10 files changed, 133 insertions, 79 deletions

diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index aeec017fe814..93a8b3bd69e3 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -9,7 +9,6 @@
 #include <linux/completion.h>
 #include <linux/ip.h>
 #include <linux/module.h>
-#include <linux/smp_lock.h>
 #include <linux/sunrpc/svc.h>
 #include <linux/sunrpc/svcsock.h>
 #include <linux/nfs_fs.h>
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index 232a7eead33a..1fd62fc49be3 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -11,7 +11,6 @@
 #include <linux/module.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
-#include <linux/smp_lock.h>
 #include <linux/spinlock.h>
 
 #include <linux/nfs4.h>
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 07ac3847e562..f0a384e2ae63 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -34,6 +34,7 @@
 #include <linux/mount.h>
 #include <linux/sched.h>
 #include <linux/vmalloc.h>
+#include <linux/kmemleak.h>
 
 #include "delegation.h"
 #include "iostat.h"
@@ -161,6 +162,7 @@ struct nfs_cache_array_entry {
         u64 cookie;
         u64 ino;
         struct qstr string;
+        unsigned char d_type;
 };
 
 struct nfs_cache_array {
@@ -170,8 +172,6 @@ struct nfs_cache_array {
         struct nfs_cache_array_entry array[0];
 };
 
-#define MAX_READDIR_ARRAY ((PAGE_SIZE - sizeof(struct nfs_cache_array)) / sizeof(struct nfs_cache_array_entry))
-
 typedef __be32 * (*decode_dirent_t)(struct xdr_stream *, struct nfs_entry *, struct nfs_server *, int);
 typedef struct {
         struct file     *file;
@@ -194,9 +194,13 @@ typedef struct {
 static
 struct nfs_cache_array *nfs_readdir_get_array(struct page *page)
 {
+        void *ptr;
         if (page == NULL)
                 return ERR_PTR(-EIO);
-        return (struct nfs_cache_array *)kmap(page);
+        ptr = kmap(page);
+        if (ptr == NULL)
+                return ERR_PTR(-ENOMEM);
+        return ptr;
 }
 
 static
@@ -213,6 +217,9 @@ int nfs_readdir_clear_array(struct page *page, gfp_t mask)
 {
         struct nfs_cache_array *array = nfs_readdir_get_array(page);
         int i;
+
+        if (IS_ERR(array))
+                return PTR_ERR(array);
         for (i = 0; i < array->size; i++)
                 kfree(array->array[i].string.name);
         nfs_readdir_release_array(page);
@@ -231,6 +238,11 @@ int nfs_readdir_make_qstr(struct qstr *string, const char *name, unsigned int le
         string->name = kmemdup(name, len, GFP_KERNEL);
         if (string->name == NULL)
                 return -ENOMEM;
+        /*
+         * Avoid a kmemleak false positive. The pointer to the name is stored
+         * in a page cache page which kmemleak does not scan.
+         */
+        kmemleak_not_leak(string->name);
         string->hash = full_name_hash(name, len);
         return 0;
 }
@@ -244,20 +256,24 @@ int nfs_readdir_add_to_array(struct nfs_entry *entry, struct page *page)
 
         if (IS_ERR(array))
                 return PTR_ERR(array);
-        ret = -EIO;
-        if (array->size >= MAX_READDIR_ARRAY)
-                goto out;
 
         cache_entry = &array->array[array->size];
+
+        /* Check that this entry lies within the page bounds */
+        ret = -ENOSPC;
+        if ((char *)&cache_entry[1] - (char *)page_address(page) > PAGE_SIZE)
+                goto out;
+
         cache_entry->cookie = entry->prev_cookie;
         cache_entry->ino = entry->ino;
+        cache_entry->d_type = entry->d_type;
         ret = nfs_readdir_make_qstr(&cache_entry->string, entry->name, entry->len);
         if (ret)
                 goto out;
         array->last_cookie = entry->cookie;
+        array->size++;
         if (entry->eof == 1)
                 array->eof_index = array->size;
-        array->size++;
 out:
         nfs_readdir_release_array(page);
         return ret;
@@ -272,7 +288,7 @@ int nfs_readdir_search_for_pos(struct nfs_cache_array *array, nfs_readdir_descri
         if (diff < 0)
                 goto out_eof;
         if (diff >= array->size) {
-                if (array->eof_index > 0)
+                if (array->eof_index >= 0)
                         goto out_eof;
                 desc->current_index += array->size;
                 return -EAGAIN;
@@ -281,8 +297,6 @@ int nfs_readdir_search_for_pos(struct nfs_cache_array *array, nfs_readdir_descri
         index = (unsigned int)diff;
         *desc->dir_cookie = array->array[index].cookie;
         desc->cache_entry_index = index;
-        if (index == array->eof_index)
-                desc->eof = 1;
         return 0;
 out_eof:
         desc->eof = 1;
@@ -296,17 +310,17 @@ int nfs_readdir_search_for_cookie(struct nfs_cache_array *array, nfs_readdir_des
         int status = -EAGAIN;
 
         for (i = 0; i < array->size; i++) {
-                if (i == array->eof_index) {
-                        desc->eof = 1;
-                        status = -EBADCOOKIE;
-                }
                 if (array->array[i].cookie == *desc->dir_cookie) {
                         desc->cache_entry_index = i;
                         status = 0;
-                        break;
+                        goto out;
                 }
         }
-
+        if (i == array->eof_index) {
+                desc->eof = 1;
+                status = -EBADCOOKIE;
+        }
+out:
         return status;
 }
 
@@ -381,13 +395,9 @@ int xdr_decode(nfs_readdir_descriptor_t *desc, struct nfs_entry *entry, struct x
 static
 int nfs_same_file(struct dentry *dentry, struct nfs_entry *entry)
 {
-        struct nfs_inode *node;
         if (dentry->d_inode == NULL)
                 goto different;
-        node = NFS_I(dentry->d_inode);
-        if (node->fh.size != entry->fh->size)
-                goto different;
-        if (strncmp(node->fh.data, entry->fh->data, node->fh.size) != 0)
+        if (nfs_compare_fh(entry->fh, NFS_FH(dentry->d_inode)) != 0)
                 goto different;
         return 1;
 different:
@@ -449,14 +459,15 @@ out:
 
 /* Perform conversion from xdr to cache array */
 static
-void nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *entry,
+int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *entry,
                                 void *xdr_page, struct page *page, unsigned int buflen)
 {
         struct xdr_stream stream;
         struct xdr_buf buf;
         __be32 *ptr = xdr_page;
-        int status;
         struct nfs_cache_array *array;
+        unsigned int count = 0;
+        int status;
 
         buf.head->iov_base = xdr_page;
         buf.head->iov_len = buflen;
@@ -471,21 +482,32 @@ void nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *e
 
         do {
                 status = xdr_decode(desc, entry, &stream);
-                if (status != 0)
+                if (status != 0) {
+                        if (status == -EAGAIN)
+                                status = 0;
                         break;
+                }
+
+                count++;
 
-                if (nfs_readdir_add_to_array(entry, page) == -1)
-                        break;
                 if (desc->plus == 1)
                         nfs_prime_dcache(desc->file->f_path.dentry, entry);
+
+                status = nfs_readdir_add_to_array(entry, page);
+                if (status != 0)
+                        break;
         } while (!entry->eof);
 
-        if (status == -EBADCOOKIE && entry->eof) {
+        if (count == 0 || (status == -EBADCOOKIE && entry->eof == 1)) {
                 array = nfs_readdir_get_array(page);
-                array->eof_index = array->size - 1;
-                status = 0;
-                nfs_readdir_release_array(page);
+                if (!IS_ERR(array)) {
+                        array->eof_index = array->size;
+                        status = 0;
+                        nfs_readdir_release_array(page);
+                } else
+                        status = PTR_ERR(array);
         }
+        return status;
 }
 
 static
@@ -537,7 +559,7 @@ int nfs_readdir_xdr_to_array(nfs_readdir_descriptor_t *desc, struct page *page,
         struct nfs_entry entry;
         struct file     *file = desc->file;
         struct nfs_cache_array *array;
-        int status = 0;
+        int status = -ENOMEM;
         unsigned int array_size = ARRAY_SIZE(pages);
 
         entry.prev_cookie = 0;
@@ -549,6 +571,10 @@ int nfs_readdir_xdr_to_array(nfs_readdir_descriptor_t *desc, struct page *page,
                 goto out;
 
         array = nfs_readdir_get_array(page);
+        if (IS_ERR(array)) {
+                status = PTR_ERR(array);
+                goto out;
+        }
         memset(array, 0, sizeof(struct nfs_cache_array));
         array->eof_index = -1;
 
