[2.6.8-rc4] New nfsd-related kernel panic

[2.6.8-rc4] New nfsd-related kernel panic

[walt]

The following patch of 09Aug is causing kernel panics:

$bk get -D fs/nfsd/nfsxdr.c
237d236
<       int len;
237a237
 >       unsigned int len;
269d268
<       int len;
269a269
 >       unsigned int len;

I can cause a kernel panic by mounting the remote filesystem
read-only and merely copying a moderately large tarball from it.
(The linux-kernel source tarball, for example.)

The panic occurs every time, after only a second or two at most.
It's so easy to reproduce that I haven't copied down the backtrace,
but I will if no one else can reproduce the problem.

Anyone else seeing this?

Re: [2.6.8-rc4] New nfsd-related kernel panic

[Neil Brown]

On Wednesday August 11, wa1ter@myrealbox.com wrote:
> 
> Anyone else seeing this?

Yes.  I've just sent the following patch to Linus/Andrew.

NeilBrown

diff ./fs/nfsd/nfs3xdr.c~current~ ./fs/nfsd/nfs3xdr.c
--- ./fs/nfsd/nfs3xdr.c~current~	2004-08-12 08:32:26.000000000 +1000
+++ ./fs/nfsd/nfs3xdr.c	2004-08-12 08:37:33.000000000 +1000
@@ -347,8 +347,8 @@ nfs3svc_decode_readargs(struct svc_rqst 
 		svc_take_page(rqstp);
 		args->vec[v].iov_base = page_address(rqstp->rq_respages[pn]);
 		args->vec[v].iov_len = len < PAGE_SIZE? len : PAGE_SIZE;
+		len -= args->vec[v].iov_len;
 		v++;
-		len -= PAGE_SIZE;
 	}
 	args->vlen = v;
 	return xdr_argsize_check(rqstp, p);

diff ./fs/nfsd/nfsxdr.c~current~ ./fs/nfsd/nfsxdr.c
--- ./fs/nfsd/nfsxdr.c~current~	2004-08-12 08:32:26.000000000 +1000
+++ ./fs/nfsd/nfsxdr.c	2004-08-12 08:38:49.000000000 +1000
@@ -255,8 +255,8 @@ nfssvc_decode_readargs(struct svc_rqst *
 		svc_take_page(rqstp);
 		args->vec[v].iov_base = page_address(rqstp->rq_respages[pn]);
 		args->vec[v].iov_len = len < PAGE_SIZE?len:PAGE_SIZE;
+		len -= args->vec[v].iov_len;
 		v++;
-		len -= PAGE_SIZE;
 	}
 	args->vlen = v;
 	return xdr_argsize_check(rqstp, p);