[PATCH 2/3] NFSD: Apply the entered export's credentials after LOOKUP and RESTOREFH

[VeroFess <coderzeng@gmail.com>]

LOOKUP verifies its parent filehandle before selecting a child export.
After the crossing, the task can still use credentials mapped by the
parent export. RESTOREFH likewise restores a saved filehandle without
restoring its export's credentials. The requester must already hold an
OPEN stateid for the file: with a cached stateid, READ can retain root
access after the export enables root_squash, or fail even though
all_squash would allow access through its anonymous UID or GID.

Verify the composed filehandle when LOOKUP selects another export.
After RESTOREFH, install the saved export's credentials and propagate
an error from nfsd_setuser(). Keep the existing deferred flavor
decision for RESTOREFH.

The credential mismatch is old; it dates back at least to Linux
2.6.12. Maintained LTS branches with these filehandle paths also need
the correction.

Signed-off-by: VeroFess <coderzeng@gmail.com>
---
On nfsd-testing with all three fixes, crossed and restored READ used the
child export's root_squash or all_squash mapping, including anonymous
UID 2000 and GID 2001. In a separate fault-injection build of the same
NFSD code, RESTOREFH returned NFS4ERR_DELAY before GETATTR. This patch
also built alone with W=1.

 fs/nfsd/nfs4proc.c | 4 +++-
 fs/nfsd/vfs.c      | 5 +++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 43c2aa9..218cedb 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -49,6 +49,7 @@
 #include "xdr4.h"
 #include "nfs4ctl.h"
 #include "vfs.h"
+#include "auth.h"
 #include "current_stateid.h"
 #include "netns.h"
 #include "acl.h"
@@ -859,7 +860,8 @@ nfsd4_restorefh(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 		memcpy(&cstate->current_stateid, &cstate->save_stateid, sizeof(stateid_t));
 		SET_CSTATE_FLAG(cstate, CURRENT_STATE_ID_FLAG);
 	}
-	return nfs_ok;
+	return nfserrno(nfsd_setuser(&rqstp->rq_cred,
+					cstate->current_fh.fh_export));
 }
 
 static __be32
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 2775911..0547029 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -351,6 +351,7 @@ __nfsd_lookup(struct svc_rqst *rqstp, struct svc_fh *fhp, const char *name,
 {
 	struct svc_export	*exp;
 	struct dentry		*dentry;
+	bool crossed;
 	__be32 err;
 
 	err = fh_verify(rqstp, fhp, S_IFDIR, access);
@@ -363,9 +364,13 @@ __nfsd_lookup(struct svc_rqst *rqstp, struct svc_fh *fhp, const char *name,
 	 * Note: we compose the file handle now, but as the
 	 * dentry may be negative, it may need to be updated.
 	 */
+	crossed = exp != fhp->fh_export;
 	err = fh_compose(resfh, exp, dentry, fhp);
 	if (!err && d_really_is_negative(dentry))
 		err = nfserr_noent;
+	if (!err && crossed)
+		err = fh_verify(rqstp, resfh, 0,
+				access & NFSD_MAY_BYPASS_FLAVOR);
 
 	dput(dentry);
 	exp_put(exp);
-- 
2.43.0