5 files changed, 61 insertions, 24 deletions

diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index cc2b874ad5a4..48e892880d5b 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -312,7 +312,13 @@ static void nfs_invalidate_page(struct page *page, unsigned long offset)
 
 static int nfs_release_page(struct page *page, gfp_t gfp)
 {
-        return !nfs_wb_page(page->mapping->host, page);
+        if (gfp & __GFP_FS)
+                return !nfs_wb_page(page->mapping->host, page);
+        else
+                /*
+                 * Avoid deadlock on nfs_wait_on_request().
+                 */
+                return 0;
 }
 
 const struct address_space_operations nfs_file_aops = {
diff --git a/fs/nfs/idmap.c b/fs/nfs/idmap.c
index b81e7ed3c902..07a5dd57646e 100644
--- a/fs/nfs/idmap.c
+++ b/fs/nfs/idmap.c
@@ -130,9 +130,7 @@ nfs_idmap_delete(struct nfs4_client *clp)
 
         if (!idmap)
                 return;
-        dput(idmap->idmap_dentry);
-        idmap->idmap_dentry = NULL;
-        rpc_unlink(idmap->idmap_path);
+        rpc_unlink(idmap->idmap_dentry);
         clp->cl_idmap = NULL;
         kfree(idmap);
 }
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index e6ee97f19d81..153898e1331f 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2668,7 +2668,7 @@ out:
         nfs4_set_cached_acl(inode, acl);
 }
 
-static inline ssize_t nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t buflen)
+static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t buflen)
 {
         struct page *pages[NFS4ACL_MAXPAGES];
         struct nfs_getaclargs args = {
@@ -2721,6 +2721,19 @@ out_free:
         return ret;
 }
 
+static ssize_t nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t buflen)
+{
+        struct nfs4_exception exception = { };
+        ssize_t ret;
+        do {
+                ret = __nfs4_get_acl_uncached(inode, buf, buflen);
+                if (ret >= 0)
+                        break;
+                ret = nfs4_handle_exception(NFS_SERVER(inode), ret, &exception);
+        } while (exception.retry);
+        return ret;
+}
+
 static ssize_t nfs4_proc_get_acl(struct inode *inode, void *buf, size_t buflen)
 {
         struct nfs_server *server = NFS_SERVER(inode);
@@ -2737,7 +2750,7 @@ static ssize_t nfs4_proc_get_acl(struct inode *inode, void *buf, size_t buflen)
         return nfs4_get_acl_uncached(inode, buf, buflen);
 }
 
-static int nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t buflen)
+static int __nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t buflen)
 {
         struct nfs_server *server = NFS_SERVER(inode);
         struct page *pages[NFS4ACL_MAXPAGES];
@@ -2763,6 +2776,18 @@ static int nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t buflen
         return ret;
 }
 
+static int nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t buflen)
+{
+        struct nfs4_exception exception = { };
+        int err;
+        do {
+                err = nfs4_handle_exception(NFS_SERVER(inode),
+                                __nfs4_proc_set_acl(inode, buf, buflen),
+                                &exception);
+        } while (exception.retry);
+        return err;
+}
+
 static int
 nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server)
 {
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 1750d996f49f..730ec8fb31c6 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -3355,7 +3355,7 @@ static int decode_readdir(struct xdr_stream *xdr, struct rpc_rqst *req, struct n
         struct kvec     *iov = rcvbuf->head;
         unsigned int    nr, pglen = rcvbuf->page_len;
         uint32_t        *end, *entry, *p, *kaddr;
-        uint32_t        len, attrlen;
+        uint32_t        len, attrlen, xlen;
         int             hdrlen, recvd, status;
 
         status = decode_op_hdr(xdr, OP_READDIR);
@@ -3377,10 +3377,10 @@ static int decode_readdir(struct xdr_stream *xdr, struct rpc_rqst *req, struct n
 
