From: J. Bruce Fields Date: Mon, 20 Aug 2012 20:04:40 +0000 (-0400) Subject: svcrpc: sends on closed socket should stop immediately X-Git-Tag: firefly_0821_release~7541^2~755 X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=b8e52a4288c0c1a66c60e92fc57fd3d5e3918da0;p=firefly-linux-kernel-4.4.55.git svcrpc: sends on closed socket should stop immediately commit f06f00a24d76e168ecb38d352126fd203937b601 upstream. svc_tcp_sendto sets XPT_CLOSE if we fail to transmit the entire reply. However, the XPT_CLOSE won't be acted on immediately. Meanwhile other threads could send further replies before the socket is really shut down. This can manifest as data corruption: for example, if a truncated read reply is followed by another rpc reply, that second reply will look to the client like further read data. Symptoms were data corruption preceded by svc_tcp_sendto logging something like kernel: rpc-srv/tcp: nfsd: sent only 963696 when sending 1048708 bytes - shutting down socket Reported-by: Malahal Naineni Tested-by: Malahal Naineni Signed-off-by: J. Bruce Fields Signed-off-by: Greg Kroah-Hartman --- diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c index dad7af51cac3..05dbccf48f63 100644 --- a/net/sunrpc/svc_xprt.c +++ b/net/sunrpc/svc_xprt.c @@ -801,7 +801,8 @@ int svc_send(struct svc_rqst *rqstp) /* Grab mutex to serialize outgoing data. */ mutex_lock(&xprt->xpt_mutex); - if (test_bit(XPT_DEAD, &xprt->xpt_flags)) + if (test_bit(XPT_DEAD, &xprt->xpt_flags) + || test_bit(XPT_CLOSE, &xprt->xpt_flags)) len = -ENOTCONN; else len = xprt->xpt_ops->xpo_sendto(rqstp);