9 files changed, 138 insertions, 80 deletions

diff --git a/fs/nfsd/Makefile b/fs/nfsd/Makefile
index ce341dc76d5e..9b118ee20193 100644
--- a/fs/nfsd/Makefile
+++ b/fs/nfsd/Makefile
@@ -11,4 +11,3 @@ nfsd-$(CONFIG_NFSD_V3)	+= nfs3proc.o nfs3xdr.o
 nfsd-$(CONFIG_NFSD_V3_ACL) += nfs3acl.o
 nfsd-$(CONFIG_NFSD_V4)  += nfs4proc.o nfs4xdr.o nfs4state.o nfs4idmap.o \
                            nfs4acl.o nfs4callback.o nfs4recover.o
-nfsd-objs               := $(nfsd-y)
diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
index 6f24768272a1..79bd03b8bbf8 100644
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -469,6 +469,13 @@ static int svc_export_parse(struct cache_detail *cd, char *mesg, int mlen)
         nd.dentry = NULL;
         exp.ex_path = NULL;
 
+        /* fs locations */
+        exp.ex_fslocs.locations = NULL;
+        exp.ex_fslocs.locations_count = 0;
+        exp.ex_fslocs.migrated = 0;
+
+        exp.ex_uuid = NULL;
+
         if (mesg[mlen-1] != '\n')
                 return -EINVAL;
         mesg[mlen-1] = 0;
@@ -509,13 +516,6 @@ static int svc_export_parse(struct cache_detail *cd, char *mesg, int mlen)
         if (exp.h.expiry_time == 0)
                 goto out;
 
-        /* fs locations */
-        exp.ex_fslocs.locations = NULL;
-        exp.ex_fslocs.locations_count = 0;
-        exp.ex_fslocs.migrated = 0;
-
-        exp.ex_uuid = NULL;
-
         /* flags */
         err = get_int(&mesg, &an_int);
         if (err == -ENOENT)
diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c
index 7f5bad0393b1..eac82830bfd7 100644
--- a/fs/nfsd/nfs3proc.c
+++ b/fs/nfsd/nfs3proc.c
@@ -177,7 +177,7 @@ nfsd3_proc_read(struct svc_rqst *rqstp, struct nfsd3_readargs *argp,
         if (max_blocksize < resp->count)
                 resp->count = max_blocksize;
 
-        svc_reserve(rqstp, ((1 + NFS3_POST_OP_ATTR_WORDS + 3)<<2) + resp->count +4);
+        svc_reserve_auth(rqstp, ((1 + NFS3_POST_OP_ATTR_WORDS + 3)<<2) + resp->count +4);
 
         fh_copy(&resp->fh, &argp->fh);
         nfserr = nfsd_read(rqstp, &resp->fh, NULL,
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index 7e4bb0af24d7..10f6e7dcf633 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -239,7 +239,7 @@ static __be32 *
 encode_post_op_attr(struct svc_rqst *rqstp, __be32 *p, struct svc_fh *fhp)
 {
         struct dentry *dentry = fhp->fh_dentry;
-        if (dentry && dentry->d_inode != NULL) {
+        if (dentry && dentry->d_inode) {
                 int err;
                 struct kstat stat;
 
@@ -300,9 +300,9 @@ int
 nfs3svc_decode_sattrargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_sattrargs *args)
 {
-        if (!(p = decode_fh(p, &args->fh))
-         || !(p = decode_sattr3(p, &args->attrs)))
+        if (!(p = decode_fh(p, &args->fh)))
                 return 0;
+        p = decode_sattr3(p, &args->attrs);
 
         if ((args->check_guard = ntohl(*p++)) != 0) { 
                 struct timespec time; 
@@ -343,9 +343,9 @@ nfs3svc_decode_readargs(struct svc_rqst *rqstp, __be32 *p,
         int v,pn;
         u32 max_blocksize = svc_max_payload(rqstp);
 
-        if (!(p = decode_fh(p, &args->fh))
-         || !(p = xdr_decode_hyper(p, &args->offset)))
+        if (!(p = decode_fh(p, &args->fh)))
                 return 0;
+        p = xdr_decode_hyper(p, &args->offset);
 
         len = args->count = ntohl(*p++);
 
@@ -369,28 +369,44 @@ int
 nfs3svc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_writeargs *args)
 {
-        unsigned int len, v, hdr;
+        unsigned int len, v, hdr, dlen;
         u32 max_blocksize = svc_max_payload(rqstp);
 
