1 files changed, 59 insertions, 64 deletions

diff --git a/fs/xfs/xfs_dfrag.c b/fs/xfs/xfs_dfrag.c
index 681be5c93af5..070259a4254c 100644
--- a/fs/xfs/xfs_dfrag.c
+++ b/fs/xfs/xfs_dfrag.c
@@ -1,58 +1,44 @@
 /*
- * Copyright (c) 2000-2002 Silicon Graphics, Inc.  All Rights Reserved.
+ * Copyright (c) 2000-2002,2005 Silicon Graphics, Inc.
+ * All Rights Reserved.
  *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of version 2 of the GNU General Public License as
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
  * published by the Free Software Foundation.
  *
- * This program is distributed in the hope that it would be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * This program is distributed in the hope that it would be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
  *
- * Further, this software is distributed without any warranty that it is
- * free of the rightful claim of any third person regarding infringement
- * or the like.  Any license provided herein, whether implied or
- * otherwise, applies only to this software file.  Patent licenses, if
- * any, provided herein do not apply to combinations of this program with
- * other software, or any other product whatsoever.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write the Free Software Foundation, Inc., 59
- * Temple Place - Suite 330, Boston MA 02111-1307, USA.
- *
- * Contact information: Silicon Graphics, Inc., 1600 Amphitheatre Pkwy,
- * Mountain View, CA  94043, or:
- *
- * http://www.sgi.com
- *
- * For further information regarding this notice, see:
- *
- * http://oss.sgi.com/projects/GenInfo/SGIGPLNoticeExplan/
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write the Free Software Foundation,
+ * Inc.,  51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  */
-
 #include "xfs.h"
-#include "xfs_macros.h"
+#include "xfs_fs.h"
 #include "xfs_types.h"
-#include "xfs_inum.h"
+#include "xfs_bit.h"
 #include "xfs_log.h"
+#include "xfs_inum.h"
 #include "xfs_trans.h"
 #include "xfs_sb.h"
+#include "xfs_ag.h"
 #include "xfs_dir.h"
 #include "xfs_dir2.h"
 #include "xfs_dmapi.h"
 #include "xfs_mount.h"
-#include "xfs_ag.h"
-#include "xfs_alloc_btree.h"
 #include "xfs_bmap_btree.h"
+#include "xfs_alloc_btree.h"
 #include "xfs_ialloc_btree.h"
-#include "xfs_btree.h"
-#include "xfs_attr_sf.h"
 #include "xfs_dir_sf.h"
 #include "xfs_dir2_sf.h"
+#include "xfs_attr_sf.h"
 #include "xfs_dinode.h"
-#include "xfs_inode_item.h"
 #include "xfs_inode.h"
+#include "xfs_inode_item.h"
 #include "xfs_bmap.h"
+#include "xfs_btree.h"
 #include "xfs_ialloc.h"
 #include "xfs_itable.h"
 #include "xfs_dfrag.h"
@@ -65,9 +51,9 @@
  */
 int
 xfs_swapext(
-        xfs_swapext_t   __user *sxp)
+        xfs_swapext_t   __user *sxu)
 {
-        xfs_swapext_t   sx;
+        xfs_swapext_t   *sxp;
         xfs_inode_t     *ip=NULL, *tip=NULL, *ips[2];
         xfs_trans_t     *tp;
         xfs_mount_t     *mp;
@@ -76,20 +62,29 @@ xfs_swapext(
         vnode_t         *vp, *tvp;
         bhv_desc_t      *bdp, *tbdp;
         vn_bhv_head_t   *bhp, *tbhp;
-        uint            lock_flags=0;
+        static uint     lock_flags = XFS_ILOCK_EXCL | XFS_IOLOCK_EXCL;
         int             ilf_fields, tilf_fields;
         int             error = 0;
-        xfs_ifork_t     tempif, *ifp, *tifp;
+        xfs_ifork_t     *tempifp, *ifp, *tifp;
         __uint64_t      tmp;
         int             aforkblks = 0;
         int             taforkblks = 0;
-        int             locked = 0;
+        char            locked = 0;
 
-        if (copy_from_user(&sx, sxp, sizeof(sx)))
-                return XFS_ERROR(EFAULT);
+        sxp = kmem_alloc(sizeof(xfs_swapext_t), KM_MAYFAIL);
+        tempifp = kmem_alloc(sizeof(xfs_ifork_t), KM_MAYFAIL);
+        if (!sxp || !tempifp) {
+                error = XFS_ERROR(ENOMEM);
+                goto error0;
+        }
+
+        if (copy_from_user(sxp, sxu, sizeof(xfs_swapext_t))) {
+                error = XFS_ERROR(EFAULT);
+                goto error0;
+        }
 
         /* Pull information for the target fd */
-        if (((fp = fget((int)sx.sx_fdtarget)) == NULL) ||
+        if (((fp = fget((int)sxp->sx_fdtarget)) == NULL) ||
             ((vp = LINVFS_GET_VP(fp->f_dentry->d_inode)) == NULL))  {
                 error = XFS_ERROR(EINVAL);
                 goto error0;
@@ -104,7 +99,7 @@ xfs_swapext(
                 ip = XFS_BHVTOI(bdp);
         }
 
-        if (((tfp = fget((int)sx.sx_fdtmp)) == NULL) ||
+        if (((tfp = fget((int)sxp->sx_fdtmp)) == NULL) ||
             ((tvp = LINVFS_GET_VP(tfp->f_dentry->d_inode)) == NULL)) {
                 error = XFS_ERROR(EINVAL);
                 goto error0;
@@ -131,7 +126,7 @@ xfs_swapext(
 
         mp = ip->i_mount;
 
-        sbp = &sx.sx_stat;
+        sbp = &sxp->sx_stat;
 
         if (XFS_FORCED_SHUTDOWN(mp)) {
                 error =  XFS_ERROR(EIO);
@@ -148,7 +143,7 @@ xfs_swapext(
                 ips[0] = tip;
                 ips[1] = ip;
         }
-        lock_flags = XFS_ILOCK_EXCL | XFS_IOLOCK_EXCL;
+
         xfs_lock_inodes(ips, 2, 0, lock_flags);
 
         /* Check permissions */
@@ -192,9 +187,9 @@ xfs_swapext(
         }
 
         /* Verify all data are being swapped */
-        if (sx.sx_offset != 0 ||
-            sx.sx_length != ip->i_d.di_size ||
-            sx.sx_length != tip->i_d.di_size) {
+        if (sxp->sx_offset != 0 ||
+            sxp->sx_length != ip->i_d.di_size ||
+            sxp->sx_length != tip->i_d.di_size) {
                 error = XFS_ERROR(EFAULT);
                 goto error0;
         }
@@ -255,7 +250,8 @@ xfs_swapext(
                 xfs_iunlock(ip,  XFS_IOLOCK_EXCL);
                 xfs_iunlock(tip, XFS_IOLOCK_EXCL);
                 xfs_trans_cancel(tp, 0);
-                return error;
+                locked = 0;
+                goto error0;
         }
         xfs_lock_inodes(ips, 2, 0, XFS_ILOCK_EXCL);
 
@@ -266,10 +262,8 @@ xfs_swapext(
              (ip->i_d.di_aformat != XFS_DINODE_FMT_LOCAL)) {
                 error = xfs_bmap_count_blocks(tp, ip, XFS_ATTR_FORK, &aforkblks);
                 if (error) {
-                        xfs_iunlock(ip,  lock_flags);
-                        xfs_iunlock(tip, lock_flags);
                         xfs_trans_cancel(tp, 0);
-                        return error;
+                        goto error0;
                 }
         }
         if ( ((XFS_IFORK_Q(tip) != 0) && (tip->i_d.di_anextents > 0)) &&
@@ -277,10 +271,8 @@ xfs_swapext(
                 error = xfs_bmap_count_blocks(tp, tip, XFS_ATTR_FORK,
                         &taforkblks);
                 if (error) {
-                        xfs_iunlock(ip,  lock_flags);
-                        xfs_iunlock(tip, lock_flags);
                         xfs_trans_cancel(tp, 0);
-                        return error;
+                        goto error0;
                 }
         }
 
@@ -289,9 +281,9 @@ xfs_swapext(
          */
         ifp = &ip->i_df;
         tifp = &tip->i_df;
-        tempif = *ifp;  /* struct copy */
-        *ifp = *tifp;   /* struct copy */
-        *tifp = tempif; /* struct copy */
+        *tempifp = *ifp;        /* struct copy */
+        *ifp = *tifp;           /* struct copy */
+        *tifp = *tempifp;       /* struct copy */
 
         /*
          * Fix the on-disk inode values
@@ -369,11 +361,7 @@ xfs_swapext(
         }
 
         error = xfs_trans_commit(tp, XFS_TRANS_SWAPEXT, NULL);
-
-        fput(fp);
-        fput(tfp);
-
-        return error;
+        locked = 0;
 
  error0:
         if (locked) {
@@ -381,8 +369,15 @@ xfs_swapext(
                 xfs_iunlock(tip, lock_flags);
         }
 
-        if (fp != NULL) fput(fp);
-        if (tfp != NULL) fput(tfp);
+        if (fp != NULL)
+                fput(fp);
+        if (tfp != NULL)
+                fput(tfp);
+
+        if (sxp != NULL)
+                kmem_free(sxp, sizeof(xfs_swapext_t));
+        if (tempifp != NULL)
+                kmem_free(tempifp, sizeof(xfs_ifork_t));
 
         return error;
 }