1 files changed, 83 insertions, 56 deletions

diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
index ff4a198fa677..8f250ac8b928 100644
--- a/fs/dlm/lock.c
+++ b/fs/dlm/lock.c
@@ -436,11 +436,15 @@ static int find_rsb(struct dlm_ls *ls, char *name, int namelen,
 {
         struct dlm_rsb *r, *tmp;
         uint32_t hash, bucket;
-        int error = 0;
+        int error = -EINVAL;
+
+        if (namelen > DLM_RESNAME_MAXLEN)
+                goto out;
 
         if (dlm_no_directory(ls))
                 flags |= R_CREATE;
 
+        error = 0;
         hash = jhash(name, namelen, 0);
         bucket = hash & (ls->ls_rsbtbl_size - 1);
 
@@ -1222,6 +1226,8 @@ static void set_lvb_lock_pc(struct dlm_rsb *r, struct dlm_lkb *lkb,
         b = dlm_lvb_operations[lkb->lkb_grmode + 1][lkb->lkb_rqmode + 1];
         if (b == 1) {
                 int len = receive_extralen(ms);
+                if (len > DLM_RESNAME_MAXLEN)
+                        len = DLM_RESNAME_MAXLEN;
                 memcpy(lkb->lkb_lvbptr, ms->m_extra, len);
                 lkb->lkb_lvbseq = ms->m_lvbseq;
         }
@@ -1775,7 +1781,7 @@ static void grant_pending_locks(struct dlm_rsb *r)
          */
 
         list_for_each_entry_safe(lkb, s, &r->res_grantqueue, lkb_statequeue) {
-                if (lkb->lkb_bastaddr && lock_requires_bast(lkb, high, cw)) {
+                if (lkb->lkb_bastfn && lock_requires_bast(lkb, high, cw)) {
                         if (cw && high == DLM_LOCK_PR)
                                 queue_bast(r, lkb, DLM_LOCK_CW);
                         else
@@ -1805,7 +1811,7 @@ static void send_bast_queue(struct dlm_rsb *r, struct list_head *head,
         struct dlm_lkb *gr;
 
         list_for_each_entry(gr, head, lkb_statequeue) {
-                if (gr->lkb_bastaddr && modes_require_bast(gr, lkb)) {
+                if (gr->lkb_bastfn && modes_require_bast(gr, lkb)) {
                         queue_bast(r, gr, lkb->lkb_rqmode);
                         gr->lkb_highbast = lkb->lkb_rqmode;
                 }
@@ -1960,8 +1966,11 @@ static void confirm_master(struct dlm_rsb *r, int error)
 }
 
 static int set_lock_args(int mode, struct dlm_lksb *lksb, uint32_t flags,
-                         int namelen, unsigned long timeout_cs, void *ast,
-                         void *astarg, void *bast, struct dlm_args *args)
+                         int namelen, unsigned long timeout_cs,
+                         void (*ast) (void *astparam),
+                         void *astparam,
+                         void (*bast) (void *astparam, int mode),
+                         struct dlm_args *args)
 {
         int rv = -EINVAL;
 
@@ -2011,9 +2020,9 @@ static int set_lock_args(int mode, struct dlm_lksb *lksb, uint32_t flags,
            an active lkb cannot be modified before locking the rsb */
 
         args->flags = flags;
-        args->astaddr = ast;
-        args->astparam = (long) astarg;
-        args->bastaddr = bast;
+        args->astfn = ast;
+        args->astparam = astparam;
+        args->bastfn = bast;
         args->timeout = timeout_cs;
         args->mode = mode;
         args->lksb = lksb;
@@ -2032,7 +2041,7 @@ static int set_unlock_args(uint32_t flags, void *astarg, struct dlm_args *args)
                 return -EINVAL;
 
         args->flags = flags;
-        args->astparam = (long) astarg;
+        args->astparam = astarg;
         return 0;
 }
 
