xdr->buflen += len;
 }
 
-void
+int
 xdr_partial_copy_from_skb(struct xdr_buf *xdr, unsigned int base,
                          skb_reader_t *desc,
                          skb_read_actor_t copy_actor)
                len -= base;
                ret = copy_actor(desc, (char *)xdr->head[0].iov_base + base, len);
                if (ret != len || !desc->count)
-                       return;
+                       return 0;
                base = 0;
        } else
                base -= len;
        do {
                char *kaddr;
 
+               /* ACL likes to be lazy in allocating pages - ACLs
+                * are small by default but can get huge. */
+               if (unlikely(*ppage == NULL)) {
+                       *ppage = alloc_page(GFP_ATOMIC);
+                       if (unlikely(*ppage == NULL))
+                               return -ENOMEM;
+               }
+
                len = PAGE_CACHE_SIZE;
                kaddr = kmap_atomic(*ppage, KM_SKB_SUNRPC_DATA);
                if (base) {
                flush_dcache_page(*ppage);
                kunmap_atomic(kaddr, KM_SKB_SUNRPC_DATA);
                if (ret != len || !desc->count)
-                       return;
+                       return 0;
                ppage++;
        } while ((pglen -= len) != 0);
 copy_tail:
        len = xdr->tail[0].iov_len;
        if (base < len)
                copy_actor(desc, (char *)xdr->tail[0].iov_base + base, len - base);
+
+       return 0;
 }
 
 
 
                goto no_checksum;
 
        desc.csum = csum_partial(skb->data, desc.offset, skb->csum);
-       xdr_partial_copy_from_skb(xdr, 0, &desc, skb_read_and_csum_bits);
+       if (xdr_partial_copy_from_skb(xdr, 0, &desc, skb_read_and_csum_bits) < 0)
+               return -1;
        if (desc.offset != skb->len) {
                unsigned int csum2;
                csum2 = skb_checksum(skb, desc.offset, skb->len - desc.offset, 0);
                return -1;
        return 0;
 no_checksum:
-       xdr_partial_copy_from_skb(xdr, 0, &desc, skb_read_bits);
+       if (xdr_partial_copy_from_skb(xdr, 0, &desc, skb_read_bits) < 0)
+               return -1;
        if (desc.count)
                return -1;
        return 0;
        struct rpc_rqst *req;
        struct xdr_buf *rcvbuf;
        size_t len;
+       int r;
 
        /* Find and lock the request corresponding to this xid */
        spin_lock(&xprt->sock_lock);
                len = xprt->tcp_reclen - xprt->tcp_offset;
                memcpy(&my_desc, desc, sizeof(my_desc));
                my_desc.count = len;
-               xdr_partial_copy_from_skb(rcvbuf, xprt->tcp_copied,
+               r = xdr_partial_copy_from_skb(rcvbuf, xprt->tcp_copied,
                                          &my_desc, tcp_copy_data);
                desc->count -= len;
                desc->offset += len;
        } else
-               xdr_partial_copy_from_skb(rcvbuf, xprt->tcp_copied,
+               r = xdr_partial_copy_from_skb(rcvbuf, xprt->tcp_copied,
                                          desc, tcp_copy_data);
        xprt->tcp_copied += len;
        xprt->tcp_offset += len;
 
+       if (r < 0) {
+               /* Error when copying to the receive buffer,
+                * usually because we weren't able to allocate
+                * additional buffer pages. All we can do now
+                * is turn off XPRT_COPY_DATA, so the request
+                * will not receive any additional updates,
+                * and time out.
+                * Any remaining data from this record will
+                * be discarded.
+                */
+               xprt->tcp_flags &= ~XPRT_COPY_DATA;
+               goto out;
+       }
+
        if (xprt->tcp_copied == req->rq_private_buf.buflen)
                xprt->tcp_flags &= ~XPRT_COPY_DATA;
        else if (xprt->tcp_offset == xprt->tcp_reclen) {
                                req->rq_task->tk_pid);
                xprt_complete_rqst(xprt, req, xprt->tcp_copied);
        }
+out:
        spin_unlock(&xprt->sock_lock);
        tcp_check_recm(xprt);
 }