@@ -556,12 +582,19 @@ int nfs_readdir_xdr_to_array(nfs_readdir_descriptor_t *desc, struct page *page,
         if (!pages_ptr)
                 goto out_release_array;
         do {
+                unsigned int pglen;
                 status = nfs_readdir_xdr_filler(pages, desc, &entry, file, inode);
 
                 if (status < 0)
                         break;
-                nfs_readdir_page_filler(desc, &entry, pages_ptr, page, array_size * PAGE_SIZE);
-        } while (array->eof_index < 0 && array->size < MAX_READDIR_ARRAY);
+                pglen = status;
+                status = nfs_readdir_page_filler(desc, &entry, pages_ptr, page, pglen);
+                if (status < 0) {
+                        if (status == -ENOSPC)
+                                status = 0;
+                        break;
+                }
+        } while (array->eof_index < 0);
 
         nfs_readdir_free_large_page(pages_ptr, pages, array_size);
 out_release_array:
@@ -582,8 +615,10 @@ static
 int nfs_readdir_filler(nfs_readdir_descriptor_t *desc, struct page* page)
 {
         struct inode    *inode = desc->file->f_path.dentry->d_inode;
+        int ret;
 
-        if (nfs_readdir_xdr_to_array(desc, page, inode) < 0)
+        ret = nfs_readdir_xdr_to_array(desc, page, inode);
+        if (ret < 0)
                 goto error;
         SetPageUptodate(page);
 
@@ -595,7 +630,7 @@ int nfs_readdir_filler(nfs_readdir_descriptor_t *desc, struct page* page)
         return 0;
  error:
         unlock_page(page);
-        return -EIO;
+        return ret;
 }
 
 static
@@ -608,12 +643,8 @@ void cache_page_release(nfs_readdir_descriptor_t *desc)
 static
 struct page *get_cache_page(nfs_readdir_descriptor_t *desc)
 {
-        struct page *page;
-        page = read_cache_page(desc->file->f_path.dentry->d_inode->i_mapping,
+        return read_cache_page(desc->file->f_path.dentry->d_inode->i_mapping,
                         desc->page_index, (filler_t *)nfs_readdir_filler, desc);
-        if (IS_ERR(page))
-                desc->eof = 1;
-        return page;
 }
 
 /*
@@ -639,8 +670,10 @@ int find_cache_page(nfs_readdir_descriptor_t *desc)
 static inline
 int readdir_search_pagecache(nfs_readdir_descriptor_t *desc)
 {
-        int res = -EAGAIN;
+        int res;
 
+        if (desc->page_index == 0)
+                desc->current_index = 0;
         while (1) {
                 res = find_cache_page(desc);
                 if (res != -EAGAIN)
@@ -666,35 +699,36 @@ int nfs_do_filldir(nfs_readdir_descriptor_t *desc, void *dirent,
         int i = 0;
         int res = 0;
         struct nfs_cache_array *array = NULL;
-        unsigned int d_type = DT_UNKNOWN;
-        struct dentry *dentry = NULL;
 
         array = nfs_readdir_get_array(desc->page);
+        if (IS_ERR(array)) {
+                res = PTR_ERR(array);
+                goto out;
+        }
 
         for (i = desc->cache_entry_index; i < array->size; i++) {
-                d_type = DT_UNKNOWN;
+                struct nfs_cache_array_entry *ent;
 
-                res = filldir(dirent, array->array[i].string.name,
-                        array->array[i].string.len, file->f_pos,
-                        nfs_compat_user_ino64(array->array[i].ino), d_type);
-                if (res < 0)
+                ent = &array->array[i];
+                if (filldir(dirent, ent->string.name, ent->string.len,
+                    file->f_pos, nfs_compat_user_ino64(ent->ino),
+                    ent->d_type) < 0) {
+                        desc->eof = 1;
                         break;
+                }
                 file->f_pos++;
                 desc->cache_entry_index = i;
                 if (i < (array->size-1))
                         *desc->dir_cookie = array->array[i+1].cookie;
                 else
                         *desc->dir_cookie = array->last_cookie;
-                if (i == array->eof_index) {
-                        desc->eof = 1;
-                        break;
-                }
         }
+        if (i == array->eof_index)
+                desc->eof = 1;
 
         nfs_readdir_release_array(desc->page);
+out:
         cache_page_release(desc);
-        if (dentry != NULL)
-                dput(dentry);
         dfprintk(DIRCACHE, "NFS: nfs_do_filldir() filling ended @ cookie %Lu; returning = %d\n",
                         (unsigned long long)*desc->dir_cookie, res);
         return res;
@@ -729,13 +763,13 @@ int uncached_readdir(nfs_readdir_descriptor_t *desc, void *dirent,
                 goto out;
         }
 
