--- fs/nfsd/nfs4xdr.c

+++ fs/nfsd/nfs4xdr.c

@@ -168,10 +168,10 @@ static __be32 *read_buf(struct nfsd4_com

argp->p = page_address(argp->pagelist[0]);

argp->pagelist++;

if (argp->pagelen < PAGE_SIZE) {

- argp->end = p + (argp->pagelen>>2);

+ argp->end = argp->p + (argp->pagelen>>2);

argp->pagelen = 0;

} else {

- argp->end = p + (PAGE_SIZE>>2);

+ argp->end = argp->p + (PAGE_SIZE>>2);

argp->pagelen -= PAGE_SIZE;

}

memcpy(((char*)p)+avail, argp->p, (nbytes - avail));

@@ -1433,10 +1433,10 @@ nfsd4_decode_compound(struct nfsd4_compo

argp->p = page_address(argp->pagelist[0]);

argp->pagelist++;

if (argp->pagelen < PAGE_SIZE) {

- argp->end = p + (argp->pagelen>>2);

+ argp->end = argp->p + (argp->pagelen>>2);

argp->pagelen = 0;

} else {

- argp->end = p + (PAGE_SIZE>>2);

+ argp->end = argp->p + (PAGE_SIZE>>2);

argp->pagelen -= PAGE_SIZE;

}

}

@@ -2129,9 +2129,15 @@ out_acl:

* and this is the root of a cross-mounted filesystem.

*/

if (ignore_crossmnt == 0 &&

- exp->ex_path.mnt->mnt_root->d_inode == dentry->d_inode) {

- err = vfs_getattr(exp->ex_path.mnt->mnt_parent,

- exp->ex_path.mnt->mnt_mountpoint, &stat);

+ dentry == exp->ex_path.mnt->mnt_root) {

+ struct path path = exp->ex_path;

+ path_get(&path);

+ while (follow_up(&path)) {

+ if (path.dentry != path.mnt->mnt_root)

+ break;

+ }

+ err = vfs_getattr(path.mnt, path.dentry, &stat);

+ path_put(&path);

if (err)

goto out_nfserr;

}