NFSv4: Fix an Oops in the NFSv4 getacl code

Commit bf118a342f10dafe44b14451a1392c3254629a1f (NFSv4: include bitmap
in nfsv4 get acl data) introduces the 'acl_scratch' page for the case
where we may need to decode multi-page data. However it fails to take
into account the fact that the variable may be NULL (for the case where
we're not doing multi-page decode), and it also attaches it to the
encoding xdr_stream rather than the decoding one.

The immediate result is an Oops in nfs4_xdr_enc_getacl due to the
call to page_address() with a NULL page pointer.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: Andy Adamson <andros@netapp.com>
Cc: stable@vger.kernel.org

1 files changed, 4 insertions, 4 deletions

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index f0c849c98fe4..d202e04aca94 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3575,8 +3575,8 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
         }
         if (npages > 1) {
                 /* for decoding across pages */
-                args.acl_scratch = alloc_page(GFP_KERNEL);
-                if (!args.acl_scratch)
+                res.acl_scratch = alloc_page(GFP_KERNEL);
+                if (!res.acl_scratch)
                         goto out_free;
         }
         args.acl_len = npages * PAGE_SIZE;
@@ -3612,8 +3612,8 @@ out_free:
         for (i = 0; i < npages; i++)
                 if (pages[i])
                         __free_page(pages[i]);
-        if (args.acl_scratch)
-                __free_page(args.acl_scratch);
+        if (res.acl_scratch)
+                __free_page(res.acl_scratch);
         return ret;
 }