1 files changed, 16 insertions, 10 deletions

diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index d6ef0955a979..9df898ba648f 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -1072,8 +1072,9 @@ nfsd4_decode_rename(struct nfsd4_compoundargs *argp, struct nfsd4_rename *rename
 
         READ_BUF(4);
         rename->rn_snamelen = be32_to_cpup(p++);
-        READ_BUF(rename->rn_snamelen + 4);
+        READ_BUF(rename->rn_snamelen);
         SAVEMEM(rename->rn_sname, rename->rn_snamelen);
+        READ_BUF(4);
         rename->rn_tnamelen = be32_to_cpup(p++);
         READ_BUF(rename->rn_tnamelen);
         SAVEMEM(rename->rn_tname, rename->rn_tnamelen);
@@ -1155,13 +1156,14 @@ nfsd4_decode_setclientid(struct nfsd4_compoundargs *argp, struct nfsd4_setclient
         READ_BUF(8);
         setclientid->se_callback_prog = be32_to_cpup(p++);
         setclientid->se_callback_netid_len = be32_to_cpup(p++);
-
-        READ_BUF(setclientid->se_callback_netid_len + 4);
+        READ_BUF(setclientid->se_callback_netid_len);
         SAVEMEM(setclientid->se_callback_netid_val, setclientid->se_callback_netid_len);
+        READ_BUF(4);
         setclientid->se_callback_addr_len = be32_to_cpup(p++);
 
-        READ_BUF(setclientid->se_callback_addr_len + 4);
+        READ_BUF(setclientid->se_callback_addr_len);
         SAVEMEM(setclientid->se_callback_addr_val, setclientid->se_callback_addr_len);
+        READ_BUF(4);
         setclientid->se_callback_ident = be32_to_cpup(p++);
 
         DECODE_TAIL;
@@ -1835,8 +1837,9 @@ nfsd4_decode_compound(struct nfsd4_compoundargs *argp)
 
         READ_BUF(4);
         argp->taglen = be32_to_cpup(p++);
-        READ_BUF(argp->taglen + 8);
+        READ_BUF(argp->taglen);
         SAVEMEM(argp->tag, argp->taglen);
+        READ_BUF(8);
         argp->minorversion = be32_to_cpup(p++);
         argp->opcnt = be32_to_cpup(p++);
         max_reply += 4 + (XDR_QUADLEN(argp->taglen) << 2);
@@ -3060,7 +3063,7 @@ static __be32 nfsd4_encode_bind_conn_to_session(struct nfsd4_compoundres *resp,
                 p = xdr_encode_opaque_fixed(p, bcts->sessionid.data,
                                                 NFS4_MAX_SESSIONID_LEN);
                 *p++ = cpu_to_be32(bcts->dir);
-                /* Sorry, we do not yet support RDMA over 4.1: */
+                /* Upshifting from TCP to RDMA is not supported */
                 *p++ = cpu_to_be32(0);
         }
         return nfserr;
@@ -3362,6 +3365,7 @@ static __be32 nfsd4_encode_splice_read(
         struct xdr_stream *xdr = &resp->xdr;
         struct xdr_buf *buf = xdr->buf;
         u32 eof;
+        long len;
         int space_left;
         __be32 nfserr;
         __be32 *p = xdr->p - 2;
@@ -3370,6 +3374,7 @@ static __be32 nfsd4_encode_splice_read(
         if (xdr->end - xdr->p < 1)
                 return nfserr_resource;
 
+        len = maxcount;
         nfserr = nfsd_splice_read(read->rd_rqstp, file,
                                   read->rd_offset, &maxcount);
         if (nfserr) {
@@ -3382,8 +3387,8 @@ static __be32 nfsd4_encode_splice_read(
                 return nfserr;
         }
 
-        eof = (read->rd_offset + maxcount >=
-               d_inode(read->rd_fhp->fh_dentry)->i_size);
+        eof = nfsd_eof_on_read(len, maxcount, read->rd_offset,
+                                d_inode(read->rd_fhp->fh_dentry)->i_size);
 
         *(p++) = htonl(eof);
         *(p++) = htonl(maxcount);
@@ -3453,14 +3458,15 @@ static __be32 nfsd4_encode_readv(struct nfsd4_compoundres *resp,
         }
         read->rd_vlen = v;
 
+        len = maxcount;
         nfserr = nfsd_readv(file, read->rd_offset, resp->rqstp->rq_vec,
                         read->rd_vlen, &maxcount);
         if (nfserr)
                 return nfserr;
         xdr_truncate_encode(xdr, starting_len + 8 + ((maxcount+3)&~3));
 
-        eof = (read->rd_offset + maxcount >=
-               d_inode(read->rd_fhp->fh_dentry)->i_size);
+        eof = nfsd_eof_on_read(len, maxcount, read->rd_offset,
+                                d_inode(read->rd_fhp->fh_dentry)->i_size);
 
         tmp = htonl(eof);
         write_bytes_to_xdr_buf(xdr->buf, starting_len    , &tmp, 4);