Introduction

diff ./net/sunrpc/svcauth_unix.c~current~ ./net/sunrpc/svcauth_unix.c
@@ -150,11 +150,14 @@ static void ip_map_request(struct cache_
 }
 
 static struct ip_map *ip_map_lookup(struct ip_map *, int);
+
 static int ip_map_parse(struct cache_detail *cd,
 			  char *mesg, int mlen)
 {
 	/* class ipaddress [domainname] */
-	char class[50], buf[50];
+	/* should be safe just to use the start of the input buffer
+	 * for scratch: */
+	char *buf = mesg;
 	int len;
 	int b1,b2,b3,b4;
 	char c;

@@ -167,13 +170,11 @@ static int ip_map_parse(struct cache_det
 	mesg[mlen-1] = 0;
 
 	/* class */
-	len = qword_get(&mesg, class, 50);
+	len = qword_get(&mesg, ipm.m_class, sizeof(ipm.m_class));
 	if (len <= 0) return -EINVAL;
-	if (len >= sizeof(ipm.m_class))
-		return -EINVAL;
 
 	/* ip address */
-	len = qword_get(&mesg, buf, 50);
+	len = qword_get(&mesg, buf, mlen);
 	if (len <= 0) return -EINVAL;
 
 	if (sscanf(buf, "%u.%u.%u.%u%c", &b1, &b2, &b3, &b4, &c) != 4)

@@ -184,7 +185,7 @@ static int ip_map_parse(struct cache_det
 		return -EINVAL;
 
 	/* domainname, or empty for NEGATIVE */
-	len = qword_get(&mesg, buf, 50);
+	len = qword_get(&mesg, buf, mlen);
 	if (len < 0) return -EINVAL;
 
 	if (len) {

@@ -194,7 +195,6 @@ static int ip_map_parse(struct cache_det
 	} else
 		dom = NULL;
 
-	strcpy(ipm.m_class, class);
 	ipm.m_addr.s_addr =
 		htonl((((((b1<<8)|b2)<<8)|b3)<<8)|b4);
 	ipm.h.flags = 0;

diff ./fs/nfsd/nfs4xdr.c~current~ ./fs/nfsd/nfs4xdr.c
@@ -825,7 +825,7 @@ nfsd4_decode_open_downgrade(struct nfsd4
 	DECODE_HEAD;
 		    
 	open_down->od_stateowner = NULL;
-	READ_BUF(4 + sizeof(stateid_t));
+	READ_BUF(12 + sizeof(stateid_t));
 	READ32(open_down->od_stateid.si_generation);
 	COPYMEM(&open_down->od_stateid.si_opaque, sizeof(stateid_opaque_t));
 	READ32(open_down->od_seqid);

diff ./net/sunrpc/svcauth_unix.c~current~ ./net/sunrpc/svcauth_unix.c
@@ -335,9 +335,13 @@ svcauth_null_accept(struct svc_rqst *rqs
 {
 	struct kvec	*argv = &rqstp->rq_arg.head[0];
 	struct kvec	*resv = &rqstp->rq_res.head[0];
+	struct svc_cred	*cred = &rqstp->rq_cred;
 	int		rv=0;
 	struct ip_map key, *ipm;
 
+	cred->cr_group_info = NULL;
+	rqstp->rq_client = NULL;
+
 	if (argv->iov_len < 3*4)
 		return SVC_GARBAGE;
 

@@ -353,23 +357,17 @@ svcauth_null_accept(struct svc_rqst *rqs
 	}
 
 	/* Signal that mapping to nobody uid/gid is required */
-	rqstp->rq_cred.cr_uid = (uid_t) -1;
-	rqstp->rq_cred.cr_gid = (gid_t) -1;
-	rqstp->rq_cred.cr_group_info = groups_alloc(0);
-	if (rqstp->rq_cred.cr_group_info == NULL)
+	cred->cr_uid = (uid_t) -1;
+	cred->cr_gid = (gid_t) -1;
+	cred->cr_group_info = groups_alloc(0);
+	if (cred->cr_group_info == NULL)
 		return SVC_DROP; /* kmalloc failure - client must retry */
 
-	/* Put NULL verifier */
-	svc_putu32(resv, RPC_AUTH_NULL);
-	svc_putu32(resv, 0);
-
 	strcpy(key.m_class, rqstp->rq_server->sv_program->pg_class);
 	key.m_addr = rqstp->rq_addr.sin_addr;
 
 	ipm = ip_map_lookup(&key, 0);
 
-	rqstp->rq_client = NULL;
-
 	if (ipm)
 		switch (cache_check(&ip_map_cache, &ipm->h, &rqstp->rq_chandle)) {
 		case -EAGAIN:

