Merge branch 'work.mount3' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

[linux-2.6-microblaze.git] / fs / afs / security.c

diff --git a/fs/afs/security.c b/fs/afs/security.c
index 71e71c0..ce9de1e 100644 (file)
--- a/fs/afs/security.c
+++ b/fs/afs/security.c
@@ -27,8 +27,37 @@ struct key *afs_request_key(struct afs_cell *cell)
        _enter("{%x}", key_serial(cell->anonymous_key));
 
        _debug("key %s", cell->anonymous_key->description);
-       key = request_key(&key_type_rxrpc, cell->anonymous_key->description,
-                         NULL);
+       key = request_key_net(&key_type_rxrpc, cell->anonymous_key->description,
+                             cell->net->net, NULL);
+       if (IS_ERR(key)) {
+               if (PTR_ERR(key) != -ENOKEY) {
+                       _leave(" = %ld", PTR_ERR(key));
+                       return key;
+               }
+
+               /* act as anonymous user */
+               _leave(" = {%x} [anon]", key_serial(cell->anonymous_key));
+               return key_get(cell->anonymous_key);
+       } else {
+               /* act as authorised user */
+               _leave(" = {%x} [auth]", key_serial(key));
+               return key;
+       }
+}
+
+/*
+ * Get a key when pathwalk is in rcuwalk mode.
+ */
+struct key *afs_request_key_rcu(struct afs_cell *cell)
+{
+       struct key *key;
+
+       _enter("{%x}", key_serial(cell->anonymous_key));
+
+       _debug("key %s", cell->anonymous_key->description);
+       key = request_key_net_rcu(&key_type_rxrpc,
+                                 cell->anonymous_key->description,
+                                 cell->net->net);
        if (IS_ERR(key)) {
                if (PTR_ERR(key) != -ENOKEY) {
                        _leave(" = %ld", PTR_ERR(key));
@@ -274,6 +303,40 @@ someone_else_changed_it:
        return;
 }
 
+static bool afs_check_permit_rcu(struct afs_vnode *vnode, struct key *key,
+                                afs_access_t *_access)
+{
+       const struct afs_permits *permits;
+       int i;
+
+       _enter("{%llx:%llu},%x",
+              vnode->fid.vid, vnode->fid.vnode, key_serial(key));
+
+       /* check the permits to see if we've got one yet */
+       if (key == vnode->volume->cell->anonymous_key) {
+               *_access = vnode->status.anon_access;
+               _leave(" = t [anon %x]", *_access);
+               return true;
+       }
+
+       permits = rcu_dereference(vnode->permit_cache);
+       if (permits) {
+               for (i = 0; i < permits->nr_permits; i++) {
+                       if (permits->permits[i].key < key)
+                               continue;
+                       if (permits->permits[i].key > key)
+                               break;
+
+                       *_access = permits->permits[i].access;
+                       _leave(" = %u [perm %x]", !permits->invalidated, *_access);
+                       return !permits->invalidated;
+               }
+       }
+
+       _leave(" = f");
+       return false;
+}
+
 /*
  * check with the fileserver to see if the directory or parent directory is
  * permitted to be accessed with this authorisation, and if so, what access it
@@ -340,33 +403,42 @@ int afs_permission(struct inode *inode, int mask)
        struct afs_vnode *vnode = AFS_FS_I(inode);
        afs_access_t uninitialized_var(access);
        struct key *key;
-       int ret;
-
-       if (mask & MAY_NOT_BLOCK)
-               return -ECHILD;
+       int ret = 0;
 
        _enter("{{%llx:%llu},%lx},%x,",
               vnode->fid.vid, vnode->fid.vnode, vnode->flags, mask);
 
-       key = afs_request_key(vnode->volume->cell);
-       if (IS_ERR(key)) {
-               _leave(" = %ld [key]", PTR_ERR(key));
-               return PTR_ERR(key);
-       }
+       if (mask & MAY_NOT_BLOCK) {
+               key = afs_request_key_rcu(vnode->volume->cell);
+               if (IS_ERR(key))
+                       return -ECHILD;
+
+               ret = -ECHILD;
+               if (!afs_check_validity(vnode) ||
+                   !afs_check_permit_rcu(vnode, key, &access))
+                       goto error;
+       } else {
+               key = afs_request_key(vnode->volume->cell);
+               if (IS_ERR(key)) {
+                       _leave(" = %ld [key]", PTR_ERR(key));
+                       return PTR_ERR(key);
+               }
 
-       ret = afs_validate(vnode, key);
-       if (ret < 0)
-               goto error;
+               ret = afs_validate(vnode, key);
+               if (ret < 0)
+                       goto error;
 
-       /* check the permits to see if we've got one yet */
-       ret = afs_check_permit(vnode, key, &access);
-       if (ret < 0)
-               goto error;
+               /* check the permits to see if we've got one yet */
+               ret = afs_check_permit(vnode, key, &access);
+               if (ret < 0)
+                       goto error;
+       }
 
        /* interpret the access mask */
        _debug("REQ %x ACC %x on %s",
               mask, access, S_ISDIR(inode->i_mode) ? "dir" : "file");
 
+       ret = 0;
        if (S_ISDIR(inode->i_mode)) {
                if (mask & (MAY_EXEC | MAY_READ | MAY_CHDIR)) {
                        if (!(access & AFS_ACE_LOOKUP))