1 files changed, 16 insertions, 9 deletions

diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index a8587e90fd5a..34ccf815ea8a 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -40,6 +40,7 @@
  * at the end of nfs4svc_decode_compoundargs.
  */
 
+#include <linux/slab.h>
 #include <linux/namei.h>
 #include <linux/statfs.h>
 #include <linux/utsname.h>
@@ -160,10 +161,10 @@ static __be32 *read_buf(struct nfsd4_compoundargs *argp, u32 nbytes)
         argp->p = page_address(argp->pagelist[0]);
         argp->pagelist++;
         if (argp->pagelen < PAGE_SIZE) {
-                argp->end = p + (argp->pagelen>>2);
+                argp->end = argp->p + (argp->pagelen>>2);
                 argp->pagelen = 0;
         } else {
-                argp->end = p + (PAGE_SIZE>>2);
+                argp->end = argp->p + (PAGE_SIZE>>2);
                 argp->pagelen -= PAGE_SIZE;
         }
         memcpy(((char*)p)+avail, argp->p, (nbytes - avail));
@@ -1425,16 +1426,16 @@ nfsd4_decode_compound(struct nfsd4_compoundargs *argp)
                         argp->p = page_address(argp->pagelist[0]);
                         argp->pagelist++;
                         if (argp->pagelen < PAGE_SIZE) {
-                                argp->end = p + (argp->pagelen>>2);
+                                argp->end = argp->p + (argp->pagelen>>2);
                                 argp->pagelen = 0;
                         } else {
-                                argp->end = p + (PAGE_SIZE>>2);
+                                argp->end = argp->p + (PAGE_SIZE>>2);
                                 argp->pagelen -= PAGE_SIZE;
                         }
                 }
                 op->opnum = ntohl(*argp->p++);
 
-                if (op->opnum >= OP_ACCESS && op->opnum < ops->nops)
+                if (op->opnum >= FIRST_NFS4_OP && op->opnum <= LAST_NFS4_OP)
                         op->status = ops->decoders[op->opnum](argp, &op->u);
                 else {
                         op->opnum = OP_ILLEGAL;
@@ -1528,7 +1529,7 @@ static void write_cinfo(__be32 **p, struct nfsd4_change_info *c)
         } } while (0);
 
 /* Encode as an array of strings the string given with components
- * seperated @sep.
+ * separated @sep.
  */
 static __be32 nfsd4_encode_components(char sep, char *components,
                                    __be32 **pp, int *buflen)
@@ -2121,9 +2122,15 @@ out_acl:
                  * and this is the root of a cross-mounted filesystem.
                  */
                 if (ignore_crossmnt == 0 &&
-                    exp->ex_path.mnt->mnt_root->d_inode == dentry->d_inode) {
-                        err = vfs_getattr(exp->ex_path.mnt->mnt_parent,
-                                exp->ex_path.mnt->mnt_mountpoint, &stat);
+                    dentry == exp->ex_path.mnt->mnt_root) {
+                        struct path path = exp->ex_path;
+                        path_get(&path);
+                        while (follow_up(&path)) {
+                                if (path.dentry != path.mnt->mnt_root)
+                                        break;
+                        }
+                        err = vfs_getattr(path.mnt, path.dentry, &stat);
+                        path_put(&path);
                         if (err)
                                 goto out_nfserr;
                 }