Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e77295dc authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for-2.6.27' of git://linux-nfs.org/~bfields/linux 

* 'for-2.6.27' of git://linux-nfs.org/~bfields/linux:
  nfsd: fix buffer overrun decoding NFSv4 acl
  sunrpc: fix possible overrun on read of /proc/sys/sunrpc/transports
  nfsd: fix compound state allocation error handling
  svcrdma: Fix race between svc_rdma_recvfrom thread and the dto_tasklet
parents 1136cf11 91b80969

fs/nfsd/nfs4acl.c

+1 −1
Original line number Diff line number Diff line
@@ -443,7 +443,7 @@ init_state(struct posix_acl_state *state, int cnt) 
	 * enough space for either:

	 */

	alloc = sizeof(struct posix_ace_state_array)

		+ cnt*sizeof(struct posix_ace_state);

		+ cnt*sizeof(struct posix_user_ace_state);

	state->users = kzalloc(alloc, GFP_KERNEL);

	if (!state->users)

		return -ENOMEM;

fs/nfsd/nfs4proc.c

+6 −6
Original line number Diff line number Diff line
@@ -867,11 +867,6 @@ nfsd4_proc_compound(struct svc_rqst *rqstp, 
	int		slack_bytes;

	__be32		status;



	status = nfserr_resource;

	cstate = cstate_alloc();

	if (cstate == NULL)

		goto out;



	resp->xbuf = &rqstp->rq_res;

	resp->p = rqstp->rq_res.head[0].iov_base + rqstp->rq_res.head[0].iov_len;

	resp->tagp = resp->p;
@@ -890,6 +885,11 @@ nfsd4_proc_compound(struct svc_rqst *rqstp, 
	if (args->minorversion > NFSD_SUPPORTED_MINOR_VERSION)

		goto out;



	status = nfserr_resource;

	cstate = cstate_alloc();

	if (cstate == NULL)

		goto out;



	status = nfs_ok;

	while (!status && resp->opcnt < args->opcnt) {

		op = &args->ops[resp->opcnt++];
@@ -957,9 +957,9 @@ nfsd4_proc_compound(struct svc_rqst *rqstp, 
		nfsd4_increment_op_stats(op->opnum);

	}



	cstate_free(cstate);

out:

	nfsd4_release_compoundargs(args);

	cstate_free(cstate);

	dprintk("nfsv4 compound returned %d\n", ntohl(status));

	return status;

}

include/linux/sunrpc/svc_rdma.h

+0 −1
Original line number Diff line number Diff line
@@ -143,7 +143,6 @@ struct svcxprt_rdma { 
	unsigned long	     sc_flags;

	struct list_head     sc_dto_q;		/* DTO tasklet I/O pending Q */

	struct list_head     sc_read_complete_q;

	spinlock_t           sc_read_complete_lock;

	struct work_struct   sc_work;

};

/* sc_flags */

net/sunrpc/sysctl.c

+4 −14
Original line number Diff line number Diff line
@@ -60,24 +60,14 @@ static int proc_do_xprt(ctl_table *table, int write, struct file *file, 
			void __user *buffer, size_t *lenp, loff_t *ppos)

{

	char tmpbuf[256];

	int len;

	size_t len;



	if ((*ppos && !write) || !*lenp) {

		*lenp = 0;

		return 0;

	}

	if (write)

		return -EINVAL;

	else {

	len = svc_print_xprts(tmpbuf, sizeof(tmpbuf));

		if (!access_ok(VERIFY_WRITE, buffer, len))

			return -EFAULT;



		if (__copy_to_user(buffer, tmpbuf, len))

			return -EFAULT;

	}

	*lenp -= len;

	*ppos += len;

	return 0;

	return simple_read_from_buffer(buffer, *lenp, ppos, tmpbuf, len);

}



static int

net/sunrpc/xprtrdma/svc_rdma_recvfrom.c

+4 −4
Original line number Diff line number Diff line
@@ -443,18 +443,18 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp) 


	dprintk("svcrdma: rqstp=%p\n", rqstp);



	spin_lock_bh(&rdma_xprt->sc_read_complete_lock);

	spin_lock_bh(&rdma_xprt->sc_rq_dto_lock);

	if (!list_empty(&rdma_xprt->sc_read_complete_q)) {

		ctxt = list_entry(rdma_xprt->sc_read_complete_q.next,

				  struct svc_rdma_op_ctxt,

				  dto_q);

		list_del_init(&ctxt->dto_q);

	}

	spin_unlock_bh(&rdma_xprt->sc_read_complete_lock);

	if (ctxt)

	if (ctxt) {

		spin_unlock_bh(&rdma_xprt->sc_rq_dto_lock);

		return rdma_read_complete(rqstp, ctxt);

	}



	spin_lock_bh(&rdma_xprt->sc_rq_dto_lock);

	if (!list_empty(&rdma_xprt->sc_rq_dto_q)) {

		ctxt = list_entry(rdma_xprt->sc_rq_dto_q.next,

				  struct svc_rdma_op_ctxt,