@@ -2062,9 +2071,9 @@ static int validate_lock_args(struct dlm_ls *ls, struct dlm_lkb *lkb,
 
         lkb->lkb_exflags = args->flags;
         lkb->lkb_sbflags = 0;
-        lkb->lkb_astaddr = args->astaddr;
+        lkb->lkb_astfn = args->astfn;
         lkb->lkb_astparam = args->astparam;
-        lkb->lkb_bastaddr = args->bastaddr;
+        lkb->lkb_bastfn = args->bastfn;
         lkb->lkb_rqmode = args->mode;
         lkb->lkb_lksb = args->lksb;
         lkb->lkb_lvbptr = args->lksb->sb_lvbptr;
@@ -2711,9 +2720,9 @@ static void send_args(struct dlm_rsb *r, struct dlm_lkb *lkb,
         /* m_result and m_bastmode are set from function args,
            not from lkb fields */
 
-        if (lkb->lkb_bastaddr)
+        if (lkb->lkb_bastfn)
                 ms->m_asts |= AST_BAST;
-        if (lkb->lkb_astaddr)
+        if (lkb->lkb_astfn)
                 ms->m_asts |= AST_COMP;
 
         /* compare with switch in create_message; send_remove() doesn't
@@ -2989,11 +2998,23 @@ static int receive_lvb(struct dlm_ls *ls, struct dlm_lkb *lkb,
                 if (!lkb->lkb_lvbptr)
                         return -ENOMEM;
                 len = receive_extralen(ms);
+                if (len > DLM_RESNAME_MAXLEN)
+                        len = DLM_RESNAME_MAXLEN;
                 memcpy(lkb->lkb_lvbptr, ms->m_extra, len);
         }
         return 0;
 }
 
+static void fake_bastfn(void *astparam, int mode)
+{
+        log_print("fake_bastfn should not be called");
+}
+
+static void fake_astfn(void *astparam)
+{
+        log_print("fake_astfn should not be called");
+}
+
 static int receive_request_args(struct dlm_ls *ls, struct dlm_lkb *lkb,
                                 struct dlm_message *ms)
 {
@@ -3002,8 +3023,9 @@ static int receive_request_args(struct dlm_ls *ls, struct dlm_lkb *lkb,
         lkb->lkb_remid = ms->m_lkid;
         lkb->lkb_grmode = DLM_LOCK_IV;
         lkb->lkb_rqmode = ms->m_rqmode;
-        lkb->lkb_bastaddr = (void *) (long) (ms->m_asts & AST_BAST);
-        lkb->lkb_astaddr = (void *) (long) (ms->m_asts & AST_COMP);
+
+        lkb->lkb_bastfn = (ms->m_asts & AST_BAST) ? &fake_bastfn : NULL;
+        lkb->lkb_astfn = (ms->m_asts & AST_COMP) ? &fake_astfn : NULL;
 
         if (lkb->lkb_exflags & DLM_LKF_VALBLK) {
                 /* lkb was just created so there won't be an lvb yet */
@@ -3802,7 +3824,7 @@ static void dlm_receive_message(struct dlm_ls *ls, struct dlm_message *ms,
                                 int nodeid)
 {
         if (dlm_locking_stopped(ls)) {
-                dlm_add_requestqueue(ls, nodeid, (struct dlm_header *) ms);
+                dlm_add_requestqueue(ls, nodeid, ms);
         } else {
                 dlm_wait_requestqueue(ls);
                 _receive_message(ls, ms);
@@ -3822,21 +3844,20 @@ void dlm_receive_message_saved(struct dlm_ls *ls, struct dlm_message *ms)
    standard locking activity) or an RCOM (recovery message sent as part of
    lockspace recovery). */
 
-void dlm_receive_buffer(struct dlm_header *hd, int nodeid)
+void dlm_receive_buffer(union dlm_packet *p, int nodeid)
 {
-        struct dlm_message *ms = (struct dlm_message *) hd;
-        struct dlm_rcom *rc = (struct dlm_rcom *) hd;
+        struct dlm_header *hd = &p->header;
         struct dlm_ls *ls;
         int type = 0;
 
         switch (hd->h_cmd) {
         case DLM_MSG:
-                dlm_message_in(ms);
-                type = ms->m_type;
+                dlm_message_in(&p->message);
+                type = p->message.m_type;
                 break;
         case DLM_RCOM:
-                dlm_rcom_in(rc);
-                type = rc->rc_type;
+                dlm_rcom_in(&p->rcom);
+                type = p->rcom.rc_type;
                 break;
         default:
                 log_print("invalid h_cmd %d from %u", hd->h_cmd, nodeid);
@@ -3856,7 +3877,7 @@ void dlm_receive_buffer(struct dlm_header *hd, int nodeid)
                                   hd->h_lockspace, nodeid, hd->h_cmd, type);
 
                 if (hd->h_cmd == DLM_RCOM && type == DLM_RCOM_STATUS)
-                        dlm_send_ls_not_ready(nodeid, rc);
+                        dlm_send_ls_not_ready(nodeid, &p->rcom);
                 return;
         }
 
