[PATCH] RPC: fix accounting bug in the case of a truncated RPC message

 Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

3 files changed, 42 insertions, 17 deletions

diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h
index 0f5b7a5a7432..5d1eed2b58a1 100644
--- a/include/linux/sunrpc/xdr.h
+++ b/include/linux/sunrpc/xdr.h
@@ -160,7 +160,7 @@ typedef struct {
 
 typedef size_t (*skb_read_actor_t)(skb_reader_t *desc, void *to, size_t len);
 
-extern int xdr_partial_copy_from_skb(struct xdr_buf *, unsigned int,
+extern ssize_t xdr_partial_copy_from_skb(struct xdr_buf *, unsigned int,
                 skb_reader_t *, skb_read_actor_t);
 
 struct socket;
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 65b268d39782..b3ac3f72bf9c 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -176,21 +176,23 @@ xdr_inline_pages(struct xdr_buf *xdr, unsigned int offset,
         xdr->buflen += len;
 }
 
-int
+ssize_t
 xdr_partial_copy_from_skb(struct xdr_buf *xdr, unsigned int base,
                           skb_reader_t *desc,
                           skb_read_actor_t copy_actor)
 {
         struct page     **ppage = xdr->pages;
         unsigned int    len, pglen = xdr->page_len;
+        ssize_t         copied = 0;
         int             ret;
 
         len = xdr->head[0].iov_len;
         if (base < len) {
                 len -= base;
                 ret = copy_actor(desc, (char *)xdr->head[0].iov_base + base, len);
+                copied += ret;
                 if (ret != len || !desc->count)
-                        return 0;
+                        goto out;
                 base = 0;
         } else
                 base -= len;
@@ -214,8 +216,11 @@ xdr_partial_copy_from_skb(struct xdr_buf *xdr, unsigned int base,
                  * are small by default but can get huge. */
                 if (unlikely(*ppage == NULL)) {
                         *ppage = alloc_page(GFP_ATOMIC);
-                        if (unlikely(*ppage == NULL))
-                                return -ENOMEM;
+                        if (unlikely(*ppage == NULL)) {
+                                if (copied == 0)
+                                        copied = -ENOMEM;
+                                goto out;
+                        }
                 }
 
                 len = PAGE_CACHE_SIZE;
@@ -233,16 +238,17 @@ xdr_partial_copy_from_skb(struct xdr_buf *xdr, unsigned int base,
                 }
                 flush_dcache_page(*ppage);
                 kunmap_atomic(kaddr, KM_SKB_SUNRPC_DATA);
+                copied += ret;
                 if (ret != len || !desc->count)
-                        return 0;
+                        goto out;
                 ppage++;
         } while ((pglen -= len) != 0);
 copy_tail:
         len = xdr->tail[0].iov_len;
         if (base < len)
-                copy_actor(desc, (char *)xdr->tail[0].iov_base + base, len - base);
-
-        return 0;
+                copied += copy_actor(desc, (char *)xdr->tail[0].iov_base + base, len - base);
+out:
+        return copied;
 }
 
 
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index a180ed4952d6..ef941e7de8bf 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -823,10 +823,15 @@ tcp_copy_data(skb_reader_t *desc, void *p, size_t len)
 {
         if (len > desc->count)
                 len = desc->count;
-        if (skb_copy_bits(desc->skb, desc->offset, p, len))
+        if (skb_copy_bits(desc->skb, desc->offset, p, len)) {
+                dprintk("RPC:      failed to copy %zu bytes from skb. %zu bytes remain\n",
+                                len, desc->count);
                 return 0;
+        }
         desc->offset += len;
         desc->count -= len;
+        dprintk("RPC:      copied %zu bytes from skb. %zu bytes remain\n",
+                        len, desc->count);
         return len;
 }
 
@@ -865,6 +870,8 @@ tcp_read_fraghdr(struct rpc_xprt *xprt, skb_reader_t *desc)
 static void
 tcp_check_recm(struct rpc_xprt *xprt)
 {
+        dprintk("RPC:      xprt = %p, tcp_copied = %lu, tcp_offset = %u, tcp_reclen = %u, tcp_flags = %lx\n",
+                        xprt, xprt->tcp_copied, xprt->tcp_offset, xprt->tcp_reclen, xprt->tcp_flags);
         if (xprt->tcp_offset == xprt->tcp_reclen) {
                 xprt->tcp_flags |= XPRT_COPY_RECM;
                 xprt->tcp_offset = 0;
@@ -909,7 +916,7 @@ tcp_read_request(struct rpc_xprt *xprt, skb_reader_t *desc)
         struct rpc_rqst *req;
         struct xdr_buf *rcvbuf;
         size_t len;
-        int r;
+        ssize_t r;
 
         /* Find and lock the request corresponding to this xid */
         spin_lock(&xprt->sock_lock);
@@ -932,15 +939,17 @@ tcp_read_request(struct rpc_xprt *xprt, skb_reader_t *desc)
                 my_desc.count = len;
                 r = xdr_partial_copy_from_skb(rcvbuf, xprt->tcp_copied,
                                           &my_desc, tcp_copy_data);
-                desc->count -= len;
-                desc->offset += len;
+                desc->count -= r;
+                desc->offset += r;
         } else
                 r = xdr_partial_copy_from_skb(rcvbuf, xprt->tcp_copied,
                                           desc, tcp_copy_data);
-        xprt->tcp_copied += len;
-        xprt->tcp_offset += len;
 
-        if (r < 0) {
+        if (r > 0) {
+                xprt->tcp_copied += r;
+                xprt->tcp_offset += r;
+        }
+        if (r != len) {
                 /* Error when copying to the receive buffer,
                  * usually because we weren't able to allocate
                  * additional buffer pages. All we can do now
@@ -951,9 +960,18 @@ tcp_read_request(struct rpc_xprt *xprt, skb_reader_t *desc)
                  * be discarded.
                  */
                 xprt->tcp_flags &= ~XPRT_COPY_DATA;
+                dprintk("RPC:      XID %08x truncated request\n",
+                                ntohl(xprt->tcp_xid));
+                dprintk("RPC:      xprt = %p, tcp_copied = %lu, tcp_offset = %u, tcp_reclen = %u\n",
+                                xprt, xprt->tcp_copied, xprt->tcp_offset, xprt->tcp_reclen);
                 goto out;
         }
 
+        dprintk("RPC:      XID %08x read %u bytes\n",
+                        ntohl(xprt->tcp_xid), r);
+        dprintk("RPC:      xprt = %p, tcp_copied = %lu, tcp_offset = %u, tcp_reclen = %u\n",
+                        xprt, xprt->tcp_copied, xprt->tcp_offset, xprt->tcp_reclen);
+
         if (xprt->tcp_copied == req->rq_private_buf.buflen)
                 xprt->tcp_flags &= ~XPRT_COPY_DATA;
         else if (xprt->tcp_offset == xprt->tcp_reclen) {
@@ -961,12 +979,12 @@ tcp_read_request(struct rpc_xprt *xprt, skb_reader_t *desc)
                         xprt->tcp_flags &= ~XPRT_COPY_DATA;
         }
 
+out:
         if (!(xprt->tcp_flags & XPRT_COPY_DATA)) {
                 dprintk("RPC: %4d received reply complete\n",
                                 req->rq_task->tk_pid);
                 xprt_complete_rqst(xprt, req, xprt->tcp_copied);
         }
-out:
         spin_unlock(&xprt->sock_lock);
         tcp_check_recm(xprt);
 }
@@ -985,6 +1003,7 @@ tcp_read_discard(struct rpc_xprt *xprt, skb_reader_t *desc)
         desc->count -= len;
         desc->offset += len;
         xprt->tcp_offset += len;
+        dprintk("RPC:      discarded %u bytes\n", len);
         tcp_check_recm(xprt);
 }