NFS: Fix double d_drop in nfs_instantiate() error path

If the LOOKUP or GETATTR in nfs_instantiate fail, nfs_instantiate will do a
d_drop before returning.  But some callers already do a d_drop in the case
of an error return.  Make certain we do only one d_drop in all error paths.

This issue was introduced because over time, the symlink proc API diverged
slightly from the create/mkdir/mknod proc API.  To prevent other coding
mistakes of this type, change the symlink proc API to be more like
create/mkdir/mknod and move the nfs_instantiate call into the symlink proc
routines so it is used in exactly the same way for create, mkdir, mknod,
and symlink.

Test plan:
Connectathon, all versions of NFS.

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

1 files changed, 16 insertions, 10 deletions

diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
index 9e8258ece6fd..d85ac427c326 100644
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -544,23 +544,23 @@ nfs3_proc_link(struct inode *inode, struct inode *dir, struct qstr *name)
 }
 
 static int
-nfs3_proc_symlink(struct inode *dir, struct qstr *name, struct qstr *path,
-                  struct iattr *sattr, struct nfs_fh *fhandle,
-                  struct nfs_fattr *fattr)
+nfs3_proc_symlink(struct inode *dir, struct dentry *dentry, struct qstr *path,
+                  struct iattr *sattr)
 {
-        struct nfs_fattr        dir_attr;
+        struct nfs_fh fhandle;
+        struct nfs_fattr fattr, dir_attr;
         struct nfs3_symlinkargs arg = {
                 .fromfh         = NFS_FH(dir),
-                .fromname       = name->name,
-                .fromlen        = name->len,
+                .fromname       = dentry->d_name.name,
+                .fromlen        = dentry->d_name.len,
                 .topath         = path->name,
                 .tolen          = path->len,
                 .sattr          = sattr
         };
         struct nfs3_diropres    res = {
                 .dir_attr       = &dir_attr,
-                .fh             = fhandle,
-                .fattr          = fattr
+                .fh             = &fhandle,
+                .fattr          = &fattr
         };
         struct rpc_message msg = {
                 .rpc_proc       = &nfs3_procedures[NFS3PROC_SYMLINK],
@@ -571,11 +571,17 @@ nfs3_proc_symlink(struct inode *dir, struct qstr *name, struct qstr *path,
 
         if (path->len > NFS3_MAXPATHLEN)
                 return -ENAMETOOLONG;
-        dprintk("NFS call  symlink %s -> %s\n", name->name, path->name);
+
+        dprintk("NFS call  symlink %s -> %s\n", dentry->d_name.name,
+                        path->name);
         nfs_fattr_init(&dir_attr);
-        nfs_fattr_init(fattr);
+        nfs_fattr_init(&fattr);
         status = rpc_call_sync(NFS_CLIENT(dir), &msg, 0);
         nfs_post_op_update_inode(dir, &dir_attr);
+        if (status != 0)
+                goto out;
+        status = nfs_instantiate(dentry, &fhandle, &fattr);
+out:
         dprintk("NFS reply symlink: %d\n", status);
         return status;
 }