Merge tag 'nfs-for-3.14-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs

Pull NFS client bugfixes from Trond Myklebust:
 "Highlights:

   - Fix NFSv3 acl regressions
   - Fix NFSv4 memory corruption due to slot table abuse in
     nfs4_proc_open_confirm
   - nfs4_destroy_session must call rpc_destroy_waitqueue"

* tag 'nfs-for-3.14-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
  fs: get_acl() must be allowed to return EOPNOTSUPP
  NFSv3: Fix return value of nfs3_proc_setacls
  NFSv3: Remove unused function nfs3_proc_set_default_acl
  NFSv4.1: nfs4_destroy_session must call rpc_destroy_waitqueue
  NFSv4: Fix memory corruption in nfs4_proc_open_confirm
  nfs: fix setting of ACLs on file creation.

6 files changed, 50 insertions, 39 deletions

diff --git a/fs/nfs/nfs3acl.c b/fs/nfs/nfs3acl.c
index 9a5ca03fa539..871d6eda8dba 100644
--- a/fs/nfs/nfs3acl.c
+++ b/fs/nfs/nfs3acl.c
@@ -80,7 +80,7 @@ struct posix_acl *nfs3_get_acl(struct inode *inode, int type)
         }
 
         if (res.acl_access != NULL) {
-                if (posix_acl_equiv_mode(res.acl_access, NULL) ||
+                if ((posix_acl_equiv_mode(res.acl_access, NULL) == 0) ||
                     res.acl_access->a_count == 0) {
                         posix_acl_release(res.acl_access);
                         res.acl_access = NULL;
@@ -113,7 +113,7 @@ getout:
         return ERR_PTR(status);
 }
 
-int nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl,
+static int __nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl,
                 struct posix_acl *dfacl)
 {
         struct nfs_server *server = NFS_SERVER(inode);
@@ -198,6 +198,15 @@ out:
         return status;
 }
 
+int nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl,
+                struct posix_acl *dfacl)
+{
+        int ret;
+        ret = __nfs3_proc_setacls(inode, acl, dfacl);
+        return (ret == -EOPNOTSUPP) ? 0 : ret;
+
+}
+
 int nfs3_set_acl(struct inode *inode, struct posix_acl *acl, int type)
 {
         struct posix_acl *alloc = NULL, *dfacl = NULL;
@@ -225,7 +234,7 @@ int nfs3_set_acl(struct inode *inode, struct posix_acl *acl, int type)
                 if (IS_ERR(alloc))
                         goto fail;
         }
-        status = nfs3_proc_setacls(inode, acl, dfacl);
+        status = __nfs3_proc_setacls(inode, acl, dfacl);
         posix_acl_release(alloc);
         return status;
 
@@ -233,25 +242,6 @@ fail:
         return PTR_ERR(alloc);
 }
 
-int nfs3_proc_set_default_acl(struct inode *dir, struct inode *inode,
-                umode_t mode)
-{
-        struct posix_acl *default_acl, *acl;
-        int error;
-
-        error = posix_acl_create(dir, &mode, &default_acl, &acl);
-        if (error)
-                return (error == -EOPNOTSUPP) ? 0 : error;
-
-        error = nfs3_proc_setacls(inode, acl, default_acl);
-
-        if (acl)
-                posix_acl_release(acl);
-        if (default_acl)
-                posix_acl_release(default_acl);
-        return error;
-}
-
 const struct xattr_handler *nfs3_xattr_handlers[] = {
         &posix_acl_access_xattr_handler,
         &posix_acl_default_xattr_handler,
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index dbb3e1f30c68..860ad26a5590 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -170,7 +170,7 @@ void nfs41_shutdown_client(struct nfs_client *clp)
 void nfs40_shutdown_client(struct nfs_client *clp)
 {
         if (clp->cl_slot_tbl) {
-                nfs4_release_slot_table(clp->cl_slot_tbl);
+                nfs4_shutdown_slot_table(clp->cl_slot_tbl);
                 kfree(clp->cl_slot_tbl);
         }
 }
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 42da6af77587..2da6a698b8f7 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -1620,15 +1620,15 @@ static void nfs4_open_confirm_prepare(struct rpc_task *task, void *calldata)
 {
         struct nfs4_opendata *data = calldata;
 
-        nfs40_setup_sequence(data->o_arg.server, &data->o_arg.seq_args,
-                                &data->o_res.seq_res, task);
+        nfs40_setup_sequence(data->o_arg.server, &data->c_arg.seq_args,
+                                &data->c_res.seq_res, task);
 }
 
 static void nfs4_open_confirm_done(struct rpc_task *task, void *calldata)
 {
         struct nfs4_opendata *data = calldata;
 
-        nfs40_sequence_done(task, &data->o_res.seq_res);
+        nfs40_sequence_done(task, &data->c_res.seq_res);
 
         data->rpc_status = task->tk_status;
         if (data->rpc_status == 0) {
@@ -1686,7 +1686,7 @@ static int _nfs4_proc_open_confirm(struct nfs4_opendata *data)
         };
         int status;
 
