1 files changed, 55 insertions, 49 deletions

diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 03827cef1fa7..0a148c9d2a5c 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -84,7 +84,11 @@ static struct lock_class_key svc_slock_key[2];
 static void svc_reclassify_socket(struct socket *sock)
 {
         struct sock *sk = sock->sk;
-        BUG_ON(sock_owned_by_user(sk));
+
+        WARN_ON_ONCE(sock_owned_by_user(sk));
+        if (sock_owned_by_user(sk))
+                return;
+
         switch (sk->sk_family) {
         case AF_INET:
                 sock_lock_init_class_and_name(sk, "slock-AF_INET-NFSD",
@@ -601,6 +605,7 @@ static int svc_udp_recvfrom(struct svc_rqst *rqstp)
                 rqstp->rq_respages = rqstp->rq_pages + 1 +
                         DIV_ROUND_UP(rqstp->rq_arg.page_len, PAGE_SIZE);
         }
+        rqstp->rq_next_page = rqstp->rq_respages+1;
 
         if (serv->sv_stats)
                 serv->sv_stats->netudpcnt++;
@@ -874,9 +879,9 @@ static unsigned int svc_tcp_restore_pages(struct svc_sock *svsk, struct svc_rqst
 {
         unsigned int i, len, npages;
 
-        if (svsk->sk_tcplen <= sizeof(rpc_fraghdr))
+        if (svsk->sk_datalen == 0)
                 return 0;
-        len = svsk->sk_tcplen - sizeof(rpc_fraghdr);
+        len = svsk->sk_datalen;
         npages = (len + PAGE_SIZE - 1) >> PAGE_SHIFT;
         for (i = 0; i < npages; i++) {
                 if (rqstp->rq_pages[i] != NULL)
@@ -893,9 +898,9 @@ static void svc_tcp_save_pages(struct svc_sock *svsk, struct svc_rqst *rqstp)
 {
         unsigned int i, len, npages;
 
-        if (svsk->sk_tcplen <= sizeof(rpc_fraghdr))
+        if (svsk->sk_datalen == 0)
                 return;
-        len = svsk->sk_tcplen - sizeof(rpc_fraghdr);
+        len = svsk->sk_datalen;
         npages = (len + PAGE_SIZE - 1) >> PAGE_SHIFT;
         for (i = 0; i < npages; i++) {
                 svsk->sk_pages[i] = rqstp->rq_pages[i];
@@ -907,9 +912,9 @@ static void svc_tcp_clear_pages(struct svc_sock *svsk)
 {
         unsigned int i, len, npages;
 
-        if (svsk->sk_tcplen <= sizeof(rpc_fraghdr))
+        if (svsk->sk_datalen == 0)
                 goto out;
-        len = svsk->sk_tcplen - sizeof(rpc_fraghdr);
+        len = svsk->sk_datalen;
         npages = (len + PAGE_SIZE - 1) >> PAGE_SHIFT;
         for (i = 0; i < npages; i++) {
                 BUG_ON(svsk->sk_pages[i] == NULL);
@@ -918,13 +923,12 @@ static void svc_tcp_clear_pages(struct svc_sock *svsk)
         }
 out:
         svsk->sk_tcplen = 0;
+        svsk->sk_datalen = 0;
 }
 
 /*
- * Receive data.
+ * Receive fragment record header.
  * If we haven't gotten the record length yet, get the next four bytes.
- * Otherwise try to gobble up as much as possible up to the complete
- * record length.
  */
 static int svc_tcp_recv_record(struct svc_sock *svsk, struct svc_rqst *rqstp)
 {
@@ -950,32 +954,16 @@ static int svc_tcp_recv_record(struct svc_sock *svsk, struct svc_rqst *rqstp)
                         return -EAGAIN;
                 }
 
-                svsk->sk_reclen = ntohl(svsk->sk_reclen);
-                if (!(svsk->sk_reclen & RPC_LAST_STREAM_FRAGMENT)) {
-                        /* FIXME: technically, a record can be fragmented,
-                         *  and non-terminal fragments will not have the top
-                         *  bit set in the fragment length header.
-                         *  But apparently no known nfs clients send fragmented
-                         *  records. */
-                        net_notice_ratelimited("RPC: multiple fragments per record not supported\n");
-                        goto err_delete;
-                }
-
-                svsk->sk_reclen &= RPC_FRAGMENT_SIZE_MASK;
-                dprintk("svc: TCP record, %d bytes\n", svsk->sk_reclen);
-                if (svsk->sk_reclen > serv->sv_max_mesg) {
-                        net_notice_ratelimited("RPC: fragment too large: 0x%08lx\n",
-                                               (unsigned long)svsk->sk_reclen);
+                dprintk("svc: TCP record, %d bytes\n", svc_sock_reclen(svsk));
+                if (svc_sock_reclen(svsk) + svsk->sk_datalen >
+                                                        serv->sv_max_mesg) {
+                        net_notice_ratelimited("RPC: fragment too large: %d\n",
+                                        svc_sock_reclen(svsk));
                         goto err_delete;
                 }
         }
 