@@ -388,10 +386,18 @@ svcauth_null_accept(struct svc_rqst *rqs
 		}
 	else rv = SVC_DROP;
 
-	if (rqstp->rq_client == NULL && rqstp->rq_proc != 0)
-		*authp = rpc_autherr_badcred;
+	if (rv == SVC_OK && rqstp->rq_client == NULL && rqstp->rq_proc != 0)
+		goto badcred;
+
+	/* Put NULL verifier */
+	svc_putu32(resv, RPC_AUTH_NULL);
+	svc_putu32(resv, 0);
 
 	return rv;
+
+badcred:
+	*authp = rpc_autherr_badcred;
+	return SVC_DENIED;
 }
 
 static int

diff ./net/sunrpc/svcauth_unix.c~current~ ./net/sunrpc/svcauth_unix.c
@@ -329,6 +329,38 @@ void svcauth_unix_purge(void)
 	cache_purge(&auth_domain_cache);
 }
 
+int
+svcauth_unix_set_client(struct svc_rqst *rqstp)
+{
+	struct ip_map key, *ipm;
+
+	rqstp->rq_client = NULL;
+	if (rqstp->rq_proc == 0)
+		return SVC_OK;
+
+	strcpy(key.m_class, rqstp->rq_server->sv_program->pg_class);
+	key.m_addr = rqstp->rq_addr.sin_addr;
+
+	ipm = ip_map_lookup(&key, 0);
+
+	if (ipm == NULL)
+		return SVC_DENIED;
+
+	switch (cache_check(&ip_map_cache, &ipm->h, &rqstp->rq_chandle)) {
+		default:
+			BUG();
+		case -EAGAIN:
+			return SVC_DROP;
+		case -ENOENT:
+			return SVC_DENIED;
+		case 0:
+			rqstp->rq_client = &ipm->m_client->h;
+			cache_get(&rqstp->rq_client->h);
+			ip_map_put(&ipm->h, &ip_map_cache);
+			break;
+	}
+	return SVC_OK;
+}
 
 static int
 svcauth_null_accept(struct svc_rqst *rqstp, u32 *authp)

@@ -337,7 +369,6 @@ svcauth_null_accept(struct svc_rqst *rqs
 	struct kvec	*resv = &rqstp->rq_res.head[0];
 	struct svc_cred	*cred = &rqstp->rq_cred;
 	int		rv=0;
-	struct ip_map key, *ipm;
 
 	cred->cr_group_info = NULL;
 	rqstp->rq_client = NULL;

@@ -363,30 +394,8 @@ svcauth_null_accept(struct svc_rqst *rqs
 	if (cred->cr_group_info == NULL)
 		return SVC_DROP; /* kmalloc failure - client must retry */
 
-	strcpy(key.m_class, rqstp->rq_server->sv_program->pg_class);
-	key.m_addr = rqstp->rq_addr.sin_addr;
-
-	ipm = ip_map_lookup(&key, 0);
-
-	if (ipm)
-		switch (cache_check(&ip_map_cache, &ipm->h, &rqstp->rq_chandle)) {
-		case -EAGAIN:
-			rv = SVC_DROP;
-			break;
-		case -ENOENT:
-			rv = SVC_OK; /* rq_client is NULL */
-			break;
-		case 0:
-			rqstp->rq_client = &ipm->m_client->h;
-			cache_get(&rqstp->rq_client->h);
-			ip_map_put(&ipm->h, &ip_map_cache);
-			rv = SVC_OK;
-			break;
-		default: BUG();
-		}
-	else rv = SVC_DROP;
-
-	if (rv == SVC_OK && rqstp->rq_client == NULL && rqstp->rq_proc != 0)
+	rv = svcauth_unix_set_client(rqstp);
+	if (rv == SVC_DENIED)
 		goto badcred;
 
 	/* Put NULL verifier */

@@ -432,7 +441,6 @@ svcauth_unix_accept(struct svc_rqst *rqs
 	u32		slen, i;
 	int		len   = argv->iov_len;
 	int		rv=0;
-	struct ip_map key, *ipm;
 
 	cred->cr_group_info = NULL;
 	rqstp->rq_client = NULL;

@@ -464,32 +472,8 @@ svcauth_unix_accept(struct svc_rqst *rqs
 		return SVC_DENIED;
 	}
 