-        if (!(p = decode_fh(p, &args->fh))
-         || !(p = xdr_decode_hyper(p, &args->offset)))
+        if (!(p = decode_fh(p, &args->fh)))
                 return 0;
+        p = xdr_decode_hyper(p, &args->offset);
 
         args->count = ntohl(*p++);
         args->stable = ntohl(*p++);
         len = args->len = ntohl(*p++);
+        /*
+         * The count must equal the amount of data passed.
+         */
+        if (args->count != args->len)
+                return 0;
 
+        /*
+         * Check to make sure that we got the right number of
+         * bytes.
+         */
         hdr = (void*)p - rqstp->rq_arg.head[0].iov_base;
-        if (rqstp->rq_arg.len < hdr ||
-            rqstp->rq_arg.len - hdr < len)
+        dlen = rqstp->rq_arg.head[0].iov_len + rqstp->rq_arg.page_len
+                - hdr;
+        /*
+         * Round the length of the data which was specified up to
+         * the next multiple of XDR units and then compare that
+         * against the length which was actually received.
+         */
+        if (dlen != XDR_QUADLEN(len)*4)
                 return 0;
 
+        if (args->count > max_blocksize) {
+                args->count = max_blocksize;
+                len = args->len = max_blocksize;
+        }
         rqstp->rq_vec[0].iov_base = (void*)p;
         rqstp->rq_vec[0].iov_len = rqstp->rq_arg.head[0].iov_len - hdr;
-
-        if (len > max_blocksize)
-                len = max_blocksize;
-        v=  0;
+        v = 0;
         while (len > rqstp->rq_vec[v].iov_len) {
                 len -= rqstp->rq_vec[v].iov_len;
                 v++;
@@ -398,9 +414,8 @@ nfs3svc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p,
                 rqstp->rq_vec[v].iov_len = PAGE_SIZE;
         }
         rqstp->rq_vec[v].iov_len = len;
-        args->vlen = v+1;
-
-        return args->count == args->len && rqstp->rq_vec[0].iov_len > 0;
+        args->vlen = v + 1;
+        return 1;
 }
 
 int
@@ -414,8 +429,7 @@ nfs3svc_decode_createargs(struct svc_rqst *rqstp, __be32 *p,
         switch (args->createmode = ntohl(*p++)) {
         case NFS3_CREATE_UNCHECKED:
         case NFS3_CREATE_GUARDED:
-                if (!(p = decode_sattr3(p, &args->attrs)))
-                        return 0;
+                p = decode_sattr3(p, &args->attrs);
                 break;
         case NFS3_CREATE_EXCLUSIVE:
                 args->verf = p;
@@ -431,10 +445,10 @@ int
 nfs3svc_decode_mkdirargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_createargs *args)
 {
-        if (!(p = decode_fh(p, &args->fh))
-         || !(p = decode_filename(p, &args->name, &args->len))
-         || !(p = decode_sattr3(p, &args->attrs)))
+        if (!(p = decode_fh(p, &args->fh)) ||
+            !(p = decode_filename(p, &args->name, &args->len)))
                 return 0;
+        p = decode_sattr3(p, &args->attrs);
 
         return xdr_argsize_check(rqstp, p);
 }
@@ -448,11 +462,12 @@ nfs3svc_decode_symlinkargs(struct svc_rqst *rqstp, __be32 *p,
         char *old, *new;
         struct kvec *vec;
 
-        if (!(p = decode_fh(p, &args->ffh))
-         || !(p = decode_filename(p, &args->fname, &args->flen))
-         || !(p = decode_sattr3(p, &args->attrs))
+        if (!(p = decode_fh(p, &args->ffh)) ||
+            !(p = decode_filename(p, &args->fname, &args->flen))
                 )
                 return 0;
+        p = decode_sattr3(p, &args->attrs);
+
         /* now decode the pathname, which might be larger than the first page.
          * As we have to check for nul's anyway, we copy it into a new page
          * This page appears in the rq_res.pages list, but as pages_len is always
@@ -502,10 +517,8 @@ nfs3svc_decode_mknodargs(struct svc_rqst *rqstp, __be32 *p,
         args->ftype = ntohl(*p++);
 
         if (args->ftype == NF3BLK  || args->ftype == NF3CHR
-         || args->ftype == NF3SOCK || args->ftype == NF3FIFO) {
-                if (!(p = decode_sattr3(p, &args->attrs)))
-                        return 0;
-        }
+         || args->ftype == NF3SOCK || args->ftype == NF3FIFO)
+                p = decode_sattr3(p, &args->attrs);
 
         if (args->ftype == NF3BLK || args->ftype == NF3CHR) {
                 args->major = ntohl(*p++);
diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
index 673a53c014a3..cc3b7badd486 100644
--- a/fs/nfsd/nfs4acl.c
+++ b/fs/nfsd/nfs4acl.c
@@ -137,7 +137,6 @@ struct ace_container {
 static short ace2type(struct nfs4_ace *);
 static void _posix_to_nfsv4_one(struct posix_acl *, struct nfs4_acl *,
                                 unsigned int);
-void nfs4_acl_add_ace(struct nfs4_acl *, u32, u32, u32, int, uid_t);
 
 struct nfs4_acl *
 nfs4_acl_posix_to_nfsv4(struct posix_acl *pacl, struct posix_acl *dpacl,
@@ -785,21 +784,6 @@ nfs4_acl_new(int n)
         return acl;
 }
 