-        if (svsk->sk_reclen < 8)
-                goto err_delete; /* client is nuts. */
-
-        len = svsk->sk_reclen;
-
-        return len;
+        return svc_sock_reclen(svsk);
 error:
         dprintk("RPC: TCP recv_record got %d\n", len);
         return len;
@@ -1019,7 +1007,7 @@ static int receive_cb_reply(struct svc_sock *svsk, struct svc_rqst *rqstp)
         if (dst->iov_len < src->iov_len)
                 return -EAGAIN; /* whatever; just giving up. */
         memcpy(dst->iov_base, src->iov_base, src->iov_len);
-        xprt_complete_rqst(req->rq_task, svsk->sk_reclen);
+        xprt_complete_rqst(req->rq_task, rqstp->rq_arg.len);
         rqstp->rq_arg.len = 0;
         return 0;
 }
@@ -1038,6 +1026,17 @@ static int copy_pages_to_kvecs(struct kvec *vec, struct page **pages, int len)
         return i;
 }
 
+static void svc_tcp_fragment_received(struct svc_sock *svsk)
+{
+        /* If we have more data, signal svc_xprt_enqueue() to try again */
+        if (svc_recv_available(svsk) > sizeof(rpc_fraghdr))
+                set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
+        dprintk("svc: TCP %s record (%d bytes)\n",
+                svc_sock_final_rec(svsk) ? "final" : "nonfinal",
+                svc_sock_reclen(svsk));
+        svsk->sk_tcplen = 0;
+        svsk->sk_reclen = 0;
+}
 
 /*
  * Receive data from a TCP socket.
@@ -1064,29 +1063,39 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
                 goto error;
 
         base = svc_tcp_restore_pages(svsk, rqstp);
-        want = svsk->sk_reclen - base;
+        want = svc_sock_reclen(svsk) - (svsk->sk_tcplen - sizeof(rpc_fraghdr));
 
         vec = rqstp->rq_vec;
 
         pnum = copy_pages_to_kvecs(&vec[0], &rqstp->rq_pages[0],
-                                                svsk->sk_reclen);
+                                                svsk->sk_datalen + want);
 
         rqstp->rq_respages = &rqstp->rq_pages[pnum];
+        rqstp->rq_next_page = rqstp->rq_respages + 1;
 
         /* Now receive data */
         len = svc_partial_recvfrom(rqstp, vec, pnum, want, base);
-        if (len >= 0)
+        if (len >= 0) {
                 svsk->sk_tcplen += len;
-        if (len != want) {
+                svsk->sk_datalen += len;
+        }
+        if (len != want || !svc_sock_final_rec(svsk)) {
                 svc_tcp_save_pages(svsk, rqstp);
                 if (len < 0 && len != -EAGAIN)
-                        goto err_other;
-                dprintk("svc: incomplete TCP record (%d of %d)\n",
-                        svsk->sk_tcplen, svsk->sk_reclen);
+                        goto err_delete;
+                if (len == want)
+                        svc_tcp_fragment_received(svsk);
+                else
+                        dprintk("svc: incomplete TCP record (%d of %d)\n",
+                                (int)(svsk->sk_tcplen - sizeof(rpc_fraghdr)),
+                                svc_sock_reclen(svsk));
                 goto err_noclose;
         }
 
-        rqstp->rq_arg.len = svsk->sk_reclen;
+        if (svc_sock_reclen(svsk) < 8)
+                goto err_delete; /* client is nuts. */
+
+        rqstp->rq_arg.len = svsk->sk_datalen;
         rqstp->rq_arg.page_base = 0;
         if (rqstp->rq_arg.len <= rqstp->rq_arg.head[0].iov_len) {
                 rqstp->rq_arg.head[0].iov_len = rqstp->rq_arg.len;
@@ -1103,11 +1112,8 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
                 len = receive_cb_reply(svsk, rqstp);
 
         /* Reset TCP read info */
-        svsk->sk_reclen = 0;
-        svsk->sk_tcplen = 0;
-        /* If we have more data, signal svc_xprt_enqueue() to try again */
-        if (svc_recv_available(svsk) > sizeof(rpc_fraghdr))
-                set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
+        svsk->sk_datalen = 0;
+        svc_tcp_fragment_received(svsk);
 
         if (len < 0)
                 goto error;
@@ -1116,15 +1122,14 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
         if (serv->sv_stats)
                 serv->sv_stats->nettcpcnt++;
 
-        dprintk("svc: TCP complete record (%d bytes)\n", rqstp->rq_arg.len);
         return rqstp->rq_arg.len;
 
 error:
         if (len != -EAGAIN)
-                goto err_other;
+                goto err_delete;
         dprintk("RPC: TCP recvfrom got EAGAIN\n");
         return 0;
-err_other:
+err_delete:
         printk(KERN_NOTICE "%s: recvfrom returned errno %d\n",
                svsk->sk_xprt.xpt_server->sv_name, -len);
         set_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags);
@@ -1301,6 +1306,7 @@ static void svc_tcp_init(struct svc_sock *svsk, struct svc_serv *serv)
 
                 svsk->sk_reclen = 0;
                 svsk->sk_tcplen = 0;
+                svsk->sk_datalen = 0;
                 memset(&svsk->sk_pages[0], 0, sizeof(svsk->sk_pages));
 
                 tcp_sk(sk)->nonagle |= TCP_NAGLE_OFF;