Attachment 239561 Details for Bug 241545 – patch -- calculate rq_rlen locally in smb_receive

[patch] patch -- calculate rq_rlen locally in smb_receive

0001-smbfs-fix-calculation-of-size-parameter-in-smb_rec.patch (text/plain), 2.03 KB, created by Jeff Layton on 2007-10-26 20:41:43 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jeff Layton

Created: 2007-10-26 20:41:43 UTC

Size: 2.03 KB

patch

obsolete

>From 0f0ef12d2dbe0a7bc3b37c6e302c52ed34ebc8b7 Mon Sep 17 00:00:00 2001
>From: Jeff Layton <jlayton@redhat.com>
>Date: Fri, 26 Oct 2007 16:34:48 -0400
>Subject: [PATCH 1/1] [smbfs] fix calculation of size parameter in smb_receive
>
>smb_receive calls kernel_recvmsg with a size that's the minimum of the
>amount of buffer space in the kvec passed in or req->rq_rlen. req->rq_rlen
>is only calculated in smb_recv_param phase of the receive. If
>smb_recv_data doesn't receive the entire response, then smbiod will
>call it again.
>
>At that point rq_rlen no longer reflects the amount of data left in
>the response. kernel_recvmsg will then be called with too big a size
>parameter and will go past the end of the response. The next response
>will be invalid since the alignment is off.
>
>This causes messages like this to pop up in the ring buffer:
>
>smb_get_length: Invalid NBT packet, code=69
>
>as well as other things indicating that the response is unrecognizable.
>
>This patch changes the code to recalculate the rq_len locally and
>then use that to make a determination of what size parameter should
>be passed to kernel_recvmsg.
>
>Signed-off-by: Jeff Layton <jlayton@redhat.com>
>---
> fs/smbfs/sock.c |    8 ++++----
> 1 files changed, 4 insertions(+), 4 deletions(-)
>
>diff --git a/fs/smbfs/sock.c b/fs/smbfs/sock.c
>index 93f3cd2..1a1c8cb 100644
>--- a/fs/smbfs/sock.c
>+++ b/fs/smbfs/sock.c
>@@ -314,7 +314,7 @@ smb_receive(struct smb_sb_info *server, struct smb_request *req)
> 	struct kvec *p = req->rq_iov;
> 	size_t num = req->rq_iovlen;
> 	struct msghdr msg;
>-	int rlen;
>+	int rlen, rq_rlen;
> 	int result = -EIO;
> 
> 	sock = server_sock(server);
>@@ -331,9 +331,9 @@ smb_receive(struct smb_sb_info *server, struct smb_request *req)
> 
> 	/* Dont repeat bytes and count available bufferspace */
> 	rlen = smb_move_iov(&p, &num, iov, req->rq_bytes_recvd);
>-	if (req->rq_rlen < rlen)
>-		rlen = req->rq_rlen;
>-
>+	rq_rlen = req->rq_rlen - req->rq_bytes_recvd;
>+	rlen = min_t(int, rlen, rq_rlen);
>+	
> 	result = kernel_recvmsg(sock, &msg, p, num, rlen, flags);
> 
> 	VERBOSE("read: %d\n", result);
>-- 
>1.5.2.1
>

Actions: View | Diff

Attachments on bug 241545: 236241 | 239561 | 249001