1 files changed, 61 insertions, 33 deletions

diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 853d6d1cc822..834fce759d80 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -244,7 +244,7 @@ cifs_nt_open(char *full_path, struct inode *inode, struct cifs_sb_info *cifs_sb,
                                               xid);
         else
                 rc = cifs_get_inode_info(&inode, full_path, buf, inode->i_sb,
-                                         xid, &fid->netfid);
+                                         xid, fid);
 
 out:
         kfree(buf);
@@ -2043,7 +2043,8 @@ retry:
                         }
                         wdata->pid = wdata->cfile->pid;
                         server = tlink_tcon(wdata->cfile->tlink)->ses->server;
-                        rc = server->ops->async_writev(wdata);
+                        rc = server->ops->async_writev(wdata,
+                                                        cifs_writedata_release);
                 } while (wbc->sync_mode == WB_SYNC_ALL && rc == -EAGAIN);
 
                 for (i = 0; i < nr_pages; ++i)
@@ -2331,9 +2332,20 @@ size_t get_numpages(const size_t wsize, const size_t len, size_t *cur_len)
 }
 
 static void
-cifs_uncached_writev_complete(struct work_struct *work)
+cifs_uncached_writedata_release(struct kref *refcount)
 {
         int i;
+        struct cifs_writedata *wdata = container_of(refcount,
+                                        struct cifs_writedata, refcount);
+
+        for (i = 0; i < wdata->nr_pages; i++)
+                put_page(wdata->pages[i]);
+        cifs_writedata_release(refcount);
+}
+
+static void
+cifs_uncached_writev_complete(struct work_struct *work)
+{
         struct cifs_writedata *wdata = container_of(work,
                                         struct cifs_writedata, work);
         struct inode *inode = wdata->cfile->dentry->d_inode;
@@ -2347,12 +2359,7 @@ cifs_uncached_writev_complete(struct work_struct *work)
 
         complete(&wdata->done);
 
-        if (wdata->result != -EAGAIN) {
-                for (i = 0; i < wdata->nr_pages; i++)
-                        put_page(wdata->pages[i]);
-        }
-
-        kref_put(&wdata->refcount, cifs_writedata_release);
+        kref_put(&wdata->refcount, cifs_uncached_writedata_release);
 }
 
 /* attempt to send write to server, retry on any -EAGAIN errors */
@@ -2370,7 +2377,8 @@ cifs_uncached_retry_writev(struct cifs_writedata *wdata)
                         if (rc != 0)
                                 continue;
                 }
-                rc = server->ops->async_writev(wdata);
+                rc = server->ops->async_writev(wdata,
+                                               cifs_uncached_writedata_release);
         } while (rc == -EAGAIN);
 
         return rc;
@@ -2381,7 +2389,7 @@ cifs_iovec_write(struct file *file, const struct iovec *iov,
                  unsigned long nr_segs, loff_t *poffset)
 {
         unsigned long nr_pages, i;
-        size_t copied, len, cur_len;
+        size_t bytes, copied, len, cur_len;
         ssize_t total_written = 0;
         loff_t offset;
         struct iov_iter it;
@@ -2436,14 +2444,45 @@ cifs_iovec_write(struct file *file, const struct iovec *iov,
 
                 save_len = cur_len;
                 for (i = 0; i < nr_pages; i++) {
-                        copied = min_t(const size_t, cur_len, PAGE_SIZE);
+                        bytes = min_t(const size_t, cur_len, PAGE_SIZE);
                         copied = iov_iter_copy_from_user(wdata->pages[i], &it,
-                                                         0, copied);
+                                                         0, bytes);
                         cur_len -= copied;
                         iov_iter_advance(&it, copied);
+                        /*
+                         * If we didn't copy as much as we expected, then that
+                         * may mean we trod into an unmapped area. Stop copying
+                         * at that point. On the next pass through the big
+                         * loop, we'll likely end up getting a zero-length
+                         * write and bailing out of it.
+                         */
+                        if (copied < bytes)
+                                break;
                 }
                 cur_len = save_len - cur_len;
 
+                /*
+                 * If we have no data to send, then that probably means that
+                 * the copy above failed altogether. That's most likely because
+                 * the address in the iovec was bogus. Set the rc to -EFAULT,
+                 * free anything we allocated and bail out.
+                 */
+                if (!cur_len) {
+                        for (i = 0; i < nr_pages; i++)
+                                put_page(wdata->pages[i]);
+                        kfree(wdata);
+                        rc = -EFAULT;
+                        break;
+                }
+
+                /*
+                 * i + 1 now represents the number of pages we actually used in
+                 * the copy phase above. Bring nr_pages down to that, and free
+                 * any pages that we didn't use.
+                 */
+                for ( ; nr_pages > i + 1; nr_pages--)
+                        put_page(wdata->pages[nr_pages - 1]);
+
                 wdata->sync_mode = WB_SYNC_ALL;
                 wdata->nr_pages = nr_pages;
                 wdata->offset = (__u64)offset;
@@ -2454,7 +2493,8 @@ cifs_iovec_write(struct file *file, const struct iovec *iov,
                 wdata->tailsz = cur_len - ((nr_pages - 1) * PAGE_SIZE);
                 rc = cifs_uncached_retry_writev(wdata);
                 if (rc) {
-                        kref_put(&wdata->refcount, cifs_writedata_release);
+                        kref_put(&wdata->refcount,
+                                 cifs_uncached_writedata_release);
                         break;
                 }
 
@@ -2496,7 +2536,7 @@ restart_loop:
                         }
                 }
                 list_del_init(&wdata->list);
-                kref_put(&wdata->refcount, cifs_writedata_release);
+                kref_put(&wdata->refcount, cifs_uncached_writedata_release);
         }
 
         if (total_written > 0)
@@ -2539,31 +2579,19 @@ cifs_writev(struct kiocb *iocb, const struct iovec *iov,
         struct cifsInodeInfo *cinode = CIFS_I(inode);
         struct TCP_Server_Info *server = tlink_tcon(cfile->tlink)->ses->server;
         ssize_t rc = -EACCES;
+        loff_t lock_pos = pos;
 
-        BUG_ON(iocb->ki_pos != pos);
-
+        if (file->f_flags & O_APPEND)
+                lock_pos = i_size_read(inode);
         /*
          * We need to hold the sem to be sure nobody modifies lock list
          * with a brlock that prevents writing.
          */
         down_read(&cinode->lock_sem);
-        if (!cifs_find_lock_conflict(cfile, pos, iov_length(iov, nr_segs),
+        if (!cifs_find_lock_conflict(cfile, lock_pos, iov_length(iov, nr_segs),
                                      server->vals->exclusive_lock_type, NULL,
-                                     CIFS_WRITE_OP)) {
-                mutex_lock(&inode->i_mutex);
-                rc = __generic_file_aio_write(iocb, iov, nr_segs,
-                                               &iocb->ki_pos);
-                mutex_unlock(&inode->i_mutex);
-        }
-
-        if (rc > 0) {
-                ssize_t err;
-
-                err = generic_write_sync(file, pos, rc);
-                if (err < 0 && rc > 0)
-                        rc = err;
-        }
-
+                                     CIFS_WRITE_OP))
+                rc = generic_file_aio_write(iocb, iov, nr_segs, pos);
         up_read(&cinode->lock_sem);
         return rc;
 }