1 files changed, 27 insertions, 10 deletions

diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 37421dd4805d..2b519f6325f9 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -3481,7 +3481,7 @@ static int decode_readdir(struct xdr_stream *xdr, struct rpc_rqst *req, struct n
         size_t          hdrlen;
         u32             recvd, pglen = rcvbuf->page_len;
         __be32          *end, *entry, *p, *kaddr;
-        unsigned int    nr;
+        unsigned int    nr = 0;
         int             status;
 
         status = decode_op_hdr(xdr, OP_READDIR);
@@ -3505,7 +3505,12 @@ static int decode_readdir(struct xdr_stream *xdr, struct rpc_rqst *req, struct n
         kaddr = p = kmap_atomic(page, KM_USER0);
         end = p + ((pglen + readdir->pgbase) >> 2);
         entry = p;
-        for (nr = 0; *p++; nr++) {
+
+        /* Make sure the packet actually has a value_follows and EOF entry */
+        if ((entry + 1) > end)
+                goto short_pkt;
+
+        for (; *p++; nr++) {
                 u32 len, attrlen, xlen;
                 if (end - p < 3)
                         goto short_pkt;
@@ -3532,20 +3537,32 @@ static int decode_readdir(struct xdr_stream *xdr, struct rpc_rqst *req, struct n
                 p += attrlen;           /* attributes */
                 entry = p;
         }
-        if (!nr && (entry[0] != 0 || entry[1] == 0))
-                goto short_pkt;
+        /*
+         * Apparently some server sends responses that are a valid size, but
+         * contain no entries, and have value_follows==0 and EOF==0. For
+         * those, just set the EOF marker.
+         */
+        if (!nr && entry[1] == 0) {
+                dprintk("NFS: readdir reply truncated!\n");
+                entry[1] = 1;
+        }
 out:    
         kunmap_atomic(kaddr, KM_USER0);
         return 0;
 short_pkt:
+        /*
+         * When we get a short packet there are 2 possibilities. We can
+         * return an error, or fix up the response to look like a valid
+         * response and return what we have so far. If there are no
+         * entries and the packet was short, then return -EIO. If there
+         * are valid entries in the response, return them and pretend that
+         * the call was successful, but incomplete. The caller can retry the
+         * readdir starting at the last cookie.
+         */
         dprintk("%s: short packet at entry %d\n", __FUNCTION__, nr);
         entry[0] = entry[1] = 0;
-        /* truncate listing ? */
-        if (!nr) {
-                dprintk("NFS: readdir reply truncated!\n");
-                entry[1] = 1;
-        }
-        goto out;
+        if (nr)
+                goto out;
 err_unmap:
         kunmap_atomic(kaddr, KM_USER0);
         return -errno_NFSERR_IO;