Eric Lee / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 250f3915183d377d36e012bac9caa7345ce465b8

Authored by NeilBrown
Committed by Linus Torvalds
1 parent 1a8eff6d97

[PATCH] knfsd: fix an NFSD bug with full sized, non-page-aligned reads 

NFSd assumes that largest number of pages that will be needed for a
request+response is 2+N where N pages is the size of the largest permitted
read/write request.  The '2' are 1 for the non-data part of the request, and 1
for the non-data part of the reply.

However, when a read request is not page-aligned, and we choose to use
->sendfile to send it directly from the page cache, we may need N+1 pages to
hold the whole reply.  This can overflow and array and cause an Oops.

This patch increases size of the array for holding pages by one and makes sure
that entry is NULL when it is not in use.

Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Showing 3 changed files with 8 additions and 2 deletions Side-by-side Diff

... ... @@ -822,7 +822,8 @@
822 822 rqstp->rq_res.page_len = size;
823 823 } else if (page != pp[-1]) {
824 824 get_page(page);
825   - put_page(*pp);
  825 + if (*pp)
  826 + put_page(*pp);
826 827 *pp = page;
827 828 rqstp->rq_resused++;
828 829 rqstp->rq_res.page_len += size;
include/linux/sunrpc/svc.h
Diff comments   View file @ 250f391
... ... @@ -144,8 +144,11 @@
144 144 *
145 145 * Each request/reply pair can have at most one "payload", plus two pages,
146 146 * one for the request, and one for the reply.
  147 + * We using ->sendfile to return read data, we might need one extra page
  148 + * if the request is not page-aligned. So add another '1'.
147 149 */
148   -#define RPCSVC_MAXPAGES ((RPCSVC_MAXPAYLOAD+PAGE_SIZE-1)/PAGE_SIZE + 2)
  150 +#define RPCSVC_MAXPAGES ((RPCSVC_MAXPAYLOAD+PAGE_SIZE-1)/PAGE_SIZE \
  151 + + 2 + 1)
149 152  
150 153 static inline u32 svc_getnl(struct kvec *iov)
151 154 {
net/sunrpc/svcsock.c
Diff comments   View file @ 250f391
... ... @@ -1278,6 +1278,8 @@
1278 1278 schedule_timeout_uninterruptible(msecs_to_jiffies(500));
1279 1279 rqstp->rq_pages[i] = p;
1280 1280 }
  1281 + rqstp->rq_pages[i++] = NULL; /* this might be seen in nfs_read_actor */
  1282 + BUG_ON(pages >= RPCSVC_MAXPAGES);
1281 1283  
1282 1284 /* Make arg->head point to first page and arg->pages point to rest */
1283 1285 arg = &rqstp->rq_arg;