[lkml]   [2003]   [Jan]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH] counting bug in svc_tcp_recvfrom causes panic for TCP NFS

When svc_tcp_recvfrom() builds up its iovec to receive a packet, it
invokes page_address() with an argument which refers to
rqstp->rq_argused++. For some memory layouts (eg not HIMEM and
not WANT_PAGE_VIRTUAL), page_address() is a macro which evalutes its
argument three times. This results in a kernel panic when an TCP NFS
client sends a packet longer than about 1/3 of the maximum size.

The patch below causes the increment to be performed outside of the
call to page_address(), which avoids the kernel panic. Perhaps a
better solution would be to change page_address() to be consistently
be a function for all memory layouts.


--- ./linux-2.5.58-ORIG/net/sunrpc/svcsock.c 2003-01-13 22:30:06.000000000 +0000
+++ ./linux-2.5.58/net/sunrpc/svcsock.c 2003-01-15 22:42:03.000000000 +0000
@@ -924,8 +924,9 @@
vlen = PAGE_SIZE;
pnum = 1;
while (vlen < len) {
- vec[pnum].iov_base = page_address(rqstp->rq_argpages[rqstp->rq_argused++]);
+ vec[pnum].iov_base = page_address(rqstp->rq_argpages[rqstp->rq_argused]);
vec[pnum].iov_len = PAGE_SIZE;
+ rqstp->rq_argused++;
vlen += PAGE_SIZE;
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at
 \ /
  Last update: 2005-03-22 13:32    [W:0.056 / U:0.224 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site