
3090 	}
3091 	if (bmval0 & FATTR4_WORD0_ACL) {
3092 		struct nfs4_ace *ace;
3093 
3094 		if (acl == NULL) {
3095 			p = xdr_reserve_space(xdr, 4);
3096 			if (!p)
3097 				goto out_resource;
3098 
3099 			*p++ = cpu_to_be32(0);
3100 			goto out_acl;
3101 		}
3102 		p = xdr_reserve_space(xdr, 4);
3103 		if (!p)
3104 			goto out_resource;
3105 		*p++ = cpu_to_be32(acl->naces);
3106 
3107 		for (ace = acl->aces; ace < acl->aces + acl->naces; ace++) {
3108 			p = xdr_reserve_space(xdr, 4*3);
3109 			if (!p)
3110 				goto out_resource;
3111 			*p++ = cpu_to_be32(ace->type);
3112 			*p++ = cpu_to_be32(ace->flag);
3113 			*p++ = cpu_to_be32(ace->access_mask &
3114 							NFS4_ACE_MASK_ALL);
3115 			status = nfsd4_encode_aclname(xdr, rqstp, ace);
3116 			if (status)
3117 				goto out;
3118 		}
3119 	}
3120 out_acl:
3121 	if (bmval0 & FATTR4_WORD0_ACLSUPPORT) {
3122 		p = xdr_reserve_space(xdr, 4);
3123 		if (!p)
3124 			goto out_resource;
3125 		*p++ = cpu_to_be32(IS_POSIXACL(dentry->d_inode) ?
3126 			ACL4_SUPPORT_ALLOW_ACL|ACL4_SUPPORT_DENY_ACL : 0);
3127 	}
3128 	if (bmval0 & FATTR4_WORD0_CANSETTIME) {
3129 		p = xdr_reserve_space(xdr, 4);
3130 		if (!p)
3131 			goto out_resource;
3132 		*p++ = cpu_to_be32(1);
3133 	}
3134 	if (bmval0 & FATTR4_WORD0_CASE_INSENSITIVE) {
3135 		p = xdr_reserve_space(xdr, 4);
3136 		if (!p)
3137 			goto out_resource;
3138 		*p++ = cpu_to_be32(0);
3139 	}
3140 	if (bmval0 & FATTR4_WORD0_CASE_PRESERVING) {
3141 		p = xdr_reserve_space(xdr, 4);
3142 		if (!p)
3143 			goto out_resource;
3144 		*p++ = cpu_to_be32(1);
3145 	}
3146 	if (bmval0 & FATTR4_WORD0_CHOWN_RESTRICTED) {
3147 		p = xdr_reserve_space(xdr, 4);
3148 		if (!p)
3149 			goto out_resource;
3150 		*p++ = cpu_to_be32(1);
3151 	}
3152 	if (bmval0 & FATTR4_WORD0_FILEHANDLE) {
3153 		p = xdr_reserve_space(xdr, fhp->fh_handle.fh_size + 4);
3154 		if (!p)
3155 			goto out_resource;
3156 		p = xdr_encode_opaque(p, &fhp->fh_handle.fh_raw,
3157 					fhp->fh_handle.fh_size);
3158 	}
3159 	if (bmval0 & FATTR4_WORD0_FILEID) {
3160 		p = xdr_reserve_space(xdr, 8);
3161 		if (!p)
3162 			goto out_resource;
3163 		p = xdr_encode_hyper(p, stat.ino);
3164 	}
3165 	if (bmval0 & FATTR4_WORD0_FILES_AVAIL) {
3166 		p = xdr_reserve_space(xdr, 8);
3167 		if (!p)
3168 			goto out_resource;
3169 		p = xdr_encode_hyper(p, (u64) statfs.f_ffree);
3170 	}
3171 	if (bmval0 & FATTR4_WORD0_FILES_FREE) {
3172 		p = xdr_reserve_space(xdr, 8);
3173 		if (!p)
3174 			goto out_resource;
3175 		p = xdr_encode_hyper(p, (u64) statfs.f_ffree);
3176 	}
3177 	if (bmval0 & FATTR4_WORD0_FILES_TOTAL) {
3178 		p = xdr_reserve_space(xdr, 8);
3179 		if (!p)
3180 			goto out_resource;
3181 		p = xdr_encode_hyper(p, (u64) statfs.f_files);
3182 	}
3183 	if (bmval0 & FATTR4_WORD0_FS_LOCATIONS) {
3184 		status = nfsd4_encode_fs_locations(xdr, rqstp, exp);
3185 		if (status)
3186 			goto out;
3187 	}
3188 	if (bmval0 & FATTR4_WORD0_HOMOGENEOUS) {
3189 		p = xdr_reserve_space(xdr, 4);
3190 		if (!p)
3191 			goto out_resource;
3192 		*p++ = cpu_to_be32(1);
3193 	}
3194 	if (bmval0 & FATTR4_WORD0_MAXFILESIZE) {
3195 		p = xdr_reserve_space(xdr, 8);
3196 		if (!p)
3197 			goto out_resource;
3198 		p = xdr_encode_hyper(p, exp->ex_path.mnt->mnt_sb->s_maxbytes);
3199 	}
3200 	if (bmval0 & FATTR4_WORD0_MAXLINK) {
3201 		p = xdr_reserve_space(xdr, 4);
3202 		if (!p)
3203 			goto out_resource;
3204 		*p++ = cpu_to_be32(255);
3205 	}
3206 	if (bmval0 & FATTR4_WORD0_MAXNAME) {
3207 		p = xdr_reserve_space(xdr, 4);
3208 		if (!p)
3209 			goto out_resource;
3210 		*p++ = cpu_to_be32(statfs.f_namelen);
3211 	}
3212 	if (bmval0 & FATTR4_WORD0_MAXREAD) {
3213 		p = xdr_reserve_space(xdr, 8);
3214 		if (!p)
3215 			goto out_resource;
3216 		p = xdr_encode_hyper(p, (u64) svc_max_payload(rqstp));
3217 	}
3218 	if (bmval0 & FATTR4_WORD0_MAXWRITE) {
3219 		p = xdr_reserve_space(xdr, 8);
3220 		if (!p)
3221 			goto out_resource;
3222 		p = xdr_encode_hyper(p, (u64) svc_max_payload(rqstp));
3223 	}
3224 	if (bmval1 & FATTR4_WORD1_MODE) {
3225 		p = xdr_reserve_space(xdr, 4);
3226 		if (!p)
3227 			goto out_resource;
3228 		*p++ = cpu_to_be32(stat.mode & S_IALLUGO);
3229 	}
3230 	if (bmval1 & FATTR4_WORD1_NO_TRUNC) {
3231 		p = xdr_reserve_space(xdr, 4);
3232 		if (!p)
3233 			goto out_resource;
3234 		*p++ = cpu_to_be32(1);
3235 	}
3236 	if (bmval1 & FATTR4_WORD1_NUMLINKS) {
3237 		p = xdr_reserve_space(xdr, 4);
3238 		if (!p)
3239 			goto out_resource;
3240 		*p++ = cpu_to_be32(stat.nlink);
3241 	}
3242 	if (bmval1 & FATTR4_WORD1_OWNER) {
3243 		status = nfsd4_encode_user(xdr, rqstp, stat.uid);
3244 		if (status)
3245 			goto out;
3246 	}
3247 	if (bmval1 & FATTR4_WORD1_OWNER_GROUP) {
3248 		status = nfsd4_encode_group(xdr, rqstp, stat.gid);
3249 		if (status)
3250 			goto out;
3251 	}
3252 	if (bmval1 & FATTR4_WORD1_RAWDEV) {
3253 		p = xdr_reserve_space(xdr, 8);
3254 		if (!p)
3255 			goto out_resource;
3256 		*p++ = cpu_to_be32((u32) MAJOR(stat.rdev));
3257 		*p++ = cpu_to_be32((u32) MINOR(stat.rdev));
3258 	}
3259 	if (bmval1 & FATTR4_WORD1_SPACE_AVAIL) {
3260 		p = xdr_reserve_space(xdr, 8);
3261 		if (!p)
3262 			goto out_resource;
3263 		dummy64 = (u64)statfs.f_bavail * (u64)statfs.f_bsize;
3264 		p = xdr_encode_hyper(p, dummy64);
3265 	}
3266 	if (bmval1 & FATTR4_WORD1_SPACE_FREE) {
3267 		p = xdr_reserve_space(xdr, 8);
3268 		if (!p)
3269 			goto out_resource;
3270 		dummy64 = (u64)statfs.f_bfree * (u64)statfs.f_bsize;
3271 		p = xdr_encode_hyper(p, dummy64);
3272 	}
3273 	if (bmval1 & FATTR4_WORD1_SPACE_TOTAL) {
3274 		p = xdr_reserve_space(xdr, 8);
3275 		if (!p)
3276 			goto out_resource;
3277 		dummy64 = (u64)statfs.f_blocks * (u64)statfs.f_bsize;
3278 		p = xdr_encode_hyper(p, dummy64);
3279 	}
3280 	if (bmval1 & FATTR4_WORD1_SPACE_USED) {
3281 		p = xdr_reserve_space(xdr, 8);
3282 		if (!p)
3283 			goto out_resource;
3284 		dummy64 = (u64)stat.blocks << 9;
3285 		p = xdr_encode_hyper(p, dummy64);
3286 	}
3287 	if (bmval1 & FATTR4_WORD1_TIME_ACCESS) {
3288 		p = xdr_reserve_space(xdr, 12);
3289 		if (!p)
3290 			goto out_resource;
3291 		p = xdr_encode_hyper(p, (s64)stat.atime.tv_sec);
3292 		*p++ = cpu_to_be32(stat.atime.tv_nsec);
3293 	}
3294 	if (bmval1 & FATTR4_WORD1_TIME_DELTA) {
3295 		p = xdr_reserve_space(xdr, 12);
3296 		if (!p)
3297 			goto out_resource;
3298 		p = encode_time_delta(p, d_inode(dentry));
3299 	}
3300 	if (bmval1 & FATTR4_WORD1_TIME_METADATA) {
3301 		p = xdr_reserve_space(xdr, 12);
3302 		if (!p)
3303 			goto out_resource;
3304 		p = xdr_encode_hyper(p, (s64)stat.ctime.tv_sec);
3305 		*p++ = cpu_to_be32(stat.ctime.tv_nsec);
3306 	}
3307 	if (bmval1 & FATTR4_WORD1_TIME_MODIFY) {
3308 		p = xdr_reserve_space(xdr, 12);
3309 		if (!p)
3310 			goto out_resource;
3311 		p = xdr_encode_hyper(p, (s64)stat.mtime.tv_sec);
3312 		*p++ = cpu_to_be32(stat.mtime.tv_nsec);
3313 	}
3314 	if (bmval1 & FATTR4_WORD1_TIME_CREATE) {
3315 		p = xdr_reserve_space(xdr, 12);
3316 		if (!p)
3317 			goto out_resource;
3318 		p = xdr_encode_hyper(p, (s64)stat.btime.tv_sec);
3319 		*p++ = cpu_to_be32(stat.btime.tv_nsec);
3320 	}
3321 	if (bmval1 & FATTR4_WORD1_MOUNTED_ON_FILEID) {
3322 		u64 ino = stat.ino;
3323 
3324 		p = xdr_reserve_space(xdr, 8);
3325 		if (!p)
3326                 	goto out_resource;
3327 		/*
3328 		 * Get ino of mountpoint in parent filesystem, if not ignoring
3329 		 * crossmount and this is the root of a cross-mounted
3330 		 * filesystem.
3331 		 */
3332 		if (ignore_crossmnt == 0 &&
3333 		    dentry == exp->ex_path.mnt->mnt_root) {
3334 			err = nfsd4_get_mounted_on_ino(exp, &ino);
3335 			if (err)
3336 				goto out_nfserr;
3337 		}
3338 		p = xdr_encode_hyper(p, ino);
3339 	}
3340 #ifdef CONFIG_NFSD_PNFS
3341 	if (bmval1 & FATTR4_WORD1_FS_LAYOUT_TYPES) {
3342 		status = nfsd4_encode_layout_types(xdr, exp->ex_layout_types);
3343 		if (status)
3344 			goto out;
3345 	}
3346 
3347 	if (bmval2 & FATTR4_WORD2_LAYOUT_TYPES) {
3348 		status = nfsd4_encode_layout_types(xdr, exp->ex_layout_types);
3349 		if (status)
3350 			goto out;
3351 	}
3352 
3353 	if (bmval2 & FATTR4_WORD2_LAYOUT_BLKSIZE) {
3354 		p = xdr_reserve_space(xdr, 4);
3355 		if (!p)
3356 			goto out_resource;
3357 		*p++ = cpu_to_be32(stat.blksize);
3358 	}
3359 #endif /* CONFIG_NFSD_PNFS */
3360 	if (bmval2 & FATTR4_WORD2_SUPPATTR_EXCLCREAT) {
3361 		u32 supp[3];
3362 
3363 		memcpy(supp, nfsd_suppattrs[minorversion], sizeof(supp));
3364 		supp[0] &= NFSD_SUPPATTR_EXCLCREAT_WORD0;
3365 		supp[1] &= NFSD_SUPPATTR_EXCLCREAT_WORD1;
3366 		supp[2] &= NFSD_SUPPATTR_EXCLCREAT_WORD2;
3367 
3368 		status = nfsd4_encode_bitmap(xdr, supp[0], supp[1], supp[2]);
3369 		if (status)
3370 			goto out;
3371 	}
3372 
3373 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
3374 	if (bmval2 & FATTR4_WORD2_SECURITY_LABEL) {
3375 		status = nfsd4_encode_security_label(xdr, rqstp, context,
3376 								contextlen);
3377 		if (status)
3378 			goto out;
3379 	}
3380 #endif
3381 
3382 	if (bmval2 & FATTR4_WORD2_XATTR_SUPPORT) {
3383 		p = xdr_reserve_space(xdr, 4);
3384 		if (!p)
3385 			goto out_resource;
3386 		err = xattr_supported_namespace(d_inode(dentry),
3387 						XATTR_USER_PREFIX);
3388 		*p++ = cpu_to_be32(err == 0);
3389 	}
3390 
3391 	*attrlen_p = cpu_to_be32(xdr->buf->len - attrlen_offset - XDR_UNIT);
3392 	status = nfs_ok;
3393 
3394 out:
3395 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
3396 	if (context)
3397 		security_release_secctx(context, contextlen);
3398 #endif /* CONFIG_NFSD_V4_SECURITY_LABEL */
3399 	kfree(acl);
3400 	if (tempfh) {
3401 		fh_put(tempfh);
3402 		kfree(tempfh);
3403 	}
3404 	if (status)
3405 		xdr_truncate_encode(xdr, starting_len);
3406 	return status;
3407 out_nfserr:
3408 	status = nfserrno(err);
3409 	goto out;
3410 out_resource:
3411 	status = nfserr_resource;
3412 	goto out;
3413 }
3414 
svcxdr_init_encode_from_buffer(struct xdr_stream * xdr,struct xdr_buf * buf,__be32 * p,int bytes)3415 static void svcxdr_init_encode_from_buffer(struct xdr_stream *xdr,
3416 				struct xdr_buf *buf, __be32 *p, int bytes)
3417 {
3418 	xdr->scratch.iov_len = 0;
3419 	memset(buf, 0, sizeof(struct xdr_buf));
3420 	buf->head[0].iov_base = p;
3421 	buf->head[0].iov_len = 0;
3422 	buf->len = 0;
3423 	xdr->buf = buf;
3424 	xdr->iov = buf->head;
3425 	xdr->p = p;
3426 	xdr->end = (void *)p + bytes;
3427 	buf->buflen = bytes;
3428 }
3429 
nfsd4_encode_fattr_to_buf(__be32 ** p,int words,struct svc_fh * fhp,struct svc_export * exp,struct dentry * dentry,u32 * bmval,struct svc_rqst * rqstp,int ignore_crossmnt)3430 __be32 nfsd4_encode_fattr_to_buf(__be32 **p, int words,
3431 			struct svc_fh *fhp, struct svc_export *exp,
3432 			struct dentry *dentry, u32 *bmval,
3433 			struct svc_rqst *rqstp, int ignore_crossmnt)
3434 {
3435 	struct xdr_buf dummy;
3436 	struct xdr_stream xdr;
3437 	__be32 ret;
3438 
3439 	svcxdr_init_encode_from_buffer(&xdr, &dummy, *p, words << 2);
3440 	ret = nfsd4_encode_fattr(&xdr, fhp, exp, dentry, bmval, rqstp,
3441 							ignore_crossmnt);
3442 	*p = xdr.p;
3443 	return ret;
3444 }
3445 
attributes_need_mount(u32 * bmval)3446 static inline int attributes_need_mount(u32 *bmval)
3447 {
3448 	if (bmval[0] & ~(FATTR4_WORD0_RDATTR_ERROR | FATTR4_WORD0_LEASE_TIME))
3449 		return 1;
3450 	if (bmval[1] & ~FATTR4_WORD1_MOUNTED_ON_FILEID)
3451 		return 1;
3452 	return 0;
3453 }
3454 
3455 static __be32
nfsd4_encode_dirent_fattr(struct xdr_stream * xdr,struct nfsd4_readdir * cd,const char * name,int namlen)3456 nfsd4_encode_dirent_fattr(struct xdr_stream *xdr, struct nfsd4_readdir *cd,
3457 			const char *name, int namlen)
3458 {
3459 	struct svc_export *exp = cd->rd_fhp->fh_export;
3460 	struct dentry *dentry;
3461 	__be32 nfserr;
3462 	int ignore_crossmnt = 0;
3463 
3464 	dentry = lookup_positive_unlocked(name, cd->rd_fhp->fh_dentry, namlen);
3465 	if (IS_ERR(dentry))
3466 		return nfserrno(PTR_ERR(dentry));
3467 
3468 	exp_get(exp);
3469 	/*
3470 	 * In the case of a mountpoint, the client may be asking for
3471 	 * attributes that are only properties of the underlying filesystem
3472 	 * as opposed to the cross-mounted file system. In such a case,
3473 	 * we will not follow the cross mount and will fill the attribtutes
3474 	 * directly from the mountpoint dentry.
3475 	 */
3476 	if (nfsd_mountpoint(dentry, exp)) {
3477 		int err;
3478 
3479 		if (!(exp->ex_flags & NFSEXP_V4ROOT)
3480 				&& !attributes_need_mount(cd->rd_bmval)) {
3481 			ignore_crossmnt = 1;
3482 			goto out_encode;
3483 		}
3484 		/*
3485 		 * Why the heck aren't we just using nfsd_lookup??
3486 		 * Different "."/".." handling?  Something else?
3487 		 * At least, add a comment here to explain....
3488 		 */
3489 		err = nfsd_cross_mnt(cd->rd_rqstp, &dentry, &exp);
3490 		if (err) {
3491 			nfserr = nfserrno(err);
3492 			goto out_put;
3493 		}
3494 		nfserr = check_nfsd_access(exp, cd->rd_rqstp);
3495 		if (nfserr)
3496 			goto out_put;
3497 
3498 	}
3499 out_encode:
3500 	nfserr = nfsd4_encode_fattr(xdr, NULL, exp, dentry, cd->rd_bmval,
3501 					cd->rd_rqstp, ignore_crossmnt);
3502 out_put:
3503 	dput(dentry);
3504 	exp_put(exp);
3505 	return nfserr;
3506 }
3507 
3508 static __be32 *
nfsd4_encode_rdattr_error(struct xdr_stream * xdr,__be32 nfserr)3509 nfsd4_encode_rdattr_error(struct xdr_stream *xdr, __be32 nfserr)
3510 {
3511 	__be32 *p;
3512 
3513 	p = xdr_reserve_space(xdr, 20);
3514 	if (!p)
3515 		return NULL;
3516 	*p++ = htonl(2);
3517 	*p++ = htonl(FATTR4_WORD0_RDATTR_ERROR); /* bmval0 */
3518 	*p++ = htonl(0);			 /* bmval1 */
3519 
3520 	*p++ = htonl(4);     /* attribute length */
3521 	*p++ = nfserr;       /* no htonl */
3522 	return p;
3523 }
3524 
3525 static int
nfsd4_encode_dirent(void * ccdv,const char * name,int namlen,loff_t offset,u64 ino,unsigned int d_type)3526 nfsd4_encode_dirent(void *ccdv, const char *name, int namlen,
3527 		    loff_t offset, u64 ino, unsigned int d_type)
3528 {
3529 	struct readdir_cd *ccd = ccdv;
3530 	struct nfsd4_readdir *cd = container_of(ccd, struct nfsd4_readdir, common);
3531 	struct xdr_stream *xdr = cd->xdr;
3532 	int start_offset = xdr->buf->len;
3533 	int cookie_offset;
3534 	u32 name_and_cookie;
3535 	int entry_bytes;
3536 	__be32 nfserr = nfserr_toosmall;
3537 	__be64 wire_offset;
3538 	__be32 *p;
3539 
3540 	/* In nfsv4, "." and ".." never make it onto the wire.. */
3541 	if (name && isdotent(name, namlen)) {
3542 		cd->common.err = nfs_ok;
3543 		return 0;
3544 	}
3545 
3546 	if (cd->cookie_offset) {
3547 		wire_offset = cpu_to_be64(offset);
3548 		write_bytes_to_xdr_buf(xdr->buf, cd->cookie_offset,
3549 							&wire_offset, 8);
3550 	}
3551 
3552 	p = xdr_reserve_space(xdr, 4);
3553 	if (!p)
3554 		goto fail;
3555 	*p++ = xdr_one;                             /* mark entry present */
3556 	cookie_offset = xdr->buf->len;
3557 	p = xdr_reserve_space(xdr, 3*4 + namlen);
3558 	if (!p)
3559 		goto fail;
3560 	p = xdr_encode_hyper(p, OFFSET_MAX);        /* offset of next entry */
3561 	p = xdr_encode_array(p, name, namlen);      /* name length & name */
3562 
3563 	nfserr = nfsd4_encode_dirent_fattr(xdr, cd, name, namlen);
3564 	switch (nfserr) {
3565 	case nfs_ok:
3566 		break;
3567 	case nfserr_resource:
3568 		nfserr = nfserr_toosmall;
3569 		goto fail;
3570 	case nfserr_noent:
3571 		xdr_truncate_encode(xdr, start_offset);
3572 		goto skip_entry;
3573 	case nfserr_jukebox:
3574 		/*
3575 		 * The pseudoroot should only display dentries that lead to
3576 		 * exports. If we get EJUKEBOX here, then we can't tell whether
3577 		 * this entry should be included. Just fail the whole READDIR
3578 		 * with NFS4ERR_DELAY in that case, and hope that the situation
3579 		 * will resolve itself by the client's next attempt.
3580 		 */
3581 		if (cd->rd_fhp->fh_export->ex_flags & NFSEXP_V4ROOT)
3582 			goto fail;
3583 		fallthrough;
3584 	default:
3585 		/*
3586 		 * If the client requested the RDATTR_ERROR attribute,
3587 		 * we stuff the error code into this attribute
3588 		 * and continue.  If this attribute was not requested,
3589 		 * then in accordance with the spec, we fail the
3590 		 * entire READDIR operation(!)
3591 		 */
3592 		if (!(cd->rd_bmval[0] & FATTR4_WORD0_RDATTR_ERROR))
3593 			goto fail;
3594 		p = nfsd4_encode_rdattr_error(xdr, nfserr);
3595 		if (p == NULL) {
3596 			nfserr = nfserr_toosmall;
3597 			goto fail;
3598 		}
3599 	}
3600 	nfserr = nfserr_toosmall;
3601 	entry_bytes = xdr->buf->len - start_offset;
3602 	if (entry_bytes > cd->rd_maxcount)
3603 		goto fail;
3604 	cd->rd_maxcount -= entry_bytes;
3605 	/*
3606 	 * RFC 3530 14.2.24 describes rd_dircount as only a "hint", and
3607 	 * notes that it could be zero. If it is zero, then the server
3608 	 * should enforce only the rd_maxcount value.
3609 	 */
3610 	if (cd->rd_dircount) {
3611 		name_and_cookie = 4 + 4 * XDR_QUADLEN(namlen) + 8;
3612 		if (name_and_cookie > cd->rd_dircount && cd->cookie_offset)
3613 			goto fail;
3614 		cd->rd_dircount -= min(cd->rd_dircount, name_and_cookie);
3615 		if (!cd->rd_dircount)
3616 			cd->rd_maxcount = 0;
3617 	}
3618 
3619 	cd->cookie_offset = cookie_offset;
3620 skip_entry:
3621 	cd->common.err = nfs_ok;
3622 	return 0;
3623 fail:
3624 	xdr_truncate_encode(xdr, start_offset);
3625 	cd->common.err = nfserr;
3626 	return -EINVAL;
3627 }
3628 
3629 static __be32
nfsd4_encode_stateid(struct xdr_stream * xdr,stateid_t * sid)3630 nfsd4_encode_stateid(struct xdr_stream *xdr, stateid_t *sid)
3631 {
3632 	__be32 *p;
3633 
3634 	p = xdr_reserve_space(xdr, sizeof(stateid_t));
3635 	if (!p)
3636 		return nfserr_resource;
3637 	*p++ = cpu_to_be32(sid->si_generation);
3638 	p = xdr_encode_opaque_fixed(p, &sid->si_opaque,
3639 					sizeof(stateid_opaque_t));
3640 	return 0;
3641 }
3642 
3643 static __be32
nfsd4_encode_access(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_access * access)3644 nfsd4_encode_access(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_access *access)
3645 {
3646 	struct xdr_stream *xdr = resp->xdr;
3647 	__be32 *p;
3648 
3649 	p = xdr_reserve_space(xdr, 8);
3650 	if (!p)
3651 		return nfserr_resource;
3652 	*p++ = cpu_to_be32(access->ac_supported);
3653 	*p++ = cpu_to_be32(access->ac_resp_access);
3654 	return 0;
3655 }
3656 
nfsd4_encode_bind_conn_to_session(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_bind_conn_to_session * bcts)3657 static __be32 nfsd4_encode_bind_conn_to_session(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_bind_conn_to_session *bcts)
3658 {
3659 	struct xdr_stream *xdr = resp->xdr;
3660 	__be32 *p;
3661 
3662 	p = xdr_reserve_space(xdr, NFS4_MAX_SESSIONID_LEN + 8);
3663 	if (!p)
3664 		return nfserr_resource;
3665 	p = xdr_encode_opaque_fixed(p, bcts->sessionid.data,
3666 					NFS4_MAX_SESSIONID_LEN);
3667 	*p++ = cpu_to_be32(bcts->dir);
3668 	/* Upshifting from TCP to RDMA is not supported */
3669 	*p++ = cpu_to_be32(0);
3670 	return 0;
3671 }
3672 
3673 static __be32
nfsd4_encode_close(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_close * close)3674 nfsd4_encode_close(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_close *close)
3675 {
3676 	struct xdr_stream *xdr = resp->xdr;
3677 
3678 	return nfsd4_encode_stateid(xdr, &close->cl_stateid);
3679 }
3680 
3681 
3682 static __be32
nfsd4_encode_commit(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_commit * commit)3683 nfsd4_encode_commit(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_commit *commit)
3684 {
3685 	struct xdr_stream *xdr = resp->xdr;
3686 	__be32 *p;
3687 
3688 	p = xdr_reserve_space(xdr, NFS4_VERIFIER_SIZE);
3689 	if (!p)
3690 		return nfserr_resource;
3691 	p = xdr_encode_opaque_fixed(p, commit->co_verf.data,
3692 						NFS4_VERIFIER_SIZE);
3693 	return 0;
3694 }
3695 
3696 static __be32
nfsd4_encode_create(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_create * create)3697 nfsd4_encode_create(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_create *create)
3698 {
3699 	struct xdr_stream *xdr = resp->xdr;
3700 	__be32 *p;
3701 
3702 	p = xdr_reserve_space(xdr, 20);
3703 	if (!p)
3704 		return nfserr_resource;
3705 	encode_cinfo(p, &create->cr_cinfo);
3706 	return nfsd4_encode_bitmap(xdr, create->cr_bmval[0],
3707 			create->cr_bmval[1], create->cr_bmval[2]);
3708 }
3709 
3710 static __be32
nfsd4_encode_getattr(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_getattr * getattr)3711 nfsd4_encode_getattr(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_getattr *getattr)
3712 {
3713 	struct svc_fh *fhp = getattr->ga_fhp;
3714 	struct xdr_stream *xdr = resp->xdr;
3715 
3716 	return nfsd4_encode_fattr(xdr, fhp, fhp->fh_export, fhp->fh_dentry,
3717 				    getattr->ga_bmval, resp->rqstp, 0);
3718 }
3719 
3720 static __be32
nfsd4_encode_getfh(struct nfsd4_compoundres * resp,__be32 nfserr,struct svc_fh ** fhpp)3721 nfsd4_encode_getfh(struct nfsd4_compoundres *resp, __be32 nfserr, struct svc_fh **fhpp)
3722 {
3723 	struct xdr_stream *xdr = resp->xdr;
3724 	struct svc_fh *fhp = *fhpp;
3725 	unsigned int len;
3726 	__be32 *p;
3727 
3728 	len = fhp->fh_handle.fh_size;
3729 	p = xdr_reserve_space(xdr, len + 4);
3730 	if (!p)
3731 		return nfserr_resource;
3732 	p = xdr_encode_opaque(p, &fhp->fh_handle.fh_raw, len);
3733 	return 0;
3734 }
3735 
3736 /*
3737 * Including all fields other than the name, a LOCK4denied structure requires
3738 *   8(clientid) + 4(namelen) + 8(offset) + 8(length) + 4(type) = 32 bytes.
3739 */
3740 static __be32
nfsd4_encode_lock_denied(struct xdr_stream * xdr,struct nfsd4_lock_denied * ld)3741 nfsd4_encode_lock_denied(struct xdr_stream *xdr, struct nfsd4_lock_denied *ld)
3742 {
3743 	struct xdr_netobj *conf = &ld->ld_owner;
3744 	__be32 *p;
3745 
3746 again:
3747 	p = xdr_reserve_space(xdr, 32 + XDR_LEN(conf->len));
3748 	if (!p) {
3749 		/*
3750 		 * Don't fail to return the result just because we can't
3751 		 * return the conflicting open:
3752 		 */
3753 		if (conf->len) {
3754 			kfree(conf->data);
3755 			conf->len = 0;
3756 			conf->data = NULL;
3757 			goto again;
3758 		}
3759 		return nfserr_resource;
3760 	}
3761 	p = xdr_encode_hyper(p, ld->ld_start);
3762 	p = xdr_encode_hyper(p, ld->ld_length);
3763 	*p++ = cpu_to_be32(ld->ld_type);
3764 	if (conf->len) {
3765 		p = xdr_encode_opaque_fixed(p, &ld->ld_clientid, 8);
3766 		p = xdr_encode_opaque(p, conf->data, conf->len);
3767 		kfree(conf->data);
3768 	}  else {  /* non - nfsv4 lock in conflict, no clientid nor owner */
3769 		p = xdr_encode_hyper(p, (u64)0); /* clientid */
3770 		*p++ = cpu_to_be32(0); /* length of owner name */
3771 	}
3772 	return nfserr_denied;
3773 }
3774 
3775 static __be32
nfsd4_encode_lock(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_lock * lock)3776 nfsd4_encode_lock(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_lock *lock)
3777 {
3778 	struct xdr_stream *xdr = resp->xdr;
3779 
3780 	if (!nfserr)
3781 		nfserr = nfsd4_encode_stateid(xdr, &lock->lk_resp_stateid);
3782 	else if (nfserr == nfserr_denied)
3783 		nfserr = nfsd4_encode_lock_denied(xdr, &lock->lk_denied);
3784 
3785 	return nfserr;
3786 }
3787 
3788 static __be32
nfsd4_encode_lockt(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_lockt * lockt)3789 nfsd4_encode_lockt(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_lockt *lockt)
3790 {
3791 	struct xdr_stream *xdr = resp->xdr;
3792 
3793 	if (nfserr == nfserr_denied)
3794 		nfsd4_encode_lock_denied(xdr, &lockt->lt_denied);
3795 	return nfserr;
3796 }
3797 
3798 static __be32
nfsd4_encode_locku(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_locku * locku)3799 nfsd4_encode_locku(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_locku *locku)
3800 {
3801 	struct xdr_stream *xdr = resp->xdr;
3802 
3803 	return nfsd4_encode_stateid(xdr, &locku->lu_stateid);
3804 }
3805 
3806 
3807 static __be32
nfsd4_encode_link(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_link * link)3808 nfsd4_encode_link(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_link *link)
3809 {
3810 	struct xdr_stream *xdr = resp->xdr;
3811 	__be32 *p;
3812 
3813 	p = xdr_reserve_space(xdr, 20);
3814 	if (!p)
3815 		return nfserr_resource;
3816 	p = encode_cinfo(p, &link->li_cinfo);
3817 	return 0;
3818 }
3819 
3820 
3821 static __be32
nfsd4_encode_open(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_open * open)3822 nfsd4_encode_open(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_open *open)
3823 {
3824 	struct xdr_stream *xdr = resp->xdr;
3825 	__be32 *p;
3826 
3827 	nfserr = nfsd4_encode_stateid(xdr, &open->op_stateid);
3828 	if (nfserr)
3829 		return nfserr;
3830 	p = xdr_reserve_space(xdr, 24);
3831 	if (!p)
3832 		return nfserr_resource;
3833 	p = encode_cinfo(p, &open->op_cinfo);
3834 	*p++ = cpu_to_be32(open->op_rflags);
3835 
3836 	nfserr = nfsd4_encode_bitmap(xdr, open->op_bmval[0], open->op_bmval[1],
3837 					open->op_bmval[2]);
3838 	if (nfserr)
3839 		return nfserr;
3840 
3841 	p = xdr_reserve_space(xdr, 4);
3842 	if (!p)
3843 		return nfserr_resource;
3844 
3845 	*p++ = cpu_to_be32(open->op_delegate_type);
3846 	switch (open->op_delegate_type) {
3847 	case NFS4_OPEN_DELEGATE_NONE:
3848 		break;
3849 	case NFS4_OPEN_DELEGATE_READ:
3850 		nfserr = nfsd4_encode_stateid(xdr, &open->op_delegate_stateid);
3851 		if (nfserr)
3852 			return nfserr;
3853 		p = xdr_reserve_space(xdr, 20);
3854 		if (!p)
3855 			return nfserr_resource;
3856 		*p++ = cpu_to_be32(open->op_recall);
3857 
3858 		/*
3859 		 * TODO: ACE's in delegations
3860 		 */
3861 		*p++ = cpu_to_be32(NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE);
3862 		*p++ = cpu_to_be32(0);
3863 		*p++ = cpu_to_be32(0);
3864 		*p++ = cpu_to_be32(0);   /* XXX: is NULL principal ok? */
3865 		break;
3866 	case NFS4_OPEN_DELEGATE_WRITE:
3867 		nfserr = nfsd4_encode_stateid(xdr, &open->op_delegate_stateid);
3868 		if (nfserr)
3869 			return nfserr;
3870 		p = xdr_reserve_space(xdr, 32);
3871 		if (!p)
3872 			return nfserr_resource;
3873 		*p++ = cpu_to_be32(0);
3874 
3875 		/*
3876 		 * TODO: space_limit's in delegations
3877 		 */
3878 		*p++ = cpu_to_be32(NFS4_LIMIT_SIZE);
3879 		*p++ = cpu_to_be32(~(u32)0);
3880 		*p++ = cpu_to_be32(~(u32)0);
3881 
3882 		/*
3883 		 * TODO: ACE's in delegations
3884 		 */
3885 		*p++ = cpu_to_be32(NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE);
3886 		*p++ = cpu_to_be32(0);
3887 		*p++ = cpu_to_be32(0);
3888 		*p++ = cpu_to_be32(0);   /* XXX: is NULL principal ok? */
3889 		break;
3890 	case NFS4_OPEN_DELEGATE_NONE_EXT: /* 4.1 */
3891 		switch (open->op_why_no_deleg) {
3892 		case WND4_CONTENTION:
3893 		case WND4_RESOURCE:
3894 			p = xdr_reserve_space(xdr, 8);
3895 			if (!p)
3896 				return nfserr_resource;
3897 			*p++ = cpu_to_be32(open->op_why_no_deleg);
3898 			/* deleg signaling not supported yet: */
3899 			*p++ = cpu_to_be32(0);
3900 			break;
3901 		default:
3902 			p = xdr_reserve_space(xdr, 4);
3903 			if (!p)
3904 				return nfserr_resource;
3905 			*p++ = cpu_to_be32(open->op_why_no_deleg);
3906 		}
3907 		break;
3908 	default:
3909 		BUG();
3910 	}
3911 	/* XXX save filehandle here */
3912 	return 0;
3913 }
3914 
3915 static __be32
nfsd4_encode_open_confirm(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_open_confirm * oc)3916 nfsd4_encode_open_confirm(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_open_confirm *oc)
3917 {
3918 	struct xdr_stream *xdr = resp->xdr;
3919 
3920 	return nfsd4_encode_stateid(xdr, &oc->oc_resp_stateid);
3921 }
3922 
3923 static __be32
nfsd4_encode_open_downgrade(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_open_downgrade * od)3924 nfsd4_encode_open_downgrade(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_open_downgrade *od)
3925 {
3926 	struct xdr_stream *xdr = resp->xdr;
3927 
3928 	return nfsd4_encode_stateid(xdr, &od->od_stateid);
3929 }
3930 
nfsd4_encode_splice_read(struct nfsd4_compoundres * resp,struct nfsd4_read * read,struct file * file,unsigned long maxcount)3931 static __be32 nfsd4_encode_splice_read(
3932 				struct nfsd4_compoundres *resp,
3933 				struct nfsd4_read *read,
3934 				struct file *file, unsigned long maxcount)
3935 {
3936 	struct xdr_stream *xdr = resp->xdr;
3937 	struct xdr_buf *buf = xdr->buf;
3938 	int status, space_left;
3939 	__be32 nfserr;
3940 
3941 	/* Make sure there will be room for padding if needed */
3942 	if (xdr->end - xdr->p < 1)
3943 		return nfserr_resource;
3944 
3945 	nfserr = nfsd_splice_read(read->rd_rqstp, read->rd_fhp,
3946 				  file, read->rd_offset, &maxcount,
3947 				  &read->rd_eof);
3948 	read->rd_length = maxcount;
3949 	if (nfserr)
3950 		goto out_err;
3951 	status = svc_encode_result_payload(read->rd_rqstp,
3952 					   buf->head[0].iov_len, maxcount);
3953 	if (status) {
3954 		nfserr = nfserrno(status);
3955 		goto out_err;
3956 	}
3957 
3958 	buf->page_len = maxcount;
3959 	buf->len += maxcount;
3960 	xdr->page_ptr += (buf->page_base + maxcount + PAGE_SIZE - 1)
3961 							/ PAGE_SIZE;
3962 
3963 	/* Use rest of head for padding and remaining ops: */
3964 	buf->tail[0].iov_base = xdr->p;
3965 	buf->tail[0].iov_len = 0;
3966 	xdr->iov = buf->tail;
3967 	if (maxcount&3) {
3968 		int pad = 4 - (maxcount&3);
3969 
3970 		*(xdr->p++) = 0;
3971 
3972 		buf->tail[0].iov_base += maxcount&3;
3973 		buf->tail[0].iov_len = pad;
3974 		buf->len += pad;
3975 	}
3976 
3977 	space_left = min_t(int, (void *)xdr->end - (void *)xdr->p,
3978 				buf->buflen - buf->len);
3979 	buf->buflen = buf->len + space_left;
3980 	xdr->end = (__be32 *)((void *)xdr->end + space_left);
3981 
3982 	return 0;
3983 
3984 out_err:
3985 	/*
3986 	 * nfsd_splice_actor may have already messed with the
3987 	 * page length; reset it so as not to confuse
3988 	 * xdr_truncate_encode in our caller.
3989 	 */
3990 	buf->page_len = 0;
3991 	return nfserr;
3992 }
3993 
nfsd4_encode_readv(struct nfsd4_compoundres * resp,struct nfsd4_read * read,struct file * file,unsigned long maxcount)3994 static __be32 nfsd4_encode_readv(struct nfsd4_compoundres *resp,
3995 				 struct nfsd4_read *read,
3996 				 struct file *file, unsigned long maxcount)
3997 {
3998 	struct xdr_stream *xdr = resp->xdr;
3999 	unsigned int starting_len = xdr->buf->len;
4000 	__be32 zero = xdr_zero;
4001 	__be32 nfserr;
4002 
4003 	read->rd_vlen = xdr_reserve_space_vec(xdr, resp->rqstp->rq_vec, maxcount);
4004 	if (read->rd_vlen < 0)
4005 		return nfserr_resource;
4006 
4007 	nfserr = nfsd_readv(resp->rqstp, read->rd_fhp, file, read->rd_offset,
4008 			    resp->rqstp->rq_vec, read->rd_vlen, &maxcount,
4009 			    &read->rd_eof);
4010 	read->rd_length = maxcount;
4011 	if (nfserr)
4012 		return nfserr;
4013 	if (svc_encode_result_payload(resp->rqstp, starting_len, maxcount))
4014 		return nfserr_io;
4015 	xdr_truncate_encode(xdr, starting_len + xdr_align_size(maxcount));
4016 
4017 	write_bytes_to_xdr_buf(xdr->buf, starting_len + maxcount, &zero,
4018 			       xdr_pad_size(maxcount));
4019 	return nfs_ok;
4020 }
4021 
4022 static __be32
nfsd4_encode_read(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_read * read)4023 nfsd4_encode_read(struct nfsd4_compoundres *resp, __be32 nfserr,
4024 		  struct nfsd4_read *read)
4025 {
4026 	bool splice_ok = test_bit(RQ_SPLICE_OK, &resp->rqstp->rq_flags);
4027 	unsigned long maxcount;
4028 	struct xdr_stream *xdr = resp->xdr;
4029 	struct file *file;
4030 	int starting_len = xdr->buf->len;
4031 	__be32 *p;
4032 
4033 	if (nfserr)
4034 		return nfserr;
4035 	file = read->rd_nf->nf_file;
4036 
4037 	p = xdr_reserve_space(xdr, 8); /* eof flag and byte count */
4038 	if (!p) {
4039 		WARN_ON_ONCE(splice_ok);
4040 		return nfserr_resource;
4041 	}
4042 	if (resp->xdr->buf->page_len && splice_ok) {
4043 		WARN_ON_ONCE(1);
4044 		return nfserr_serverfault;
4045 	}
4046 	xdr_commit_encode(xdr);
4047 
4048 	maxcount = min_t(unsigned long, read->rd_length,
4049 			 (xdr->buf->buflen - xdr->buf->len));
4050 
4051 	if (file->f_op->splice_read && splice_ok)
4052 		nfserr = nfsd4_encode_splice_read(resp, read, file, maxcount);
4053 	else
4054 		nfserr = nfsd4_encode_readv(resp, read, file, maxcount);
4055 	if (nfserr) {
4056 		xdr_truncate_encode(xdr, starting_len);
4057 		return nfserr;
4058 	}
4059 
4060 	p = xdr_encode_bool(p, read->rd_eof);
4061 	*p = cpu_to_be32(read->rd_length);
4062 	return nfs_ok;
4063 }
4064 
4065 static __be32
nfsd4_encode_readlink(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_readlink * readlink)4066 nfsd4_encode_readlink(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_readlink *readlink)
4067 {
4068 	__be32 *p, *maxcount_p, zero = xdr_zero;
4069 	struct xdr_stream *xdr = resp->xdr;
4070 	int length_offset = xdr->buf->len;
4071 	int maxcount, status;
4072 
4073 	maxcount_p = xdr_reserve_space(xdr, XDR_UNIT);
4074 	if (!maxcount_p)
4075 		return nfserr_resource;
4076 	maxcount = PAGE_SIZE;
4077 
4078 	p = xdr_reserve_space(xdr, maxcount);
4079 	if (!p)
4080 		return nfserr_resource;
4081 	/*
4082 	 * XXX: By default, vfs_readlink() will truncate symlinks if they
4083 	 * would overflow the buffer.  Is this kosher in NFSv4?  If not, one
4084 	 * easy fix is: if vfs_readlink() precisely fills the buffer, assume
4085 	 * that truncation occurred, and return NFS4ERR_RESOURCE.
4086 	 */
4087 	nfserr = nfsd_readlink(readlink->rl_rqstp, readlink->rl_fhp,
4088 						(char *)p, &maxcount);
4089 	if (nfserr == nfserr_isdir)
4090 		nfserr = nfserr_inval;
4091 	if (nfserr)
4092 		goto out_err;
4093 	status = svc_encode_result_payload(readlink->rl_rqstp, length_offset,
4094 					   maxcount);
4095 	if (status) {
4096 		nfserr = nfserrno(status);
4097 		goto out_err;
4098 	}
4099 	*maxcount_p = cpu_to_be32(maxcount);
4100 	xdr_truncate_encode(xdr, length_offset + 4 + xdr_align_size(maxcount));
4101 	write_bytes_to_xdr_buf(xdr->buf, length_offset + 4 + maxcount, &zero,
4102 			       xdr_pad_size(maxcount));
4103 	return nfs_ok;
4104 
4105 out_err:
4106 	xdr_truncate_encode(xdr, length_offset);
4107 	return nfserr;
4108 }
4109 
4110 static __be32
nfsd4_encode_readdir(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_readdir * readdir)4111 nfsd4_encode_readdir(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_readdir *readdir)
4112 {
4113 	int maxcount;
4114 	int bytes_left;
4115 	loff_t offset;
4116 	__be64 wire_offset;
4117 	struct xdr_stream *xdr = resp->xdr;
4118 	int starting_len = xdr->buf->len;
4119 	__be32 *p;
4120 
4121 	p = xdr_reserve_space(xdr, NFS4_VERIFIER_SIZE);
4122 	if (!p)
4123 		return nfserr_resource;
4124 
4125 	/* XXX: Following NFSv3, we ignore the READDIR verifier for now. */
4126 	*p++ = cpu_to_be32(0);
4127 	*p++ = cpu_to_be32(0);
4128 	xdr->buf->head[0].iov_len = (char *)xdr->p -
4129 				    (char *)xdr->buf->head[0].iov_base;
4130 
4131 	/*
4132 	 * Number of bytes left for directory entries allowing for the
4133 	 * final 8 bytes of the readdir and a following failed op:
4134 	 */
4135 	bytes_left = xdr->buf->buflen - xdr->buf->len
4136 			- COMPOUND_ERR_SLACK_SPACE - 8;
4137 	if (bytes_left < 0) {
4138 		nfserr = nfserr_resource;
4139 		goto err_no_verf;
4140 	}
4141 	maxcount = svc_max_payload(resp->rqstp);
4142 	maxcount = min_t(u32, readdir->rd_maxcount, maxcount);
4143 	/*
4144 	 * Note the rfc defines rd_maxcount as the size of the
4145 	 * READDIR4resok structure, which includes the verifier above
4146 	 * and the 8 bytes encoded at the end of this function:
4147 	 */
4148 	if (maxcount < 16) {
4149 		nfserr = nfserr_toosmall;
4150 		goto err_no_verf;
4151 	}
4152 	maxcount = min_t(int, maxcount-16, bytes_left);
4153 
4154 	/* RFC 3530 14.2.24 allows us to ignore dircount when it's 0: */
4155 	if (!readdir->rd_dircount)
4156 		readdir->rd_dircount = svc_max_payload(resp->rqstp);
4157 
4158 	readdir->xdr = xdr;
4159 	readdir->rd_maxcount = maxcount;
4160 	readdir->common.err = 0;
4161 	readdir->cookie_offset = 0;
4162 
4163 	offset = readdir->rd_cookie;
4164 	nfserr = nfsd_readdir(readdir->rd_rqstp, readdir->rd_fhp,
4165 			      &offset,
4166 			      &readdir->common, nfsd4_encode_dirent);
4167 	if (nfserr == nfs_ok &&
4168 	    readdir->common.err == nfserr_toosmall &&
4169 	    xdr->buf->len == starting_len + 8) {
4170 		/* nothing encoded; which limit did we hit?: */
4171 		if (maxcount - 16 < bytes_left)
4172 			/* It was the fault of rd_maxcount: */
4173 			nfserr = nfserr_toosmall;
4174 		else
4175 			/* We ran out of buffer space: */
4176 			nfserr = nfserr_resource;
4177 	}
4178 	if (nfserr)
4179 		goto err_no_verf;
4180 
4181 	if (readdir->cookie_offset) {
4182 		wire_offset = cpu_to_be64(offset);
4183 		write_bytes_to_xdr_buf(xdr->buf, readdir->cookie_offset,
4184 							&wire_offset, 8);
4185 	}
4186 
4187 	p = xdr_reserve_space(xdr, 8);
4188 	if (!p) {
4189 		WARN_ON_ONCE(1);
4190 		goto err_no_verf;
4191 	}
4192 	*p++ = 0;	/* no more entries */
4193 	*p++ = htonl(readdir->common.err == nfserr_eof);
4194 
4195 	return 0;
4196 err_no_verf:
4197 	xdr_truncate_encode(xdr, starting_len);
4198 	return nfserr;
4199 }
4200 
4201 static __be32
nfsd4_encode_remove(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_remove * remove)4202 nfsd4_encode_remove(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_remove *remove)
4203 {
4204 	struct xdr_stream *xdr = resp->xdr;
4205 	__be32 *p;
4206 
4207 	p = xdr_reserve_space(xdr, 20);
4208 	if (!p)
4209 		return nfserr_resource;
4210 	p = encode_cinfo(p, &remove->rm_cinfo);
4211 	return 0;
4212 }
4213 
4214 static __be32
nfsd4_encode_rename(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_rename * rename)4215 nfsd4_encode_rename(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_rename *rename)
4216 {
4217 	struct xdr_stream *xdr = resp->xdr;
4218 	__be32 *p;
4219 
4220 	p = xdr_reserve_space(xdr, 40);
4221 	if (!p)
4222 		return nfserr_resource;
4223 	p = encode_cinfo(p, &rename->rn_sinfo);
4224 	p = encode_cinfo(p, &rename->rn_tinfo);
4225 	return 0;
4226 }
4227 
4228 static __be32
nfsd4_do_encode_secinfo(struct xdr_stream * xdr,struct svc_export * exp)4229 nfsd4_do_encode_secinfo(struct xdr_stream *xdr, struct svc_export *exp)
4230 {
4231 	u32 i, nflavs, supported;
4232 	struct exp_flavor_info *flavs;
4233 	struct exp_flavor_info def_flavs[2];
4234 	__be32 *p, *flavorsp;
4235 	static bool report = true;
4236 
4237 	if (exp->ex_nflavors) {
4238 		flavs = exp->ex_flavors;
4239 		nflavs = exp->ex_nflavors;
4240 	} else { /* Handling of some defaults in absence of real secinfo: */
4241 		flavs = def_flavs;
4242 		if (exp->ex_client->flavour->flavour == RPC_AUTH_UNIX) {
4243 			nflavs = 2;
4244 			flavs[0].pseudoflavor = RPC_AUTH_UNIX;
4245 			flavs[1].pseudoflavor = RPC_AUTH_NULL;
4246 		} else if (exp->ex_client->flavour->flavour == RPC_AUTH_GSS) {
4247 			nflavs = 1;
4248 			flavs[0].pseudoflavor
4249 					= svcauth_gss_flavor(exp->ex_client);
4250 		} else {
4251 			nflavs = 1;
4252 			flavs[0].pseudoflavor
4253 					= exp->ex_client->flavour->flavour;
4254 		}
4255 	}
4256 
4257 	supported = 0;
4258 	p = xdr_reserve_space(xdr, 4);
4259 	if (!p)
4260 		return nfserr_resource;
4261 	flavorsp = p++;		/* to be backfilled later */
4262 
4263 	for (i = 0; i < nflavs; i++) {
4264 		rpc_authflavor_t pf = flavs[i].pseudoflavor;
4265 		struct rpcsec_gss_info info;
4266 
4267 		if (rpcauth_get_gssinfo(pf, &info) == 0) {
4268 			supported++;
4269 			p = xdr_reserve_space(xdr, 4 + 4 +
4270 					      XDR_LEN(info.oid.len) + 4 + 4);
4271 			if (!p)
4272 				return nfserr_resource;
4273 			*p++ = cpu_to_be32(RPC_AUTH_GSS);
4274 			p = xdr_encode_opaque(p,  info.oid.data, info.oid.len);
4275 			*p++ = cpu_to_be32(info.qop);
4276 			*p++ = cpu_to_be32(info.service);
4277 		} else if (pf < RPC_AUTH_MAXFLAVOR) {
4278 			supported++;
4279 			p = xdr_reserve_space(xdr, 4);
4280 			if (!p)
4281 				return nfserr_resource;
4282 			*p++ = cpu_to_be32(pf);
4283 		} else {
4284 			if (report)
4285 				pr_warn("NFS: SECINFO: security flavor %u "
4286 					"is not supported\n", pf);
4287 		}
4288 	}
4289 
4290 	if (nflavs != supported)
4291 		report = false;
4292 	*flavorsp = htonl(supported);
4293 	return 0;
4294 }
4295 
4296 static __be32
nfsd4_encode_secinfo(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_secinfo * secinfo)4297 nfsd4_encode_secinfo(struct nfsd4_compoundres *resp, __be32 nfserr,
4298 		     struct nfsd4_secinfo *secinfo)
4299 {
4300 	struct xdr_stream *xdr = resp->xdr;
4301 
4302 	return nfsd4_do_encode_secinfo(xdr, secinfo->si_exp);
4303 }
4304 
4305 static __be32
nfsd4_encode_secinfo_no_name(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_secinfo_no_name * secinfo)4306 nfsd4_encode_secinfo_no_name(struct nfsd4_compoundres *resp, __be32 nfserr,
4307 		     struct nfsd4_secinfo_no_name *secinfo)
4308 {
4309 	struct xdr_stream *xdr = resp->xdr;
4310 
4311 	return nfsd4_do_encode_secinfo(xdr, secinfo->sin_exp);
4312 }
4313 
4314 /*
4315  * The SETATTR encode routine is special -- it always encodes a bitmap,
4316  * regardless of the error status.
4317  */
4318 static __be32
nfsd4_encode_setattr(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_setattr * setattr)4319 nfsd4_encode_setattr(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_setattr *setattr)
4320 {
4321 	struct xdr_stream *xdr = resp->xdr;
4322 	__be32 *p;
4323 
4324 	p = xdr_reserve_space(xdr, 16);
4325 	if (!p)
4326 		return nfserr_resource;
4327 	if (nfserr) {
4328 		*p++ = cpu_to_be32(3);
4329 		*p++ = cpu_to_be32(0);
4330 		*p++ = cpu_to_be32(0);
4331 		*p++ = cpu_to_be32(0);
4332 	}
4333 	else {
4334 		*p++ = cpu_to_be32(3);
4335 		*p++ = cpu_to_be32(setattr->sa_bmval[0]);
4336 		*p++ = cpu_to_be32(setattr->sa_bmval[1]);
4337 		*p++ = cpu_to_be32(setattr->sa_bmval[2]);
4338 	}
4339 	return nfserr;
4340 }
4341 
4342 static __be32
nfsd4_encode_setclientid(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_setclientid * scd)4343 nfsd4_encode_setclientid(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_setclientid *scd)
4344 {
4345 	struct xdr_stream *xdr = resp->xdr;
4346 	__be32 *p;
4347 
4348 	if (!nfserr) {
4349 		p = xdr_reserve_space(xdr, 8 + NFS4_VERIFIER_SIZE);
4350 		if (!p)
4351 			return nfserr_resource;
4352 		p = xdr_encode_opaque_fixed(p, &scd->se_clientid, 8);
4353 		p = xdr_encode_opaque_fixed(p, &scd->se_confirm,
4354 						NFS4_VERIFIER_SIZE);
4355 	}
4356 	else if (nfserr == nfserr_clid_inuse) {
4357 		p = xdr_reserve_space(xdr, 8);
4358 		if (!p)
4359 			return nfserr_resource;
4360 		*p++ = cpu_to_be32(0);
4361 		*p++ = cpu_to_be32(0);
4362 	}
4363 	return nfserr;
4364 }
4365 
4366 static __be32
nfsd4_encode_write(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_write * write)4367 nfsd4_encode_write(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_write *write)
4368 {
4369 	struct xdr_stream *xdr = resp->xdr;
4370 	__be32 *p;
4371 
4372 	p = xdr_reserve_space(xdr, 16);
4373 	if (!p)
4374 		return nfserr_resource;
4375 	*p++ = cpu_to_be32(write->wr_bytes_written);
4376 	*p++ = cpu_to_be32(write->wr_how_written);
4377 	p = xdr_encode_opaque_fixed(p, write->wr_verifier.data,
4378 						NFS4_VERIFIER_SIZE);
4379 	return 0;
4380 }
4381 
4382 static __be32
nfsd4_encode_exchange_id(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_exchange_id * exid)4383 nfsd4_encode_exchange_id(struct nfsd4_compoundres *resp, __be32 nfserr,
4384 			 struct nfsd4_exchange_id *exid)
4385 {
4386 	struct xdr_stream *xdr = resp->xdr;
4387 	__be32 *p;
4388 	char *major_id;
4389 	char *server_scope;
4390 	int major_id_sz;
4391 	int server_scope_sz;
4392 	uint64_t minor_id = 0;
4393 	struct nfsd_net *nn = net_generic(SVC_NET(resp->rqstp), nfsd_net_id);
4394 
4395 	major_id = nn->nfsd_name;
4396 	major_id_sz = strlen(nn->nfsd_name);
4397 	server_scope = nn->nfsd_name;
4398 	server_scope_sz = strlen(nn->nfsd_name);
4399 
4400 	p = xdr_reserve_space(xdr,
4401 		8 /* eir_clientid */ +
4402 		4 /* eir_sequenceid */ +
4403 		4 /* eir_flags */ +
4404 		4 /* spr_how */);
4405 	if (!p)
4406 		return nfserr_resource;
4407 
4408 	p = xdr_encode_opaque_fixed(p, &exid->clientid, 8);
4409 	*p++ = cpu_to_be32(exid->seqid);
4410 	*p++ = cpu_to_be32(exid->flags);
4411 
4412 	*p++ = cpu_to_be32(exid->spa_how);
4413 
4414 	switch (exid->spa_how) {
4415 	case SP4_NONE:
4416 		break;
4417 	case SP4_MACH_CRED:
4418 		/* spo_must_enforce bitmap: */
4419 		nfserr = nfsd4_encode_bitmap(xdr,
4420 					exid->spo_must_enforce[0],
4421 					exid->spo_must_enforce[1],
4422 					exid->spo_must_enforce[2]);
4423 		if (nfserr)
4424 			return nfserr;
4425 		/* spo_must_allow bitmap: */
4426 		nfserr = nfsd4_encode_bitmap(xdr,
4427 					exid->spo_must_allow[0],
4428 					exid->spo_must_allow[1],
4429 					exid->spo_must_allow[2]);
4430 		if (nfserr)
4431 			return nfserr;
4432 		break;
4433 	default:
4434 		WARN_ON_ONCE(1);
4435 	}
4436 
4437 	p = xdr_reserve_space(xdr,
4438 		8 /* so_minor_id */ +
4439 		4 /* so_major_id.len */ +
4440 		(XDR_QUADLEN(major_id_sz) * 4) +
4441 		4 /* eir_server_scope.len */ +
4442 		(XDR_QUADLEN(server_scope_sz) * 4) +
4443 		4 /* eir_server_impl_id.count (0) */);
4444 	if (!p)
4445 		return nfserr_resource;
4446 
4447 	/* The server_owner struct */
4448 	p = xdr_encode_hyper(p, minor_id);      /* Minor id */
4449 	/* major id */
4450 	p = xdr_encode_opaque(p, major_id, major_id_sz);
4451 
4452 	/* Server scope */
4453 	p = xdr_encode_opaque(p, server_scope, server_scope_sz);
4454 
4455 	/* Implementation id */
4456 	*p++ = cpu_to_be32(0);	/* zero length nfs_impl_id4 array */
4457 	return 0;
4458 }
4459 
4460 static __be32
nfsd4_encode_create_session(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_create_session * sess)4461 nfsd4_encode_create_session(struct nfsd4_compoundres *resp, __be32 nfserr,
4462 			    struct nfsd4_create_session *sess)
4463 {
4464 	struct xdr_stream *xdr = resp->xdr;
4465 	__be32 *p;
4466 
4467 	p = xdr_reserve_space(xdr, 24);
4468 	if (!p)
4469 		return nfserr_resource;
4470 	p = xdr_encode_opaque_fixed(p, sess->sessionid.data,
4471 					NFS4_MAX_SESSIONID_LEN);
4472 	*p++ = cpu_to_be32(sess->seqid);
4473 	*p++ = cpu_to_be32(sess->flags);
4474 
4475 	p = xdr_reserve_space(xdr, 28);
4476 	if (!p)
4477 		return nfserr_resource;
4478 	*p++ = cpu_to_be32(0); /* headerpadsz */
4479 	*p++ = cpu_to_be32(sess->fore_channel.maxreq_sz);
4480 	*p++ = cpu_to_be32(sess->fore_channel.maxresp_sz);
4481 	*p++ = cpu_to_be32(sess->fore_channel.maxresp_cached);
4482 	*p++ = cpu_to_be32(sess->fore_channel.maxops);
4483 	*p++ = cpu_to_be32(sess->fore_channel.maxreqs);
4484 	*p++ = cpu_to_be32(sess->fore_channel.nr_rdma_attrs);
4485 
4486 	if (sess->fore_channel.nr_rdma_attrs) {
4487 		p = xdr_reserve_space(xdr, 4);
4488 		if (!p)
4489 			return nfserr_resource;
4490 		*p++ = cpu_to_be32(sess->fore_channel.rdma_attrs);
4491 	}
4492 
4493 	p = xdr_reserve_space(xdr, 28);
4494 	if (!p)
4495 		return nfserr_resource;
4496 	*p++ = cpu_to_be32(0); /* headerpadsz */
4497 	*p++ = cpu_to_be32(sess->back_channel.maxreq_sz);
4498 	*p++ = cpu_to_be32(sess->back_channel.maxresp_sz);
4499 	*p++ = cpu_to_be32(sess->back_channel.maxresp_cached);
4500 	*p++ = cpu_to_be32(sess->back_channel.maxops);
4501 	*p++ = cpu_to_be32(sess->back_channel.maxreqs);
4502 	*p++ = cpu_to_be32(sess->back_channel.nr_rdma_attrs);
4503 
4504 	if (sess->back_channel.nr_rdma_attrs) {
4505 		p = xdr_reserve_space(xdr, 4);
4506 		if (!p)
4507 			return nfserr_resource;
4508 		*p++ = cpu_to_be32(sess->back_channel.rdma_attrs);
4509 	}
4510 	return 0;
4511 }
4512 
4513 static __be32
nfsd4_encode_sequence(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_sequence * seq)4514 nfsd4_encode_sequence(struct nfsd4_compoundres *resp, __be32 nfserr,
4515 		      struct nfsd4_sequence *seq)
4516 {
4517 	struct xdr_stream *xdr = resp->xdr;
4518 	__be32 *p;
4519 
4520 	p = xdr_reserve_space(xdr, NFS4_MAX_SESSIONID_LEN + 20);
4521 	if (!p)
4522 		return nfserr_resource;
4523 	p = xdr_encode_opaque_fixed(p, seq->sessionid.data,
4524 					NFS4_MAX_SESSIONID_LEN);
4525 	*p++ = cpu_to_be32(seq->seqid);
4526 	*p++ = cpu_to_be32(seq->slotid);
4527 	/* Note slotid's are numbered from zero: */
4528 	*p++ = cpu_to_be32(seq->maxslots - 1); /* sr_highest_slotid */
4529 	*p++ = cpu_to_be32(seq->maxslots - 1); /* sr_target_highest_slotid */
4530 	*p++ = cpu_to_be32(seq->status_flags);
4531 
4532 	resp->cstate.data_offset = xdr->buf->len; /* DRC cache data pointer */
4533 	return 0;
4534 }
4535 
4536 static __be32
nfsd4_encode_test_stateid(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_test_stateid * test_stateid)4537 nfsd4_encode_test_stateid(struct nfsd4_compoundres *resp, __be32 nfserr,
4538 			  struct nfsd4_test_stateid *test_stateid)
4539 {
4540 	struct xdr_stream *xdr = resp->xdr;
4541 	struct nfsd4_test_stateid_id *stateid, *next;
4542 	__be32 *p;
4543 
4544 	p = xdr_reserve_space(xdr, 4 + (4 * test_stateid->ts_num_ids));
4545 	if (!p)
4546 		return nfserr_resource;
4547 	*p++ = htonl(test_stateid->ts_num_ids);
4548 
4549 	list_for_each_entry_safe(stateid, next, &test_stateid->ts_stateid_list, ts_id_list) {
4550 		*p++ = stateid->ts_id_status;
4551 	}
4552 
4553 	return 0;
4554 }
4555 
4556 #ifdef CONFIG_NFSD_PNFS
4557 static __be32
nfsd4_encode_getdeviceinfo(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_getdeviceinfo * gdev)4558 nfsd4_encode_getdeviceinfo(struct nfsd4_compoundres *resp, __be32 nfserr,
4559 		struct nfsd4_getdeviceinfo *gdev)
4560 {
4561 	struct xdr_stream *xdr = resp->xdr;
4562 	const struct nfsd4_layout_ops *ops;
4563 	u32 starting_len = xdr->buf->len, needed_len;
4564 	__be32 *p;
4565 
4566 	p = xdr_reserve_space(xdr, 4);
4567 	if (!p)
4568 		return nfserr_resource;
4569 
4570 	*p++ = cpu_to_be32(gdev->gd_layout_type);
4571 
4572 	/* If maxcount is 0 then just update notifications */
4573 	if (gdev->gd_maxcount != 0) {
4574 		ops = nfsd4_layout_ops[gdev->gd_layout_type];
4575 		nfserr = ops->encode_getdeviceinfo(xdr, gdev);
4576 		if (nfserr) {
4577 			/*
4578 			 * We don't bother to burden the layout drivers with
4579 			 * enforcing gd_maxcount, just tell the client to
4580 			 * come back with a bigger buffer if it's not enough.
4581 			 */
4582 			if (xdr->buf->len + 4 > gdev->gd_maxcount)
4583 				goto toosmall;
4584 			return nfserr;
4585 		}
4586 	}
4587 
4588 	if (gdev->gd_notify_types) {
4589 		p = xdr_reserve_space(xdr, 4 + 4);
4590 		if (!p)
4591 			return nfserr_resource;
4592 		*p++ = cpu_to_be32(1);			/* bitmap length */
4593 		*p++ = cpu_to_be32(gdev->gd_notify_types);
4594 	} else {
4595 		p = xdr_reserve_space(xdr, 4);
4596 		if (!p)
4597 			return nfserr_resource;
4598 		*p++ = 0;
4599 	}
4600 
4601 	return 0;
4602 toosmall:
4603 	dprintk("%s: maxcount too small\n", __func__);
4604 	needed_len = xdr->buf->len + 4 /* notifications */;
4605 	xdr_truncate_encode(xdr, starting_len);
4606 	p = xdr_reserve_space(xdr, 4);
4607 	if (!p)
4608 		return nfserr_resource;
4609 	*p++ = cpu_to_be32(needed_len);
4610 	return nfserr_toosmall;
4611 }
4612 
4613 static __be32
nfsd4_encode_layoutget(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_layoutget * lgp)4614 nfsd4_encode_layoutget(struct nfsd4_compoundres *resp, __be32 nfserr,
4615 		struct nfsd4_layoutget *lgp)
4616 {
4617 	struct xdr_stream *xdr = resp->xdr;
4618 	const struct nfsd4_layout_ops *ops;
4619 	__be32 *p;
4620 
4621 	p = xdr_reserve_space(xdr, 36 + sizeof(stateid_opaque_t));
4622 	if (!p)
4623 		return nfserr_resource;
4624 
4625 	*p++ = cpu_to_be32(1);	/* we always set return-on-close */
4626 	*p++ = cpu_to_be32(lgp->lg_sid.si_generation);
4627 	p = xdr_encode_opaque_fixed(p, &lgp->lg_sid.si_opaque,
4628 				    sizeof(stateid_opaque_t));
4629 
4630 	*p++ = cpu_to_be32(1);	/* we always return a single layout */
4631 	p = xdr_encode_hyper(p, lgp->lg_seg.offset);
4632 	p = xdr_encode_hyper(p, lgp->lg_seg.length);
4633 	*p++ = cpu_to_be32(lgp->lg_seg.iomode);
4634 	*p++ = cpu_to_be32(lgp->lg_layout_type);
4635 
4636 	ops = nfsd4_layout_ops[lgp->lg_layout_type];
4637 	return ops->encode_layoutget(xdr, lgp);
4638 }
4639 
4640 static __be32
nfsd4_encode_layoutcommit(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_layoutcommit * lcp)4641 nfsd4_encode_layoutcommit(struct nfsd4_compoundres *resp, __be32 nfserr,
4642 			  struct nfsd4_layoutcommit *lcp)
4643 {
4644 	struct xdr_stream *xdr = resp->xdr;
4645 	__be32 *p;
4646 
4647 	p = xdr_reserve_space(xdr, 4);
4648 	if (!p)
4649 		return nfserr_resource;
4650 	*p++ = cpu_to_be32(lcp->lc_size_chg);
4651 	if (lcp->lc_size_chg) {
4652 		p = xdr_reserve_space(xdr, 8);
4653 		if (!p)
4654 			return nfserr_resource;
4655 		p = xdr_encode_hyper(p, lcp->lc_newsize);
4656 	}
4657 
4658 	return 0;
4659 }
4660 
4661 static __be32
nfsd4_encode_layoutreturn(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_layoutreturn * lrp)4662 nfsd4_encode_layoutreturn(struct nfsd4_compoundres *resp, __be32 nfserr,
4663 		struct nfsd4_layoutreturn *lrp)
4664 {
4665 	struct xdr_stream *xdr = resp->xdr;
4666 	__be32 *p;
4667 
4668 	p = xdr_reserve_space(xdr, 4);
4669 	if (!p)
4670 		return nfserr_resource;
4671 	*p++ = cpu_to_be32(lrp->lrs_present);
4672 	if (lrp->lrs_present)
4673 		return nfsd4_encode_stateid(xdr, &lrp->lr_sid);
4674 	return 0;
4675 }
4676 #endif /* CONFIG_NFSD_PNFS */
4677 
4678 static __be32
nfsd42_encode_write_res(struct nfsd4_compoundres * resp,struct nfsd42_write_res * write,bool sync)4679 nfsd42_encode_write_res(struct nfsd4_compoundres *resp,
4680 		struct nfsd42_write_res *write, bool sync)
4681 {
4682 	__be32 *p;
4683 	p = xdr_reserve_space(resp->xdr, 4);
4684 	if (!p)
4685 		return nfserr_resource;
4686 
4687 	if (sync)
4688 		*p++ = cpu_to_be32(0);
4689 	else {
4690 		__be32 nfserr;
4691 		*p++ = cpu_to_be32(1);
4692 		nfserr = nfsd4_encode_stateid(resp->xdr, &write->cb_stateid);
4693 		if (nfserr)
4694 			return nfserr;
4695 	}
4696 	p = xdr_reserve_space(resp->xdr, 8 + 4 + NFS4_VERIFIER_SIZE);
4697 	if (!p)
4698 		return nfserr_resource;
4699 
4700 	p = xdr_encode_hyper(p, write->wr_bytes_written);
4701 	*p++ = cpu_to_be32(write->wr_stable_how);
4702 	p = xdr_encode_opaque_fixed(p, write->wr_verifier.data,
4703 				    NFS4_VERIFIER_SIZE);
4704 	return nfs_ok;
4705 }
4706 
4707 static __be32
nfsd42_encode_nl4_server(struct nfsd4_compoundres * resp,struct nl4_server * ns)4708 nfsd42_encode_nl4_server(struct nfsd4_compoundres *resp, struct nl4_server *ns)
4709 {
4710 	struct xdr_stream *xdr = resp->xdr;
4711 	struct nfs42_netaddr *addr;
4712 	__be32 *p;
4713 
4714 	p = xdr_reserve_space(xdr, 4);
4715 	*p++ = cpu_to_be32(ns->nl4_type);
4716 
4717 	switch (ns->nl4_type) {
4718 	case NL4_NETADDR:
4719 		addr = &ns->u.nl4_addr;
4720 
4721 		/* netid_len, netid, uaddr_len, uaddr (port included
4722 		 * in RPCBIND_MAXUADDRLEN)
4723 		 */
4724 		p = xdr_reserve_space(xdr,
4725 			4 /* netid len */ +
4726 			(XDR_QUADLEN(addr->netid_len) * 4) +
4727 			4 /* uaddr len */ +
4728 			(XDR_QUADLEN(addr->addr_len) * 4));
4729 		if (!p)
4730 			return nfserr_resource;
4731 
4732 		*p++ = cpu_to_be32(addr->netid_len);
4733 		p = xdr_encode_opaque_fixed(p, addr->netid,
4734 					    addr->netid_len);
4735 		*p++ = cpu_to_be32(addr->addr_len);
4736 		p = xdr_encode_opaque_fixed(p, addr->addr,
4737 					addr->addr_len);
4738 		break;
4739 	default:
4740 		WARN_ON_ONCE(ns->nl4_type != NL4_NETADDR);
4741 		return nfserr_inval;
4742 	}
4743 
4744 	return 0;
4745 }
4746 
4747 static __be32
nfsd4_encode_copy(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_copy * copy)4748 nfsd4_encode_copy(struct nfsd4_compoundres *resp, __be32 nfserr,
4749 		  struct nfsd4_copy *copy)
4750 {
4751 	__be32 *p;
4752 
4753 	nfserr = nfsd42_encode_write_res(resp, &copy->cp_res,
4754 					 nfsd4_copy_is_sync(copy));
4755 	if (nfserr)
4756 		return nfserr;
4757 
4758 	p = xdr_reserve_space(resp->xdr, 4 + 4);
4759 	*p++ = xdr_one; /* cr_consecutive */
4760 	*p = nfsd4_copy_is_sync(copy) ? xdr_one : xdr_zero;
4761 	return 0;
4762 }
4763 
4764 static __be32
nfsd4_encode_offload_status(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_offload_status * os)4765 nfsd4_encode_offload_status(struct nfsd4_compoundres *resp, __be32 nfserr,
4766 			    struct nfsd4_offload_status *os)
4767 {
4768 	struct xdr_stream *xdr = resp->xdr;
4769 	__be32 *p;
4770 
4771 	p = xdr_reserve_space(xdr, 8 + 4);
4772 	if (!p)
4773 		return nfserr_resource;
4774 	p = xdr_encode_hyper(p, os->count);
4775 	*p++ = cpu_to_be32(0);
4776 	return nfserr;
4777 }
4778 
4779 static __be32
nfsd4_encode_read_plus_data(struct nfsd4_compoundres * resp,struct nfsd4_read * read,unsigned long * maxcount,u32 * eof,loff_t * pos)4780 nfsd4_encode_read_plus_data(struct nfsd4_compoundres *resp,
4781 			    struct nfsd4_read *read,
4782 			    unsigned long *maxcount, u32 *eof,
4783 			    loff_t *pos)
4784 {
4785 	struct xdr_stream *xdr = resp->xdr;
4786 	struct file *file = read->rd_nf->nf_file;
4787 	int starting_len = xdr->buf->len;
4788 	loff_t hole_pos;
4789 	__be32 nfserr;
4790 	__be32 *p, tmp;
4791 	__be64 tmp64;
4792 
4793 	hole_pos = pos ? *pos : vfs_llseek(file, read->rd_offset, SEEK_HOLE);
4794 	if (hole_pos > read->rd_offset)
4795 		*maxcount = min_t(unsigned long, *maxcount, hole_pos - read->rd_offset);
4796 	*maxcount = min_t(unsigned long, *maxcount, (xdr->buf->buflen - xdr->buf->len));
4797 
4798 	/* Content type, offset, byte count */
4799 	p = xdr_reserve_space(xdr, 4 + 8 + 4);
4800 	if (!p)
4801 		return nfserr_resource;
4802 
4803 	read->rd_vlen = xdr_reserve_space_vec(xdr, resp->rqstp->rq_vec, *maxcount);
4804 	if (read->rd_vlen < 0)
4805 		return nfserr_resource;
4806 
4807 	nfserr = nfsd_readv(resp->rqstp, read->rd_fhp, file, read->rd_offset,
4808 			    resp->rqstp->rq_vec, read->rd_vlen, maxcount, eof);
4809 	if (nfserr)
4810 		return nfserr;
4811 	xdr_truncate_encode(xdr, starting_len + 16 + xdr_align_size(*maxcount));
4812 
4813 	tmp = htonl(NFS4_CONTENT_DATA);
4814 	write_bytes_to_xdr_buf(xdr->buf, starting_len,      &tmp,   4);
4815 	tmp64 = cpu_to_be64(read->rd_offset);
4816 	write_bytes_to_xdr_buf(xdr->buf, starting_len + 4,  &tmp64, 8);
4817 	tmp = htonl(*maxcount);
4818 	write_bytes_to_xdr_buf(xdr->buf, starting_len + 12, &tmp,   4);
4819 
4820 	tmp = xdr_zero;
4821 	write_bytes_to_xdr_buf(xdr->buf, starting_len + 16 + *maxcount, &tmp,
4822 			       xdr_pad_size(*maxcount));
4823 	return nfs_ok;
4824 }
4825 
4826 static __be32
nfsd4_encode_read_plus_hole(struct nfsd4_compoundres * resp,struct nfsd4_read * read,unsigned long * maxcount,u32 * eof)4827 nfsd4_encode_read_plus_hole(struct nfsd4_compoundres *resp,
4828 			    struct nfsd4_read *read,
4829 			    unsigned long *maxcount, u32 *eof)
4830 {
4831 	struct file *file = read->rd_nf->nf_file;
4832 	loff_t data_pos = vfs_llseek(file, read->rd_offset, SEEK_DATA);
4833 	loff_t f_size = i_size_read(file_inode(file));
4834 	unsigned long count;
4835 	__be32 *p;
4836 
4837 	if (data_pos == -ENXIO)
4838 		data_pos = f_size;
4839 	else if (data_pos <= read->rd_offset || (data_pos < f_size && data_pos % PAGE_SIZE))
4840 		return nfsd4_encode_read_plus_data(resp, read, maxcount, eof, &f_size);
4841 	count = data_pos - read->rd_offset;
4842 
4843 	/* Content type, offset, byte count */
4844 	p = xdr_reserve_space(resp->xdr, 4 + 8 + 8);
4845 	if (!p)
4846 		return nfserr_resource;
4847 
4848 	*p++ = htonl(NFS4_CONTENT_HOLE);
4849 	p = xdr_encode_hyper(p, read->rd_offset);
4850 	p = xdr_encode_hyper(p, count);
4851 
4852 	*eof = (read->rd_offset + count) >= f_size;
4853 	*maxcount = min_t(unsigned long, count, *maxcount);
4854 	return nfs_ok;
4855 }
4856 
4857 static __be32
nfsd4_encode_read_plus(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_read * read)4858 nfsd4_encode_read_plus(struct nfsd4_compoundres *resp, __be32 nfserr,
4859 		       struct nfsd4_read *read)
4860 {
4861 	unsigned long maxcount, count;
4862 	struct xdr_stream *xdr = resp->xdr;
4863 	struct file *file;
4864 	int starting_len = xdr->buf->len;
4865 	int last_segment = xdr->buf->len;
4866 	int segments = 0;
4867 	__be32 *p, tmp;
4868 	bool is_data;
4869 	loff_t pos;
4870 	u32 eof;
4871 
4872 	if (nfserr)
4873 		return nfserr;
4874 	file = read->rd_nf->nf_file;
4875 
4876 	/* eof flag, segment count */
4877 	p = xdr_reserve_space(xdr, 4 + 4);
4878 	if (!p)
4879 		return nfserr_resource;
4880 	xdr_commit_encode(xdr);
4881 
4882 	maxcount = min_t(unsigned long, read->rd_length,
4883 			 (xdr->buf->buflen - xdr->buf->len));
4884 	count    = maxcount;
4885 
4886 	eof = read->rd_offset >= i_size_read(file_inode(file));
4887 	if (eof)
4888 		goto out;
4889 
4890 	pos = vfs_llseek(file, read->rd_offset, SEEK_HOLE);
4891 	is_data = pos > read->rd_offset;
4892 
4893 	while (count > 0 && !eof) {
4894 		maxcount = count;
4895 		if (is_data)
4896 			nfserr = nfsd4_encode_read_plus_data(resp, read, &maxcount, &eof,
4897 						segments == 0 ? &pos : NULL);
4898 		else
4899 			nfserr = nfsd4_encode_read_plus_hole(resp, read, &maxcount, &eof);
4900 		if (nfserr)
4901 			goto out;
4902 		count -= maxcount;
4903 		read->rd_offset += maxcount;
4904 		is_data = !is_data;
4905 		last_segment = xdr->buf->len;
4906 		segments++;
4907 	}
4908 
4909 out:
4910 	if (nfserr && segments == 0)
4911 		xdr_truncate_encode(xdr, starting_len);
4912 	else {
4913 		if (nfserr) {
4914 			xdr_truncate_encode(xdr, last_segment);
4915 			nfserr = nfs_ok;
4916 			eof = 0;
4917 		}
4918 		tmp = htonl(eof);
4919 		write_bytes_to_xdr_buf(xdr->buf, starting_len,     &tmp, 4);
4920 		tmp = htonl(segments);
4921 		write_bytes_to_xdr_buf(xdr->buf, starting_len + 4, &tmp, 4);
4922 	}
4923 
4924 	return nfserr;
4925 }
4926 
4927 static __be32
nfsd4_encode_copy_notify(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_copy_notify * cn)4928 nfsd4_encode_copy_notify(struct nfsd4_compoundres *resp, __be32 nfserr,
4929 			 struct nfsd4_copy_notify *cn)
4930 {
4931 	struct xdr_stream *xdr = resp->xdr;
4932 	__be32 *p;
4933 
4934 	if (nfserr)
4935 		return nfserr;
4936 
4937 	/* 8 sec, 4 nsec */
4938 	p = xdr_reserve_space(xdr, 12);
4939 	if (!p)
4940 		return nfserr_resource;
4941 
4942 	/* cnr_lease_time */
4943 	p = xdr_encode_hyper(p, cn->cpn_sec);
4944 	*p++ = cpu_to_be32(cn->cpn_nsec);
4945 
4946 	/* cnr_stateid */
4947 	nfserr = nfsd4_encode_stateid(xdr, &cn->cpn_cnr_stateid);
4948 	if (nfserr)
4949 		return nfserr;
4950 
4951 	/* cnr_src.nl_nsvr */
4952 	p = xdr_reserve_space(xdr, 4);
4953 	if (!p)
4954 		return nfserr_resource;
4955 
4956 	*p++ = cpu_to_be32(1);
4957 
4958 	nfserr = nfsd42_encode_nl4_server(resp, cn->cpn_src);
4959 	return nfserr;
4960 }
4961 
4962 static __be32
nfsd4_encode_seek(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_seek * seek)4963 nfsd4_encode_seek(struct nfsd4_compoundres *resp, __be32 nfserr,
4964 		  struct nfsd4_seek *seek)
4965 {
4966 	__be32 *p;
4967 
4968 	p = xdr_reserve_space(resp->xdr, 4 + 8);
4969 	*p++ = cpu_to_be32(seek->seek_eof);
4970 	p = xdr_encode_hyper(p, seek->seek_pos);
4971 
4972 	return 0;
4973 }
4974 
4975 static __be32
nfsd4_encode_noop(struct nfsd4_compoundres * resp,__be32 nfserr,void * p)4976 nfsd4_encode_noop(struct nfsd4_compoundres *resp, __be32 nfserr, void *p)
4977 {
4978 	return nfserr;
4979 }
4980 
4981 /*
4982  * Encode kmalloc-ed buffer in to XDR stream.
4983  */
4984 static __be32
nfsd4_vbuf_to_stream(struct xdr_stream * xdr,char * buf,u32 buflen)4985 nfsd4_vbuf_to_stream(struct xdr_stream *xdr, char *buf, u32 buflen)
4986 {
4987 	u32 cplen;
4988 	__be32 *p;
4989 
4990 	cplen = min_t(unsigned long, buflen,
4991 		      ((void *)xdr->end - (void *)xdr->p));
4992 	p = xdr_reserve_space(xdr, cplen);
4993 	if (!p)
4994 		return nfserr_resource;
4995 
4996 	memcpy(p, buf, cplen);
4997 	buf += cplen;
4998 	buflen -= cplen;
4999 
5000 	while (buflen) {
5001 		cplen = min_t(u32, buflen, PAGE_SIZE);
5002 		p = xdr_reserve_space(xdr, cplen);
5003 		if (!p)
5004 			return nfserr_resource;
5005 
5006 		memcpy(p, buf, cplen);
5007 
5008 		if (cplen < PAGE_SIZE) {
5009 			/*
5010 			 * We're done, with a length that wasn't page
5011 			 * aligned, so possibly not word aligned. Pad
5012 			 * any trailing bytes with 0.
5013 			 */
5014 			xdr_encode_opaque_fixed(p, NULL, cplen);
5015 			break;
5016 		}
5017 
5018 		buflen -= PAGE_SIZE;
5019 		buf += PAGE_SIZE;
5020 	}
5021 
5022 	return 0;
5023 }
5024 
5025 static __be32
nfsd4_encode_getxattr(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_getxattr * getxattr)5026 nfsd4_encode_getxattr(struct nfsd4_compoundres *resp, __be32 nfserr,
5027 		      struct nfsd4_getxattr *getxattr)
5028 {
5029 	struct xdr_stream *xdr = resp->xdr;
5030 	__be32 *p, err;
5031 
5032 	p = xdr_reserve_space(xdr, 4);
5033 	if (!p)
5034 		return nfserr_resource;
5035 
5036 	*p = cpu_to_be32(getxattr->getxa_len);
5037 
5038 	if (getxattr->getxa_len == 0)
5039 		return 0;
5040 
5041 	err = nfsd4_vbuf_to_stream(xdr, getxattr->getxa_buf,
5042 				    getxattr->getxa_len);
5043 
5044 	kvfree(getxattr->getxa_buf);
5045 
5046 	return err;
5047 }
5048 
5049 static __be32
nfsd4_encode_setxattr(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_setxattr * setxattr)5050 nfsd4_encode_setxattr(struct nfsd4_compoundres *resp, __be32 nfserr,
5051 		      struct nfsd4_setxattr *setxattr)
5052 {
5053 	struct xdr_stream *xdr = resp->xdr;
5054 	__be32 *p;
5055 
5056 	p = xdr_reserve_space(xdr, 20);
5057 	if (!p)
5058 		return nfserr_resource;
5059 
5060 	encode_cinfo(p, &setxattr->setxa_cinfo);
5061 
5062 	return 0;
5063 }
5064 
5065 /*
5066  * See if there are cookie values that can be rejected outright.
5067  */
5068 static __be32
nfsd4_listxattr_validate_cookie(struct nfsd4_listxattrs * listxattrs,u32 * offsetp)5069 nfsd4_listxattr_validate_cookie(struct nfsd4_listxattrs *listxattrs,
5070 				u32 *offsetp)
5071 {
5072 	u64 cookie = listxattrs->lsxa_cookie;
5073 
5074 	/*
5075 	 * If the cookie is larger than the maximum number we can fit
5076 	 * in either the buffer we just got back from vfs_listxattr, or,
5077 	 * XDR-encoded, in the return buffer, it's invalid.
5078 	 */
5079 	if (cookie > (listxattrs->lsxa_len) / (XATTR_USER_PREFIX_LEN + 2))
5080 		return nfserr_badcookie;
5081 
5082 	if (cookie > (listxattrs->lsxa_maxcount /
5083 		      (XDR_QUADLEN(XATTR_USER_PREFIX_LEN + 2) + 4)))
5084 		return nfserr_badcookie;
5085 
5086 	*offsetp = (u32)cookie;
5087 	return 0;
5088 }
5089 
5090 static __be32
nfsd4_encode_listxattrs(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_listxattrs * listxattrs)5091 nfsd4_encode_listxattrs(struct nfsd4_compoundres *resp, __be32 nfserr,
5092 			struct nfsd4_listxattrs *listxattrs)
5093 {
5094 	struct xdr_stream *xdr = resp->xdr;
5095 	u32 cookie_offset, count_offset, eof;
5096 	u32 left, xdrleft, slen, count;
5097 	u32 xdrlen, offset;
5098 	u64 cookie;
5099 	char *sp;
5100 	__be32 status, tmp;
5101 	__be32 *p;
5102 	u32 nuser;
5103 
5104 	eof = 1;
5105 
5106 	status = nfsd4_listxattr_validate_cookie(listxattrs, &offset);
5107 	if (status)
5108 		goto out;
5109 
5110 	/*
5111 	 * Reserve space for the cookie and the name array count. Record
5112 	 * the offsets to save them later.
5113 	 */
5114 	cookie_offset = xdr->buf->len;
5115 	count_offset = cookie_offset + 8;
5116 	p = xdr_reserve_space(xdr, 12);
5117 	if (!p) {
5118 		status = nfserr_resource;
5119 		goto out;
5120 	}
5121 
5122 	count = 0;
5123 	left = listxattrs->lsxa_len;
5124 	sp = listxattrs->lsxa_buf;
5125 	nuser = 0;
5126 
5127 	xdrleft = listxattrs->lsxa_maxcount;
5128 
5129 	while (left > 0 && xdrleft > 0) {
5130 		slen = strlen(sp);
5131 
5132 		/*
5133 		 * Check if this is a "user." attribute, skip it if not.
5134 		 */
5135 		if (strncmp(sp, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
5136 			goto contloop;
5137 
5138 		slen -= XATTR_USER_PREFIX_LEN;
5139 		xdrlen = 4 + ((slen + 3) & ~3);
5140 		if (xdrlen > xdrleft) {
5141 			if (count == 0) {
5142 				/*
5143 				 * Can't even fit the first attribute name.
5144 				 */
5145 				status = nfserr_toosmall;
5146 				goto out;
5147 			}
5148 			eof = 0;
5149 			goto wreof;
5150 		}
5151 
5152 		left -= XATTR_USER_PREFIX_LEN;
5153 		sp += XATTR_USER_PREFIX_LEN;
5154 		if (nuser++ < offset)
5155 			goto contloop;
5156 
5157 
5158 		p = xdr_reserve_space(xdr, xdrlen);
5159 		if (!p) {
5160 			status = nfserr_resource;
5161 			goto out;
5162 		}
5163 
5164 		xdr_encode_opaque(p, sp, slen);
5165 
5166 		xdrleft -= xdrlen;
5167 		count++;
5168 contloop:
5169 		sp += slen + 1;
5170 		left -= slen + 1;
5171 	}
5172 
5173 	/*
5174 	 * If there were user attributes to copy, but we didn't copy
5175 	 * any, the offset was too large (e.g. the cookie was invalid).
5176 	 */
5177 	if (nuser > 0 && count == 0) {
5178 		status = nfserr_badcookie;
5179 		goto out;
5180 	}
5181 
5182 wreof:
5183 	p = xdr_reserve_space(xdr, 4);
5184 	if (!p) {
5185 		status = nfserr_resource;
5186 		goto out;
5187 	}
5188 	*p = cpu_to_be32(eof);
5189 
5190 	cookie = offset + count;
5191 
5192 	write_bytes_to_xdr_buf(xdr->buf, cookie_offset, &cookie, 8);
5193 	tmp = cpu_to_be32(count);
5194 	write_bytes_to_xdr_buf(xdr->buf, count_offset, &tmp, 4);
5195 out:
5196 	if (listxattrs->lsxa_len)
5197 		kvfree(listxattrs->lsxa_buf);
5198 	return status;
5199 }
5200 
5201 static __be32
nfsd4_encode_removexattr(struct nfsd4_compoundres * resp,__be32 nfserr,struct nfsd4_removexattr * removexattr)5202 nfsd4_encode_removexattr(struct nfsd4_compoundres *resp, __be32 nfserr,
5203 			 struct nfsd4_removexattr *removexattr)
5204 {
5205 	struct xdr_stream *xdr = resp->xdr;
5206 	__be32 *p;
5207 
5208 	p = xdr_reserve_space(xdr, 20);
5209 	if (!p)
5210 		return nfserr_resource;
5211 
5212 	p = encode_cinfo(p, &removexattr->rmxa_cinfo);
5213 	return 0;
5214 }
5215 
5216 typedef __be32(* nfsd4_enc)(struct nfsd4_compoundres *, __be32, void *);
5217 
5218 /*
5219  * Note: nfsd4_enc_ops vector is shared for v4.0 and v4.1
5220  * since we don't need to filter out obsolete ops as this is
5221  * done in the decoding phase.
5222  */
5223 static const nfsd4_enc nfsd4_enc_ops[] = {
5224 	[OP_ACCESS]		= (nfsd4_enc)nfsd4_encode_access,
5225 	[OP_CLOSE]		= (nfsd4_enc)nfsd4_encode_close,
5226 	[OP_COMMIT]		= (nfsd4_enc)nfsd4_encode_commit,
5227 	[OP_CREATE]		= (nfsd4_enc)nfsd4_encode_create,
5228 	[OP_DELEGPURGE]		= (nfsd4_enc)nfsd4_encode_noop,
5229 	[OP_DELEGRETURN]	= (nfsd4_enc)nfsd4_encode_noop,
5230 	[OP_GETATTR]		= (nfsd4_enc)nfsd4_encode_getattr,
5231 	[OP_GETFH]		= (nfsd4_enc)nfsd4_encode_getfh,
5232 	[OP_LINK]		= (nfsd4_enc)nfsd4_encode_link,
5233 	[OP_LOCK]		= (nfsd4_enc)nfsd4_encode_lock,
5234 	[OP_LOCKT]		= (nfsd4_enc)nfsd4_encode_lockt,
5235 	[OP_LOCKU]		= (nfsd4_enc)nfsd4_encode_locku,
5236 	[OP_LOOKUP]		= (nfsd4_enc)nfsd4_encode_noop,
5237 	[OP_LOOKUPP]		= (nfsd4_enc)nfsd4_encode_noop,
5238 	[OP_NVERIFY]		= (nfsd4_enc)nfsd4_encode_noop,
5239 	[OP_OPEN]		= (nfsd4_enc)nfsd4_encode_open,
5240 	[OP_OPENATTR]		= (nfsd4_enc)nfsd4_encode_noop,
5241 	[OP_OPEN_CONFIRM]	= (nfsd4_enc)nfsd4_encode_open_confirm,
5242 	[OP_OPEN_DOWNGRADE]	= (nfsd4_enc)nfsd4_encode_open_downgrade,
5243 	[OP_PUTFH]		= (nfsd4_enc)nfsd4_encode_noop,
5244 	[OP_PUTPUBFH]		= (nfsd4_enc)nfsd4_encode_noop,
5245 	[OP_PUTROOTFH]		= (nfsd4_enc)nfsd4_encode_noop,
5246 	[OP_READ]		= (nfsd4_enc)nfsd4_encode_read,
5247 	[OP_READDIR]		= (nfsd4_enc)nfsd4_encode_readdir,
5248 	[OP_READLINK]		= (nfsd4_enc)nfsd4_encode_readlink,
5249 	[OP_REMOVE]		= (nfsd4_enc)nfsd4_encode_remove,
5250 	[OP_RENAME]		= (nfsd4_enc)nfsd4_encode_rename,
5251 	[OP_RENEW]		= (nfsd4_enc)nfsd4_encode_noop,
5252 	[OP_RESTOREFH]		= (nfsd4_enc)nfsd4_encode_noop,
5253 	[OP_SAVEFH]		= (nfsd4_enc)nfsd4_encode_noop,
5254 	[OP_SECINFO]		= (nfsd4_enc)nfsd4_encode_secinfo,
5255 	[OP_SETATTR]		= (nfsd4_enc)nfsd4_encode_setattr,
5256 	[OP_SETCLIENTID]	= (nfsd4_enc)nfsd4_encode_setclientid,
5257 	[OP_SETCLIENTID_CONFIRM] = (nfsd4_enc)nfsd4_encode_noop,
5258 	[OP_VERIFY]		= (nfsd4_enc)nfsd4_encode_noop,
5259 	[OP_WRITE]		= (nfsd4_enc)nfsd4_encode_write,
5260 	[OP_RELEASE_LOCKOWNER]	= (nfsd4_enc)nfsd4_encode_noop,
5261 
5262 	/* NFSv4.1 operations */
5263 	[OP_BACKCHANNEL_CTL]	= (nfsd4_enc)nfsd4_encode_noop,
5264 	[OP_BIND_CONN_TO_SESSION] = (nfsd4_enc)nfsd4_encode_bind_conn_to_session,
5265 	[OP_EXCHANGE_ID]	= (nfsd4_enc)nfsd4_encode_exchange_id,
5266 	[OP_CREATE_SESSION]	= (nfsd4_enc)nfsd4_encode_create_session,
5267 	[OP_DESTROY_SESSION]	= (nfsd4_enc)nfsd4_encode_noop,
5268 	[OP_FREE_STATEID]	= (nfsd4_enc)nfsd4_encode_noop,
5269 	[OP_GET_DIR_DELEGATION]	= (nfsd4_enc)nfsd4_encode_noop,
5270 #ifdef CONFIG_NFSD_PNFS
5271 	[OP_GETDEVICEINFO]	= (nfsd4_enc)nfsd4_encode_getdeviceinfo,
5272 	[OP_GETDEVICELIST]	= (nfsd4_enc)nfsd4_encode_noop,
5273 	[OP_LAYOUTCOMMIT]	= (nfsd4_enc)nfsd4_encode_layoutcommit,
5274 	[OP_LAYOUTGET]		= (nfsd4_enc)nfsd4_encode_layoutget,
5275 	[OP_LAYOUTRETURN]	= (nfsd4_enc)nfsd4_encode_layoutreturn,
5276 #else
5277 	[OP_GETDEVICEINFO]	= (nfsd4_enc)nfsd4_encode_noop,
5278 	[OP_GETDEVICELIST]	= (nfsd4_enc)nfsd4_encode_noop,
5279 	[OP_LAYOUTCOMMIT]	= (nfsd4_enc)nfsd4_encode_noop,
5280 	[OP_LAYOUTGET]		= (nfsd4_enc)nfsd4_encode_noop,
5281 	[OP_LAYOUTRETURN]	= (nfsd4_enc)nfsd4_encode_noop,
5282 #endif
5283 	[OP_SECINFO_NO_NAME]	= (nfsd4_enc)nfsd4_encode_secinfo_no_name,
5284 	[OP_SEQUENCE]		= (nfsd4_enc)nfsd4_encode_sequence,
5285 	[OP_SET_SSV]		= (nfsd4_enc)nfsd4_encode_noop,
5286 	[OP_TEST_STATEID]	= (nfsd4_enc)nfsd4_encode_test_stateid,
5287 	[OP_WANT_DELEGATION]	= (nfsd4_enc)nfsd4_encode_noop,
5288 	[OP_DESTROY_CLIENTID]	= (nfsd4_enc)nfsd4_encode_noop,
5289 	[OP_RECLAIM_COMPLETE]	= (nfsd4_enc)nfsd4_encode_noop,
5290 
5291 	/* NFSv4.2 operations */
5292 	[OP_ALLOCATE]		= (nfsd4_enc)nfsd4_encode_noop,
5293 	[OP_COPY]		= (nfsd4_enc)nfsd4_encode_copy,
5294 	[OP_COPY_NOTIFY]	= (nfsd4_enc)nfsd4_encode_copy_notify,
5295 	[OP_DEALLOCATE]		= (nfsd4_enc)nfsd4_encode_noop,
5296 	[OP_IO_ADVISE]		= (nfsd4_enc)nfsd4_encode_noop,
5297 	[OP_LAYOUTERROR]	= (nfsd4_enc)nfsd4_encode_noop,
5298 	[OP_LAYOUTSTATS]	= (nfsd4_enc)nfsd4_encode_noop,
5299 	[OP_OFFLOAD_CANCEL]	= (nfsd4_enc)nfsd4_encode_noop,
5300 	[OP_OFFLOAD_STATUS]	= (nfsd4_enc)nfsd4_encode_offload_status,
5301 	[OP_READ_PLUS]		= (nfsd4_enc)nfsd4_encode_read_plus,
5302 	[OP_SEEK]		= (nfsd4_enc)nfsd4_encode_seek,
5303 	[OP_WRITE_SAME]		= (nfsd4_enc)nfsd4_encode_noop,
5304 	[OP_CLONE]		= (nfsd4_enc)nfsd4_encode_noop,
5305 
5306 	/* RFC 8276 extended atributes operations */
5307 	[OP_GETXATTR]		= (nfsd4_enc)nfsd4_encode_getxattr,
5308 	[OP_SETXATTR]		= (nfsd4_enc)nfsd4_encode_setxattr,
5309 	[OP_LISTXATTRS]		= (nfsd4_enc)nfsd4_encode_listxattrs,
5310 	[OP_REMOVEXATTR]	= (nfsd4_enc)nfsd4_encode_removexattr,
5311 };
5312 
5313 /*
5314  * Calculate whether we still have space to encode repsize bytes.
5315  * There are two considerations:
5316  *     - For NFS versions >=4.1, the size of the reply must stay within
5317  *       session limits
5318  *     - For all NFS versions, we must stay within limited preallocated
5319  *       buffer space.
5320  *
5321  * This is called before the operation is processed, so can only provide
5322  * an upper estimate.  For some nonidempotent operations (such as
5323  * getattr), it's not necessarily a problem if that estimate is wrong,
5324  * as we can fail it after processing without significant side effects.
5325  */
nfsd4_check_resp_size(struct nfsd4_compoundres * resp,u32 respsize)5326 __be32 nfsd4_check_resp_size(struct nfsd4_compoundres *resp, u32 respsize)
5327 {
5328 	struct xdr_buf *buf = &resp->rqstp->rq_res;
5329 	struct nfsd4_slot *slot = resp->cstate.slot;
5330 
5331 	if (buf->len + respsize <= buf->buflen)
5332 		return nfs_ok;
5333 	if (!nfsd4_has_session(&resp->cstate))
5334 		return nfserr_resource;
5335 	if (slot->sl_flags & NFSD4_SLOT_CACHETHIS) {
5336 		WARN_ON_ONCE(1);
5337 		return nfserr_rep_too_big_to_cache;
5338 	}
5339 	return nfserr_rep_too_big;
5340 }
5341 
5342 void
nfsd4_encode_operation(struct nfsd4_compoundres * resp,struct nfsd4_op * op)5343 nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op)
5344 {
5345 	struct xdr_stream *xdr = resp->xdr;
5346 	struct nfs4_stateowner *so = resp->cstate.replay_owner;
5347 	struct svc_rqst *rqstp = resp->rqstp;
5348 	const struct nfsd4_operation *opdesc = op->opdesc;
5349 	int post_err_offset;
5350 	nfsd4_enc encoder;
5351 	__be32 *p;
5352 
5353 	p = xdr_reserve_space(xdr, 8);
5354 	if (!p) {
5355 		WARN_ON_ONCE(1);
5356 		return;
5357 	}
5358 	*p++ = cpu_to_be32(op->opnum);
5359 	post_err_offset = xdr->buf->len;
5360 
5361 	if (op->opnum == OP_ILLEGAL)
5362 		goto status;
5363 	if (op->status && opdesc &&
5364 			!(opdesc->op_flags & OP_NONTRIVIAL_ERROR_ENCODE))
5365 		goto status;
5366 	BUG_ON(op->opnum >= ARRAY_SIZE(nfsd4_enc_ops) ||
5367 	       !nfsd4_enc_ops[op->opnum]);
5368 	encoder = nfsd4_enc_ops[op->opnum];
5369 	op->status = encoder(resp, op->status, &op->u);
5370 	if (op->status)
5371 		trace_nfsd_compound_encode_err(rqstp, op->opnum, op->status);
5372 	if (opdesc && opdesc->op_release)
5373 		opdesc->op_release(&op->u);
5374 	xdr_commit_encode(xdr);
5375 
5376 	/* nfsd4_check_resp_size guarantees enough room for error status */
5377 	if (!op->status) {
5378 		int space_needed = 0;
5379 		if (!nfsd4_last_compound_op(rqstp))
5380 			space_needed = COMPOUND_ERR_SLACK_SPACE;
5381 		op->status = nfsd4_check_resp_size(resp, space_needed);
5382 	}
5383 	if (op->status == nfserr_resource && nfsd4_has_session(&resp->cstate)) {
5384 		struct nfsd4_slot *slot = resp->cstate.slot;
5385 
5386 		if (slot->sl_flags & NFSD4_SLOT_CACHETHIS)
5387 			op->status = nfserr_rep_too_big_to_cache;
5388 		else
5389 			op->status = nfserr_rep_too_big;
5390 	}
5391 	if (op->status == nfserr_resource ||
5392 	    op->status == nfserr_rep_too_big ||
5393 	    op->status == nfserr_rep_too_big_to_cache) {
5394 		/*
5395 		 * The operation may have already been encoded or
5396 		 * partially encoded.  No op returns anything additional
5397 		 * in the case of one of these three errors, so we can
5398 		 * just truncate back to after the status.  But it's a
5399 		 * bug if we had to do this on a non-idempotent op:
5400 		 */
5401 		warn_on_nonidempotent_op(op);
5402 		xdr_truncate_encode(xdr, post_err_offset);
5403 	}
5404 	if (so) {
5405 		int len = xdr->buf->len - post_err_offset;
5406 
5407 		so->so_replay.rp_status = op->status;
5408 		so->so_replay.rp_buflen = len;
5409 		read_bytes_from_xdr_buf(xdr->buf, post_err_offset,
5410 						so->so_replay.rp_buf, len);
5411 	}
5412 status:
5413 	*p = op->status;
5414 }
5415 
5416 /*
5417  * Encode the reply stored in the stateowner reply cache
5418  *
5419  * XDR note: do not encode rp->rp_buflen: the buffer contains the
5420  * previously sent already encoded operation.
5421  */
5422 void
nfsd4_encode_replay(struct xdr_stream * xdr,struct nfsd4_op * op)5423 nfsd4_encode_replay(struct xdr_stream *xdr, struct nfsd4_op *op)
5424 {
5425 	__be32 *p;
5426 	struct nfs4_replay *rp = op->replay;
5427 
5428 	p = xdr_reserve_space(xdr, 8 + rp->rp_buflen);
5429 	if (!p) {
5430 		WARN_ON_ONCE(1);
5431 		return;
5432 	}
5433 	*p++ = cpu_to_be32(op->opnum);
5434 	*p++ = rp->rp_status;  /* already xdr'ed */
5435 
5436 	p = xdr_encode_opaque_fixed(p, rp->rp_buf, rp->rp_buflen);
5437 }
5438 
nfsd4_release_compoundargs(struct svc_rqst * rqstp)5439 void nfsd4_release_compoundargs(struct svc_rqst *rqstp)
5440 {
5441 	struct nfsd4_compoundargs *args = rqstp->rq_argp;
5442 
5443 	if (args->ops != args->iops) {
5444 		vfree(args->ops);
5445 		args->ops = args->iops;
5446 	}
5447 	while (args->to_free) {
5448 		struct svcxdr_tmpbuf *tb = args->to_free;
5449 		args->to_free = tb->next;
5450 		kfree(tb);
5451 	}
5452 }
5453 
5454 bool
nfs4svc_decode_compoundargs(struct svc_rqst * rqstp,struct xdr_stream * xdr)5455 nfs4svc_decode_compoundargs(struct svc_rqst *rqstp, struct xdr_stream *xdr)
5456 {
5457 	struct nfsd4_compoundargs *args = rqstp->rq_argp;
5458 
5459 	/* svcxdr_tmp_alloc */
5460 	args->to_free = NULL;
5461 
5462 	args->xdr = xdr;
5463 	args->ops = args->iops;
5464 	args->rqstp = rqstp;
5465 
5466 	return nfsd4_decode_compound(args);
5467 }
5468 
5469 bool
nfs4svc_encode_compoundres(struct svc_rqst * rqstp,struct xdr_stream * xdr)5470 nfs4svc_encode_compoundres(struct svc_rqst *rqstp, struct xdr_stream *xdr)
5471 {
5472 	struct nfsd4_compoundres *resp = rqstp->rq_resp;
5473 	__be32 *p;
5474 
5475 	/*
5476 	 * Send buffer space for the following items is reserved
5477 	 * at the top of nfsd4_proc_compound().
5478 	 */
5479 	p = resp->statusp;
5480 
5481 	*p++ = resp->cstate.status;
5482 
5483 	rqstp->rq_next_page = xdr->page_ptr + 1;
5484 
5485 	*p++ = htonl(resp->taglen);
5486 	memcpy(p, resp->tag, resp->taglen);
5487 	p += XDR_QUADLEN(resp->taglen);
5488 	*p++ = htonl(resp->opcnt);
5489 
5490 	nfsd4_sequence_done(resp);
5491 	return true;
5492 }
5493