-void
-nfs4_acl_add_ace(struct nfs4_acl *acl, u32 type, u32 flag, u32 access_mask,
-                int whotype, uid_t who)
-{
-        struct nfs4_ace *ace = acl->aces + acl->naces;
-
-        ace->type = type;
-        ace->flag = flag;
-        ace->access_mask = access_mask;
-        ace->whotype = whotype;
-        ace->who = who;
-
-        acl->naces++;
-}
-
 static struct {
         char *string;
         int   stringlen;
@@ -851,6 +835,5 @@ nfs4_acl_write_who(int who, char *p)
 }
 
 EXPORT_SYMBOL(nfs4_acl_new);
-EXPORT_SYMBOL(nfs4_acl_add_ace);
 EXPORT_SYMBOL(nfs4_acl_get_whotype);
 EXPORT_SYMBOL(nfs4_acl_write_who);
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 678f3be88ac0..3cc8ce422ab1 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1326,8 +1326,6 @@ do_recall(void *__dp)
 {
         struct nfs4_delegation *dp = __dp;
 
-        daemonize("nfsv4-recall");
-
         nfsd4_cb_recall(dp);
         return 0;
 }
diff --git a/fs/nfsd/nfsfh.c b/fs/nfsd/nfsfh.c
index 739dd3c5c3b2..6ca2d24fc216 100644
--- a/fs/nfsd/nfsfh.c
+++ b/fs/nfsd/nfsfh.c
@@ -323,7 +323,7 @@ fh_compose(struct svc_fh *fhp, struct svc_export *exp, struct dentry *dentry,
          *
          */
 
-        u8 version = 1;
+        u8 version;
         u8 fsid_type = 0;
         struct inode * inode = dentry->d_inode;
         struct dentry *parent = dentry->d_parent;
@@ -341,15 +341,59 @@ fh_compose(struct svc_fh *fhp, struct svc_export *exp, struct dentry *dentry,
          * the reference filehandle (if it is in the same export)
          * or the export options.
          */
+ retry:
+        version = 1;
         if (ref_fh && ref_fh->fh_export == exp) {
                 version = ref_fh->fh_handle.fh_version;
-                if (version == 0xca)
+                fsid_type = ref_fh->fh_handle.fh_fsid_type;
+
+                if (ref_fh == fhp)
+                        fh_put(ref_fh);
+                ref_fh = NULL;
+
+                switch (version) {
+                case 0xca:
                         fsid_type = FSID_DEV;
-                else
-                        fsid_type = ref_fh->fh_handle.fh_fsid_type;
-                /* We know this version/type works for this export
-                 * so there is no need for further checks.
+                        break;
+                case 1:
+                        break;
+                default:
+                        goto retry;
+                }
+
+                /* Need to check that this type works for this
+                 * export point.  As the fsid -> filesystem mapping
+                 * was guided by user-space, there is no guarantee
+                 * that the filesystem actually supports that fsid
+                 * type. If it doesn't we loop around again without
+                 * ref_fh set.
                  */
+                switch(fsid_type) {
+                case FSID_DEV:
+                        if (!old_valid_dev(ex_dev))
+                                goto retry;
+                        /* FALL THROUGH */
+                case FSID_MAJOR_MINOR:
+                case FSID_ENCODE_DEV:
+                        if (!(exp->ex_dentry->d_inode->i_sb->s_type->fs_flags
+                              & FS_REQUIRES_DEV))
+                                goto retry;
+                        break;
+                case FSID_NUM:
+                        if (! (exp->ex_flags & NFSEXP_FSID))
+                                goto retry;
+                        break;
+                case FSID_UUID8:
+                case FSID_UUID16:
+                        if (!root_export)
+                                goto retry;
+                        /* fall through */
+                case FSID_UUID4_INUM:
+                case FSID_UUID16_INUM:
+                        if (exp->ex_uuid == NULL)
+                                goto retry;
+                        break;
+                }
         } else if (exp->ex_uuid) {
                 if (fhp->fh_maxsize >= 64) {
                         if (root_export)
diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c
index 5cc2eec981b8..b2c7147aa921 100644
--- a/fs/nfsd/nfsproc.c
+++ b/fs/nfsd/nfsproc.c
@@ -155,7 +155,7 @@ nfsd_proc_read(struct svc_rqst *rqstp, struct nfsd_readargs *argp,
                                 argp->count);
                 argp->count = NFSSVC_MAXBLKSIZE_V2;
         }
-        svc_reserve(rqstp, (19<<2) + argp->count + 4);
+        svc_reserve_auth(rqstp, (19<<2) + argp->count + 4);
 
