Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 58df9b38 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'nfs-for-3.4-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs 



Pull NFS client bugfixes for Linux 3.4 from Trond Myklebust

Highlights include:
- Fix infinite loops in the mount code
- Fix a userspace buffer overflow in __nfs4_get_acl_uncached
- Fix a memory leak due to a double reference count in rpcb_getport_async()

Signed-off-by: default avatarTrond Myklebust <Trond.Myklebust@netapp.com>

* tag 'nfs-for-3.4-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
  NFSv4: Minor cleanups for nfs4_handle_exception and nfs4_async_handle_error
  NFSv4.1: Fix layoutcommit error handling
  NFSv4: Fix two infinite loops in the mount code
  SUNRPC: Use the already looked-up xprt in rpcb_getport_async()
  NFS4.1: remove duplicate variable declaration in filelayout_clear_request_commit
  Fix length of buffer copied in __nfs4_get_acl_uncached
parents 8563f878 14977489

fs/nfs/nfs4filelayout.c

+0 −1
Original line number Diff line number Diff line
@@ -793,7 +793,6 @@ filelayout_clear_request_commit(struct nfs_page *req) 
	if (!test_and_clear_bit(PG_COMMIT_TO_DS, &req->wb_flags))

		goto out;

	if (list_is_singular(&req->wb_list)) {

		struct inode *inode = req->wb_context->dentry->d_inode;

		struct pnfs_layout_segment *lseg;



		/* From here we can find the bucket, but for the moment,

fs/nfs/nfs4proc.c

+23 −20
Original line number Diff line number Diff line
@@ -270,7 +270,7 @@ static int nfs4_handle_exception(struct nfs_server *server, int errorcode, struc 
		case 0:

			return 0;

		case -NFS4ERR_OPENMODE:

			if (nfs_have_delegation(inode, FMODE_READ)) {

			if (inode && nfs_have_delegation(inode, FMODE_READ)) {

				nfs_inode_return_delegation(inode);

				exception->retry = 1;

				return 0;
@@ -282,10 +282,9 @@ static int nfs4_handle_exception(struct nfs_server *server, int errorcode, struc 
		case -NFS4ERR_DELEG_REVOKED:

		case -NFS4ERR_ADMIN_REVOKED:

		case -NFS4ERR_BAD_STATEID:

			if (state != NULL)

				nfs_remove_bad_delegation(state->inode);

			if (state == NULL)

				break;

			nfs_remove_bad_delegation(state->inode);

			nfs4_schedule_stateid_recovery(server, state);

			goto wait_on_recovery;

		case -NFS4ERR_EXPIRED:
@@ -2290,11 +2289,12 @@ static int nfs4_lookup_root(struct nfs_server *server, struct nfs_fh *fhandle, 
		switch (err) {

		case 0:

		case -NFS4ERR_WRONGSEC:

			break;

			goto out;

		default:

			err = nfs4_handle_exception(server, err, &exception);

		}

	} while (exception.retry);

out:

	return err;

}
@@ -3712,7 +3712,7 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu 
		if (acl_len > buflen)

			goto out_free;

		_copy_from_pages(buf, pages, res.acl_data_offset,

				res.acl_len);

				acl_len);

	}

	ret = acl_len;

out_free:
@@ -3824,7 +3824,8 @@ nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server, 
		case -NFS4ERR_DELEG_REVOKED:

		case -NFS4ERR_ADMIN_REVOKED:

		case -NFS4ERR_BAD_STATEID:

			if (state != NULL)

			if (state == NULL)

				break;

			nfs_remove_bad_delegation(state->inode);

		case -NFS4ERR_OPENMODE:

			if (state == NULL)
@@ -6111,21 +6112,22 @@ nfs4_layoutcommit_done(struct rpc_task *task, void *calldata) 
		return;



	switch (task->tk_status) { /* Just ignore these failures */

	case NFS4ERR_DELEG_REVOKED: /* layout was recalled */

	case NFS4ERR_BADIOMODE:     /* no IOMODE_RW layout for range */

	case NFS4ERR_BADLAYOUT:     /* no layout */

	case NFS4ERR_GRACE:	    /* loca_recalim always false */

	case -NFS4ERR_DELEG_REVOKED: /* layout was recalled */

	case -NFS4ERR_BADIOMODE:     /* no IOMODE_RW layout for range */

	case -NFS4ERR_BADLAYOUT:     /* no layout */

	case -NFS4ERR_GRACE:	    /* loca_recalim always false */

		task->tk_status = 0;

	}



		break;

	case 0:

		nfs_post_op_update_inode_force_wcc(data->args.inode,

						   data->res.fattr);

		break;

	default:

		if (nfs4_async_handle_error(task, server, NULL) == -EAGAIN) {

			rpc_restart_call_prepare(task);

			return;

		}



	if (task->tk_status == 0)

		nfs_post_op_update_inode_force_wcc(data->args.inode,

						   data->res.fattr);

	}

}



static void nfs4_layoutcommit_release(void *calldata)
@@ -6229,11 +6231,12 @@ nfs41_proc_secinfo_no_name(struct nfs_server *server, struct nfs_fh *fhandle, 
		case 0:

		case -NFS4ERR_WRONGSEC:

		case -NFS4ERR_NOTSUPP:

			break;

			goto out;

		default:

			err = nfs4_handle_exception(server, err, &exception);

		}

	} while (exception.retry);

out:

	return err;

}

net/sunrpc/rpcb_clnt.c

+1 −1
Original line number Diff line number Diff line
@@ -734,7 +734,7 @@ void rpcb_getport_async(struct rpc_task *task) 
	map->r_vers = clnt->cl_vers;

	map->r_prot = xprt->prot;

	map->r_port = 0;

	map->r_xprt = xprt_get(xprt);

	map->r_xprt = xprt;

	map->r_status = -EIO;



	switch (bind_version) {