Commit bb6e8a9f authored by NeilBrown's avatar NeilBrown Committed by Linus Torvalds
Browse files

[PATCH] knfsd: nfsd4: fix corruption on readdir encoding with 64k pages 



Fix corruption on readdir encoding with 64k pages.

Signed-off-by: default avatarJ. Bruce Fields <bfields@citi.umich.edu>
Signed-off-by: default avatarNeil Brown <neilb@suse.de>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 6ed6decc

fs/nfsd/nfs4xdr.c

+6 −7
Original line number Diff line number Diff line
@@ -2157,7 +2157,7 @@ nfsd4_encode_readdir(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_re 
{

	int maxcount;

	loff_t offset;

	u32 *page, *savep;

	u32 *page, *savep, *tailbase;

	ENCODE_HEAD;



	if (nfserr)
@@ -2173,6 +2173,7 @@ nfsd4_encode_readdir(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_re 
	WRITE32(0);

	ADJUST_ARGS();

	resp->xbuf->head[0].iov_len = ((char*)resp->p) - (char*)resp->xbuf->head[0].iov_base;

	tailbase = p;



	maxcount = PAGE_SIZE;

	if (maxcount > readdir->rd_maxcount)
@@ -2217,14 +2218,12 @@ nfsd4_encode_readdir(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_re 
	*p++ = htonl(readdir->common.err == nfserr_eof);

	resp->xbuf->page_len = ((char*)p) - (char*)page_address(resp->rqstp->rq_respages[resp->rqstp->rq_resused-1]);



	/* allocate a page for the tail */

	svc_take_page(resp->rqstp);

	resp->xbuf->tail[0].iov_base = 

		page_address(resp->rqstp->rq_respages[resp->rqstp->rq_resused-1]);

	resp->rqstp->rq_restailpage = resp->rqstp->rq_resused-1;

	/* Use rest of head for padding and remaining ops: */

	resp->rqstp->rq_restailpage = 0;

	resp->xbuf->tail[0].iov_base = tailbase;

	resp->xbuf->tail[0].iov_len = 0;

	resp->p = resp->xbuf->tail[0].iov_base;

	resp->end = resp->p + PAGE_SIZE/4;

	resp->end = resp->p + (PAGE_SIZE - resp->xbuf->head[0].iov_len)/4;



	return 0;

err_no_verf: