.. | .. |
---|
| 1 | +// SPDX-License-Identifier: GPL-2.0-only |
---|
1 | 2 | #include <linux/types.h> |
---|
2 | 3 | #include <linux/sched.h> |
---|
3 | 4 | #include <linux/module.h> |
---|
.. | .. |
---|
37 | 38 | extern struct auth_ops svcauth_null; |
---|
38 | 39 | extern struct auth_ops svcauth_unix; |
---|
39 | 40 | |
---|
40 | | -static void svcauth_unix_domain_release(struct auth_domain *dom) |
---|
| 41 | +static void svcauth_unix_domain_release_rcu(struct rcu_head *head) |
---|
41 | 42 | { |
---|
| 43 | + struct auth_domain *dom = container_of(head, struct auth_domain, rcu_head); |
---|
42 | 44 | struct unix_domain *ud = container_of(dom, struct unix_domain, h); |
---|
43 | 45 | |
---|
44 | 46 | kfree(dom->name); |
---|
45 | 47 | kfree(ud); |
---|
| 48 | +} |
---|
| 49 | + |
---|
| 50 | +static void svcauth_unix_domain_release(struct auth_domain *dom) |
---|
| 51 | +{ |
---|
| 52 | + call_rcu(&dom->rcu_head, svcauth_unix_domain_release_rcu); |
---|
46 | 53 | } |
---|
47 | 54 | |
---|
48 | 55 | struct auth_domain *unix_domain_find(char *name) |
---|
.. | .. |
---|
50 | 57 | struct auth_domain *rv; |
---|
51 | 58 | struct unix_domain *new = NULL; |
---|
52 | 59 | |
---|
53 | | - rv = auth_domain_lookup(name, NULL); |
---|
| 60 | + rv = auth_domain_find(name); |
---|
54 | 61 | while(1) { |
---|
55 | 62 | if (rv) { |
---|
56 | 63 | if (new && rv != &new->h) |
---|
.. | .. |
---|
91 | 98 | char m_class[8]; /* e.g. "nfsd" */ |
---|
92 | 99 | struct in6_addr m_addr; |
---|
93 | 100 | struct unix_domain *m_client; |
---|
| 101 | + struct rcu_head m_rcu; |
---|
94 | 102 | }; |
---|
95 | 103 | |
---|
96 | 104 | static void ip_map_put(struct kref *kref) |
---|
.. | .. |
---|
101 | 109 | if (test_bit(CACHE_VALID, &item->flags) && |
---|
102 | 110 | !test_bit(CACHE_NEGATIVE, &item->flags)) |
---|
103 | 111 | auth_domain_put(&im->m_client->h); |
---|
104 | | - kfree(im); |
---|
| 112 | + kfree_rcu(im, m_rcu); |
---|
105 | 113 | } |
---|
106 | 114 | |
---|
107 | 115 | static inline int hash_ip6(const struct in6_addr *ip) |
---|
.. | .. |
---|
140 | 148 | return NULL; |
---|
141 | 149 | } |
---|
142 | 150 | |
---|
| 151 | +static int ip_map_upcall(struct cache_detail *cd, struct cache_head *h) |
---|
| 152 | +{ |
---|
| 153 | + return sunrpc_cache_pipe_upcall(cd, h); |
---|
| 154 | +} |
---|
| 155 | + |
---|
143 | 156 | static void ip_map_request(struct cache_detail *cd, |
---|
144 | 157 | struct cache_head *h, |
---|
145 | 158 | char **bpp, int *blen) |
---|
.. | .. |
---|
158 | 171 | } |
---|
159 | 172 | |
---|
160 | 173 | static struct ip_map *__ip_map_lookup(struct cache_detail *cd, char *class, struct in6_addr *addr); |
---|
161 | | -static int __ip_map_update(struct cache_detail *cd, struct ip_map *ipm, struct unix_domain *udom, time_t expiry); |
---|
| 174 | +static int __ip_map_update(struct cache_detail *cd, struct ip_map *ipm, struct unix_domain *udom, time64_t expiry); |
---|
162 | 175 | |
---|
163 | 176 | static int ip_map_parse(struct cache_detail *cd, |
---|
164 | 177 | char *mesg, int mlen) |
---|
.. | .. |
---|
179 | 192 | |
---|
180 | 193 | struct ip_map *ipmp; |
---|
181 | 194 | struct auth_domain *dom; |
---|
182 | | - time_t expiry; |
---|
| 195 | + time64_t expiry; |
---|
183 | 196 | |
---|
184 | 197 | if (mesg[mlen-1] != '\n') |
---|
185 | 198 | return -EINVAL; |
---|
.. | .. |
---|
280 | 293 | |
---|
281 | 294 | strcpy(ip.m_class, class); |
---|
282 | 295 | ip.m_addr = *addr; |
---|
283 | | - ch = sunrpc_cache_lookup(cd, &ip.h, |
---|
284 | | - hash_str(class, IP_HASHBITS) ^ |
---|
285 | | - hash_ip6(addr)); |
---|
| 296 | + ch = sunrpc_cache_lookup_rcu(cd, &ip.h, |
---|
| 297 | + hash_str(class, IP_HASHBITS) ^ |
---|
| 298 | + hash_ip6(addr)); |
---|
286 | 299 | |
---|
287 | 300 | if (ch) |
---|
288 | 301 | return container_of(ch, struct ip_map, h); |
---|
.. | .. |
---|
300 | 313 | } |
---|
301 | 314 | |
---|
302 | 315 | static int __ip_map_update(struct cache_detail *cd, struct ip_map *ipm, |
---|
303 | | - struct unix_domain *udom, time_t expiry) |
---|
| 316 | + struct unix_domain *udom, time64_t expiry) |
---|
304 | 317 | { |
---|
305 | 318 | struct ip_map ip; |
---|
306 | 319 | struct cache_head *ch; |
---|
.. | .. |
---|
317 | 330 | return -ENOMEM; |
---|
318 | 331 | cache_put(ch, cd); |
---|
319 | 332 | return 0; |
---|
320 | | -} |
---|
321 | | - |
---|
322 | | -static inline int ip_map_update(struct net *net, struct ip_map *ipm, |
---|
323 | | - struct unix_domain *udom, time_t expiry) |
---|
324 | | -{ |
---|
325 | | - struct sunrpc_net *sn; |
---|
326 | | - |
---|
327 | | - sn = net_generic(net, sunrpc_net_id); |
---|
328 | | - return __ip_map_update(sn->ip_map_cache, ipm, udom, expiry); |
---|
329 | 333 | } |
---|
330 | 334 | |
---|
331 | 335 | void svcauth_unix_purge(struct net *net) |
---|
.. | .. |
---|
412 | 416 | struct cache_head h; |
---|
413 | 417 | kuid_t uid; |
---|
414 | 418 | struct group_info *gi; |
---|
| 419 | + struct rcu_head rcu; |
---|
415 | 420 | }; |
---|
416 | 421 | |
---|
417 | 422 | static int unix_gid_hash(kuid_t uid) |
---|
.. | .. |
---|
419 | 424 | return hash_long(from_kuid(&init_user_ns, uid), GID_HASHBITS); |
---|
420 | 425 | } |
---|
421 | 426 | |
---|
422 | | -static void unix_gid_put(struct kref *kref) |
---|
| 427 | +static void unix_gid_free(struct rcu_head *rcu) |
---|
423 | 428 | { |
---|
424 | | - struct cache_head *item = container_of(kref, struct cache_head, ref); |
---|
425 | | - struct unix_gid *ug = container_of(item, struct unix_gid, h); |
---|
| 429 | + struct unix_gid *ug = container_of(rcu, struct unix_gid, rcu); |
---|
| 430 | + struct cache_head *item = &ug->h; |
---|
| 431 | + |
---|
426 | 432 | if (test_bit(CACHE_VALID, &item->flags) && |
---|
427 | 433 | !test_bit(CACHE_NEGATIVE, &item->flags)) |
---|
428 | 434 | put_group_info(ug->gi); |
---|
429 | 435 | kfree(ug); |
---|
| 436 | +} |
---|
| 437 | + |
---|
| 438 | +static void unix_gid_put(struct kref *kref) |
---|
| 439 | +{ |
---|
| 440 | + struct cache_head *item = container_of(kref, struct cache_head, ref); |
---|
| 441 | + struct unix_gid *ug = container_of(item, struct unix_gid, h); |
---|
| 442 | + |
---|
| 443 | + call_rcu(&ug->rcu, unix_gid_free); |
---|
430 | 444 | } |
---|
431 | 445 | |
---|
432 | 446 | static int unix_gid_match(struct cache_head *corig, struct cache_head *cnew) |
---|
.. | .. |
---|
458 | 472 | return NULL; |
---|
459 | 473 | } |
---|
460 | 474 | |
---|
| 475 | +static int unix_gid_upcall(struct cache_detail *cd, struct cache_head *h) |
---|
| 476 | +{ |
---|
| 477 | + return sunrpc_cache_pipe_upcall_timeout(cd, h); |
---|
| 478 | +} |
---|
| 479 | + |
---|
461 | 480 | static void unix_gid_request(struct cache_detail *cd, |
---|
462 | 481 | struct cache_head *h, |
---|
463 | 482 | char **bpp, int *blen) |
---|
.. | .. |
---|
482 | 501 | int rv; |
---|
483 | 502 | int i; |
---|
484 | 503 | int err; |
---|
485 | | - time_t expiry; |
---|
| 504 | + time64_t expiry; |
---|
486 | 505 | struct unix_gid ug, *ugp; |
---|
487 | 506 | |
---|
488 | 507 | if (mesg[mlen - 1] != '\n') |
---|
.. | .. |
---|
492 | 511 | rv = get_int(&mesg, &id); |
---|
493 | 512 | if (rv) |
