aboutsummaryrefslogtreecommitdiffstats
path: root/fs
diff options
context:
space:
mode:
authorJ. Bruce Fields <bfields@citi.umich.edu>2007-07-19 04:49:18 -0400
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2007-07-19 13:04:52 -0400
commita280df32db291f41b3922ac218674be526af5b9b (patch)
tree133e80664abd69ad14b3951112d2916e26f51680 /fs
parentd688abf50bd5a30d2c44dea2a72dd59052cd3cce (diff)
nfsd: fix possible read-ahead cache and export table corruption
The value of nperbucket calculated here is too small--we should be rounding up instead of down--with the result that the index j in the following loop can overflow the raparm_hash array. At least in my case, the next thing in memory turns out to be export_table, so the symptoms I see are crashes caused by the appearance of four zeroed-out export entries in the first bucket of the hash table of exports (which were actually entries in the readahead cache, a pointer to which had been written to the export table in this initialization code). It looks like the bug was probably introduced with commit fce1456a19f5c08b688c29f00ef90fdfa074c79b ("knfsd: make the readahead params cache SMP-friendly"). Cc: <stable@kernel.org> Cc: Greg Banks <gnb@melbourne.sgi.com> Signed-off-by: "J. Bruce Fields" <bfields@citi.umich.edu> Acked-by: NeilBrown <neilb@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs')
-rw-r--r--fs/nfsd/vfs.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index e90f4a8a1d01..b8da5ddb3a0a 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1916,7 +1916,7 @@ nfsd_racache_init(int cache_size)
1916 raparm_hash[i].pb_head = NULL; 1916 raparm_hash[i].pb_head = NULL;
1917 spin_lock_init(&raparm_hash[i].pb_lock); 1917 spin_lock_init(&raparm_hash[i].pb_lock);
1918 } 1918 }
1919 nperbucket = cache_size >> RAPARM_HASH_BITS; 1919 nperbucket = DIV_ROUND_UP(cache_size, RAPARM_HASH_SIZE);
1920 for (i = 0; i < cache_size - 1; i++) { 1920 for (i = 0; i < cache_size - 1; i++) {
1921 if (i % nperbucket == 0) 1921 if (i % nperbucket == 0)
1922 raparm_hash[j++].pb_head = raparml + i; 1922 raparm_hash[j++].pb_head = raparml + i;