git: d5c2465af843 - main - nfsserver: use the destination export for the COPY/CLONE write check

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=d5c2465af8434d3eb7551d12220b4a24e7dca8af

commit d5c2465af8434d3eb7551d12220b4a24e7dca8af
Author:     Osvaldo Janeri Filho <ojanerif@amd.com>
AuthorDate: 2026-10-29 20:25:01 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-10-29 20:25:06 +0000

    nfsserver: use the destination export for the COPY/CLONE write check
    
    The write-permission check on the destination file in
    nfsrvd_copy_file_range() and nfsrvd_clone() tested
    NFSVNO_EXSTRICTACCESS() on the source export instead of the destination
    export.
    
    Rick notes:
        The change is harmless and mostly meaningless.
        NFSVNO_EXSTRICTACCESS() is a placeholder for some site that might
        not want to let the file "owner" get access despite mode bits.
    
        The "owner override" is a hack that has existed forever in NFS,
        since applications often create files with O_WRONLY, but mode 444.
        This works for POSIX, but would make NFS writes fail, since they
        check mode on every write, instead of just at POSIX open(). The hack
        is to always allow the file owner to have write access.
    
        Without the hack, lots of applications would break over NFS, so I
        doubt anyone would enable NFSVNO_EXSTRICTACCESS().
        { No one has ever even wanted an export flag for it. }
    
    Reviewed by:    rmacklem, markj
    MFC after:      1 week
    Differential Revision:  https://reviews.freebsd.org/D60952
---
 sys/fs/nfsserver/nfs_nfsdserv.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sys/fs/nfsserver/nfs_nfsdserv.c b/sys/fs/nfsserver/nfs_nfsdserv.c
index dd6e4805606a..516ac6ab9706 100644
--- a/sys/fs/nfsserver/nfs_nfsdserv.c
+++ b/sys/fs/nfsserver/nfs_nfsdserv.c
@@ -6039,7 +6039,7 @@ nfsrvd_copy_file_range(struct nfsrv_descript *nd, __unused int isdgram,
 	if (nd->nd_repstat == 0)
 		nd->nd_repstat = ret;
 	if (nd->nd_repstat == 0 && (at.na_uid != nd->nd_cred->cr_uid ||
-	     NFSVNO_EXSTRICTACCESS(exp)))
+	     NFSVNO_EXSTRICTACCESS(toexp)))
 		nd->nd_repstat = nfsvno_accchk(tovp, VWRITE, nd->nd_cred, toexp,
 		    curthread, NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED,
 		    NULL);
@@ -6268,7 +6268,7 @@ nfsrvd_clone(struct nfsrv_descript *nd, __unused int isdgram,
 	if (nd->nd_repstat == 0)
 		nd->nd_repstat = ret;
 	if (nd->nd_repstat == 0 && (at.na_uid != nd->nd_cred->cr_uid ||
-	     NFSVNO_EXSTRICTACCESS(exp)))
+	     NFSVNO_EXSTRICTACCESS(toexp)))
 		nd->nd_repstat = nfsvno_accchk(tovp, VWRITE, nd->nd_cred, toexp,
 		    curthread, NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED,
 		    NULL);