---|
494 | 513 | return -EINVAL; |
---|
495 | | - uid = make_kuid(&init_user_ns, id); |
---|
| 514 | + uid = make_kuid(current_user_ns(), id); |
---|
496 | 515 | ug.uid = uid; |
---|
497 | 516 | |
---|
498 | 517 | expiry = get_expiry(&mesg); |
---|
.. | .. |
---|
514 | 533 | err = -EINVAL; |
---|
515 | 534 | if (rv) |
---|
516 | 535 | goto out; |
---|
517 | | - kgid = make_kgid(&init_user_ns, gid); |
---|
| 536 | + kgid = make_kgid(current_user_ns(), gid); |
---|
518 | 537 | if (!gid_valid(kgid)) |
---|
519 | 538 | goto out; |
---|
520 | 539 | ug.gi->gid[i] = kgid; |
---|
.. | .. |
---|
547 | 566 | struct cache_detail *cd, |
---|
548 | 567 | struct cache_head *h) |
---|
549 | 568 | { |
---|
550 | | - struct user_namespace *user_ns = &init_user_ns; |
---|
| 569 | + struct user_namespace *user_ns = m->file->f_cred->user_ns; |
---|
551 | 570 | struct unix_gid *ug; |
---|
552 | 571 | int i; |
---|
553 | 572 | int glen; |
---|
.. | .. |
---|
575 | 594 | .hash_size = GID_HASHMAX, |
---|
576 | 595 | .name = "auth.unix.gid", |
---|
577 | 596 | .cache_put = unix_gid_put, |
---|
| 597 | + .cache_upcall = unix_gid_upcall, |
---|
578 | 598 | .cache_request = unix_gid_request, |
---|
579 | 599 | .cache_parse = unix_gid_parse, |
---|
580 | 600 | .cache_show = unix_gid_show, |
---|
.. | .. |
---|
619 | 639 | struct cache_head *ch; |
---|
620 | 640 | |
---|
621 | 641 | ug.uid = uid; |
---|
622 | | - ch = sunrpc_cache_lookup(cd, &ug.h, unix_gid_hash(uid)); |
---|
| 642 | + ch = sunrpc_cache_lookup_rcu(cd, &ug.h, unix_gid_hash(uid)); |
---|
623 | 643 | if (ch) |
---|
624 | 644 | return container_of(ch, struct unix_gid, h); |
---|
625 | 645 | else |
---|
.. | .. |
---|
788 | 808 | struct kvec *argv = &rqstp->rq_arg.head[0]; |
---|
789 | 809 | struct kvec *resv = &rqstp->rq_res.head[0]; |
---|
790 | 810 | struct svc_cred *cred = &rqstp->rq_cred; |
---|
| 811 | + struct user_namespace *userns; |
---|
791 | 812 | u32 slen, i; |
---|
792 | 813 | int len = argv->iov_len; |
---|
793 | 814 | |
---|
.. | .. |
---|
808 | 829 | * (export-specific) anonymous id by nfsd_setuser. |
---|
809 | 830 | * Supplementary gid's will be left alone. |
---|
810 | 831 | */ |
---|
811 | | - cred->cr_uid = make_kuid(&init_user_ns, svc_getnl(argv)); /* uid */ |
---|
812 | | - cred->cr_gid = make_kgid(&init_user_ns, svc_getnl(argv)); /* gid */ |
---|
| 832 | + userns = (rqstp->rq_xprt && rqstp->rq_xprt->xpt_cred) ? |
---|
| 833 | + rqstp->rq_xprt->xpt_cred->user_ns : &init_user_ns; |
---|
| 834 | + cred->cr_uid = make_kuid(userns, svc_getnl(argv)); /* uid */ |
---|
| 835 | + cred->cr_gid = make_kgid(userns, svc_getnl(argv)); /* gid */ |
---|
813 | 836 | slen = svc_getnl(argv); /* gids length */ |
---|
814 | 837 | if (slen > UNX_NGROUPS || (len -= (slen + 2)*4) < 0) |
---|
815 | 838 | goto badcred; |
---|
.. | .. |
---|
817 | 840 | if (cred->cr_group_info == NULL) |
---|
818 | 841 | return SVC_CLOSE; |
---|
819 | 842 | for (i = 0; i < slen; i++) { |
---|
820 | | - kgid_t kgid = make_kgid(&init_user_ns, svc_getnl(argv)); |
---|
| 843 | + kgid_t kgid = make_kgid(userns, svc_getnl(argv)); |
---|
821 | 844 | cred->cr_group_info->gid[i] = kgid; |
---|
822 | 845 | } |
---|
823 | 846 | groups_sort(cred->cr_group_info); |
---|
.. | .. |
---|
869 | 892 | .hash_size = IP_HASHMAX, |
---|
870 | 893 | .name = "auth.unix.ip", |
---|
871 | 894 | .cache_put = ip_map_put, |
---|
| 895 | + .cache_upcall = ip_map_upcall, |
---|
872 | 896 | .cache_request = ip_map_request, |
---|
873 | 897 | .cache_parse = ip_map_parse, |
---|
874 | 898 | .cache_show = ip_map_show, |
---|