-        if (nfs_readdir_xdr_to_array(desc, page, inode) == -1) {
-                status = -EIO;
-                goto out_release;
-        }
-
         desc->page_index = 0;
         desc->page = page;
+
+        status = nfs_readdir_xdr_to_array(desc, page, inode);
+        if (status < 0)
+                goto out_release;
+
         status = nfs_do_filldir(desc, dirent, filldir);
 
  out:
@@ -786,14 +820,14 @@ static int nfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
                 res = readdir_search_pagecache(desc);
 
                 if (res == -EBADCOOKIE) {
+                        res = 0;
                         /* This means either end of directory */
                         if (*desc->dir_cookie && desc->eof == 0) {
                                 /* Or that the server has 'lost' a cookie */
                                 res = uncached_readdir(desc, dirent, filldir);
-                                if (res >= 0)
+                                if (res == 0)
                                         continue;
                         }
-                        res = 0;
                         break;
                 }
                 if (res == -ETOOSMALL && desc->plus) {
@@ -808,10 +842,8 @@ static int nfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
                         break;
 
                 res = nfs_do_filldir(desc, dirent, filldir);
-                if (res < 0) {
-                        res = 0;
+                if (res < 0)
                         break;
-                }
         }
 out:
         nfs_unblock_sillyrename(dentry);
@@ -1345,12 +1377,12 @@ static struct dentry *nfs_atomic_lookup(struct inode *dir, struct dentry *dentry
                                 res = NULL;
                                 goto out;
                         /* This turned out not to be a regular file */
-                        case -EISDIR:
                         case -ENOTDIR:
                                 goto no_open;
                         case -ELOOP:
                                 if (!(nd->intent.open.flags & O_NOFOLLOW))
                                         goto no_open;
+                        /* case -EISDIR: */
                         /* case -EINVAL: */
                         default:
                                 res = ERR_CAST(inode);
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 84d3c8b90206..e6ace0d93c71 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -867,7 +867,7 @@ static ssize_t nfs_direct_write(struct kiocb *iocb, const struct iovec *iov,
                 goto out;
         nfs_alloc_commit_data(dreq);
 
-        if (dreq->commit_data == NULL || count < wsize)
+        if (dreq->commit_data == NULL || count <= wsize)
                 sync = NFS_FILE_SYNC;
 
         dreq->inode = inode;
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index db08ff3ff454..e6356b750b77 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -362,6 +362,15 @@ unsigned int nfs_page_length(struct page *page)
 }
 
 /*
+ * Convert a umode to a dirent->d_type
+ */
+static inline
+unsigned char nfs_umode_to_dtype(umode_t mode)
+{
+        return (mode >> 12) & 15;
+}
+
+/*
  * Determine the number of pages in an array of length 'len' and
  * with a base offset of 'base'
  */
diff --git a/fs/nfs/nfs2xdr.c b/fs/nfs/nfs2xdr.c
index e6bf45710cc7..5914a1911c95 100644
--- a/fs/nfs/nfs2xdr.c
+++ b/fs/nfs/nfs2xdr.c
@@ -423,7 +423,7 @@ nfs_xdr_readdirres(struct rpc_rqst *req, __be32 *p, void *dummy)
         struct page **page;
         size_t hdrlen;
         unsigned int pglen, recvd;
-        int status, nr = 0;
+        int status;
 
         if ((status = ntohl(*p++)))
                 return nfs_stat_to_errno(status);
@@ -443,7 +443,7 @@ nfs_xdr_readdirres(struct rpc_rqst *req, __be32 *p, void *dummy)
         if (pglen > recvd)
                 pglen = recvd;
         page = rcvbuf->pages;
-        return nr;
+        return pglen;
 }
 
 static void print_overflow_msg(const char *func, const struct xdr_stream *xdr)
@@ -485,6 +485,8 @@ nfs_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, struct nfs_se
         entry->prev_cookie        = entry->cookie;
         entry->cookie     = ntohl(*p++);
 
+        entry->d_type = DT_UNKNOWN;
+
         p = xdr_inline_peek(xdr, 8);
         if (p != NULL)
                 entry->eof = !p[0] && p[1];
@@ -495,7 +497,7 @@ nfs_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, struct nfs_se
 
 out_overflow:
         print_overflow_msg(__func__, xdr);
-        return ERR_PTR(-EIO);
+        return ERR_PTR(-EAGAIN);
 }
 
