[PATCH] knfsd reply cache bug

David Mansfield (david@cobite.com)
Sun, 6 Dec 1998 19:13:53 -0500 (EST)

Well. I found out why my solaris boxen have been pukeing up errors when
reading a mount off a linux knfsd server. The "reply cache" keeps a copy
of the results of a completed request (in my case, a write request). For
some ops it caches the result, and for others (write falls into this cat.)
the entire reply buffer. Buffers are all u32 * and all of the length
variables are (# of bytes) >> 2. However, someone got confused in
nfsd_cache_append and thought that the length was in bytes, when it is
clearly the same as the others (see nfsd_cache_update, the previous func.
where the value is question is initialized).

Since the knfsd stuff is the vanilla tree is somewhat out of date, and
Alan's patches have neatly wrapped up H.J.'s current patch set, this is a
diff against 2.1.131ac4.

Here's the patch (my first ever, this is exciting!):

--- linux/fs/nfsd/nfscache.c.orig Sun Dec 6 17:59:15 1998
+++ linux/fs/nfsd/nfscache.c Sun Dec 6 19:10:41 1998
@@ -314,8 +314,8 @@
data->len);
return 0;
}
- memcpy(resp->buf, data->buf, data->len);
- resp->buf += ((data->len + 3) >> 2);
+ memcpy(resp->buf, data->buf, data->len << 2);
+ resp->buf += data->len;
resp->len += data->len;
return 1;
}

-- 
/==============================\
| David Mansfield              |
| david@cobite.com             |
\==============================/




-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/