Fix an Oops in the NFSv4 asynchronous unlink code. The v4

getattr "bitmap" was allocated on the stack.

Make it use the bitmaps already allocated for that purpose
in the nfs_fattr struct.

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index a0a5e39d8563c676459b7154379ecc58a12185cc..c778e648b7f3c61c845b93bc5bae3133d270f9d1 100644 (file)
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -218,8 +218,7 @@ __nfs4_setup_getattr(struct nfs4_compound *cp, u32 *bitmap,
                     struct nfs_fattr *fattr,
                     struct nfs_fsstat *fsstat,
                     struct nfs_fsinfo *fsinfo,
-                    struct nfs_pathconf *pathconf,
-                    u32 *bmres)
+                    struct nfs_pathconf *pathconf)
 {
         struct nfs4_getattr *getattr = GET_OP(cp, getattr);
 
@@ -228,7 +227,6 @@ __nfs4_setup_getattr(struct nfs4_compound *cp, u32 *bitmap,
        getattr->gt_fsstat = fsstat;
        getattr->gt_fsinfo = fsinfo;
        getattr->gt_pathconf = pathconf;
-       getattr->gt_bmres = bmres;
 
         OPNUM(cp) = OP_GETATTR;
         cp->req_nops++;
@@ -236,48 +234,43 @@ __nfs4_setup_getattr(struct nfs4_compound *cp, u32 *bitmap,
 
 static void
 nfs4_setup_getattr(struct nfs4_compound *cp,
-               struct nfs_fattr *fattr,
-               u32 *bmres)
+               struct nfs_fattr *fattr)
 {
        __nfs4_setup_getattr(cp, nfs4_fattr_bitmap, fattr,
-                       NULL, NULL, NULL, bmres);
+                       NULL, NULL, NULL);
 }
 
 static void
 nfs4_setup_getrootattr(struct nfs4_compound *cp,
                struct nfs_fattr *fattr,
-               struct nfs_fsinfo *fsinfo,
-               u32 *bmres)
+               struct nfs_fsinfo *fsinfo)
 {
        __nfs4_setup_getattr(cp, nfs4_mount_bitmap,
-                       fattr, NULL, fsinfo, NULL, bmres);
+                       fattr, NULL, fsinfo, NULL);
 }
 
 static void
 nfs4_setup_statfs(struct nfs4_compound *cp,
-               struct nfs_fsstat *fsstat,
-               u32 *bmres)
+               struct nfs_fsstat *fsstat)
 {
        __nfs4_setup_getattr(cp, nfs4_statfs_bitmap,
-                       NULL, fsstat, NULL, NULL, bmres);
+                       NULL, fsstat, NULL, NULL);
 }
 
 static void
 nfs4_setup_fsinfo(struct nfs4_compound *cp,
-               struct nfs_fsinfo *fsinfo,
-               u32 *bmres)
+               struct nfs_fsinfo *fsinfo)
 {
        __nfs4_setup_getattr(cp, nfs4_fsinfo_bitmap,
-                       NULL, NULL, fsinfo, NULL, bmres);
+                       NULL, NULL, fsinfo, NULL);
 }
 
 static void
 nfs4_setup_pathconf(struct nfs4_compound *cp,
-               struct nfs_pathconf *pathconf,
-               u32 *bmres)
+               struct nfs_pathconf *pathconf)
 {
        __nfs4_setup_getattr(cp, nfs4_pathconf_bitmap,
-                       NULL, NULL, NULL, pathconf, bmres);
+                       NULL, NULL, NULL, pathconf);
 }
 
