Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=250f3915183d377d36e012bac9caa7345ce465b8
Commit:     250f3915183d377d36e012bac9caa7345ce465b8
Parent:     1a8eff6d977c28162c61c9532ca58634e7090b69
Author:     NeilBrown <[EMAIL PROTECTED]>
AuthorDate: Fri Jan 26 00:56:59 2007 -0800
Committer:  Linus Torvalds <[EMAIL PROTECTED]>
CommitDate: Fri Jan 26 13:50:59 2007 -0800

    [PATCH] knfsd: fix an NFSD bug with full sized, non-page-aligned reads
    
    NFSd assumes that largest number of pages that will be needed for a
    request+response is 2+N where N pages is the size of the largest permitted
    read/write request.  The '2' are 1 for the non-data part of the request, 
and 1
    for the non-data part of the reply.
    
    However, when a read request is not page-aligned, and we choose to use
    ->sendfile to send it directly from the page cache, we may need N+1 pages to
    hold the whole reply.  This can overflow and array and cause an Oops.
    
    This patch increases size of the array for holding pages by one and makes 
sure
    that entry is NULL when it is not in use.
    
    Signed-off-by: Neil Brown <[EMAIL PROTECTED]>
    Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
    Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
---
 fs/nfsd/vfs.c              |    3 ++-
 include/linux/sunrpc/svc.h |    5 ++++-
 net/sunrpc/svcsock.c       |    2 ++
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 7a79c23..ea85562 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -822,7 +822,8 @@ nfsd_read_actor(read_descriptor_t *desc, struct page *page, 
unsigned long offset
                rqstp->rq_res.page_len = size;
        } else if (page != pp[-1]) {
                get_page(page);
-               put_page(*pp);
+               if (*pp)
+                       put_page(*pp);
                *pp = page;
                rqstp->rq_resused++;
                rqstp->rq_res.page_len += size;
diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
index 965d6c2..64f3d60 100644
--- a/include/linux/sunrpc/svc.h
+++ b/include/linux/sunrpc/svc.h
@@ -144,8 +144,11 @@ extern u32 svc_max_payload(const struct svc_rqst *rqstp);
  *
  * Each request/reply pair can have at most one "payload", plus two pages,
  * one for the request, and one for the reply.
+ * We using ->sendfile to return read data, we might need one extra page
+ * if the request is not page-aligned.  So add another '1'.
  */
-#define RPCSVC_MAXPAGES                
((RPCSVC_MAXPAYLOAD+PAGE_SIZE-1)/PAGE_SIZE + 2)
+#define RPCSVC_MAXPAGES                
((RPCSVC_MAXPAYLOAD+PAGE_SIZE-1)/PAGE_SIZE \
+                               + 2 + 1)
 
 static inline u32 svc_getnl(struct kvec *iov)
 {
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 99f54fb..45120f2 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1278,6 +1278,8 @@ svc_recv(struct svc_rqst *rqstp, long timeout)
                                
schedule_timeout_uninterruptible(msecs_to_jiffies(500));
                        rqstp->rq_pages[i] = p;
                }
+       rqstp->rq_pages[i++] = NULL; /* this might be seen in nfs_read_actor */
+       BUG_ON(pages >= RPCSVC_MAXPAGES);
 
        /* Make arg->head point to first page and arg->pages point to rest */
        arg = &rqstp->rq_arg;
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to