 /*
diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
index d9a5e832c257..f6cc60f06dac 100644
--- a/fs/nfs/nfs3xdr.c
+++ b/fs/nfs/nfs3xdr.c
@@ -555,7 +555,7 @@ nfs3_xdr_readdirres(struct rpc_rqst *req, __be32 *p, struct nfs3_readdirres *res
         struct page **page;
         size_t hdrlen;
         u32 recvd, pglen;
-        int status, nr = 0;
+        int status;
 
         status = ntohl(*p++);
         /* Decode post_op_attrs */
@@ -586,7 +586,7 @@ nfs3_xdr_readdirres(struct rpc_rqst *req, __be32 *p, struct nfs3_readdirres *res
                 pglen = recvd;
         page = rcvbuf->pages;
 
-        return nr;
+        return pglen;
 }
 
 __be32 *
@@ -622,11 +622,13 @@ nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, struct nfs_s
         entry->prev_cookie = entry->cookie;
         p = xdr_decode_hyper(p, &entry->cookie);
 
+        entry->d_type = DT_UNKNOWN;
         if (plus) {
                 entry->fattr->valid = 0;
                 p = xdr_decode_post_op_attr_stream(xdr, entry->fattr);
                 if (IS_ERR(p))
                         goto out_overflow_exit;
+                entry->d_type = nfs_umode_to_dtype(entry->fattr->mode);
                 /* In fact, a post_op_fh3: */
                 p = xdr_inline_decode(xdr, 4);
                 if (unlikely(!p))
@@ -656,7 +658,7 @@ nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, struct nfs_s
 out_overflow:
         print_overflow_msg(__func__, xdr);
 out_overflow_exit:
-        return ERR_PTR(-EIO);
+        return ERR_PTR(-EAGAIN);
 }
 
 /*
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 0f24cdf2cb13..6a653ffd8e4e 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2852,8 +2852,10 @@ static int _nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
         nfs4_setup_readdir(cookie, NFS_COOKIEVERF(dir), dentry, &args);
         res.pgbase = args.pgbase;
         status = nfs4_call_sync(NFS_SERVER(dir), &msg, &args, &res, 0);
-        if (status == 0)
+        if (status >= 0) {
                 memcpy(NFS_COOKIEVERF(dir), res.verifier.data, NFS4_VERIFIER_SIZE);
+                status += args.pgbase;
+        }
 
         nfs_invalidate_atime(dir);
 
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index f313c4cce7e4..9f1826b012e6 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -4518,7 +4518,7 @@ static int decode_readdir(struct xdr_stream *xdr, struct rpc_rqst *req, struct n
         xdr_read_pages(xdr, pglen);
 
 
-        return 0;
+        return pglen;
 }
 
 static int decode_readlink(struct xdr_stream *xdr, struct rpc_rqst *req)
@@ -6208,6 +6208,10 @@ __be32 *nfs4_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
         if (entry->fattr->valid & NFS_ATTR_FATTR_FILEID)
                 entry->ino = entry->fattr->fileid;
 
+        entry->d_type = DT_UNKNOWN;
+        if (entry->fattr->valid & NFS_ATTR_FATTR_TYPE)
+                entry->d_type = nfs_umode_to_dtype(entry->fattr->mode);
+
         if (verify_attr_len(xdr, p, len) < 0)
                 goto out_overflow;
 
@@ -6221,7 +6225,7 @@ __be32 *nfs4_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
 
 out_overflow:
         print_overflow_msg(__func__, xdr);
-        return ERR_PTR(-EIO);
+        return ERR_PTR(-EAGAIN);
 }
 
 /*
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 0a42e8f4adcb..3c045044fca2 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -39,7 +39,6 @@
 #include <linux/nfs_mount.h>
 #include <linux/nfs4_mount.h>
 #include <linux/lockd/bind.h>
-#include <linux/smp_lock.h>
 #include <linux/seq_file.h>
 #include <linux/mount.h>
 #include <linux/mnt_namespace.h>
@@ -67,6 +66,12 @@
 
 #define NFSDBG_FACILITY         NFSDBG_VFS
 
+#ifdef CONFIG_NFS_V3
+#define NFS_DEFAULT_VERSION 3
+#else
+#define NFS_DEFAULT_VERSION 2
+#endif
+
 enum {
         /* Mount options that take no arguments */
         Opt_soft, Opt_hard,
@@ -2277,7 +2282,7 @@ static int nfs_get_sb(struct file_system_type *fs_type,
         };
         int error = -ENOMEM;
 
-        data = nfs_alloc_parsed_mount_data(3);
+        data = nfs_alloc_parsed_mount_data(NFS_DEFAULT_VERSION);
         mntfh = nfs_alloc_fhandle();
         if (data == NULL || mntfh == NULL)
                 goto out_free_fh;