4 files changed, 41 insertions, 34 deletions

diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
index 3eec30000f3f..01bc68c628ad 100644
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -126,7 +126,7 @@ static int expkey_parse(struct cache_detail *cd, char *mesg, int mlen)
         if (*ep)
                 goto out;
         dprintk("found fsidtype %d\n", fsidtype);
-        if (fsidtype > 2)
+        if (key_len(fsidtype)==0) /* invalid type */
                 goto out;
         if ((len=qword_get(&mesg, buf, PAGE_SIZE)) <= 0)
                 goto out;
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 7c7d01672d35..9daa0b9feb8d 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1237,8 +1237,15 @@ find_file(struct inode *ino)
         return NULL;
 }
 
-#define TEST_ACCESS(x) ((x > 0 || x < 4)?1:0)
-#define TEST_DENY(x) ((x >= 0 || x < 5)?1:0)
+static int access_valid(u32 x)
+{
+        return (x > 0 && x < 4);
+}
+
+static int deny_valid(u32 x)
+{
+        return (x >= 0 && x < 5);
+}
 
 static void
 set_access(unsigned int *access, unsigned long bmap) {
@@ -1745,7 +1752,8 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf
         int status;
 
         status = nfserr_inval;
-        if (!TEST_ACCESS(open->op_share_access) || !TEST_DENY(open->op_share_deny))
+        if (!access_valid(open->op_share_access)
+                        || !deny_valid(open->op_share_deny))
                 goto out;
         /*
          * Lookup file; if found, lookup stateid and check open request,
@@ -1782,10 +1790,10 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf
         } else {
                 /* Stateid was not found, this is a new OPEN */
                 int flags = 0;
+                if (open->op_share_access & NFS4_SHARE_ACCESS_READ)
+                        flags |= MAY_READ;
                 if (open->op_share_access & NFS4_SHARE_ACCESS_WRITE)
-                        flags = MAY_WRITE;
-                else
-                        flags = MAY_READ;
+                        flags |= MAY_WRITE;
                 status = nfs4_new_open(rqstp, &stp, dp, current_fh, flags);
                 if (status)
                         goto out;
@@ -2070,16 +2078,12 @@ nfs4_preprocess_stateid_op(struct svc_fh *current_fh, stateid_t *stateid, int fl
         if (!stateid->si_fileid) { /* delegation stateid */
                 if(!(dp = find_delegation_stateid(ino, stateid))) {
                         dprintk("NFSD: delegation stateid not found\n");
-                        if (nfs4_in_grace())
-                                status = nfserr_grace;
                         goto out;
                 }
                 stidp = &dp->dl_stateid;
         } else { /* open or lock stateid */
                 if (!(stp = find_stateid(stateid, flags))) {
                         dprintk("NFSD: open or lock stateid not found\n");
-                        if (nfs4_in_grace())
-                                status = nfserr_grace;
                         goto out;
                 }
                 if ((flags & CHECK_FH) && nfs4_check_fh(current_fh, stp))
@@ -2252,8 +2256,9 @@ nfsd4_open_confirm(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfs
                         (int)current_fh->fh_dentry->d_name.len,
                         current_fh->fh_dentry->d_name.name);
 
-        if ((status = fh_verify(rqstp, current_fh, S_IFREG, 0)))
-                goto out;
+        status = fh_verify(rqstp, current_fh, S_IFREG, 0);
+        if (status)
+                return status;
 
         nfs4_lock_state();
 
@@ -2320,7 +2325,8 @@ nfsd4_open_downgrade(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct n
                         (int)current_fh->fh_dentry->d_name.len,
                         current_fh->fh_dentry->d_name.name);
 
-        if (!TEST_ACCESS(od->od_share_access) || !TEST_DENY(od->od_share_deny))
+        if (!access_valid(od->od_share_access)
+                        || !deny_valid(od->od_share_deny))
                 return nfserr_inval;
 
         nfs4_lock_state();
diff --git a/fs/nfsd/nfsfh.c b/fs/nfsd/nfsfh.c
index 3f2ec2e6d06c..ecc439d2565f 100644
--- a/fs/nfsd/nfsfh.c
+++ b/fs/nfsd/nfsfh.c
@@ -187,13 +187,6 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
                         goto out;
                 }
 
