lkml.org 
[lkml]   [2019]   [Aug]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 053/157] afs: Fix StoreData op marshalling
    3.16.72-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: David Howells <dhowells@redhat.com>

    commit 8c7ae38d1ce12a0eaeba655df8562552b3596c7f upstream.

    The marshalling of AFS.StoreData, AFS.StoreData64 and YFS.StoreData64 calls
    generated by ->setattr() ops for the purpose of expanding a file is
    incorrect due to older documentation incorrectly describing the way the RPC
    'FileLength' parameter is meant to work.

    The older documentation says that this is the length the file is meant to
    end up at the end of the operation; however, it was never implemented this
    way in any of the servers, but rather the file is truncated down to this
    before the write operation is effected, and never expanded to it (and,
    indeed, it was renamed to 'TruncPos' in 2014).

    Fix this by setting the position parameter to the new file length and doing
    a zero-lengh write there.

    The bug causes Xwayland to SIGBUS due to unexpected non-expansion of a file
    it then mmaps. This can be tested by giving the following test program a
    filename in an AFS directory:

    #include <stdio.h>
    #include <stdlib.h>
    #include <unistd.h>
    #include <fcntl.h>
    #include <sys/mman.h>
    int main(int argc, char *argv[])
    {
    char *p;
    int fd;
    if (argc != 2) {
    fprintf(stderr,
    "Format: test-trunc-mmap <file>\n");
    exit(2);
    }
    fd = open(argv[1], O_RDWR | O_CREAT | O_TRUNC);
    if (fd < 0) {
    perror(argv[1]);
    exit(1);
    }
    if (ftruncate(fd, 0x140008) == -1) {
    perror("ftruncate");
    exit(1);
    }
    p = mmap(NULL, 4096, PROT_READ | PROT_WRITE,
    MAP_SHARED, fd, 0);
    if (p == MAP_FAILED) {
    perror("mmap");
    exit(1);
    }
    p[0] = 'a';
    if (munmap(p, 4096) < 0) {
    perror("munmap");
    exit(1);
    }
    if (close(fd) < 0) {
    perror("close");
    exit(1);
    }
    exit(0);
    }

    Fixes: 31143d5d515e ("AFS: implement basic file write support")
    Reported-by: Jonathan Billings <jsbillin@umich.edu>
    Tested-by: Jonathan Billings <jsbillin@umich.edu>
    Signed-off-by: David Howells <dhowells@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [bwh: Backported to 3.16: drop change in yfsclient.c]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    fs/afs/fsclient.c | 6 +++---
    fs/afs/yfsclient.c | 2 +-
    2 files changed, 4 insertions(+), 4 deletions(-)

    --- a/fs/afs/fsclient.c
    +++ b/fs/afs/fsclient.c
    @@ -1382,8 +1382,8 @@ static int afs_fs_setattr_size64(struct

    xdr_encode_AFS_StoreStatus(&bp, attr);

    - *bp++ = 0; /* position of start of write */
    - *bp++ = 0;
    + *bp++ = htonl(attr->ia_size >> 32); /* position of start of write */
    + *bp++ = htonl((u32) attr->ia_size);
    *bp++ = 0; /* size of write */
    *bp++ = 0;
    *bp++ = htonl(attr->ia_size >> 32); /* new file length */
    @@ -1433,7 +1433,7 @@ static int afs_fs_setattr_size(struct af

    xdr_encode_AFS_StoreStatus(&bp, attr);

    - *bp++ = 0; /* position of start of write */
    + *bp++ = htonl(attr->ia_size); /* position of start of write */
    *bp++ = 0; /* size of write */
    *bp++ = htonl(attr->ia_size); /* new file length */

    \
     
     \ /
      Last update: 2019-08-10 22:52    [W:4.118 / U:0.492 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site