 static void
@@ -569,8 +562,6 @@ nfs4_do_open(struct inode *dir, struct qstr *name, int flags,
        struct nfs_server       *server = NFS_SERVER(dir);
        struct nfs4_change_info d_cinfo;
        int                     status;
-       u32                     f_bmres[2];
-       u32                     d_bmres[2];
        struct nfs_fattr        d_attr = {
                .valid          = 0,
        };
@@ -580,12 +571,10 @@ nfs4_do_open(struct inode *dir, struct qstr *name, int flags,
        struct nfs4_getattr     f_getattr = {
                .gt_bmval       = nfs4_fattr_bitmap,
                .gt_attrs       = (fattr == NULL ? &f_attr: fattr),
-               .gt_bmres       = f_bmres,
        };
        struct nfs4_getattr     d_getattr = {
                .gt_bmval       = nfs4_fattr_bitmap,
                .gt_attrs       = &d_attr,
-               .gt_bmres       = d_bmres,
        };
        struct nfs_openargs o_arg = {
                .fh             = NFS_FH(dir),
@@ -677,11 +666,9 @@ nfs4_do_setattr(struct nfs_server *server, struct nfs_fattr *fattr,
                 struct nfs_fh *fhandle, struct iattr *sattr,
                 struct nfs4_shareowner *sp)
 {
-        u32                     g_bmres[2];
         struct nfs4_getattr     getattr = {
                 .gt_bmval       = nfs4_fattr_bitmap,
                 .gt_attrs       = fattr,
-                .gt_bmres       = g_bmres,
         };
         struct nfs_setattrargs  arg = {
                 .fh             = fhandle,
@@ -756,7 +743,6 @@ nfs4_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,
        struct nfs4_compound    compound;
        struct nfs4_op          ops[4];
        struct nfs_fsinfo       fsinfo;
-       u32                     bmres[2];
        unsigned char *         p;
        struct qstr             q;
        int                     status;
@@ -783,7 +769,7 @@ nfs4_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,
        nfs4_setup_compound(&compound, ops, server, "setclientid_confirm");
        nfs4_setup_setclientid_confirm(&compound);
        nfs4_setup_putrootfh(&compound);
-       nfs4_setup_getrootattr(&compound, fattr, &fsinfo, bmres);
+       nfs4_setup_getrootattr(&compound, fattr, &fsinfo);
        nfs4_setup_getfh(&compound, fhandle);
        if ((status = nfs4_call_compound(&compound, NULL, 0)))
                goto out;
@@ -816,7 +802,7 @@ nfs4_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,
                nfs4_setup_compound(&compound, ops, server, "mount");
                nfs4_setup_putfh(&compound, fhandle);
                nfs4_setup_lookup(&compound, &q);
-               nfs4_setup_getattr(&compound, fattr, bmres);
+               nfs4_setup_getattr(&compound, fattr);
                nfs4_setup_getfh(&compound, fhandle);
                status = nfs4_call_compound(&compound, NULL, 0);
                if (!status)
@@ -837,13 +823,12 @@ nfs4_proc_getattr(struct inode *inode, struct nfs_fattr *fattr)
 {
        struct nfs4_compound compound;
        struct nfs4_op ops[2];
-       u32 bmres[2];
 
        fattr->valid = 0;
 
        nfs4_setup_compound(&compound, ops, NFS_SERVER(inode), "getattr");
        nfs4_setup_putfh(&compound, NFS_FH(inode));
-       nfs4_setup_getattr(&compound, fattr, bmres);
+       nfs4_setup_getattr(&compound, fattr);
        return nfs4_call_compound(&compound, NULL, 0);
 }
 
@@ -905,8 +890,6 @@ nfs4_proc_lookup(struct inode *dir, struct qstr *name,
        struct nfs4_compound    compound;
        struct nfs4_op          ops[5];
        struct nfs_fattr        dir_attr;
-       u32                     dir_bmres[2];
-       u32                     bmres[2];
        int                     status;
 
        dir_attr.valid = 0;
@@ -915,9 +898,9 @@ nfs4_proc_lookup(struct inode *dir, struct qstr *name,
        dprintk("NFS call  lookup %s\n", name->name);
        nfs4_setup_compound(&compound, ops, NFS_SERVER(dir), "lookup");
        nfs4_setup_putfh(&compound, NFS_FH(dir));
-       nfs4_setup_getattr(&compound, &dir_attr, dir_bmres);
+       nfs4_setup_getattr(&compound, &dir_attr);
        nfs4_setup_lookup(&compound, name);
-       nfs4_setup_getattr(&compound, fattr, bmres);
+       nfs4_setup_getattr(&compound, fattr);
        nfs4_setup_getfh(&compound, fhandle);
        status = nfs4_call_compound(&compound, NULL, 0);
        dprintk("NFS reply lookup: %d\n", status);
@@ -933,7 +916,6 @@ nfs4_proc_access(struct inode *inode, struct rpc_cred *cred, int mode)
        struct nfs4_compound    compound;
        struct nfs4_op          ops[3];
        struct nfs_fattr        fattr;
-       u32                     bmres[2];
        u32                     req_access = 0, resp_supported, resp_access;
        int                     status;
 
