1 files changed, 50 insertions, 5 deletions

diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index 1e308f210928..b58a501cf3d1 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -114,6 +114,26 @@ pdu_write_u(struct p9_fcall *pdu, const char __user *udata, size_t size)
         return size - len;
 }
 
+static size_t
+pdu_write_urw(struct p9_fcall *pdu, const char *kdata, const char __user *udata,
+                size_t size)
+{
+        BUG_ON(pdu->size > P9_IOHDRSZ);
+        pdu->pubuf = (char __user *)udata;
+        pdu->pkbuf = (char *)kdata;
+        pdu->pbuf_size = size;
+        return 0;
+}
+
+static size_t
+pdu_write_readdir(struct p9_fcall *pdu, const char *kdata, size_t size)
+{
+        BUG_ON(pdu->size > P9_READDIRHDRSZ);
+        pdu->pkbuf = (char *)kdata;
+        pdu->pbuf_size = size;
+        return 0;
+}
+
 /*
         b - int8_t
         w - int16_t
@@ -185,7 +205,7 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                 if (errcode)
                                         break;
 
-                                *sptr = kmalloc(len + 1, GFP_KERNEL);
+                                *sptr = kmalloc(len + 1, GFP_NOFS);
                                 if (*sptr == NULL) {
                                         errcode = -EFAULT;
                                         break;
@@ -245,7 +265,7 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                         }
                         break;
                 case 'T':{
-                                int16_t *nwname = va_arg(ap, int16_t *);
+                                uint16_t *nwname = va_arg(ap, uint16_t *);
                                 char ***wnames = va_arg(ap, char ***);
 
                                 errcode = p9pdu_readf(pdu, proto_version,
@@ -253,7 +273,7 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                 if (!errcode) {
                                         *wnames =
                                             kmalloc(sizeof(char *) * *nwname,
-                                                    GFP_KERNEL);
+                                                    GFP_NOFS);
                                         if (!*wnames)
                                                 errcode = -ENOMEM;
                                 }
@@ -297,7 +317,7 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                         *wqids =
                                             kmalloc(*nwqid *
                                                     sizeof(struct p9_qid),
-                                                    GFP_KERNEL);
+                                                    GFP_NOFS);
                                         if (*wqids == NULL)
                                                 errcode = -ENOMEM;
                                 }
@@ -445,6 +465,26 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                         errcode = -EFAULT;
                         }
                         break;
+                case 'E':{
+                                 int32_t cnt = va_arg(ap, int32_t);
+                                 const char *k = va_arg(ap, const void *);
+                                 const char __user *u = va_arg(ap,
+                                                        const void __user *);
+                                 errcode = p9pdu_writef(pdu, proto_version, "d",
+                                                 cnt);
+                                 if (!errcode && pdu_write_urw(pdu, k, u, cnt))
+                                        errcode = -EFAULT;
+                         }
+                         break;
+                case 'F':{
+                                 int32_t cnt = va_arg(ap, int32_t);
+                                 const char *k = va_arg(ap, const void *);
+                                 errcode = p9pdu_writef(pdu, proto_version, "d",
+                                                 cnt);
+                                 if (!errcode && pdu_write_readdir(pdu, k, cnt))
+                                        errcode = -EFAULT;
+                         }
+                         break;
                 case 'U':{
                                 int32_t count = va_arg(ap, int32_t);
                                 const char __user *udata =
@@ -456,7 +496,7 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
                         }
                         break;
                 case 'T':{
-                                int16_t nwname = va_arg(ap, int);
+                                uint16_t nwname = va_arg(ap, int);
                                 const char **wnames = va_arg(ap, const char **);
 
                                 errcode = p9pdu_writef(pdu, proto_version, "w",
@@ -579,6 +619,7 @@ EXPORT_SYMBOL(p9stat_read);
 
 int p9pdu_prepare(struct p9_fcall *pdu, int16_t tag, int8_t type)
 {
+        pdu->id = type;
         return p9pdu_writef(pdu, 0, "dbw", 0, type, tag);
 }
 
@@ -606,6 +647,10 @@ void p9pdu_reset(struct p9_fcall *pdu)
 {
         pdu->offset = 0;
         pdu->size = 0;
+        pdu->private = NULL;
+        pdu->pubuf = NULL;
+        pdu->pkbuf = NULL;
+        pdu->pbuf_size = 0;
 }
 
 int p9dirent_read(char *buf, int len, struct p9_dirent *dirent,