Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a280df32db291f41b3922ac218674be526af5b9b
Commit:     a280df32db291f41b3922ac218674be526af5b9b
Parent:     d688abf50bd5a30d2c44dea2a72dd59052cd3cce
Author:     J. Bruce Fields <[EMAIL PROTECTED]>
AuthorDate: Thu Jul 19 01:49:18 2007 -0700
Committer:  Linus Torvalds <[EMAIL PROTECTED]>
CommitDate: Thu Jul 19 10:04:52 2007 -0700

    nfsd: fix possible read-ahead cache and export table corruption
    
    The value of nperbucket calculated here is too small--we should be rounding 
up
    instead of down--with the result that the index j in the following loop can
    overflow the raparm_hash array.  At least in my case, the next thing in 
memory
    turns out to be export_table, so the symptoms I see are crashes caused by 
the
    appearance of four zeroed-out export entries in the first bucket of the hash
    table of exports (which were actually entries in the readahead cache, a
    pointer to which had been written to the export table in this initialization
    code).
    
    It looks like the bug was probably introduced with commit
    fce1456a19f5c08b688c29f00ef90fdfa074c79b ("knfsd: make the readahead params
    cache SMP-friendly").
    
    Cc: <[EMAIL PROTECTED]>
    Cc: Greg Banks <[EMAIL PROTECTED]>
    Signed-off-by: "J. Bruce Fields" <[EMAIL PROTECTED]>
    Acked-by: NeilBrown <[EMAIL PROTECTED]>
    Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
    Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
---
 fs/nfsd/vfs.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index e90f4a8..b8da5dd 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1916,7 +1916,7 @@ nfsd_racache_init(int cache_size)
                raparm_hash[i].pb_head = NULL;
                spin_lock_init(&raparm_hash[i].pb_lock);
        }
-       nperbucket = cache_size >> RAPARM_HASH_BITS;
+       nperbucket = DIV_ROUND_UP(cache_size, RAPARM_HASH_SIZE);
        for (i = 0; i < cache_size - 1; i++) {
                if (i % nperbucket == 0)
                        raparm_hash[j++].pb_head = raparml + i;
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to