Merge branch 'fixes' of git://git.linux-nfs.org/pub/linux/nfs-2.6

3 files changed, 41 insertions, 47 deletions

diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 4a9aa9393b97..ef1cf5b476c8 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -718,8 +718,7 @@ gss_destroy(struct rpc_auth *auth)
                 auth, auth->au_flavor);
 
         gss_auth = container_of(auth, struct gss_auth, rpc_auth);
-        rpc_unlink(gss_auth->path);
-        dput(gss_auth->dentry);
+        rpc_unlink(gss_auth->dentry);
         gss_auth->dentry = NULL;
         gss_mech_put(gss_auth->mech);
 
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index d6409e757219..3e19d321067a 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -183,8 +183,7 @@ rpc_new_client(struct rpc_xprt *xprt, char *servname,
 
 out_no_auth:
         if (!IS_ERR(clnt->cl_dentry)) {
-                rpc_rmdir(clnt->cl_pathname);
-                dput(clnt->cl_dentry);
+                rpc_rmdir(clnt->cl_dentry);
                 rpc_put_mount();
         }
 out_no_path:
@@ -251,10 +250,8 @@ rpc_clone_client(struct rpc_clnt *clnt)
         new->cl_autobind = 0;
         new->cl_oneshot = 0;
         new->cl_dead = 0;
-        if (!IS_ERR(new->cl_dentry)) {
+        if (!IS_ERR(new->cl_dentry))
                 dget(new->cl_dentry);
-                rpc_get_mount();
-        }
         rpc_init_rtt(&new->cl_rtt_default, clnt->cl_xprt->timeout.to_initval);
         if (new->cl_auth)
                 atomic_inc(&new->cl_auth->au_count);
@@ -317,11 +314,15 @@ rpc_destroy_client(struct rpc_clnt *clnt)
                 clnt->cl_auth = NULL;
         }
         if (clnt->cl_parent != clnt) {
+                if (!IS_ERR(clnt->cl_dentry))
+                        dput(clnt->cl_dentry);
                 rpc_destroy_client(clnt->cl_parent);
                 goto out_free;
         }
-        if (clnt->cl_pathname[0])
-                rpc_rmdir(clnt->cl_pathname);
+        if (!IS_ERR(clnt->cl_dentry)) {
+                rpc_rmdir(clnt->cl_dentry);
+                rpc_put_mount();
+        }
         if (clnt->cl_xprt) {
                 xprt_destroy(clnt->cl_xprt);
                 clnt->cl_xprt = NULL;
@@ -331,10 +332,6 @@ rpc_destroy_client(struct rpc_clnt *clnt)
 out_free:
         rpc_free_iostats(clnt->cl_metrics);
         clnt->cl_metrics = NULL;
-        if (!IS_ERR(clnt->cl_dentry)) {
-                dput(clnt->cl_dentry);
-                rpc_put_mount();
-        }
         kfree(clnt);
         return 0;
 }
@@ -1184,6 +1181,17 @@ call_verify(struct rpc_task *task)
         u32     *p = iov->iov_base, n;
         int error = -EACCES;
 
+        if ((task->tk_rqstp->rq_rcv_buf.len & 3) != 0) {
+                /* RFC-1014 says that the representation of XDR data must be a
+                 * multiple of four bytes
+                 * - if it isn't pointer subtraction in the NFS client may give
+                 *   undefined results
+                 */
+                printk(KERN_WARNING
+                       "call_verify: XDR representation not a multiple of"
+                       " 4 bytes: 0x%x\n", task->tk_rqstp->rq_rcv_buf.len);
+                goto out_eio;
+        }
         if ((len -= 3) < 0)
                 goto out_overflow;
         p += 1; /* skip XID */
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index a3bd2db2e024..0b1a1ac8a4bc 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -539,6 +539,7 @@ repeat:
                                 rpc_close_pipes(dentry->d_inode);
                                 simple_unlink(dir, dentry);
                         }
+                        inode_dir_notify(dir, DN_DELETE);
                         dput(dentry);
                 } while (n);
                 goto repeat;
@@ -610,8 +611,8 @@ __rpc_rmdir(struct inode *dir, struct dentry *dentry)
         int error;
 
         shrink_dcache_parent(dentry);
-        if (dentry->d_inode)
-                rpc_close_pipes(dentry->d_inode);
+        if (d_unhashed(dentry))
+                return 0;
         if ((error = simple_rmdir(dir, dentry)) != 0)
                 return error;
         if (!error) {
@@ -684,28 +685,20 @@ err_dput:
 }
 
 int
-rpc_rmdir(char *path)
+rpc_rmdir(struct dentry *dentry)
 {
-        struct nameidata nd;
-        struct dentry *dentry;
+        struct dentry *parent;
         struct inode *dir;
         int error;
 
-        if ((error = rpc_lookup_parent(path, &nd)) != 0)
-                return error;
-        dir = nd.dentry->d_inode;
+        parent = dget_parent(dentry);
+        dir = parent->d_inode;
         mutex_lock_nested(&dir->i_mutex, I_MUTEX_PARENT);
-        dentry = lookup_one_len(nd.last.name, nd.dentry, nd.last.len);
-        if (IS_ERR(dentry)) {
-                error = PTR_ERR(dentry);
-                goto out_release;
-        }
         rpc_depopulate(dentry);
         error = __rpc_rmdir(dir, dentry);
         dput(dentry);
-out_release:
         mutex_unlock(&dir->i_mutex);
-        rpc_release_path(&nd);
+        dput(parent);
         return error;
 }
 
@@ -746,32 +739,26 @@ err_dput:
 }
 
 int
-rpc_unlink(char *path)
+rpc_unlink(struct dentry *dentry)
 {
-        struct nameidata nd;
-        struct dentry *dentry;
+        struct dentry *parent;
         struct inode *dir;
-        int error;
+        int error = 0;
 
-        if ((error = rpc_lookup_parent(path, &nd)) != 0)
-                return error;
-        dir = nd.dentry->d_inode;
+        parent = dget_parent(dentry);
+        dir = parent->d_inode;
         mutex_lock_nested(&dir->i_mutex, I_MUTEX_PARENT);
-        dentry = lookup_one_len(nd.last.name, nd.dentry, nd.last.len);
-        if (IS_ERR(dentry)) {
-                error = PTR_ERR(dentry);
-                goto out_release;
-        }
-        d_drop(dentry);
-        if (dentry->d_inode) {
-                rpc_close_pipes(dentry->d_inode);
-                error = simple_unlink(dir, dentry);
+        if (!d_unhashed(dentry)) {
+                d_drop(dentry);
+                if (dentry->d_inode) {
+                        rpc_close_pipes(dentry->d_inode);
+                        error = simple_unlink(dir, dentry);
+                }
+                inode_dir_notify(dir, DN_DELETE);
         }
         dput(dentry);
-        inode_dir_notify(dir, DN_DELETE);
-out_release:
         mutex_unlock(&dir->i_mutex);
-        rpc_release_path(&nd);
+        dput(parent);
         return error;
 }