@@ -3865,9 +3886,9 @@ void dlm_receive_buffer(struct dlm_header *hd, int nodeid)
 
         down_read(&ls->ls_recv_active);
         if (hd->h_cmd == DLM_MSG)
-                dlm_receive_message(ls, ms, nodeid);
+                dlm_receive_message(ls, &p->message, nodeid);
         else
-                dlm_receive_rcom(ls, rc, nodeid);
+                dlm_receive_rcom(ls, &p->rcom, nodeid);
         up_read(&ls->ls_recv_active);
 
         dlm_put_lockspace(ls);
@@ -4267,32 +4288,34 @@ static struct dlm_lkb *search_remid(struct dlm_rsb *r, int nodeid,
         return NULL;
 }
 
+/* needs at least dlm_rcom + rcom_lock */
 static int receive_rcom_lock_args(struct dlm_ls *ls, struct dlm_lkb *lkb,
                                   struct dlm_rsb *r, struct dlm_rcom *rc)
 {
         struct rcom_lock *rl = (struct rcom_lock *) rc->rc_buf;
-        int lvblen;
 
         lkb->lkb_nodeid = rc->rc_header.h_nodeid;
-        lkb->lkb_ownpid = rl->rl_ownpid;
-        lkb->lkb_remid = rl->rl_lkid;
-        lkb->lkb_exflags = rl->rl_exflags;
-        lkb->lkb_flags = rl->rl_flags & 0x0000FFFF;
+        lkb->lkb_ownpid = le32_to_cpu(rl->rl_ownpid);
+        lkb->lkb_remid = le32_to_cpu(rl->rl_lkid);
+        lkb->lkb_exflags = le32_to_cpu(rl->rl_exflags);
+        lkb->lkb_flags = le32_to_cpu(rl->rl_flags) & 0x0000FFFF;
         lkb->lkb_flags |= DLM_IFL_MSTCPY;
-        lkb->lkb_lvbseq = rl->rl_lvbseq;
+        lkb->lkb_lvbseq = le32_to_cpu(rl->rl_lvbseq);
         lkb->lkb_rqmode = rl->rl_rqmode;
         lkb->lkb_grmode = rl->rl_grmode;
         /* don't set lkb_status because add_lkb wants to itself */
 
-        lkb->lkb_bastaddr = (void *) (long) (rl->rl_asts & AST_BAST);
-        lkb->lkb_astaddr = (void *) (long) (rl->rl_asts & AST_COMP);
+        lkb->lkb_bastfn = (rl->rl_asts & AST_BAST) ? &fake_bastfn : NULL;
+        lkb->lkb_astfn = (rl->rl_asts & AST_COMP) ? &fake_astfn : NULL;
 
         if (lkb->lkb_exflags & DLM_LKF_VALBLK) {
+                int lvblen = rc->rc_header.h_length - sizeof(struct dlm_rcom) -
+                         sizeof(struct rcom_lock);
+                if (lvblen > ls->ls_lvblen)
+                        return -EINVAL;
                 lkb->lkb_lvbptr = dlm_allocate_lvb(ls);
                 if (!lkb->lkb_lvbptr)
                         return -ENOMEM;
-                lvblen = rc->rc_header.h_length - sizeof(struct dlm_rcom) -
-                         sizeof(struct rcom_lock);
                 memcpy(lkb->lkb_lvbptr, rl->rl_lvb, lvblen);
         }
 
@@ -4300,7 +4323,8 @@ static int receive_rcom_lock_args(struct dlm_ls *ls, struct dlm_lkb *lkb,
            The real granted mode of these converting locks cannot be determined
            until all locks have been rebuilt on the rsb (recover_conversion) */
 
