Commit 4ed4b547 authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'fixes' of git://git.linux-nfs.org/pub/linux/nfs-2.6

* 'fixes' of git://git.linux-nfs.org/pub/linux/nfs-2.6:
  NFS: Fix nfs_page use after free issues in fs/nfs/write.c
  NFSv4: Fix incorrect semaphore release in _nfs4_do_open()
  NFS: Fix Oopsable condition in nfs_readpage_sync()
parents 79e453d4 5c2d97cb
...@@ -970,7 +970,7 @@ static int _nfs4_do_open(struct inode *dir, struct dentry *dentry, int flags, st ...@@ -970,7 +970,7 @@ static int _nfs4_do_open(struct inode *dir, struct dentry *dentry, int flags, st
status = -ENOMEM; status = -ENOMEM;
opendata = nfs4_opendata_alloc(dentry, sp, flags, sattr); opendata = nfs4_opendata_alloc(dentry, sp, flags, sattr);
if (opendata == NULL) if (opendata == NULL)
goto err_put_state_owner; goto err_release_rwsem;
status = _nfs4_proc_open(opendata); status = _nfs4_proc_open(opendata);
if (status != 0) if (status != 0)
...@@ -989,11 +989,11 @@ static int _nfs4_do_open(struct inode *dir, struct dentry *dentry, int flags, st ...@@ -989,11 +989,11 @@ static int _nfs4_do_open(struct inode *dir, struct dentry *dentry, int flags, st
return 0; return 0;
err_opendata_free: err_opendata_free:
nfs4_opendata_free(opendata); nfs4_opendata_free(opendata);
err_release_rwsem:
up_read(&clp->cl_sem);
err_put_state_owner: err_put_state_owner:
nfs4_put_state_owner(sp); nfs4_put_state_owner(sp);
out_err: out_err:
/* Note: clp->cl_sem must be released before nfs4_put_open_state()! */
up_read(&clp->cl_sem);
*res = NULL; *res = NULL;
return status; return status;
} }
......
...@@ -204,9 +204,11 @@ static int nfs_readpage_sync(struct nfs_open_context *ctx, struct inode *inode, ...@@ -204,9 +204,11 @@ static int nfs_readpage_sync(struct nfs_open_context *ctx, struct inode *inode,
NFS_I(inode)->cache_validity |= NFS_INO_INVALID_ATIME; NFS_I(inode)->cache_validity |= NFS_INO_INVALID_ATIME;
spin_unlock(&inode->i_lock); spin_unlock(&inode->i_lock);
nfs_readpage_truncate_uninitialised_page(rdata); if (rdata->res.eof || rdata->res.count == rdata->args.count) {
if (rdata->res.eof || rdata->res.count == rdata->args.count)
SetPageUptodate(page); SetPageUptodate(page);
if (rdata->res.eof && count != 0)
memclear_highpage_flush(page, rdata->args.pgbase, count);
}
result = 0; result = 0;
io_error: io_error:
......
...@@ -590,8 +590,8 @@ static void nfs_cancel_commit_list(struct list_head *head) ...@@ -590,8 +590,8 @@ static void nfs_cancel_commit_list(struct list_head *head)
req = nfs_list_entry(head->next); req = nfs_list_entry(head->next);
nfs_list_remove_request(req); nfs_list_remove_request(req);
nfs_inode_remove_request(req); nfs_inode_remove_request(req);
nfs_clear_page_writeback(req);
dec_zone_page_state(req->wb_page, NR_UNSTABLE_NFS); dec_zone_page_state(req->wb_page, NR_UNSTABLE_NFS);
nfs_clear_page_writeback(req);
} }
} }
...@@ -1386,8 +1386,8 @@ nfs_commit_list(struct inode *inode, struct list_head *head, int how) ...@@ -1386,8 +1386,8 @@ nfs_commit_list(struct inode *inode, struct list_head *head, int how)
req = nfs_list_entry(head->next); req = nfs_list_entry(head->next);
nfs_list_remove_request(req); nfs_list_remove_request(req);
nfs_mark_request_commit(req); nfs_mark_request_commit(req);
nfs_clear_page_writeback(req);
dec_zone_page_state(req->wb_page, NR_UNSTABLE_NFS); dec_zone_page_state(req->wb_page, NR_UNSTABLE_NFS);
nfs_clear_page_writeback(req);
} }
return -ENOMEM; return -ENOMEM;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment