[PATCH] NFS: large non-page-aligned direct I/O clobbers memory

The logic in nfs_direct_read_schedule and nfs_direct_write_schedule can
allow data->npages to be one larger than rpages.  This causes a page
pointer to be written beyond the end of the pagevec in nfs_read_data (or
nfs_write_data).

Fix this by making nfs_(read|write)_alloc() calculate the size of the
pagevec array, and initialise data->npages.

Also get rid of the redundant argument to nfs_commit_alloc().

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

1 files changed, 13 insertions, 11 deletions

diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index da9cf11c326f..7a9ee00e0c61 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -43,13 +43,15 @@ static mempool_t *nfs_rdata_mempool;
 
 #define MIN_POOL_READ   (32)
 
-struct nfs_read_data *nfs_readdata_alloc(unsigned int pagecount)
+struct nfs_read_data *nfs_readdata_alloc(size_t len)
 {
+        unsigned int pagecount = (len + PAGE_SIZE - 1) >> PAGE_SHIFT;
         struct nfs_read_data *p = mempool_alloc(nfs_rdata_mempool, SLAB_NOFS);
 
         if (p) {
                 memset(p, 0, sizeof(*p));
                 INIT_LIST_HEAD(&p->pages);
+                p->npages = pagecount;
                 if (pagecount <= ARRAY_SIZE(p->page_array))
                         p->pagevec = p->page_array;
                 else {
@@ -140,7 +142,7 @@ static int nfs_readpage_sync(struct nfs_open_context *ctx, struct inode *inode,
         int             result;
         struct nfs_read_data *rdata;
 
-        rdata = nfs_readdata_alloc(1);
+        rdata = nfs_readdata_alloc(count);
         if (!rdata)
                 return -ENOMEM;
 
@@ -336,25 +338,25 @@ static int nfs_pagein_multi(struct list_head *head, struct inode *inode)
         struct nfs_page *req = nfs_list_entry(head->next);
         struct page *page = req->wb_page;
         struct nfs_read_data *data;
-        unsigned int rsize = NFS_SERVER(inode)->rsize;
-        unsigned int nbytes, offset;
+        size_t rsize = NFS_SERVER(inode)->rsize, nbytes;
+        unsigned int offset;
         int requests = 0;
         LIST_HEAD(list);
 
         nfs_list_remove_request(req);
 
         nbytes = req->wb_bytes;
-        for(;;) {
-                data = nfs_readdata_alloc(1);
+        do {
+                size_t len = min(nbytes,rsize);
+
+                data = nfs_readdata_alloc(len);
                 if (!data)
                         goto out_bad;
                 INIT_LIST_HEAD(&data->pages);
                 list_add(&data->pages, &list);
                 requests++;
-                if (nbytes <= rsize)
-                        break;
-                nbytes -= rsize;
-        }
+                nbytes -= len;
+        } while(nbytes != 0);
         atomic_set(&req->wb_complete, requests);
 
         ClearPageError(page);
@@ -402,7 +404,7 @@ static int nfs_pagein_one(struct list_head *head, struct inode *inode)
         if (NFS_SERVER(inode)->rsize < PAGE_CACHE_SIZE)
                 return nfs_pagein_multi(head, inode);
 
-        data = nfs_readdata_alloc(NFS_SERVER(inode)->rpages);
+        data = nfs_readdata_alloc(NFS_SERVER(inode)->rsize);
         if (!data)
                 goto out_bad;