Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4ed4b547 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'fixes' of git://git.linux-nfs.org/pub/linux/nfs-2.6 

* 'fixes' of git://git.linux-nfs.org/pub/linux/nfs-2.6:
  NFS: Fix nfs_page use after free issues in fs/nfs/write.c
  NFSv4: Fix incorrect semaphore release in _nfs4_do_open()
  NFS: Fix Oopsable condition in nfs_readpage_sync()
parents 79e453d4 5c2d97cb

fs/nfs/nfs4proc.c

+3 −3
Original line number Diff line number Diff line
@@ -970,7 +970,7 @@ static int _nfs4_do_open(struct inode *dir, struct dentry *dentry, int flags, st 
	status = -ENOMEM;

	opendata = nfs4_opendata_alloc(dentry, sp, flags, sattr);

	if (opendata == NULL)

		goto err_put_state_owner;

		goto err_release_rwsem;



	status = _nfs4_proc_open(opendata);

	if (status != 0)
@@ -989,11 +989,11 @@ static int _nfs4_do_open(struct inode *dir, struct dentry *dentry, int flags, st 
	return 0;

err_opendata_free:

	nfs4_opendata_free(opendata);

err_release_rwsem:

	up_read(&clp->cl_sem);

err_put_state_owner:

	nfs4_put_state_owner(sp);

out_err:

	/* Note: clp->cl_sem must be released before nfs4_put_open_state()! */

	up_read(&clp->cl_sem);

	*res = NULL;

	return status;

}

fs/nfs/read.c

+4 −2
Original line number Diff line number Diff line
@@ -204,9 +204,11 @@ static int nfs_readpage_sync(struct nfs_open_context *ctx, struct inode *inode, 
	NFS_I(inode)->cache_validity |= NFS_INO_INVALID_ATIME;

	spin_unlock(&inode->i_lock);



	nfs_readpage_truncate_uninitialised_page(rdata);

	if (rdata->res.eof || rdata->res.count == rdata->args.count)

	if (rdata->res.eof || rdata->res.count == rdata->args.count) {

		SetPageUptodate(page);

		if (rdata->res.eof && count != 0)

			memclear_highpage_flush(page, rdata->args.pgbase, count);

	}

	result = 0;



io_error:

fs/nfs/write.c

+2 −2
Original line number Diff line number Diff line
@@ -590,8 +590,8 @@ static void nfs_cancel_commit_list(struct list_head *head) 
		req = nfs_list_entry(head->next);

		nfs_list_remove_request(req);

		nfs_inode_remove_request(req);

		nfs_clear_page_writeback(req);

		dec_zone_page_state(req->wb_page, NR_UNSTABLE_NFS);

		nfs_clear_page_writeback(req);

	}

}
@@ -1386,8 +1386,8 @@ nfs_commit_list(struct inode *inode, struct list_head *head, int how) 
		req = nfs_list_entry(head->next);

		nfs_list_remove_request(req);

		nfs_mark_request_commit(req);

		nfs_clear_page_writeback(req);

		dec_zone_page_state(req->wb_page, NR_UNSTABLE_NFS);

		nfs_clear_page_writeback(req);

	}

	return -ENOMEM;

}