1 files changed, 42 insertions, 29 deletions

diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index 7e4bb0af24d7..10f6e7dcf633 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -239,7 +239,7 @@ static __be32 *
 encode_post_op_attr(struct svc_rqst *rqstp, __be32 *p, struct svc_fh *fhp)
 {
         struct dentry *dentry = fhp->fh_dentry;
-        if (dentry && dentry->d_inode != NULL) {
+        if (dentry && dentry->d_inode) {
                 int err;
                 struct kstat stat;
 
@@ -300,9 +300,9 @@ int
 nfs3svc_decode_sattrargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_sattrargs *args)
 {
-        if (!(p = decode_fh(p, &args->fh))
-         || !(p = decode_sattr3(p, &args->attrs)))
+        if (!(p = decode_fh(p, &args->fh)))
                 return 0;
+        p = decode_sattr3(p, &args->attrs);
 
         if ((args->check_guard = ntohl(*p++)) != 0) { 
                 struct timespec time; 
@@ -343,9 +343,9 @@ nfs3svc_decode_readargs(struct svc_rqst *rqstp, __be32 *p,
         int v,pn;
         u32 max_blocksize = svc_max_payload(rqstp);
 
-        if (!(p = decode_fh(p, &args->fh))
-         || !(p = xdr_decode_hyper(p, &args->offset)))
+        if (!(p = decode_fh(p, &args->fh)))
                 return 0;
+        p = xdr_decode_hyper(p, &args->offset);
 
         len = args->count = ntohl(*p++);
 
@@ -369,28 +369,44 @@ int
 nfs3svc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_writeargs *args)
 {
-        unsigned int len, v, hdr;
+        unsigned int len, v, hdr, dlen;
         u32 max_blocksize = svc_max_payload(rqstp);
 
-        if (!(p = decode_fh(p, &args->fh))
-         || !(p = xdr_decode_hyper(p, &args->offset)))
+        if (!(p = decode_fh(p, &args->fh)))
                 return 0;
+        p = xdr_decode_hyper(p, &args->offset);
 
         args->count = ntohl(*p++);
         args->stable = ntohl(*p++);
         len = args->len = ntohl(*p++);
+        /*
+         * The count must equal the amount of data passed.
+         */
+        if (args->count != args->len)
+                return 0;
 
+        /*
+         * Check to make sure that we got the right number of
+         * bytes.
+         */
         hdr = (void*)p - rqstp->rq_arg.head[0].iov_base;
-        if (rqstp->rq_arg.len < hdr ||
-            rqstp->rq_arg.len - hdr < len)
+        dlen = rqstp->rq_arg.head[0].iov_len + rqstp->rq_arg.page_len
+                - hdr;
+        /*
+         * Round the length of the data which was specified up to
+         * the next multiple of XDR units and then compare that
+         * against the length which was actually received.
+         */
+        if (dlen != XDR_QUADLEN(len)*4)
                 return 0;
 
+        if (args->count > max_blocksize) {
+                args->count = max_blocksize;
+                len = args->len = max_blocksize;
+        }
         rqstp->rq_vec[0].iov_base = (void*)p;
         rqstp->rq_vec[0].iov_len = rqstp->rq_arg.head[0].iov_len - hdr;
-
-        if (len > max_blocksize)
-                len = max_blocksize;
-        v=  0;
+        v = 0;
         while (len > rqstp->rq_vec[v].iov_len) {
                 len -= rqstp->rq_vec[v].iov_len;
                 v++;
@@ -398,9 +414,8 @@ nfs3svc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p,
                 rqstp->rq_vec[v].iov_len = PAGE_SIZE;
         }
         rqstp->rq_vec[v].iov_len = len;
-        args->vlen = v+1;
-
-        return args->count == args->len && rqstp->rq_vec[0].iov_len > 0;
+        args->vlen = v + 1;
+        return 1;
 }
 
 int
@@ -414,8 +429,7 @@ nfs3svc_decode_createargs(struct svc_rqst *rqstp, __be32 *p,
         switch (args->createmode = ntohl(*p++)) {
         case NFS3_CREATE_UNCHECKED:
         case NFS3_CREATE_GUARDED:
-                if (!(p = decode_sattr3(p, &args->attrs)))
-                        return 0;
+                p = decode_sattr3(p, &args->attrs);
                 break;
         case NFS3_CREATE_EXCLUSIVE:
                 args->verf = p;
@@ -431,10 +445,10 @@ int
 nfs3svc_decode_mkdirargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_createargs *args)
 {
-        if (!(p = decode_fh(p, &args->fh))
-         || !(p = decode_filename(p, &args->name, &args->len))
-         || !(p = decode_sattr3(p, &args->attrs)))
+        if (!(p = decode_fh(p, &args->fh)) ||
+            !(p = decode_filename(p, &args->name, &args->len)))
                 return 0;
+        p = decode_sattr3(p, &args->attrs);
 
         return xdr_argsize_check(rqstp, p);
 }
@@ -448,11 +462,12 @@ nfs3svc_decode_symlinkargs(struct svc_rqst *rqstp, __be32 *p,
         char *old, *new;
         struct kvec *vec;
 
-        if (!(p = decode_fh(p, &args->ffh))
-         || !(p = decode_filename(p, &args->fname, &args->flen))
-         || !(p = decode_sattr3(p, &args->attrs))
+        if (!(p = decode_fh(p, &args->ffh)) ||
+            !(p = decode_filename(p, &args->fname, &args->flen))
                 )
                 return 0;
+        p = decode_sattr3(p, &args->attrs);
+
         /* now decode the pathname, which might be larger than the first page.
          * As we have to check for nul's anyway, we copy it into a new page
          * This page appears in the rq_res.pages list, but as pages_len is always
@@ -502,10 +517,8 @@ nfs3svc_decode_mknodargs(struct svc_rqst *rqstp, __be32 *p,
         args->ftype = ntohl(*p++);
 
         if (args->ftype == NF3BLK  || args->ftype == NF3CHR
-         || args->ftype == NF3SOCK || args->ftype == NF3FIFO) {
-                if (!(p = decode_sattr3(p, &args->attrs)))
-                        return 0;
-        }
+         || args->ftype == NF3SOCK || args->ftype == NF3FIFO)
+                p = decode_sattr3(p, &args->attrs);
 
         if (args->ftype == NF3BLK || args->ftype == NF3CHR) {
                 args->major = ntohl(*p++);