@@ -959,7 +941,7 @@ nfs4_proc_access(struct inode *inode, struct rpc_cred *cred, int mode)
 
        nfs4_setup_compound(&compound, ops, NFS_SERVER(inode), "access");
        nfs4_setup_putfh(&compound, NFS_FH(inode));
-       nfs4_setup_getattr(&compound, &fattr, bmres);
+       nfs4_setup_getattr(&compound, &fattr);
        nfs4_setup_access(&compound, req_access, &resp_supported, &resp_access);
        status = nfs4_call_compound(&compound, cred, 0);
        nfs_refresh_inode(inode, &fattr);
@@ -1155,14 +1137,13 @@ nfs4_proc_remove(struct inode *dir, struct qstr *name)
        struct nfs4_op          ops[3];
        struct nfs4_change_info dir_cinfo;
        struct nfs_fattr        dir_attr;
-       u32                     dir_bmres[2];
        int                     status;
 
        dir_attr.valid = 0;
        nfs4_setup_compound(&compound, ops, NFS_SERVER(dir), "remove");
        nfs4_setup_putfh(&compound, NFS_FH(dir));
        nfs4_setup_remove(&compound, name, &dir_cinfo);
-       nfs4_setup_getattr(&compound, &dir_attr, dir_bmres);
+       nfs4_setup_getattr(&compound, &dir_attr);
        status = nfs4_call_compound(&compound, NULL, 0);
 
        if (!status) {
@@ -1184,7 +1165,6 @@ nfs4_proc_unlink_setup(struct rpc_message *msg, struct dentry *dir, struct qstr
 {
        struct unlink_desc *    up;
        struct nfs4_compound *  cp;
-       u32                     bmres[2];
 
        up = (struct unlink_desc *) kmalloc(sizeof(*up), GFP_KERNEL);
        if (!up)
@@ -1194,7 +1174,7 @@ nfs4_proc_unlink_setup(struct rpc_message *msg, struct dentry *dir, struct qstr
        nfs4_setup_compound(cp, up->ops, NFS_SERVER(dir->d_inode), "unlink_setup");
        nfs4_setup_putfh(cp, NFS_FH(dir->d_inode));
        nfs4_setup_remove(cp, name, &up->cinfo);
-       nfs4_setup_getattr(cp, &up->attrs, bmres);
+       nfs4_setup_getattr(cp, &up->attrs);
        
        msg->rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_COMPOUND];
        msg->rpc_argp = cp;
@@ -1227,7 +1207,6 @@ nfs4_proc_rename(struct inode *old_dir, struct qstr *old_name,
        struct nfs4_op          ops[7];
        struct nfs4_change_info old_cinfo, new_cinfo;
        struct nfs_fattr        old_dir_attr, new_dir_attr;
-       u32                     old_dir_bmres[2], new_dir_bmres[2];
        int                     status;
 
        old_dir_attr.valid = 0;
@@ -1238,9 +1217,9 @@ nfs4_proc_rename(struct inode *old_dir, struct qstr *old_name,
        nfs4_setup_savefh(&compound);
        nfs4_setup_putfh(&compound, NFS_FH(new_dir));
        nfs4_setup_rename(&compound, old_name, new_name, &old_cinfo, &new_cinfo);
-       nfs4_setup_getattr(&compound, &new_dir_attr, new_dir_bmres);
+       nfs4_setup_getattr(&compound, &new_dir_attr);
        nfs4_setup_restorefh(&compound);
-       nfs4_setup_getattr(&compound, &old_dir_attr, old_dir_bmres);
+       nfs4_setup_getattr(&compound, &old_dir_attr);
        status = nfs4_call_compound(&compound, NULL, 0);
 
