[PATCH 3/3] NFSD: Verify COPY and CLONE source and destination filehandles

[VeroFess <coderzeng@gmail.com>]

nfsd4_verify_copy() checks the saved source export's flavor and
transport policy, then resolves its stateid. With a cached OPEN
stateid, the file permission check can use credentials left by PUTFH
on the destination export. This can retain root access after the
source export enables root_squash, or reject a source that all_squash
maps to its anonymous UID or GID. The requester must already hold an
OPEN stateid for each file in the reproducer, both source and
destination.

Verify the saved filehandle before resolving the source stateid.
This checks its port requirement and installs the source export's
mapped credentials. Verify the destination filehandle before
resolving its stateid to restore the credentials for the write.
Continue mapping NFS4ERR_WRONGSEC to NFS4ERR_ACCESS for COPY and CLONE.

Fixes: 29ae7f9dc21a ("NFSD: Implement the COPY call")
Signed-off-by: VeroFess <coderzeng@gmail.com>
---
On the combined fix tree, saved-source COPY with root_squash was denied
without changing the destination; permitted COPY and CLONE matched the
source bytes. This patch also built alone with W=1.

 fs/nfsd/nfs4proc.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 218cedb..774ba9e 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1514,7 +1514,7 @@ nfsd4_verify_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 		return nfserr_nofilehandle;
 
 	/* A cached open stateid does not authorize the saved source export. */
-	status = check_nfsd_access(cstate->save_fh.fh_export, rqstp);
+	status = fh_verify(rqstp, &cstate->save_fh, 0, NFSD_MAY_NOP);
 	if (status)
 		return status == nfserr_wrongsec ? nfserr_acces : status;
 
@@ -1523,6 +1523,14 @@ nfsd4_verify_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 	if (status)
 		goto out;
 
+	/* Use the destination export's credentials for the write. */
+	status = fh_verify(rqstp, &cstate->current_fh, 0, NFSD_MAY_NOP);
+	if (status) {
+		if (status == nfserr_wrongsec)
+			status = nfserr_acces;
+		goto out_put_src;
+	}
+
 	status = nfs4_preprocess_stateid_op(rqstp, cstate, &cstate->current_fh,
 					    dst_stateid, WR_STATE, dst, NULL);
 	if (status)
-- 
2.43.0