knfsd: fix reply cache memory corruption

Fix a regression in the reply cache introduced when the code was
converted to use proper Linux lists.  When a new entry needs to be
inserted, the case where all the entries are currently being used
by threads is not correctly detected.  This can result in memory
corruption and a crash.  In the current code this is an extremely
unlikely corner case; it would require the machine to have 1024
nfsd threads and all of them to be busy at the same time.  However,
upcoming reply cache changes make this more likely; a crash due to
this problem was actually observed in field.

Signed-off-by: Greg Banks <gnb@sgi.com>
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>

diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
index 6f0aa4989c6153398890dae0a3eb1c37d2bb7b9d..4638635c5d87d217ea813c9f83b0a07a57624089 100644 (file)
--- a/fs/nfsd/nfscache.c
+++ b/fs/nfsd/nfscache.c
@@ -174,8 +174,8 @@ nfsd_cache_lookup(struct svc_rqst *rqstp, int type)
        }
        }
 
-       /* This should not happen */
-       if (rp == NULL) {
+       /* All entries on the LRU are in-progress. This should not happen */
+       if (&rp->c_lru == &lru_head) {
                static int      complaints;
 
                printk(KERN_WARNING "nfsd: all repcache entries locked!\n");