-        nfs4_init_sequence(&data->o_arg.seq_args, &data->o_res.seq_res, 1);
+        nfs4_init_sequence(&data->c_arg.seq_args, &data->c_res.seq_res, 1);
         kref_get(&data->kref);
         data->rpc_done = 0;
         data->rpc_status = 0;
diff --git a/fs/nfs/nfs4session.c b/fs/nfs/nfs4session.c
index cf883c7ae053..e799dc3c3b1d 100644
--- a/fs/nfs/nfs4session.c
+++ b/fs/nfs/nfs4session.c
@@ -231,14 +231,23 @@ out:
         return ret;
 }
 
+/*
+ * nfs4_release_slot_table - release all slot table entries
+ */
+static void nfs4_release_slot_table(struct nfs4_slot_table *tbl)
+{
+        nfs4_shrink_slot_table(tbl, 0);
+}
+
 /**
- * nfs4_release_slot_table - release resources attached to a slot table
+ * nfs4_shutdown_slot_table - release resources attached to a slot table
  * @tbl: slot table to shut down
  *
  */
-void nfs4_release_slot_table(struct nfs4_slot_table *tbl)
+void nfs4_shutdown_slot_table(struct nfs4_slot_table *tbl)
 {
-        nfs4_shrink_slot_table(tbl, 0);
+        nfs4_release_slot_table(tbl);
+        rpc_destroy_wait_queue(&tbl->slot_tbl_waitq);
 }
 
 /**
@@ -422,7 +431,7 @@ void nfs41_update_target_slotid(struct nfs4_slot_table *tbl,
         spin_unlock(&tbl->slot_tbl_lock);
 }
 
-static void nfs4_destroy_session_slot_tables(struct nfs4_session *session)
+static void nfs4_release_session_slot_tables(struct nfs4_session *session)
 {
         nfs4_release_slot_table(&session->fc_slot_table);
         nfs4_release_slot_table(&session->bc_slot_table);
@@ -450,7 +459,7 @@ int nfs4_setup_session_slot_tables(struct nfs4_session *ses)
         if (status && tbl->slots == NULL)
                 /* Fore and back channel share a connection so get
                  * both slot tables or neither */
-                nfs4_destroy_session_slot_tables(ses);
+                nfs4_release_session_slot_tables(ses);
         return status;
 }
 
@@ -470,6 +479,12 @@ struct nfs4_session *nfs4_alloc_session(struct nfs_client *clp)
         return session;
 }
 
+static void nfs4_destroy_session_slot_tables(struct nfs4_session *session)
+{
+        nfs4_shutdown_slot_table(&session->fc_slot_table);
+        nfs4_shutdown_slot_table(&session->bc_slot_table);
+}
+
 void nfs4_destroy_session(struct nfs4_session *session)
 {
         struct rpc_xprt *xprt;
diff --git a/fs/nfs/nfs4session.h b/fs/nfs/nfs4session.h
index 232306100651..b34ada9bc6a2 100644
--- a/fs/nfs/nfs4session.h
+++ b/fs/nfs/nfs4session.h
@@ -74,7 +74,7 @@ enum nfs4_session_state {
 
 extern int nfs4_setup_slot_table(struct nfs4_slot_table *tbl,
                 unsigned int max_reqs, const char *queue);
-extern void nfs4_release_slot_table(struct nfs4_slot_table *tbl);
+extern void nfs4_shutdown_slot_table(struct nfs4_slot_table *tbl);
 extern struct nfs4_slot *nfs4_alloc_slot(struct nfs4_slot_table *tbl);
 extern void nfs4_free_slot(struct nfs4_slot_table *tbl, struct nfs4_slot *slot);
 extern void nfs4_slot_tbl_drain_complete(struct nfs4_slot_table *tbl);
diff --git a/fs/posix_acl.c b/fs/posix_acl.c
index 38bae5a0ea25..11c54fd51e16 100644
--- a/fs/posix_acl.c
+++ b/fs/posix_acl.c
@@ -521,8 +521,11 @@ posix_acl_chmod(struct inode *inode, umode_t mode)
                 return -EOPNOTSUPP;
 
         acl = get_acl(inode, ACL_TYPE_ACCESS);
-        if (IS_ERR_OR_NULL(acl))
+        if (IS_ERR_OR_NULL(acl)) {
+                if (acl == ERR_PTR(-EOPNOTSUPP))
+                        return 0;
                 return PTR_ERR(acl);
+        }
 
         ret = __posix_acl_chmod(&acl, GFP_KERNEL, mode);
         if (ret)
@@ -544,14 +547,15 @@ posix_acl_create(struct inode *dir, umode_t *mode,
                 goto no_acl;
 
         p = get_acl(dir, ACL_TYPE_DEFAULT);
-        if (IS_ERR(p))
+        if (IS_ERR(p)) {
+                if (p == ERR_PTR(-EOPNOTSUPP))
+                        goto apply_umask;
                 return PTR_ERR(p);
-
-        if (!p) {
-                *mode &= ~current_umask();
-                goto no_acl;
         }
 
+        if (!p)
+                goto apply_umask;
+
         *acl = posix_acl_clone(p, GFP_NOFS);
         if (!*acl)
                 return -ENOMEM;
@@ -575,6 +579,8 @@ posix_acl_create(struct inode *dir, umode_t *mode,
         }
         return 0;
 
+apply_umask:
+        *mode &= ~current_umask();
 no_acl:
         *default_acl = NULL;
         *acl = NULL;