forked from luck/tmp_suning_uos_patched
15b23ef5d3
The calculation of page_ptr here is wrong in the case the read doesn't start at an offset that is a multiple of a page. The result is that nfs4svc_encode_compoundres sets rq_next_page to a value one too small, and then the loop in svc_free_res_pages may incorrectly fail to clear a page pointer in rq_respages[]. Pages left in rq_respages[] are available for the next rpc request to use, so xdr data may be written to that page, which may hold data still waiting to be transmitted to the client or data in the page cache. The observed result was silent data corruption seen on an NFSv4 client. We tag this as "fixing" |
||
---|---|---|
.. | ||
acl.h | ||
auth.c | ||
auth.h | ||
cache.h | ||
current_stateid.h | ||
export.c | ||
export.h | ||
fault_inject.c | ||
idmap.h | ||
Kconfig | ||
lockd.c | ||
Makefile | ||
netns.h | ||
nfs2acl.c | ||
nfs3acl.c | ||
nfs3proc.c | ||
nfs3xdr.c | ||
nfs4acl.c | ||
nfs4callback.c | ||
nfs4idmap.c | ||
nfs4proc.c | ||
nfs4recover.c | ||
nfs4state.c | ||
nfs4xdr.c | ||
nfscache.c | ||
nfsctl.c | ||
nfsd.h | ||
nfsfh.c | ||
nfsfh.h | ||
nfsproc.c | ||
nfssvc.c | ||
nfsxdr.c | ||
state.h | ||
stats.c | ||
stats.h | ||
vfs.c | ||
vfs.h | ||
xdr3.h | ||
xdr4.h | ||
xdr4cb.h | ||
xdr.h |