         resp->count = argp->count;
         nfserr = nfsd_read(rqstp, fh_copy(&resp->fh, &argp->fh), NULL,
diff --git a/fs/nfsd/nfsxdr.c b/fs/nfsd/nfsxdr.c
index 0c24b9e24fe8..cb3e7fadb772 100644
--- a/fs/nfsd/nfsxdr.c
+++ b/fs/nfsd/nfsxdr.c
@@ -231,9 +231,10 @@ int
 nfssvc_decode_sattrargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd_sattrargs *args)
 {
-        if (!(p = decode_fh(p, &args->fh))
-         || !(p = decode_sattr(p, &args->attrs)))
+        p = decode_fh(p, &args->fh);
+        if (!p)
                 return 0;
+        p = decode_sattr(p, &args->attrs);
 
         return xdr_argsize_check(rqstp, p);
 }
@@ -284,8 +285,9 @@ int
 nfssvc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd_writeargs *args)
 {
-        unsigned int len;
+        unsigned int len, hdr, dlen;
         int v;
+
         if (!(p = decode_fh(p, &args->fh)))
                 return 0;
 
@@ -293,11 +295,30 @@ nfssvc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p,
         args->offset = ntohl(*p++);     /* offset */
         p++;                            /* totalcount */
         len = args->len = ntohl(*p++);
-        rqstp->rq_vec[0].iov_base = (void*)p;
-        rqstp->rq_vec[0].iov_len = rqstp->rq_arg.head[0].iov_len -
-                                (((void*)p) - rqstp->rq_arg.head[0].iov_base);
+        /*
+         * The protocol specifies a maximum of 8192 bytes.
+         */
         if (len > NFSSVC_MAXBLKSIZE_V2)
-                len = NFSSVC_MAXBLKSIZE_V2;
+                return 0;
+
+        /*
+         * Check to make sure that we got the right number of
+         * bytes.
+         */
+        hdr = (void*)p - rqstp->rq_arg.head[0].iov_base;
+        dlen = rqstp->rq_arg.head[0].iov_len + rqstp->rq_arg.page_len
+                - hdr;
+
+        /*
+         * Round the length of the data which was specified up to
+         * the next multiple of XDR units and then compare that
+         * against the length which was actually received.
+         */
+        if (dlen != XDR_QUADLEN(len)*4)
+                return 0;
+
+        rqstp->rq_vec[0].iov_base = (void*)p;
+        rqstp->rq_vec[0].iov_len = rqstp->rq_arg.head[0].iov_len - hdr;
         v = 0;
         while (len > rqstp->rq_vec[v].iov_len) {
                 len -= rqstp->rq_vec[v].iov_len;
@@ -306,18 +327,18 @@ nfssvc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p,
                 rqstp->rq_vec[v].iov_len = PAGE_SIZE;
         }
         rqstp->rq_vec[v].iov_len = len;
-        args->vlen = v+1;
-        return rqstp->rq_vec[0].iov_len > 0;
+        args->vlen = v + 1;
+        return 1;
 }
 
 int
 nfssvc_decode_createargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd_createargs *args)
 {
-        if (!(p = decode_fh(p, &args->fh))
-         || !(p = decode_filename(p, &args->name, &args->len))
-         || !(p = decode_sattr(p, &args->attrs)))
+        if (   !(p = decode_fh(p, &args->fh))
+            || !(p = decode_filename(p, &args->name, &args->len)))
                 return 0;
+        p = decode_sattr(p, &args->attrs);
 
         return xdr_argsize_check(rqstp, p);
 }
@@ -361,11 +382,11 @@ int
 nfssvc_decode_symlinkargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd_symlinkargs *args)
 {
-        if (!(p = decode_fh(p, &args->ffh))
-         || !(p = decode_filename(p, &args->fname, &args->flen))
-         || !(p = decode_pathname(p, &args->tname, &args->tlen))
-         || !(p = decode_sattr(p, &args->attrs)))
+        if (   !(p = decode_fh(p, &args->ffh))
+            || !(p = decode_filename(p, &args->fname, &args->flen))
+            || !(p = decode_pathname(p, &args->tname, &args->tlen)))
                 return 0;
+        p = decode_sattr(p, &args->attrs);
 
         return xdr_argsize_check(rqstp, p);
 }