diff options
| author | Konstantin Khorenko <khorenko@parallels.com> | 2011-02-01 15:16:29 +0100 |
|---|---|---|
| committer | J. Bruce Fields <bfields@redhat.com> | 2011-02-14 16:35:18 +0100 |
| commit | 3aa6e0aa8ab3e64bbfba092c64d42fd1d006b124 (patch) | |
| tree | d86305c39f790e90c51f4095b26157053538d2a5 /fs | |
| parent | NFSD: use nfserr for status after decode_cb_op_status (diff) | |
| download | linux-3aa6e0aa8ab3e64bbfba092c64d42fd1d006b124.tar.xz linux-3aa6e0aa8ab3e64bbfba092c64d42fd1d006b124.zip | |
NFSD: memory corruption due to writing beyond the stat array
If nfsd fails to find an exported via NFS file in the readahead cache, it
should increment corresponding nfsdstats counter (ra_depth[10]), but due to a
bug it may instead write to ra_depth[11], corrupting the following field.
In a kernel with NFSDv4 compiled in the corruption takes the form of an
increment of a counter of the number of NFSv4 operation 0's received; since
there is no operation 0, this is harmless.
In a kernel with NFSDv4 disabled it corrupts whatever happens to be in the
memory beyond nfsdstats.
Signed-off-by: Konstantin Khorenko <khorenko@openvz.org>
Cc: stable@kernel.org
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/nfsd/vfs.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c index fda3be237773..30c73f8a5791 100644 --- a/fs/nfsd/vfs.c +++ b/fs/nfsd/vfs.c @@ -808,7 +808,7 @@ nfsd_get_raparms(dev_t dev, ino_t ino) if (ra->p_count == 0) frap = rap; } - depth = nfsdstats.ra_size*11/10; + depth = nfsdstats.ra_size; if (!frap) { spin_unlock(&rab->pb_lock); return NULL; |