-                /* Set user creds for this exportpoint */
-                error = nfsd_setuser(rqstp, exp);
-                if (error) {
-                        error = nfserrno(error);
-                        goto out;
-                }
-
                 /*
                  * Look up the dentry using the NFS file handle.
                  */
@@ -251,6 +244,14 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
         }
         cache_get(&exp->h);
 
+        /* Set user creds for this exportpoint; necessary even in the "just
+         * checking" case because this may be a filehandle that was created by
+         * fh_compose, and that is about to be used in another nfsv4 compound
+         * operation */
+        error = nfserrno(nfsd_setuser(rqstp, exp));
+        if (error)
+                goto out;
+
         error = nfsd_mode_check(rqstp, dentry->d_inode->i_mode, type);
         if (error)
                 goto out;
@@ -312,8 +313,8 @@ int
 fh_compose(struct svc_fh *fhp, struct svc_export *exp, struct dentry *dentry, struct svc_fh *ref_fh)
 {
         /* ref_fh is a reference file handle.
-         * if it is non-null, then we should compose a filehandle which is
-         * of the same version, where possible.
+         * if it is non-null and for the same filesystem, then we should compose
+         * a filehandle which is of the same version, where possible.
          * Currently, that means that if ref_fh->fh_handle.fh_version == 0xca
          * Then create a 32byte filehandle using nfs_fhbase_old
          *
@@ -332,7 +333,7 @@ fh_compose(struct svc_fh *fhp, struct svc_export *exp, struct dentry *dentry, st
                 parent->d_name.name, dentry->d_name.name,
                 (inode ? inode->i_ino : 0));
 
-        if (ref_fh) {
+        if (ref_fh && ref_fh->fh_export == exp) {
                 ref_fh_version = ref_fh->fh_handle.fh_version;
                 if (ref_fh_version == 0xca)
                         ref_fh_fsid_type = 0;
@@ -461,7 +462,7 @@ fh_update(struct svc_fh *fhp)
         } else {
                 int size;
                 if (fhp->fh_handle.fh_fileid_type != 0)
-                        goto out_uptodate;
+                        goto out;
                 datap = fhp->fh_handle.fh_auth+
                         fhp->fh_handle.fh_size/4 -1;
                 size = (fhp->fh_maxsize - fhp->fh_handle.fh_size)/4;
@@ -481,10 +482,6 @@ out_negative:
         printk(KERN_ERR "fh_update: %s/%s still negative!\n",
                 dentry->d_parent->d_name.name, dentry->d_name.name);
         goto out;
-out_uptodate:
-        printk(KERN_ERR "fh_update: %s/%s already up-to-date!\n",
-                dentry->d_parent->d_name.name, dentry->d_name.name);
-        goto out;
 }
 
 /*
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index da3ec74d8a43..c9e3b5a8fe07 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -672,7 +672,10 @@ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
                 goto out_nfserr;
 
         if (access & MAY_WRITE) {
-                flags = O_WRONLY|O_LARGEFILE;
+                if (access & MAY_READ)
+                        flags = O_RDWR|O_LARGEFILE;
+                else
+                        flags = O_WRONLY|O_LARGEFILE;
 
                 DQUOT_INIT(inode);
         }
@@ -833,7 +836,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
         if (ra && ra->p_set)
                 file->f_ra = ra->p_ra;
 
-        if (file->f_op->sendfile) {
+        if (file->f_op->sendfile && rqstp->rq_sendfile_ok) {
                 svc_pushback_unused_pages(rqstp);
                 err = file->f_op->sendfile(file, &offset, *count,
                                                  nfsd_read_actor, rqstp);
@@ -1516,14 +1519,15 @@ nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp,
                         err = nfserrno(err);
         }
 
-        fh_unlock(ffhp);
         dput(dnew);
+out_unlock:
+        fh_unlock(ffhp);
 out:
         return err;
 
 out_nfserr:
         err = nfserrno(err);
-        goto out;
+        goto out_unlock;
 }
 
 /*
@@ -1552,7 +1556,7 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen,
         tdir = tdentry->d_inode;
 
         err = (rqstp->rq_vers == 2) ? nfserr_acces : nfserr_xdev;
-        if (fdir->i_sb != tdir->i_sb)
+        if (ffhp->fh_export != tfhp->fh_export)
                 goto out;
 
         err = nfserr_perm;