Konstantin Khorenko 3aa6e0aa8a NFSD: memory corruption due to writing beyond the stat array
If nfsd fails to find an exported via NFS file in the readahead cache, it
should increment corresponding nfsdstats counter (ra_depth[10]), but due to a
bug it may instead write to ra_depth[11], corrupting the following field.

In a kernel with NFSDv4 compiled in the corruption takes the form of an
increment of a counter of the number of NFSv4 operation 0's received; since
there is no operation 0, this is harmless.

In a kernel with NFSDv4 disabled it corrupts whatever happens to be in the
memory beyond nfsdstats.

Signed-off-by: Konstantin Khorenko <khorenko@openvz.org>
Cc: stable@kernel.org
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
2011-02-14 10:35:18 -05:00
..
2011-01-04 18:22:10 -05:00
2008-02-01 16:42:05 -05:00
2010-10-27 21:39:39 +02:00
2007-05-09 12:30:54 -07:00
2011-01-11 15:04:09 -05:00
2009-12-20 20:19:51 -08:00
2011-01-04 16:49:22 -05:00
2011-01-11 15:04:11 -05:00
2010-07-30 12:54:54 -04:00