NFSv4: Fix an Oops in the NFSv4 getacl code

Commit bf118a342f10dafe44b14451a1392c3254629a1f (NFSv4: include bitmap
in nfsv4 get acl data) introduces the 'acl_scratch' page for the case
where we may need to decode multi-page data. However it fails to take
into account the fact that the variable may be NULL (for the case where
we're not doing multi-page decode), and it also attaches it to the
encoding xdr_stream rather than the decoding one.

The immediate result is an Oops in nfs4_xdr_enc_getacl due to the
call to page_address() with a NULL page pointer.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: Andy Adamson <andros@netapp.com>
Cc: stable@vger.kernel.org

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index f0c849c98fe4bfb49208ed6a34f0714257431e75..d202e04aca942553b3f3b4fa69662c8525c2658f 100644 (file)
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3575,8 +3575,8 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
        }
        if (npages > 1) {
                /* for decoding across pages */
-               args.acl_scratch = alloc_page(GFP_KERNEL);
-               if (!args.acl_scratch)
+               res.acl_scratch = alloc_page(GFP_KERNEL);
+               if (!res.acl_scratch)
                        goto out_free;
        }
        args.acl_len = npages * PAGE_SIZE;
@@ -3612,8 +3612,8 @@ out_free:
        for (i = 0; i < npages; i++)
                if (pages[i])
                        __free_page(pages[i]);
-       if (args.acl_scratch)
-               __free_page(args.acl_scratch);
+       if (res.acl_scratch)
+               __free_page(res.acl_scratch);
        return ret;
 }
 

diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 95e92e438407c8ea39d2a6a717faeb919dd14819..33bd8d0f745d8baaa11b41fc3fcffde52ee3f02a 100644 (file)
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -2522,7 +2522,6 @@ static void nfs4_xdr_enc_getacl(struct rpc_rqst *req, struct xdr_stream *xdr,
 
        xdr_inline_pages(&req->rq_rcv_buf, replen << 2,
                args->acl_pages, args->acl_pgbase, args->acl_len);
-       xdr_set_scratch_buffer(xdr, page_address(args->acl_scratch), PAGE_SIZE);
 
        encode_nops(&hdr);
 }
@@ -6032,6 +6031,10 @@ nfs4_xdr_dec_getacl(struct rpc_rqst *rqstp, struct xdr_stream *xdr,
        struct compound_hdr hdr;
        int status;
 
+       if (res->acl_scratch != NULL) {
+               void *p = page_address(res->acl_scratch);
+               xdr_set_scratch_buffer(xdr, p, PAGE_SIZE);
+       }
        status = decode_compound_hdr(xdr, &hdr);
        if (status)
                goto out;

diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index a764cef06b733f34f89ed4a618bfb41e33428258..d6ba9a12591ea464991b1d36157918ee5fc1eebe 100644 (file)
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -614,7 +614,6 @@ struct nfs_getaclargs {
        size_t                          acl_len;
        unsigned int                    acl_pgbase;
        struct page **                  acl_pages;
-       struct page *                   acl_scratch;
        struct nfs4_sequence_args       seq_args;
 };
 
@@ -624,6 +623,7 @@ struct nfs_getaclres {
        size_t                          acl_len;
        size_t                          acl_data_offset;
        int                             acl_flags;
+       struct page *                   acl_scratch;
        struct nfs4_sequence_res        seq_res;
 };