Skip to content

Conversation

@garlick
Copy link
Member

@garlick garlick commented Dec 3, 2025

Problem: on an arm7l (32-bit) server, an x86_64 (64-bit) linux v9fs client gets stuck in an infinite readdir loop:

Treaddir tag 0 fid 1 offset 0 count 1048552
Rreaddir tag 0 count 2842 80000000 00010402 00000000 00b7d065 02000000 00040100 2e800000 00000816 02000000 00002bb7 c5020000 00000403 00676974 80000000 00d02a02 00000000
Treaddir tag 0 fid 1 offset 2147483647 count 1048552
Rreaddir tag 0 count 128180000000 00340b02 00000000 00d8b353 41000000 00040600 74616273 65748000 0000006b 6f020000 00000008 185b4200 00000004 0c006163 6c6f6361 6c2d312e
Treaddir tag 0 fid 1 offset 2147483647 count 1048552
Rreaddir tag 0 count 128180000000 00340b02 00000000 00d8b353 41000000 00040600 74616273 65748000 0000006b 6f020000 00000008 185b4200 00000004 0c006163 6c6f6361 6c2d312e
(repeat forever)

On the server, long is probably 32 bits while off_t is probably 64. The use of long to hold temporary d_off (off_t) values internally is incorrect and results in truncation of large values.

Note that large d_off values may occur as it is not necessarily an offset. See telldir(3).

Use u64 instead.

Fixes #164

WIP for now pending testing

Problem: on an arm7l (32-bit) server, an x86_64 (64-bit) linux
v9fs client gets stuck in an infinite readdir loop:

Treaddir tag 0 fid 1 offset 0 count 1048552
Rreaddir tag 0 count 2842
80000000 00010402 00000000 00b7d065 02000000 00040100 2e800000 00000816
02000000 00002bb7 c5020000 00000403 00676974 80000000 00d02a02 00000000
Treaddir tag 0 fid 1 offset 2147483647 count 1048552
Rreaddir tag 0 count 1281
80000000 00340b02 00000000 00d8b353 41000000 00040600 74616273 65748000
0000006b 6f020000 00000008 185b4200 00000004 0c006163 6c6f6361 6c2d312e
Treaddir tag 0 fid 1 offset 2147483647 count 1048552
Rreaddir tag 0 count 1281
80000000 00340b02 00000000 00d8b353 41000000 00040600 74616273 65748000
0000006b 6f020000 00000008 185b4200 00000004 0c006163 6c6f6361 6c2d312e
(repeat forever)

On the server, long is probably 32 bits while off_t is probably 64.
The use of long to hold temporary d_off (off_t) values internally is
incorrect and results in truncation of large values.

Note that large d_off values may occur as it is not necessarily an
offset.  See telldir(3).

Use u64 instead.

Fixes chaos#164
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

diod server: infinite loop

1 participant