Commit 3552c370 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'nfsd-5.10-1' of git://linux-nfs.org/~bfields/linux 

Pull nfsd fixes from Bruce Fields:
 "This is mainly server-to-server copy and fallout from Chuck's 5.10 rpc
  refactoring"

* tag 'nfsd-5.10-1' of git://linux-nfs.org/~bfields/linux:
  net/sunrpc: fix useless comparison in proc_do_xprt()
  net/sunrpc: return 0 on attempt to write to "transports"
  NFSD: fix missing refcount in nfsd4_copy by nfsd4_do_async_copy
  NFSD: Fix use-after-free warning when doing inter-server copy
  NFSD: MKNOD should return NFSERR_BADTYPE instead of NFSERR_INVAL
  SUNRPC: Fix general protection fault in trace_rpc_xdr_overflow()
  NFSD: NFSv3 PATHCONF Reply is improperly formed
parents 91808cd6 ae297504

fs/nfsd/nfs3proc.c

+1 −5
Original line number Diff line number Diff line
@@ -316,10 +316,6 @@ nfsd3_proc_mknod(struct svc_rqst *rqstp) 
	fh_copy(&resp->dirfh, &argp->fh);

	fh_init(&resp->fh, NFS3_FHSIZE);



	if (argp->ftype == 0 || argp->ftype >= NF3BAD) {

		resp->status = nfserr_inval;

		goto out;

	}

	if (argp->ftype == NF3CHR || argp->ftype == NF3BLK) {

		rdev = MKDEV(argp->major, argp->minor);

		if (MAJOR(rdev) != argp->major ||
@@ -328,7 +324,7 @@ nfsd3_proc_mknod(struct svc_rqst *rqstp) 
			goto out;

		}

	} else if (argp->ftype != NF3SOCK && argp->ftype != NF3FIFO) {

		resp->status = nfserr_inval;

		resp->status = nfserr_badtype;

		goto out;

	}

fs/nfsd/nfs3xdr.c

+1 −0
Original line number Diff line number Diff line
@@ -1114,6 +1114,7 @@ nfs3svc_encode_pathconfres(struct svc_rqst *rqstp, __be32 *p) 
{

	struct nfsd3_pathconfres *resp = rqstp->rq_resp;



	*p++ = resp->status;

	*p++ = xdr_zero;	/* no post_op_attr */



	if (resp->status == 0) {

fs/nfsd/nfs4proc.c

+2 −1
Original line number Diff line number Diff line
@@ -1299,7 +1299,7 @@ nfsd4_cleanup_inter_ssc(struct vfsmount *ss_mnt, struct nfsd_file *src, 
			struct nfsd_file *dst)

{

	nfs42_ssc_close(src->nf_file);

	nfsd_file_put(src);

	/* 'src' is freed by nfsd4_do_async_copy */

	nfsd_file_put(dst);

	mntput(ss_mnt);

}
@@ -1486,6 +1486,7 @@ static int nfsd4_do_async_copy(void *data) 
	cb_copy = kzalloc(sizeof(struct nfsd4_copy), GFP_KERNEL);

	if (!cb_copy)

		goto out;

	refcount_set(&cb_copy->refcount, 1);

	memcpy(&cb_copy->cp_res, &copy->cp_res, sizeof(copy->cp_res));

	cb_copy->cp_clp = copy->cp_clp;

	cb_copy->nfserr = copy->nfserr;

include/trace/events/sunrpc.h

+4 −4
Original line number Diff line number Diff line
@@ -655,10 +655,10 @@ TRACE_EVENT(rpc_xdr_overflow, 
		__field(size_t, tail_len)

		__field(unsigned int, page_len)

		__field(unsigned int, len)

		__string(progname,

			 xdr->rqst->rq_task->tk_client->cl_program->name)

		__string(procedure,

			 xdr->rqst->rq_task->tk_msg.rpc_proc->p_name)

		__string(progname, xdr->rqst ?

			 xdr->rqst->rq_task->tk_client->cl_program->name : "unknown")

		__string(procedure, xdr->rqst ?

			 xdr->rqst->rq_task->tk_msg.rpc_proc->p_name : "unknown")

	),



	TP_fast_assign(

net/sunrpc/sysctl.c

+5 −4
Original line number Diff line number Diff line
@@ -63,19 +63,20 @@ static int proc_do_xprt(struct ctl_table *table, int write, 
			void *buffer, size_t *lenp, loff_t *ppos)

{

	char tmpbuf[256];

	size_t len;

	ssize_t len;



	if ((*ppos && !write) || !*lenp) {

	if (write || *ppos) {

		*lenp = 0;

		return 0;

	}

	len = svc_print_xprts(tmpbuf, sizeof(tmpbuf));

	*lenp = memory_read_from_buffer(buffer, *lenp, ppos, tmpbuf, len);

	len = memory_read_from_buffer(buffer, *lenp, ppos, tmpbuf, len);



	if (*lenp < 0) {

	if (len < 0) {

		*lenp = 0;

		return -EINVAL;

	}

	*lenp = len;

	return 0;

}