        if (!status) {
@@ -1259,7 +1238,6 @@ nfs4_proc_link(struct inode *inode, struct inode *dir, struct qstr *name)
        struct nfs4_op          ops[7];
        struct nfs4_change_info dir_cinfo;
        struct nfs_fattr        dir_attr, fattr;
-       u32                     dir_bmres[2], bmres[2];
        int                     status;
        
        dir_attr.valid = 0;
@@ -1270,9 +1248,9 @@ nfs4_proc_link(struct inode *inode, struct inode *dir, struct qstr *name)
        nfs4_setup_savefh(&compound);
        nfs4_setup_putfh(&compound, NFS_FH(dir));
        nfs4_setup_link(&compound, name, &dir_cinfo);
-       nfs4_setup_getattr(&compound, &dir_attr, dir_bmres);
+       nfs4_setup_getattr(&compound, &dir_attr);
        nfs4_setup_restorefh(&compound);
-       nfs4_setup_getattr(&compound, &fattr, bmres);
+       nfs4_setup_getattr(&compound, &fattr);
        status = nfs4_call_compound(&compound, NULL, 0);
 
        if (!status) {
@@ -1291,7 +1269,6 @@ nfs4_proc_symlink(struct inode *dir, struct qstr *name, struct qstr *path,
        struct nfs4_compound    compound;
        struct nfs4_op          ops[7];
        struct nfs_fattr        dir_attr;
-       u32                     dir_bmres[2], bmres[2];
        struct nfs4_change_info dir_cinfo;
        int                     status;
 
@@ -1302,10 +1279,10 @@ nfs4_proc_symlink(struct inode *dir, struct qstr *name, struct qstr *path,
        nfs4_setup_putfh(&compound, NFS_FH(dir));
        nfs4_setup_savefh(&compound);
        nfs4_setup_create_symlink(&compound, name, path, sattr, &dir_cinfo);
-       nfs4_setup_getattr(&compound, fattr, bmres);
+       nfs4_setup_getattr(&compound, fattr);
        nfs4_setup_getfh(&compound, fhandle);
        nfs4_setup_restorefh(&compound);
-       nfs4_setup_getattr(&compound, &dir_attr, dir_bmres);
+       nfs4_setup_getattr(&compound, &dir_attr);
        status = nfs4_call_compound(&compound, NULL, 0);
 
        if (!status) {
@@ -1322,7 +1299,6 @@ nfs4_proc_mkdir(struct inode *dir, struct qstr *name, struct iattr *sattr,
        struct nfs4_compound    compound;
        struct nfs4_op          ops[7];
        struct nfs_fattr        dir_attr;
-       u32                     dir_bmres[2], bmres[2];
        struct nfs4_change_info dir_cinfo;
        int                     status;
 
@@ -1333,10 +1309,10 @@ nfs4_proc_mkdir(struct inode *dir, struct qstr *name, struct iattr *sattr,
        nfs4_setup_putfh(&compound, NFS_FH(dir));
        nfs4_setup_savefh(&compound);
        nfs4_setup_create_dir(&compound, name, sattr, &dir_cinfo);
-       nfs4_setup_getattr(&compound, fattr, bmres);
+       nfs4_setup_getattr(&compound, fattr);
        nfs4_setup_getfh(&compound, fhandle);
        nfs4_setup_restorefh(&compound);
-       nfs4_setup_getattr(&compound, &dir_attr, dir_bmres);
+       nfs4_setup_getattr(&compound, &dir_attr);
        status = nfs4_call_compound(&compound, NULL, 0);
 
        if (!status) {
@@ -1373,7 +1349,6 @@ nfs4_proc_mknod(struct inode *dir, struct qstr *name, struct iattr *sattr,
        struct nfs4_compound    compound;
        struct nfs4_op          ops[7];
        struct nfs_fattr        dir_attr;
-       u32                     dir_bmres[2], bmres[2];
        struct nfs4_change_info dir_cinfo;
        int                     status;
 
