diff options
| author | Konstantin Khorenko <khorenko@parallels.com> | 2011-02-01 17:16:29 +0300 |
|---|---|---|
| committer | J. Bruce Fields <bfields@redhat.com> | 2011-02-14 10:35:18 -0500 |
| commit | 3aa6e0aa8ab3e64bbfba092c64d42fd1d006b124 (patch) | |
| tree | d86305c39f790e90c51f4095b26157053538d2a5 /drivers/rtc | |
| parent | 0af3f814ccf0a13d3e01e8115b96f1824379fc72 (diff) | |
| download | linux-3aa6e0aa8ab3e64bbfba092c64d42fd1d006b124.tar.gz linux-3aa6e0aa8ab3e64bbfba092c64d42fd1d006b124.tar.bz2 linux-3aa6e0aa8ab3e64bbfba092c64d42fd1d006b124.zip | |
NFSD: memory corruption due to writing beyond the stat array
If nfsd fails to find an exported via NFS file in the readahead cache, it
should increment corresponding nfsdstats counter (ra_depth[10]), but due to a
bug it may instead write to ra_depth[11], corrupting the following field.
In a kernel with NFSDv4 compiled in the corruption takes the form of an
increment of a counter of the number of NFSv4 operation 0's received; since
there is no operation 0, this is harmless.
In a kernel with NFSDv4 disabled it corrupts whatever happens to be in the
memory beyond nfsdstats.
Signed-off-by: Konstantin Khorenko <khorenko@openvz.org>
Cc: stable@kernel.org
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Diffstat (limited to 'drivers/rtc')
0 files changed, 0 insertions, 0 deletions