SUMARY

There's a bug in how cfs(4) prepares Rstat for 'cfsctl' syntetic file
which results in cfs suicide if Tstat is requested on the file.

TESTCASE

cfs -S -a tcp!sources.cs.bell-labs.com -f /dev/sdE0/cache /n/sources
syscall -s fstat 0 buf 1024 </n/sources/cfsctl

EXPEXTED OUTPUT

syscall: return 67, no error
[none] (5555555555555555 0 00) --r--r--r-- (444) M 203 none none 1054 Oct 21 14:07 cfsctl
	mtime: Fri Oct 21 14:07:24 EET 2011 (1319195244)
	atime: Fri Oct 21 14:07:24 EET 2011 (1319195244)

ACTUAL OUTPUT

cfs 104806: suicide: sys: trap: fault write addr=0x55555555 pc=0x0000e8b5
syscall: return -1, error:mount rpc error

REASON

convD2M is called to marshal Dir structure to an unallocated buffer.
The global 'statbuf' is used in ramfs for this purpose, but in cfs is
had been reused to hold statistics data to send to client who reads
'cfsctl'.

FIX

Provide a buffer for convD2M on stack.


Reference: /n/sources/patch/maybe/cfs-rstatctlbug
Date: Fri Oct 21 13:30:02 CES 2011
Signed-off-by: yarikos@gmail.com

--- /sys/src/cmd/cfs/cfs.c	Fri Oct 21 13:29:36 2011
+++ /sys/src/cmd/cfs/cfs.c	Fri Oct 21 13:29:31 2011
@@ -647,6 +647,7 @@
 rstat(Mfile *mf)
 {
 	Dir d;
+	uchar buf[2048];
 
 	if(statson && ctltest(mf)){
 		genstats();
@@ -659,8 +660,8 @@
 		d.muid = "none";
 		d.atime = time(nil);
 		d.mtime = d.atime;
-		c.rhdr.nstat = convD2M(&d, c.rhdr.stat,
-			sizeof c.rhdr - (c.rhdr.stat - (uchar*)&c.rhdr));
+		c.rhdr.nstat = convD2M(&d, buf, sizeof(buf));
+		c.rhdr.stat = buf;
 		sendreply(0);
 		return;
 	}