-        if (rl->rl_wait_type == DLM_MSG_CONVERT && middle_conversion(lkb)) {
+        if (rl->rl_wait_type == cpu_to_le16(DLM_MSG_CONVERT) &&
+            middle_conversion(lkb)) {
                 rl->rl_status = DLM_LKSTS_CONVERT;
                 lkb->lkb_grmode = DLM_LOCK_IV;
                 rsb_set_flag(r, RSB_RECOVER_CONVERT);
@@ -4315,6 +4339,7 @@ static int receive_rcom_lock_args(struct dlm_ls *ls, struct dlm_lkb *lkb,
    the given values and send back our lkid.  We send back our lkid by sending
    back the rcom_lock struct we got but with the remid field filled in. */
 
+/* needs at least dlm_rcom + rcom_lock */
 int dlm_recover_master_copy(struct dlm_ls *ls, struct dlm_rcom *rc)
 {
         struct rcom_lock *rl = (struct rcom_lock *) rc->rc_buf;
@@ -4327,13 +4352,14 @@ int dlm_recover_master_copy(struct dlm_ls *ls, struct dlm_rcom *rc)
                 goto out;
         }
 
-        error = find_rsb(ls, rl->rl_name, rl->rl_namelen, R_MASTER, &r);
+        error = find_rsb(ls, rl->rl_name, le16_to_cpu(rl->rl_namelen),
+                         R_MASTER, &r);
         if (error)
                 goto out;
 
         lock_rsb(r);
 
-        lkb = search_remid(r, rc->rc_header.h_nodeid, rl->rl_lkid);
+        lkb = search_remid(r, rc->rc_header.h_nodeid, le32_to_cpu(rl->rl_lkid));
         if (lkb) {
                 error = -EEXIST;
                 goto out_remid;
@@ -4356,18 +4382,20 @@ int dlm_recover_master_copy(struct dlm_ls *ls, struct dlm_rcom *rc)
  out_remid:
         /* this is the new value returned to the lock holder for
            saving in its process-copy lkb */
-        rl->rl_remid = lkb->lkb_id;
+        rl->rl_remid = cpu_to_le32(lkb->lkb_id);
 
  out_unlock:
         unlock_rsb(r);
         put_rsb(r);
  out:
         if (error)
-                log_debug(ls, "recover_master_copy %d %x", error, rl->rl_lkid);
-        rl->rl_result = error;
+                log_debug(ls, "recover_master_copy %d %x", error,
+                          le32_to_cpu(rl->rl_lkid));
+        rl->rl_result = cpu_to_le32(error);
         return error;
 }
 
+/* needs at least dlm_rcom + rcom_lock */
 int dlm_recover_process_copy(struct dlm_ls *ls, struct dlm_rcom *rc)
 {
         struct rcom_lock *rl = (struct rcom_lock *) rc->rc_buf;
@@ -4375,15 +4403,16 @@ int dlm_recover_process_copy(struct dlm_ls *ls, struct dlm_rcom *rc)
         struct dlm_lkb *lkb;
         int error;
 
-        error = find_lkb(ls, rl->rl_lkid, &lkb);
+        error = find_lkb(ls, le32_to_cpu(rl->rl_lkid), &lkb);
         if (error) {
-                log_error(ls, "recover_process_copy no lkid %x", rl->rl_lkid);
+                log_error(ls, "recover_process_copy no lkid %x",
+                                le32_to_cpu(rl->rl_lkid));
                 return error;
         }
 
         DLM_ASSERT(is_process_copy(lkb), dlm_print_lkb(lkb););
 
-        error = rl->rl_result;
+        error = le32_to_cpu(rl->rl_result);
 
         r = lkb->lkb_resource;
         hold_rsb(r);
@@ -4402,7 +4431,7 @@ int dlm_recover_process_copy(struct dlm_ls *ls, struct dlm_rcom *rc)
                 log_debug(ls, "master copy exists %x", lkb->lkb_id);
                 /* fall through */
         case 0:
-                lkb->lkb_remid = rl->rl_remid;
+                lkb->lkb_remid = le32_to_cpu(rl->rl_remid);
                 break;
         default:
                 log_error(ls, "dlm_recover_process_copy unknown error %d %x",
@@ -4451,7 +4480,7 @@ int dlm_user_request(struct dlm_ls *ls, struct dlm_user_args *ua,
            lock and that lkb_astparam is the dlm_user_args structure. */
 
         error = set_lock_args(mode, &ua->lksb, flags, namelen, timeout_cs,
-                              DLM_FAKE_USER_AST, ua, DLM_FAKE_USER_AST, &args);
+                              fake_astfn, ua, fake_bastfn, &args);
         lkb->lkb_flags |= DLM_IFL_USER;
         ua->old_mode = DLM_LOCK_IV;
 