-
-	strcpy(key.m_class, rqstp->rq_server->sv_program->pg_class);
-	key.m_addr = rqstp->rq_addr.sin_addr;
-
-
-	ipm = ip_map_lookup(&key, 0);
-
-	if (ipm)
-		switch (cache_check(&ip_map_cache, &ipm->h, &rqstp->rq_chandle)) {
-		case -EAGAIN:
-			rv = SVC_DROP;
-			break;
-		case -ENOENT:
-			rv = SVC_OK; /* rq_client is NULL */
-			break;
-		case 0:
-			rqstp->rq_client = &ipm->m_client->h;
-			cache_get(&rqstp->rq_client->h);
-			ip_map_put(&ipm->h, &ip_map_cache);
-			rv = SVC_OK;
-			break;
-		default: BUG();
-		}
-	else rv = SVC_DROP;
-
-	if (rv  == SVC_OK && rqstp->rq_client == NULL && rqstp->rq_proc != 0)
+	rv = svcauth_unix_set_client(rqstp);
+	if (rv == SVC_DENIED)
 		goto badcred;
 
 	/* Put NULL verifier */

diff ./fs/nfsd/nfs4xdr.c~current~ ./fs/nfsd/nfs4xdr.c
@@ -1814,8 +1814,7 @@ nfsd4_encode_dirent(struct readdir_cd *c
 
 	exp_get(exp);
 	if (d_mountpoint(dentry)) {
-		if ((nfserr = nfsd_cross_mnt(cd->rd_rqstp, &dentry,
-				 &exp))) {
+		if (nfsd_cross_mnt(cd->rd_rqstp, &dentry, &exp)) {
 		/*
 		 * -EAGAIN is the only error returned from
 		 * nfsd_cross_mnt() and it indicates that an

diff ./fs/nfsd/nfsproc.c~current~ ./fs/nfsd/nfsproc.c
@@ -586,7 +586,6 @@ nfserrno (int errno)
 		{ nfserr_dquot, -EDQUOT },
 #endif
 		{ nfserr_stale, -ESTALE },
-		{ nfserr_jukebox, -EWOULDBLOCK },
 		{ nfserr_jukebox, -ETIMEDOUT },
 		{ nfserr_dropit, -EAGAIN },
 		{ nfserr_dropit, -ENOMEM },

diff ./fs/nfsd/vfs.c~current~ ./fs/nfsd/vfs.c
@@ -304,6 +304,8 @@ nfsd_setattr(struct svc_rqst *rqstp, str
 		 * we need to break all leases.
 		 */
 		err = break_lease(inode, FMODE_WRITE | O_NONBLOCK);
+		if (err == -EWOULDBLOCK)
+			err = -ETIMEDOUT;
 		if (err) /* ENOMEM or EWOULDBLOCK */
 			goto out_nfserr;
 

@@ -668,6 +670,8 @@ nfsd_open(struct svc_rqst *rqstp, struct
 	 * This may block while leases are broken.
 	 */
 	err = break_lease(inode, O_NONBLOCK | ((access & MAY_WRITE) ? FMODE_WRITE : 0));
+	if (err == -EWOULDBLOCK)
+		err = -ETIMEDOUT;
 	if (err) /* NOMEM or WOULDBLOCK */
 		goto out_nfserr;
 

diff ./fs/nfsd/nfs4xdr.c~current~ ./fs/nfsd/nfs4xdr.c
@@ -1800,7 +1800,7 @@ nfsd4_encode_dirent(struct readdir_cd *c
 	 */
 	bmval0 = cd->rd_bmval[0];
 	bmval1 = cd->rd_bmval[1];
-	if ((bmval0 & ~(FATTR4_WORD0_RDATTR_ERROR | FATTR4_WORD0_FILEID)) || bmval1)  {
+	if ((bmval0 & ~(FATTR4_WORD0_RDATTR_ERROR)) || bmval1)  {
 		/*
 		 * "Heavyweight" case: we have no choice except to
 		 * call nfsd4_encode_fattr(). 

@@ -1876,8 +1876,6 @@ error:
 	attrlenp = p++;
 	if (bmval0 & FATTR4_WORD0_RDATTR_ERROR)
 		*p++ = nfserr;       /* no htonl */
-	if (bmval0 & FATTR4_WORD0_FILEID)
-		p = xdr_encode_hyper(p, (u64)ino);
 	*attrlenp = htonl((char *)p - (char *)attrlenp - 4);
 
 out:

diff ./fs/nfsd/nfs4xdr.c~current~ ./fs/nfsd/nfs4xdr.c
@@ -1779,7 +1779,6 @@ nfsd4_encode_dirent(struct readdir_cd *c
 	u32 *attrlenp;
 	struct dentry *dentry;
 	struct svc_export *exp = cd->rd_fhp->fh_export;
-	u32 bmval0, bmval1;
 	int nfserr = 0;
 
