NFS: Fix double d_drop in nfs_instantiate() error path

If the LOOKUP or GETATTR in nfs_instantiate fail, nfs_instantiate will do a
d_drop before returning.  But some callers already do a d_drop in the case
of an error return.  Make certain we do only one d_drop in all error paths.

This issue was introduced because over time, the symlink proc API diverged
slightly from the create/mkdir/mknod proc API.  To prevent other coding
mistakes of this type, change the symlink proc API to be more like
create/mkdir/mknod and move the nfs_instantiate call into the symlink proc
routines so it is used in exactly the same way for create, mkdir, mknod,
and symlink.

Test plan:
Connectathon, all versions of NFS.

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

1 files changed, 16 insertions, 15 deletions

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index a825547e8214..2d18eac6bee5 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2084,24 +2084,24 @@ static int nfs4_proc_link(struct inode *inode, struct inode *dir, struct qstr *n
         return err;
 }
 
-static int _nfs4_proc_symlink(struct inode *dir, struct qstr *name,
-                struct qstr *path, struct iattr *sattr, struct nfs_fh *fhandle,
-                struct nfs_fattr *fattr)
+static int _nfs4_proc_symlink(struct inode *dir, struct dentry *dentry,
+                struct qstr *path, struct iattr *sattr)
 {
         struct nfs_server *server = NFS_SERVER(dir);
-        struct nfs_fattr dir_fattr;
+        struct nfs_fh fhandle;
+        struct nfs_fattr fattr, dir_fattr;
         struct nfs4_create_arg arg = {
                 .dir_fh = NFS_FH(dir),
                 .server = server,
-                .name = name,
+                .name = &dentry->d_name,
                 .attrs = sattr,
                 .ftype = NF4LNK,
                 .bitmask = server->attr_bitmask,
         };
         struct nfs4_create_res res = {
                 .server = server,
-                .fh = fhandle,
-                .fattr = fattr,
+                .fh = &fhandle,
+                .fattr = &fattr,
                 .dir_fattr = &dir_fattr,
         };
         struct rpc_message msg = {
@@ -2113,27 +2113,28 @@ static int _nfs4_proc_symlink(struct inode *dir, struct qstr *name,
 
         if (path->len > NFS4_MAXPATHLEN)
                 return -ENAMETOOLONG;
+
         arg.u.symlink = path;
-        nfs_fattr_init(fattr);
+        nfs_fattr_init(&fattr);
         nfs_fattr_init(&dir_fattr);
         
         status = rpc_call_sync(NFS_CLIENT(dir), &msg, 0);
-        if (!status)
+        if (!status) {
                 update_changeattr(dir, &res.dir_cinfo);
-        nfs_post_op_update_inode(dir, res.dir_fattr);
+                nfs_post_op_update_inode(dir, res.dir_fattr);
+                status = nfs_instantiate(dentry, &fhandle, &fattr);
+        }
         return status;
 }
 
-static int nfs4_proc_symlink(struct inode *dir, struct qstr *name,
-                struct qstr *path, struct iattr *sattr, struct nfs_fh *fhandle,
-                struct nfs_fattr *fattr)
+static int nfs4_proc_symlink(struct inode *dir, struct dentry *dentry,
+                struct qstr *path, struct iattr *sattr)
 {
         struct nfs4_exception exception = { };
         int err;
         do {
                 err = nfs4_handle_exception(NFS_SERVER(dir),
-                                _nfs4_proc_symlink(dir, name, path, sattr,
-                                        fhandle, fattr),
+                                _nfs4_proc_symlink(dir, dentry, path, sattr),
                                 &exception);
         } while (exception.retry);
         return err;