Fix i_mutex vs. readdir handling in nfsd

[safe/jmp/linux-2.6] / fs / nfsd / vfs.c

diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 46e6bd2..6c68ffd 100644 (file)
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1890,8 +1890,8 @@ static int nfsd_buffered_filldir(void *__buf, const char *name, int namlen,
        return 0;
 }
 
-static int nfsd_buffered_readdir(struct file *file, filldir_t func,
-                                struct readdir_cd *cdp, loff_t *offsetp)
+static __be32 nfsd_buffered_readdir(struct file *file, filldir_t func,
+                                   struct readdir_cd *cdp, loff_t *offsetp)
 {
        struct readdir_data buf;
        struct buffered_dirent *de;
@@ -1901,11 +1901,12 @@ static int nfsd_buffered_readdir(struct file *file, filldir_t func,
 
        buf.dirent = (void *)__get_free_page(GFP_KERNEL);
        if (!buf.dirent)
-               return -ENOMEM;
+               return nfserrno(-ENOMEM);
 
        offset = *offsetp;
 
        while (1) {
+               struct inode *dir_inode = file->f_path.dentry->d_inode;
                unsigned int reclen;
 
                cdp->err = nfserr_eof; /* will be cleared on successful read */
@@ -1924,26 +1925,38 @@ static int nfsd_buffered_readdir(struct file *file, filldir_t func,
                if (!size)
                        break;
 
+               /*
+                * Various filldir functions may end up calling back into
+                * lookup_one_len() and the file system's ->lookup() method.
+                * These expect i_mutex to be held, as it would within readdir.
+                */
+               host_err = mutex_lock_killable(&dir_inode->i_mutex);
+               if (host_err)
+                       break;
+
                de = (struct buffered_dirent *)buf.dirent;
                while (size > 0) {
                        offset = de->offset;
 
                        if (func(cdp, de->name, de->namlen, de->offset,
                                 de->ino, de->d_type))
-                               goto done;
+                               break;
 
                        if (cdp->err != nfs_ok)
-                               goto done;
+                               break;
 
                        reclen = ALIGN(sizeof(*de) + de->namlen,
                                       sizeof(u64));
                        size -= reclen;
                        de = (struct buffered_dirent *)((char *)de + reclen);
                }
+               mutex_unlock(&dir_inode->i_mutex);
+               if (size > 0) /* We bailed out early */
+                       break;
+
                offset = vfs_llseek(file, 0, SEEK_CUR);
        }
 
- done:
        free_page((unsigned long)(buf.dirent));
 
        if (host_err)