 	/* In nfsv4, "." and ".." never make it onto the wire.. */

@@ -1803,9 +1802,6 @@ nfsd4_encode_dirent(struct readdir_cd *c
 	/*
 	 * Now we come to the ugly part: writing the fattr for this entry.
 	 */
-	bmval0 = cd->rd_bmval[0];
-	bmval1 = cd->rd_bmval[1];
-
 	dentry = lookup_one_len(name, cd->rd_fhp->fh_dentry, namlen);
 	if (IS_ERR(dentry)) {
 		nfserr = nfserrno(PTR_ERR(dentry));

@@ -1852,19 +1848,16 @@ error:
 	 * then in accordance with the spec, we fail the
 	 * entire READDIR operation(!)
 	 */
-	if (!(bmval0 & FATTR4_WORD0_RDATTR_ERROR)) {
+	if (!(cd->rd_bmval[0] & FATTR4_WORD0_RDATTR_ERROR)) {
 		cd->common.err = nfserr;
 		return -EINVAL;
 	}
 
-	bmval0 = FATTR4_WORD0_RDATTR_ERROR;
-	bmval1 = 0;
-
 	if (buflen < 6)
 		goto nospc;
 	*p++ = htonl(2);
-	*p++ = htonl(bmval0);
-	*p++ = htonl(bmval1);
+	*p++ = htonl(FATTR4_WORD0_RDATTR_ERROR); /* bmval0 */
+	*p++ = htonl(0);			 /* bmval1 */
 
 	attrlenp = p++;
 	*p++ = nfserr;       /* no htonl */

diff ./fs/nfsd/nfs4xdr.c~current~ ./fs/nfsd/nfs4xdr.c
@@ -1770,6 +1770,46 @@ out_serverfault:
 }
 
 static int
+nfsd4_encode_dirent_fattr(struct nfsd4_readdir *cd,
+		const char *name, int namlen, u32 *p, int *buflen)
+{
+	struct svc_export *exp = cd->rd_fhp->fh_export;
+	struct dentry *dentry;
+	int nfserr;
+
+	dentry = lookup_one_len(name, cd->rd_fhp->fh_dentry, namlen);
+	if (IS_ERR(dentry)) {
+		nfserr = nfserrno(PTR_ERR(dentry));
+		return nfserr;
+	}
+
+	exp_get(exp);
+	if (d_mountpoint(dentry)) {
+		if (nfsd_cross_mnt(cd->rd_rqstp, &dentry, &exp)) {
+		/*
+		 * -EAGAIN is the only error returned from
+		 * nfsd_cross_mnt() and it indicates that an
+		 * up-call has  been initiated to fill in the export
+		 * options on exp.  When the answer comes back,
+		 * this call will be retried.
+		 */
+			dput(dentry);
+			exp_put(exp);
+			nfserr = nfserr_dropit;
+			return nfserr;
+		}
+
+	}
+
+	nfserr = nfsd4_encode_fattr(NULL, exp,
+			dentry, p, buflen, cd->rd_bmval,
+			cd->rd_rqstp);
+	dput(dentry);
+	exp_put(exp);
+	return nfserr;
+}
+
+static int
 nfsd4_encode_dirent(struct readdir_cd *ccd, const char *name, int namlen,
 		    loff_t offset, ino_t ino, unsigned int d_type)
 {

@@ -1777,8 +1817,6 @@ nfsd4_encode_dirent(struct readdir_cd *c
 	int buflen;
 	u32 *p = cd->buffer;
 	u32 *attrlenp;
-	struct dentry *dentry;
-	struct svc_export *exp = cd->rd_fhp->fh_export;
 	int nfserr = 0;
 
 	/* In nfsv4, "." and ".." never make it onto the wire.. */

@@ -1802,35 +1840,7 @@ nfsd4_encode_dirent(struct readdir_cd *c
 	/*
 	 * Now we come to the ugly part: writing the fattr for this entry.
 	 */
-	dentry = lookup_one_len(name, cd->rd_fhp->fh_dentry, namlen);
-	if (IS_ERR(dentry)) {
-		nfserr = nfserrno(PTR_ERR(dentry));
-		goto error;
-	}
-
-	exp_get(exp);
-	if (d_mountpoint(dentry)) {
-		if (nfsd_cross_mnt(cd->rd_rqstp, &dentry, &exp)) {
-		/*
-		 * -EAGAIN is the only error returned from
-		 * nfsd_cross_mnt() and it indicates that an
-		 * up-call has  been initiated to fill in the export
-		 * options on exp.  When the answer comes back,
-		 * this call will be retried.
-		 */
-			dput(dentry);
-			exp_put(exp);
-			nfserr = nfserr_dropit;
-			goto error;
-		}
-
-	}
-
-	nfserr = nfsd4_encode_fattr(NULL, exp,
-			dentry, p, &buflen, cd->rd_bmval,
-			cd->rd_rqstp);
-	dput(dentry);
-	exp_put(exp);
+	nfserr = nfsd4_encode_dirent_fattr(cd, name, namlen, p, &buflen);
 	if (!nfserr) {
 		p += buflen;
 		goto out;

