e9f7bee1df
The logic in nfs_direct_read_schedule and nfs_direct_write_schedule can allow data->npages to be one larger than rpages. This causes a page pointer to be written beyond the end of the pagevec in nfs_read_data (or nfs_write_data). Fix this by making nfs_(read|write)_alloc() calculate the size of the pagevec array, and initialise data->npages. Also get rid of the redundant argument to nfs_commit_alloc(). Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> Cc: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org> |
||
|---|---|---|
| .. | ||
| callback_proc.c | ||
| callback_xdr.c | ||
| callback.c | ||
| callback.h | ||
| delegation.c | ||
| delegation.h | ||
| dir.c | ||
| direct.c | ||
| file.c | ||
| idmap.c | ||
| inode.c | ||
| internal.h | ||
| iostat.h | ||
| Makefile | ||
| mount_clnt.c | ||
| namespace.c | ||
| nfs2xdr.c | ||
| nfs3acl.c | ||
| nfs3proc.c | ||
| nfs3xdr.c | ||
| nfs4_fs.h | ||
| nfs4namespace.c | ||
| nfs4proc.c | ||
| nfs4renewd.c | ||
| nfs4state.c | ||
| nfs4xdr.c | ||
| nfsroot.c | ||
| pagelist.c | ||
| proc.c | ||
| read.c | ||
| super.c | ||
| symlink.c | ||
| sysctl.c | ||
| unlink.c | ||
| write.c | ||