         BUG_ON(pglen + readdir->pgbase > PAGE_CACHE_SIZE);
         kaddr = p = (uint32_t *) kmap_atomic(page, KM_USER0);
-        end = (uint32_t *) ((char *)p + pglen + readdir->pgbase);
+        end = p + ((pglen + readdir->pgbase) >> 2);
         entry = p;
         for (nr = 0; *p++; nr++) {
-                if (p + 3 > end)
+                if (end - p < 3)
                         goto short_pkt;
                 dprintk("cookie = %Lu, ", *((unsigned long long *)p));
                 p += 2;                 /* cookie */
@@ -3389,18 +3389,19 @@ static int decode_readdir(struct xdr_stream *xdr, struct rpc_rqst *req, struct n
                         printk(KERN_WARNING "NFS: giant filename in readdir (len 0x%x)\n", len);
                         goto err_unmap;
                 }
-                dprintk("filename = %*s\n", len, (char *)p);
-                p += XDR_QUADLEN(len);
-                if (p + 1 > end)
+                xlen = XDR_QUADLEN(len);
+                if (end - p < xlen + 1)
                         goto short_pkt;
+                dprintk("filename = %*s\n", len, (char *)p);
+                p += xlen;
                 len = ntohl(*p++);      /* bitmap length */
-                p += len;
-                if (p + 1 > end)
+                if (end - p < len + 1)
                         goto short_pkt;
+                p += len;
                 attrlen = XDR_QUADLEN(ntohl(*p++));
-                p += attrlen;           /* attributes */
-                if (p + 2 > end)
+                if (end - p < attrlen + 2)
                         goto short_pkt;
+                p += attrlen;           /* attributes */
                 entry = p;
         }
         if (!nr && (entry[0] != 0 || entry[1] == 0))
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index 65c0c5b32351..da9cf11c326f 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -116,10 +116,17 @@ static void nfs_readpage_truncate_uninitialised_page(struct nfs_read_data *data)
         pages = &data->args.pages[base >> PAGE_CACHE_SHIFT];
         base &= ~PAGE_CACHE_MASK;
         pglen = PAGE_CACHE_SIZE - base;
-        if (pglen < remainder)
+        for (;;) {
+                if (remainder <= pglen) {
+                        memclear_highpage_flush(*pages, base, remainder);
+                        break;
+                }
                 memclear_highpage_flush(*pages, base, pglen);
-        else
-                memclear_highpage_flush(*pages, base, remainder);
+                pages++;
+                remainder -= pglen;
+                pglen = PAGE_CACHE_SIZE;
+                base = 0;
+        }
 }
 
 /*
@@ -476,6 +483,8 @@ static void nfs_readpage_set_pages_uptodate(struct nfs_read_data *data)
         unsigned int base = data->args.pgbase;
         struct page **pages;
 
+        if (data->res.eof)
+                count = data->args.count;
         if (unlikely(count == 0))
                 return;
         pages = &data->args.pages[base >> PAGE_CACHE_SHIFT];
@@ -483,11 +492,7 @@ static void nfs_readpage_set_pages_uptodate(struct nfs_read_data *data)
         count += base;
         for (;count >= PAGE_CACHE_SIZE; count -= PAGE_CACHE_SIZE, pages++)
                 SetPageUptodate(*pages);
-        /*
-         * Was this an eof or a short read? If the latter, don't mark the page
-         * as uptodate yet.
-         */
-        if (count > 0 && (data->res.eof || data->args.count == data->res.count))
+        if (count != 0)
                 SetPageUptodate(*pages);
 }
 
@@ -502,6 +507,8 @@ static void nfs_readpage_set_pages_error(struct nfs_read_data *data)
         count += base;
         for (;count >= PAGE_CACHE_SIZE; count -= PAGE_CACHE_SIZE, pages++)
                 SetPageError(*pages);
+        if (count != 0)
+                SetPageError(*pages);
 }
 
 /*