On 10/17/25 10:54 AM, Greg Kroah-Hartman wrote:
6.12-stable review patch. If anyone has any objections, please let me know.
No objection, but a question:
This set of patches seems to be a pre-requisite for "nfsd: decouple the xprtsec policy check from check_nfsd_access()", which FAILED to apply to v6.12 yesterday. Are you planning to apply that one next to v6.12?
From: Olga Kornievskaia okorniev@redhat.com
commit 0813c5f01249dbc32ccbc68d27a24fde5bf2901c upstream.
When an export policy with xprtsec policy is set with "tls" and/or "mtls", but an NFS client is doing a v3 xprtsec=tls mount, then NLM locking calls fail with an error because there is currently no support for NLM with TLS.
Until such support is added, allow NLM calls under TLS-secured policy.
Fixes: 4cc9b9f2bf4d ("nfsd: refine and rename NFSD_MAY_LOCK") Cc: stable@vger.kernel.org Signed-off-by: Olga Kornievskaia okorniev@redhat.com Reviewed-by: NeilBrown neil@brown.name Reviewed-by: Jeff Layton jlayton@kernel.org Signed-off-by: Chuck Lever chuck.lever@oracle.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
fs/nfsd/export.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/nfsd/export.c +++ b/fs/nfsd/export.c @@ -1115,7 +1115,8 @@ __be32 check_nfsd_access(struct svc_expo test_bit(XPT_PEER_AUTH, &xprt->xpt_flags)) goto ok; }
- goto denied;
- if (!may_bypass_gss)
goto denied;ok: /* legacy gss-only clients are always OK: */