diff options
| author | J. Bruce Fields <bfields@redhat.com> | 2012-08-09 18:12:28 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2012-09-14 10:00:19 -0700 |
| commit | 389aec33837aeaf7e7e3cb31b6f1c6da6b009fb6 (patch) | |
| tree | 2c9e3b1b1c7765fe98ebaac5ae61bdba4bdbcd96 | |
| parent | cbd3df71bb6563fe9ab2a16dc57937c0b59c3976 (diff) | |
| download | linux-3.10-389aec33837aeaf7e7e3cb31b6f1c6da6b009fb6.tar.gz linux-3.10-389aec33837aeaf7e7e3cb31b6f1c6da6b009fb6.tar.bz2 linux-3.10-389aec33837aeaf7e7e3cb31b6f1c6da6b009fb6.zip | |
svcrpc: fix BUG() in svc_tcp_clear_pages
commit be1e44441a560c43c136a562d49a1c9623c91197 upstream.
Examination of svc_tcp_clear_pages shows that it assumes sk_tcplen is
consistent with sk_pages[] (in particular, sk_pages[n] can't be NULL if
sk_tcplen would lead us to expect n pages of data).
svc_tcp_restore_pages zeroes out sk_pages[] while leaving sk_tcplen.
This is OK, since both functions are serialized by XPT_BUSY. However,
that means the inconsistency must be repaired before dropping XPT_BUSY.
Therefore we should be ensuring that svc_tcp_save_pages repairs the
problem before exiting svc_tcp_recv_record on error.
Symptoms were a BUG() in svc_tcp_clear_pages.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | net/sunrpc/svcsock.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c index 824d32fb312..f190ea96f11 100644 --- a/net/sunrpc/svcsock.c +++ b/net/sunrpc/svcsock.c @@ -1137,9 +1137,9 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp) if (len >= 0) svsk->sk_tcplen += len; if (len != want) { + svc_tcp_save_pages(svsk, rqstp); if (len < 0 && len != -EAGAIN) goto err_other; - svc_tcp_save_pages(svsk, rqstp); dprintk("svc: incomplete TCP record (%d of %d)\n", svsk->sk_tcplen, svsk->sk_reclen); goto err_noclose; |