@@ -1838,7 +1848,6 @@ nfsd4_encode_dirent(struct readdir_cd *c
 	if (nfserr == nfserr_resource)
 		goto nospc;
 
-error:
 	/*
 	 * If we get here, we experienced a miscellaneous
 	 * failure while writing the attributes.  If the

diff ./net/sunrpc/auth_gss/svcauth_gss.c~current~ ./net/sunrpc/auth_gss/svcauth_gss.c
@@ -958,7 +958,7 @@ svcauth_gss_release(struct svc_rqst *rqs
 	if (gc->gc_proc != RPC_GSS_PROC_DATA)
 		goto out;
 	/* Release can be called twice, but we only wrap once. */
-	if (gsd->body_start == 0)
+	if (gsd->body_start == NULL)
 		goto out;
 	/* normally not set till svc_send, but we need it here: */
 	resbuf->len = resbuf->head[0].iov_len

diff ./fs/nfsd/nfs4xdr.c~current~ ./fs/nfsd/nfs4xdr.c
@@ -1425,7 +1425,7 @@ nfsd4_encode_fattr(struct svc_fh *fhp, s
 		if (status)
 			goto out_nfserr;
 	}
-	if ((bmval0 & FATTR4_WORD0_FILEHANDLE) && !fhp) {
+	if ((bmval0 & (FATTR4_WORD0_FILEHANDLE | FATTR4_WORD0_FSID)) && !fhp) {
 		fh_init(&tempfh, NFS4_FHSIZE);
 		status = fh_compose(&tempfh, exp, dentry, NULL);
 		if (status)

@@ -1508,10 +1508,15 @@ nfsd4_encode_fattr(struct svc_fh *fhp, s
 	if (bmval0 & FATTR4_WORD0_FSID) {
 		if ((buflen -= 16) < 0)
 			goto out_resource;
-		WRITE32(0);
-		WRITE32(MAJOR(stat.dev));
-		WRITE32(0);
-		WRITE32(MINOR(stat.dev));
+		if (is_fsid(fhp, rqstp->rq_reffh)) {
+			WRITE64((u64)exp->ex_fsid);
+			WRITE64((u64)0);
+		} else {
+			WRITE32(0);
+			WRITE32(MAJOR(stat.dev));
+			WRITE32(0);
+			WRITE32(MINOR(stat.dev));
+		}
 	}
 	if (bmval0 & FATTR4_WORD0_UNIQUE_HANDLES) {
 		if ((buflen -= 4) < 0)

diff ./fs/nfsd/nfs4xdr.c~current~ ./fs/nfsd/nfs4xdr.c
@@ -1805,73 +1805,62 @@ nfsd4_encode_dirent(struct readdir_cd *c
 	 */
 	bmval0 = cd->rd_bmval[0];
 	bmval1 = cd->rd_bmval[1];
-	if ((bmval0 & ~(FATTR4_WORD0_RDATTR_ERROR)) || bmval1)  {
-		/*
-		 * "Heavyweight" case: we have no choice except to
-		 * call nfsd4_encode_fattr(). 
-		 */
-		dentry = lookup_one_len(name, cd->rd_fhp->fh_dentry, namlen);
-		if (IS_ERR(dentry)) {
-			nfserr = nfserrno(PTR_ERR(dentry));
-			goto error;
-		}
-
-		exp_get(exp);
-		if (d_mountpoint(dentry)) {
-			if ((nfserr = nfsd_cross_mnt(cd->rd_rqstp, &dentry, 
-					 &exp))) {	
-			/* 
-			 * -EAGAIN is the only error returned from 
-			 * nfsd_cross_mnt() and it indicates that an 
-			 * up-call has  been initiated to fill in the export 
-			 * options on exp.  When the answer comes back,
-			 * this call will be retried.
-			 */
-				dput(dentry);
-				exp_put(exp);
-				nfserr = nfserr_dropit;
-				goto error;
-			}
 
-		}
-
-		nfserr = nfsd4_encode_fattr(NULL, exp,
-				dentry, p, &buflen, cd->rd_bmval,
-				cd->rd_rqstp);
-		dput(dentry);
-		exp_put(exp);
-		if (!nfserr) {
-			p += buflen;
-			goto out;
-		}
-		if (nfserr == nfserr_resource)
-			goto nospc;
+	dentry = lookup_one_len(name, cd->rd_fhp->fh_dentry, namlen);
+	if (IS_ERR(dentry)) {
+		nfserr = nfserrno(PTR_ERR(dentry));
+		goto error;
+	}
 
-error:
+	exp_get(exp);
+	if (d_mountpoint(dentry)) {
+		if ((nfserr = nfsd_cross_mnt(cd->rd_rqstp, &dentry,
+				 &exp))) {
 		/*
-		 * If we get here, we experienced a miscellaneous
-		 * failure while writing the attributes.  If the
-		 * client requested the RDATTR_ERROR attribute,
-		 * we stuff the error code into this attribute
-		 * and continue.  If this attribute was not requested,
-		 * then in accordance with the spec, we fail the
-		 * entire READDIR operation(!)
+		 * -EAGAIN is the only error returned from
+		 * nfsd_cross_mnt() and it indicates that an
+		 * up-call has  been initiated to fill in the export
+		 * options on exp.  When the answer comes back,
+		 * this call will be retried.
 		 */
-		if (!(bmval0 & FATTR4_WORD0_RDATTR_ERROR)) {
-			cd->common.err = nfserr;
-			return -EINVAL;
+			dput(dentry);
+			exp_put(exp);
+			nfserr = nfserr_dropit;
+			goto error;
 		}
 
-		bmval0 = FATTR4_WORD0_RDATTR_ERROR;
-		bmval1 = 0;
-		/* falling through here will do the right thing... */
 	}
 
+	nfserr = nfsd4_encode_fattr(NULL, exp,
+			dentry, p, &buflen, cd->rd_bmval,
+			cd->rd_rqstp);
+	dput(dentry);
+	exp_put(exp);
+	if (!nfserr) {
+		p += buflen;
+		goto out;
+	}
+	if (nfserr == nfserr_resource)
+		goto nospc;
+
+error:
 	/*
-	 * In the common "lightweight" case, we avoid
-	 * the overhead of nfsd4_encode_fattr() by assembling
-	 * a small fattr by hand.
+	 * If we get here, we experienced a miscellaneous
+	 * failure while writing the attributes.  If the
+	 * client requested the RDATTR_ERROR attribute,
+	 * we stuff the error code into this attribute
+	 * and continue.  If this attribute was not requested,
+	 * then in accordance with the spec, we fail the
+	 * entire READDIR operation(!)
 	 */
+	if (!(bmval0 & FATTR4_WORD0_RDATTR_ERROR)) {
+		cd->common.err = nfserr;
+		return -EINVAL;
+	}
+
+	bmval0 = FATTR4_WORD0_RDATTR_ERROR;
+	bmval1 = 0;
+
 	if (buflen < 6)
 		goto nospc;
 	*p++ = htonl(2);

@@ -1879,8 +1868,7 @@ error:
 	*p++ = htonl(bmval1);
 
 	attrlenp = p++;
-	if (bmval0 & FATTR4_WORD0_RDATTR_ERROR)
-		*p++ = nfserr;       /* no htonl */
+	*p++ = nfserr;       /* no htonl */
 	*attrlenp = htonl((char *)p - (char *)attrlenp - 4);
 
 out:

diff ./fs/nfsd/nfs4xdr.c~current~ ./fs/nfsd/nfs4xdr.c
@@ -1778,10 +1778,8 @@ nfsd4_encode_dirent_fattr(struct nfsd4_r
 	int nfserr;
 
 	dentry = lookup_one_len(name, cd->rd_fhp->fh_dentry, namlen);
-	if (IS_ERR(dentry)) {
-		nfserr = nfserrno(PTR_ERR(dentry));
-		return nfserr;
-	}
+	if (IS_ERR(dentry))
+		return nfserrno(PTR_ERR(dentry));
 
 	exp_get(exp);
 	if (d_mountpoint(dentry)) {

@@ -1793,10 +1791,8 @@ nfsd4_encode_dirent_fattr(struct nfsd4_r
 		 * options on exp.  When the answer comes back,
 		 * this call will be retried.
 		 */
-			dput(dentry);
-			exp_put(exp);
 			nfserr = nfserr_dropit;
-			return nfserr;
+			goto out_put;
 		}
 
 	}

@@ -1804,6 +1800,7 @@ nfsd4_encode_dirent_fattr(struct nfsd4_r
 	nfserr = nfsd4_encode_fattr(NULL, exp,
 			dentry, p, buflen, cd->rd_bmval,
 			cd->rd_rqstp);
+out_put:
 	dput(dentry);
 	exp_put(exp);
 	return nfserr;

diff ./fs/nfsd/nfs4xdr.c~current~ ./fs/nfsd/nfs4xdr.c
@@ -1830,7 +1830,7 @@ nfsd4_encode_dirent(struct readdir_cd *c
 	struct nfsd4_readdir *cd = container_of(ccd, struct nfsd4_readdir, common);
 	int buflen;
 	u32 *p = cd->buffer;
-	int nfserr = 0;
+	int nfserr = nfserr_toosmall;
 
