4 files changed, 24 insertions, 8 deletions

diff --git a/net/sunrpc/addr.c b/net/sunrpc/addr.c
index 6dcdd2517819..f845d9d72f73 100644
--- a/net/sunrpc/addr.c
+++ b/net/sunrpc/addr.c
@@ -71,8 +71,9 @@ static size_t rpc_ntop6(const struct sockaddr *sap,
         if (unlikely(len == 0))
                 return len;
 
-        if (!(ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_LINKLOCAL) &&
-            !(ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_SITELOCAL))
+        if (!(ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_LINKLOCAL))
+                return len;
+        if (sin6->sin6_scope_id == 0)
                 return len;
 
         rc = snprintf(scopebuf, sizeof(scopebuf), "%c%u",
@@ -165,8 +166,7 @@ static int rpc_parse_scope_id(const char *buf, const size_t buflen,
         if (*delim != IPV6_SCOPE_DELIMITER)
                 return 0;
 
-        if (!(ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_LINKLOCAL) &&
-            !(ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_SITELOCAL))
+        if (!(ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_LINKLOCAL))
                 return 0;
 
         len = (buf + buflen) - delim - 1;
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index f7a7f8380e38..0cfccc2a0297 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -206,8 +206,14 @@ gss_fill_context(const void *p, const void *end, struct gss_cl_ctx *ctx, struct
         ctx->gc_win = window_size;
         /* gssd signals an error by passing ctx->gc_win = 0: */
         if (ctx->gc_win == 0) {
-                /* in which case, p points to  an error code which we ignore */
-                p = ERR_PTR(-EACCES);
+                /*
+                 * in which case, p points to an error code. Anything other
+                 * than -EKEYEXPIRED gets converted to -EACCES.
+                 */
+                p = simple_get_bytes(p, end, &ret, sizeof(ret));
+                if (!IS_ERR(p))
+                        p = (ret == -EKEYEXPIRED) ? ERR_PTR(-EKEYEXPIRED) :
+                                                    ERR_PTR(-EACCES);
                 goto err;
         }
         /* copy the opaque wire context */
@@ -646,6 +652,7 @@ gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
                 err = PTR_ERR(p);
                 switch (err) {
                 case -EACCES:
+                case -EKEYEXPIRED:
                         gss_msg->msg.errno = err;
                         err = mlen;
                         break;
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 538ca433a56c..6dcf8c9c784c 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -506,6 +506,10 @@ svc_init_buffer(struct svc_rqst *rqstp, unsigned int size)
 {
         unsigned int pages, arghi;
 
+        /* bc_xprt uses fore channel allocated buffers */
+        if (svc_is_backchannel(rqstp))
+                return 1;
+
         pages = size / PAGE_SIZE + 1; /* extra page as we hold both request and reply.
                                        * We assume one is at most one page
                                        */
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 3d739e5d15d8..712412982cee 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -1912,6 +1912,11 @@ static void xs_tcp_setup_socket(struct rpc_xprt *xprt,
         case -EALREADY:
                 xprt_clear_connecting(xprt);
                 return;
+        case -EINVAL:
+                /* Happens, for instance, if the user specified a link
+                 * local IPv6 address without a scope-id.
+                 */
+                goto out;
         }
 out_eagain:
         status = -EAGAIN;
@@ -2100,7 +2105,7 @@ static void xs_tcp_print_stats(struct rpc_xprt *xprt, struct seq_file *seq)
  * we allocate pages instead doing a kmalloc like rpc_malloc is because we want
  * to use the server side send routines.
  */
-void *bc_malloc(struct rpc_task *task, size_t size)
+static void *bc_malloc(struct rpc_task *task, size_t size)
 {
         struct page *page;
         struct rpc_buffer *buf;
@@ -2120,7 +2125,7 @@ void *bc_malloc(struct rpc_task *task, size_t size)
 /*
  * Free the space allocated in the bc_alloc routine
  */
-void bc_free(void *buffer)
+static void bc_free(void *buffer)
 {
         struct rpc_buffer *buf;