[PATCH v1 05/17] Add a check for both POSIX and NFSv4 ACLs being set

rick.macklem
2025-12-31T02:22:15Z

Check that both POSIX and NFSv4 ACLs are not being set by
the same SETATTR.
While here, fix posix_acl_release() for a couple of error cases
by adding a new out_err label, so the POSIX ACLs are released
before returning status. Note that posix_acl_release() checks
for a NULL argument and just returns for that case.

Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
---
fs/nfsd/nfs4proc.c | 22 ++++++++++++++--------
1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index b92477c87db1..71e9749375c1 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1215,7 +1215,7 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
&cstate->current_fh, &setattr->sa_stateid,
flags, NULL, &st);
if (status)
- return status;
+ goto out_err;
}

if (deleg_attrs) {
@@ -1233,17 +1233,24 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
if (st)
nfs4_put_stid(st);
if (status)
- return status;
+ goto out_err;

err = fh_want_write(&cstate->current_fh);
- if (err)
- return nfserrno(err);
+ if (err) {
+ status = nfserrno(err);
+ goto out_err;
+ }
status = nfs_ok;

status = check_attr_support(cstate, setattr->sa_bmval, nfsd_attrmask);
if (status)
goto out;

+ if (setattr->sa_acl && (setattr->sa_dpacl || setattr->sa_pacl)) {
+ status = nfserr_inval;
+ goto out;
+ }
+
inode = cstate->current_fh.fh_dentry->d_inode;
status = nfsd4_acl_to_attr(S_ISDIR(inode->i_mode) ? NF4DIR : NF4REG,
setattr->sa_acl, &attrs);
@@ -1262,12 +1269,11 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
if (!status)
status = nfserrno(attrs.na_aclerr);
out:
- if (setattr->sa_dpacl != NULL)
- posix_acl_release(setattr->sa_dpacl);
- if (setattr->sa_pacl != NULL)
- posix_acl_release(setattr->sa_pacl);
nfsd_attrs_free(&attrs);
fh_drop_write(&cstate->current_fh);
+out_err:
+ posix_acl_release(setattr->sa_dpacl);
+ posix_acl_release(setattr->sa_pacl);
return status;
}

--
2.49.0