 	/* In nfsv4, "." and ".." never make it onto the wire.. */
 	if (name && isdotent(name, namlen)) {

@@ -1843,7 +1843,7 @@ nfsd4_encode_dirent(struct readdir_cd *c
 
 	buflen = cd->buflen - 4 - XDR_QUADLEN(namlen);
 	if (buflen < 0)
-		goto nospc;
+		goto fail;
 
 	*p++ = xdr_one;                             /* mark entry present */
 	cd->offset = p;                             /* remember pointer */

@@ -1858,8 +1858,10 @@ nfsd4_encode_dirent(struct readdir_cd *c
 		p += buflen;
 		goto out;
 	}
-	if (nfserr == nfserr_resource)
-		goto nospc;
+	if (nfserr == nfserr_resource) {
+		nfserr = nfserr_toosmall;
+		goto fail;
+	}
 
 	/*
 	 * If we get here, we experienced a miscellaneous

@@ -1870,13 +1872,12 @@ nfsd4_encode_dirent(struct readdir_cd *c
 	 * then in accordance with the spec, we fail the
 	 * entire READDIR operation(!)
 	 */
-	if (!(cd->rd_bmval[0] & FATTR4_WORD0_RDATTR_ERROR)) {
-		cd->common.err = nfserr;
-		return -EINVAL;
-	}
+	if (!(cd->rd_bmval[0] & FATTR4_WORD0_RDATTR_ERROR))
+		goto fail;
+	nfserr = nfserr_toosmall;
 	p = nfsd4_encode_rdattr_error(p, buflen, nfserr);
 	if (p == NULL)
-		goto out_nospc;
+		goto fail;
 
 out:
 	cd->buflen -= (p - cd->buffer);

@@ -1884,8 +1885,8 @@ out:
 	cd->common.err = nfs_ok;
 	return 0;
 
-nospc:
-	cd->common.err = nfserr_toosmall;
+fail:
+	cd->common.err = nfserr;
 	return -EINVAL;
 }
 

diff ./fs/nfsd/nfs4xdr.c~current~ ./fs/nfsd/nfs4xdr.c
@@ -1806,6 +1806,23 @@ out_put:
 	return nfserr;
 }
 
+static u32 *
+nfsd4_encode_rdattr_error(u32 *p, int buflen, int nfserr)
+{
+	u32 *attrlenp;
+
+	if (buflen < 6)
+		return NULL;
+	*p++ = htonl(2);
+	*p++ = htonl(FATTR4_WORD0_RDATTR_ERROR); /* bmval0 */
+	*p++ = htonl(0);			 /* bmval1 */
+
+	attrlenp = p++;
+	*p++ = nfserr;       /* no htonl */
+	*attrlenp = htonl((char *)p - (char *)attrlenp - 4);
+	return p;
+}
+
 static int
 nfsd4_encode_dirent(struct readdir_cd *ccd, const char *name, int namlen,
 		    loff_t offset, ino_t ino, unsigned int d_type)

@@ -1813,7 +1830,6 @@ nfsd4_encode_dirent(struct readdir_cd *c
 	struct nfsd4_readdir *cd = container_of(ccd, struct nfsd4_readdir, common);
 	int buflen;
 	u32 *p = cd->buffer;
-	u32 *attrlenp;
 	int nfserr = 0;
 
 	/* In nfsv4, "." and ".." never make it onto the wire.. */

@@ -1858,16 +1874,9 @@ nfsd4_encode_dirent(struct readdir_cd *c
 		cd->common.err = nfserr;
 		return -EINVAL;
 	}
-
-	if (buflen < 6)
-		goto nospc;
-	*p++ = htonl(2);
-	*p++ = htonl(FATTR4_WORD0_RDATTR_ERROR); /* bmval0 */
-	*p++ = htonl(0);			 /* bmval1 */
-
-	attrlenp = p++;
-	*p++ = nfserr;       /* no htonl */
-	*attrlenp = htonl((char *)p - (char *)attrlenp - 4);
+	p = nfsd4_encode_rdattr_error(p, buflen, nfserr);
+	if (p == NULL)
+		goto out_nospc;
 
 out:
 	cd->buflen -= (p - cd->buffer);

diff ./fs/nfsd/nfs4xdr.c~current~ ./fs/nfsd/nfs4xdr.c
@@ -1796,10 +1796,8 @@ nfsd4_encode_dirent_fattr(struct nfsd4_r
 		}
 
