| From stable-bounces@linux.kernel.org Thu Jul 19 02:18:50 2007 |
| From: J. Bruce Fields <bfields@citi.umich.edu> |
| Date: Thu, 19 Jul 2007 01:49:18 -0700 |
| Subject: nfsd: fix possible read-ahead cache and export table corruption |
| To: torvalds@linux-foundation.org |
| Cc: neilb@suse.de, stable@kernel.org, akpm@linux-foundation.org, bfields@citi.umich.edu, gnb@melbourne.sgi.com |
| Message-ID: <200707190849.l6J8nIm4023400@imap1.linux-foundation.org> |
| |
| |
| From: J. Bruce Fields <bfields@citi.umich.edu> |
| |
| The value of nperbucket calculated here is too small--we should be rounding up |
| instead of down--with the result that the index j in the following loop can |
| overflow the raparm_hash array. At least in my case, the next thing in memory |
| turns out to be export_table, so the symptoms I see are crashes caused by the |
| appearance of four zeroed-out export entries in the first bucket of the hash |
| table of exports (which were actually entries in the readahead cache, a |
| pointer to which had been written to the export table in this initialization |
| code). |
| |
| It looks like the bug was probably introduced with commit |
| fce1456a19f5c08b688c29f00ef90fdfa074c79b ("knfsd: make the readahead params |
| cache SMP-friendly"). |
| |
| Cc: Greg Banks <gnb@melbourne.sgi.com> |
| Signed-off-by: "J. Bruce Fields" <bfields@citi.umich.edu> |
| Acked-by: NeilBrown <neilb@suse.de> |
| Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| fs/nfsd/vfs.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/fs/nfsd/vfs.c |
| +++ b/fs/nfsd/vfs.c |
| @@ -1890,7 +1890,7 @@ nfsd_racache_init(int cache_size) |
| raparm_hash[i].pb_head = NULL; |
| spin_lock_init(&raparm_hash[i].pb_lock); |
| } |
| - nperbucket = cache_size >> RAPARM_HASH_BITS; |
| + nperbucket = DIV_ROUND_UP(cache_size, RAPARM_HASH_SIZE); |
| for (i = 0; i < cache_size - 1; i++) { |
| if (i % nperbucket == 0) |
| raparm_hash[j++].pb_head = raparml + i; |