@@ -4504,7 +4533,7 @@ int dlm_user_convert(struct dlm_ls *ls, struct dlm_user_args *ua_tmp,
         /* user can change the params on its lock when it converts it, or
            add an lvb that didn't exist before */
 
-        ua = (struct dlm_user_args *)lkb->lkb_astparam;
+        ua = lkb->lkb_ua;
 
         if (flags & DLM_LKF_VALBLK && !ua->lksb.sb_lvbptr) {
                 ua->lksb.sb_lvbptr = kzalloc(DLM_USER_LVB_LEN, GFP_KERNEL);
@@ -4525,7 +4554,7 @@ int dlm_user_convert(struct dlm_ls *ls, struct dlm_user_args *ua_tmp,
         ua->old_mode = lkb->lkb_grmode;
 
         error = set_lock_args(mode, &ua->lksb, flags, 0, timeout_cs,
-                              DLM_FAKE_USER_AST, ua, DLM_FAKE_USER_AST, &args);
+                              fake_astfn, ua, fake_bastfn, &args);
         if (error)
                 goto out_put;
 
@@ -4555,7 +4584,7 @@ int dlm_user_unlock(struct dlm_ls *ls, struct dlm_user_args *ua_tmp,
         if (error)
                 goto out;
 
-        ua = (struct dlm_user_args *)lkb->lkb_astparam;
+        ua = lkb->lkb_ua;
 
         if (lvb_in && ua->lksb.sb_lvbptr)
                 memcpy(ua->lksb.sb_lvbptr, lvb_in, DLM_USER_LVB_LEN);
@@ -4604,7 +4633,7 @@ int dlm_user_cancel(struct dlm_ls *ls, struct dlm_user_args *ua_tmp,
         if (error)
                 goto out;
 
-        ua = (struct dlm_user_args *)lkb->lkb_astparam;
+        ua = lkb->lkb_ua;
         if (ua_tmp->castparam)
                 ua->castparam = ua_tmp->castparam;
         ua->user_lksb = ua_tmp->user_lksb;
@@ -4642,7 +4671,7 @@ int dlm_user_deadlock(struct dlm_ls *ls, uint32_t flags, uint32_t lkid)
         if (error)
                 goto out;
 
-        ua = (struct dlm_user_args *)lkb->lkb_astparam;
+        ua = lkb->lkb_ua;
 
         error = set_unlock_args(flags, ua, &args);
         if (error)
@@ -4681,7 +4710,6 @@ int dlm_user_deadlock(struct dlm_ls *ls, uint32_t flags, uint32_t lkid)
 
 static int orphan_proc_lock(struct dlm_ls *ls, struct dlm_lkb *lkb)
 {
-        struct dlm_user_args *ua = (struct dlm_user_args *)lkb->lkb_astparam;
         struct dlm_args args;
         int error;
 
@@ -4690,7 +4718,7 @@ static int orphan_proc_lock(struct dlm_ls *ls, struct dlm_lkb *lkb)
         list_add_tail(&lkb->lkb_ownqueue, &ls->ls_orphans);
         mutex_unlock(&ls->ls_orphans_mutex);
 
-        set_unlock_args(0, ua, &args);
+        set_unlock_args(0, lkb->lkb_ua, &args);
 
         error = cancel_lock(ls, lkb, &args);
         if (error == -DLM_ECANCEL)
@@ -4703,11 +4731,10 @@ static int orphan_proc_lock(struct dlm_ls *ls, struct dlm_lkb *lkb)
 
 static int unlock_proc_lock(struct dlm_ls *ls, struct dlm_lkb *lkb)
 {
-        struct dlm_user_args *ua = (struct dlm_user_args *)lkb->lkb_astparam;
         struct dlm_args args;
         int error;
 
-        set_unlock_args(DLM_LKF_FORCEUNLOCK, ua, &args);
+        set_unlock_args(DLM_LKF_FORCEUNLOCK, lkb->lkb_ua, &args);
 
         error = unlock_lock(ls, lkb, &args);
         if (error == -DLM_EUNLOCK)