 	}
-
-	nfserr = nfsd4_encode_fattr(NULL, exp,
-			dentry, p, buflen, cd->rd_bmval,
-			cd->rd_rqstp);
+	nfserr = nfsd4_encode_fattr(NULL, exp, dentry, p, buflen, cd->rd_bmval,
+					cd->rd_rqstp);
 out_put:
 	dput(dentry);
 	exp_put(exp);

@@ -1850,9 +1848,6 @@ nfsd4_encode_dirent(struct readdir_cd *c
 	p = xdr_encode_hyper(p, NFS_OFFSET_MAX);    /* offset of next entry */
 	p = xdr_encode_array(p, name, namlen);      /* name length & name */
 
-	/*
-	 * Now we come to the ugly part: writing the fattr for this entry.
-	 */
 	nfserr = nfsd4_encode_dirent_fattr(cd, name, namlen, p, &buflen);
 	switch (nfserr) {
 	case nfs_ok:

@@ -1865,9 +1860,7 @@ nfsd4_encode_dirent(struct readdir_cd *c
 		goto fail;
 	default:
 		/*
-		 * If we get here, we experienced a miscellaneous
-		 * failure while writing the attributes.  If the
-		 * client requested the RDATTR_ERROR attribute,
+		 * If the client requested the RDATTR_ERROR attribute,
 		 * we stuff the error code into this attribute
 		 * and continue.  If this attribute was not requested,
 		 * then in accordance with the spec, we fail the

@@ -1880,12 +1873,10 @@ nfsd4_encode_dirent(struct readdir_cd *c
 		if (p == NULL)
 			goto fail;
 	}
-
 	cd->buflen -= (p - cd->buffer);
 	cd->buffer = p;
 	cd->common.err = nfs_ok;
 	return 0;
-
 fail:
 	cd->common.err = nfserr;
 	return -EINVAL;

diff ./fs/nfsd/nfs4xdr.c~current~ ./fs/nfsd/nfs4xdr.c
@@ -1854,32 +1854,31 @@ nfsd4_encode_dirent(struct readdir_cd *c
 	 * Now we come to the ugly part: writing the fattr for this entry.
 	 */
 	nfserr = nfsd4_encode_dirent_fattr(cd, name, namlen, p, &buflen);
-	if (!nfserr) {
+	switch (nfserr) {
+	case nfs_ok:
 		p += buflen;
-		goto out;
-	}
-	if (nfserr == nfserr_resource) {
+		break;
+	case nfserr_resource:
 		nfserr = nfserr_toosmall;
 		goto fail;
+	default:
+		/*
+		 * If we get here, we experienced a miscellaneous
+		 * failure while writing the attributes.  If the
+		 * client requested the RDATTR_ERROR attribute,
+		 * we stuff the error code into this attribute
+		 * and continue.  If this attribute was not requested,
+		 * then in accordance with the spec, we fail the
+		 * entire READDIR operation(!)
+		 */
+		if (!(cd->rd_bmval[0] & FATTR4_WORD0_RDATTR_ERROR))
+			goto fail;
+		nfserr = nfserr_toosmall;
+		p = nfsd4_encode_rdattr_error(p, buflen, nfserr);
+		if (p == NULL)
+			goto fail;
 	}
 
-	/*
-	 * If we get here, we experienced a miscellaneous
-	 * failure while writing the attributes.  If the
-	 * client requested the RDATTR_ERROR attribute,
-	 * we stuff the error code into this attribute
-	 * and continue.  If this attribute was not requested,
-	 * then in accordance with the spec, we fail the
-	 * entire READDIR operation(!)
-	 */
-	if (!(cd->rd_bmval[0] & FATTR4_WORD0_RDATTR_ERROR))
-		goto fail;
-	nfserr = nfserr_toosmall;
-	p = nfsd4_encode_rdattr_error(p, buflen, nfserr);
-	if (p == NULL)
-		goto fail;
-
-out:
 	cd->buflen -= (p - cd->buffer);
 	cd->buffer = p;
 	cd->common.err = nfs_ok;

diff ./fs/nfsd/nfs4xdr.c~current~ ./fs/nfsd/nfs4xdr.c
@@ -1861,6 +1861,8 @@ nfsd4_encode_dirent(struct readdir_cd *c
 	case nfserr_resource:
 		nfserr = nfserr_toosmall;
 		goto fail;
+	case nfserr_dropit:
+		goto fail;
 	default:
 		/*
 		 * If we get here, we experienced a miscellaneous