Linux-2.6.31-rc8 inotify hangs samba clients

[Jeff Chua]

The first part of commit 0db501bd0610ee0c0aca84d927f90bcccd09e2bd hangs 
WinXP clients browsing Linux samba folders ... trying to add a 
terminating byte to name_len. Reverting this solves the problem.

The second part of adding zeros is fine.

If we don't revert here, then Samba 3.3.7 will have to change to work with 
Linux 2.6.31-rc8, and perhaps other codes as well.

Thanks,
Jeff




commit 0db501bd0610ee0c0aca84d927f90bcccd09e2bd
Author: Eric W. Biederman <ebiederm@xxxxxxxxxxxx>
Date:   Thu Aug 27 03:20:04 2009 -0700

    inotify: Ensure we alwasy write the terminating NULL.

    Before the rewrite copy_event_to_user always wrote a terqminating '\0'
    byte to user space after the filename.  Since the rewrite that
    terminating byte was skipped if your filename is exactly a multiple of
    event_size.  Ouch!

    So add one byte to name_size before we round up.

    Signed-off-by: Eric W. Biederman <ebiederm@xxxxxxxxxxxxxxxxxx>
    Signed-off-by: Eric Paris <eparis@xxxxxxxxxx>

diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index ce1f582..0e781bc 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -199,8 +196,10 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
 		inotify_free_event_priv(fsn_priv);
 	}

-	/* round up event->name_len so it is a multiple of event_size */
-	name_len = roundup(event->name_len, event_size);
+	/* round up event->name_len so it is a multiple of event_size
+	 * plus an extra byte for the terminating '\0'.
+	 */
+	name_len = roundup(event->name_len, event_size) + 1;
 	inotify_event.len = name_len;

 	inotify_event.mask = inotify_mask_to_arg(event->mask);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/