[PATCH] Fix bugs introduced by recent improvements to readdir_plus

 - make sure cd->buffer is always inside a page - previously if an
   entry fit perfectly in the remainder of a page, cd->buffer would
   end up pointing past the end of that page.

 - make sure num_entry_words is always correct, even on the error
   path.

diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index f49a55374dc65ed3ea472137965e73b6473b83cb..8291752c726a0ce23fb86a816ab6a49e1c86f4b7 100644 (file)
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -884,10 +884,11 @@ encode_entry(struct readdir_cd *ccd, const char *name,
                if (plus) {
                        struct svc_fh   fh;
 
-                       if (compose_entry_fh(cd, &fh, name, namlen) > 0)
-                               goto noexec;
-
-                       p = encode_entryplus_baggage(cd, p, &fh);
+                       if (compose_entry_fh(cd, &fh, name, namlen) > 0) {
+                               *p++ = 0;
+                               *p++ = 0;
+                       } else
+                               p = encode_entryplus_baggage(cd, p, &fh);
                }
                num_entry_words = p - cd->buffer;
        } else if (cd->rqstp->rq_respages[pn+1] != NULL) {
@@ -916,7 +917,7 @@ encode_entry(struct readdir_cd *ccd, const char *name,
                /* determine entry word length and lengths to go in pages */
                num_entry_words = p1 - tmp;
                len1 = curr_page_addr + PAGE_SIZE - (caddr_t)cd->buffer;
-               if ((num_entry_words << 2) <= len1) {
+               if ((num_entry_words << 2) < len1) {
                        /* the actual number of words in the entry is less
                         * than elen and can still fit in the current page
                         */
@@ -945,16 +946,11 @@ encode_entry(struct readdir_cd *ccd, const char *name,
                return -EINVAL;
        }
 
-out:
        cd->buflen -= num_entry_words;
        cd->buffer = p;
        cd->common.err = nfs_ok;
        return 0;
 
-noexec:
-       *p++ = 0;
-       *p++ = 0;
-       goto out;
 }
 
 int