@@ -1384,10 +1359,10 @@ nfs4_proc_mknod(struct inode *dir, struct qstr *name, struct iattr *sattr,
        nfs4_setup_putfh(&compound, NFS_FH(dir));
        nfs4_setup_savefh(&compound);
        nfs4_setup_create_special(&compound, name, rdev,sattr, &dir_cinfo);
-       nfs4_setup_getattr(&compound, fattr, bmres);
+       nfs4_setup_getattr(&compound, fattr);
        nfs4_setup_getfh(&compound, fh);
        nfs4_setup_restorefh(&compound);
-       nfs4_setup_getattr(&compound, &dir_attr, dir_bmres);
+       nfs4_setup_getattr(&compound, &dir_attr);
        status = nfs4_call_compound(&compound, NULL, 0);
 
        if (!status) {
@@ -1403,12 +1378,11 @@ nfs4_proc_statfs(struct nfs_server *server, struct nfs_fh *fhandle,
 {
        struct nfs4_compound compound;
        struct nfs4_op ops[2];
-       u32 bmres[2];
 
        memset(fsstat, 0, sizeof(*fsstat));
        nfs4_setup_compound(&compound, ops, server, "statfs");
        nfs4_setup_putfh(&compound, fhandle);
-       nfs4_setup_statfs(&compound, fsstat, bmres);
+       nfs4_setup_statfs(&compound, fsstat);
        return nfs4_call_compound(&compound, NULL, 0);
 }
 
@@ -1418,12 +1392,11 @@ nfs4_proc_fsinfo(struct nfs_server *server, struct nfs_fh *fhandle,
 {
        struct nfs4_compound compound;
        struct nfs4_op ops[2];
-       u32 bmres[2];
 
        memset(fsinfo, 0, sizeof(*fsinfo));
        nfs4_setup_compound(&compound, ops, server, "statfs");
        nfs4_setup_putfh(&compound, fhandle);
-       nfs4_setup_fsinfo(&compound, fsinfo, bmres);
+       nfs4_setup_fsinfo(&compound, fsinfo);
        return nfs4_call_compound(&compound, NULL, 0);
 }
 
@@ -1433,12 +1406,11 @@ nfs4_proc_pathconf(struct nfs_server *server, struct nfs_fh *fhandle,
 {
        struct nfs4_compound compound;
        struct nfs4_op ops[2];
-       u32 bmres[2];
 
        memset(pathconf, 0, sizeof(*pathconf));
        nfs4_setup_compound(&compound, ops, server, "statfs");
        nfs4_setup_putfh(&compound, fhandle);
-       nfs4_setup_pathconf(&compound, pathconf, bmres);
+       nfs4_setup_pathconf(&compound, pathconf);
        return nfs4_call_compound(&compound, NULL, 0);
 }
 

diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index c2dadc47fbe8d1892df4a9c7a4f378c3e3a2bf45..2aecef42aa6da1a4fb7708c6d3775684be7ed61d 100644 (file)
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -1333,8 +1333,10 @@ decode_getattr(struct xdr_stream *xdr, struct nfs4_getattr *getattr,
                dprintk("read_attrs: server returned bad attributes!\n");
                goto xdr_error;
        }
-       getattr->gt_bmres[0] = bmval0;
-       getattr->gt_bmres[1] = bmval1;
+       if (nfp) {
+               nfp->bitmap[0] = bmval0;
+               nfp->bitmap[1] = bmval1;
+       }
 
        /*
         * In case the server doesn't return some attributes,

diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index 88b705d8cefec517ba65b9bde919a070c951ff8d..76c7410a499b1abb9bbd4e22c0d489942cdec066 100644 (file)
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -451,7 +451,6 @@ struct nfs4_getattr {
        struct nfs_fsstat *             gt_fsstat;         /* response */
        struct nfs_fsinfo *             gt_fsinfo;         /* response */
        struct nfs_pathconf *           gt_pathconf;       /* response */
-       u32 *                           gt_bmres;          /* response */
 };
 
 struct nfs4_getfh {