nfsd: fix access checking for NLM under XPRTSEC policies

Olga Kornievskaia · gregkh · commit 996b8797d62f · 2025-10-19T16:34:06.000+02:00
commit 0813c5f upstream. When an export policy with xprtsec policy is set with "tls" and/or "mtls", but an NFS client is doing a v3 xprtsec=tls mount, then NLM locking calls fail with an error because there is currently no support for NLM with TLS. Until such support is added, allow NLM calls under TLS-secured policy. Fixes: 4cc9b9f ("nfsd: refine and rename NFSD_MAY_LOCK") Cc: stable@vger.kernel.org Signed-off-by: Olga Kornievskaia <okorniev@redhat.com> Reviewed-by: NeilBrown <neil@brown.name> Reviewed-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
@@ -1115,7 +1115,8 @@ __be32 check_nfsd_access(struct svc_export *exp, struct svc_rqst *rqstp,
 		    test_bit(XPT_PEER_AUTH, &xprt->xpt_flags))
 			goto ok;
 	}
-	goto denied;
+	if (!may_bypass_gss)
+		goto denied;
 
 ok:
 	/* legacy gss-only clients are always OK: */

Original file line number	Diff line number	Diff line change
`@@ -1115,7 +1115,8 @@ __be32 check_nfsd_access(struct svc_export exp, struct svc_rqst rqstp,`
`1115`	`1115`	`test_bit(XPT_PEER_AUTH, &xprt->xpt_flags))`
`1116`	`1116`	`goto ok;`
`1117`	`1117`	`}`
`1118`		`- goto denied;`
	`1118`	`+ if (!may_bypass_gss)`
	`1119`	`+ goto denied;`
`1119`	`1120`
`1120`	`1121`	`ok:`
`1121`	`1122`	`/* legacy gss-only clients are always OK: */`