Attachment 249001 Details for Bug 241545 – patch -- calculate rq_rlen locally in smb_receive

[patch] patch -- calculate rq_rlen locally in smb_receive

0002-smbfs-fix-calculation-of-kernel_recvmsg-size-parame.patch (text/plain), 1.92 KB, created by Jeff Layton on 2007-11-06 12:17:25 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jeff Layton

Created: 2007-11-06 12:17:25 UTC

Size: 1.92 KB

patch

obsolete

>To: linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org
>Cc: akpm@linux-foundation.org
>From: Jeff Layton <jlayton@redhat.com>
>Subject: [PATCH] smbfs: fix calculation of kernel_recvmsg size parameter in smb_receive
>
>smb_receive calls kernel_recvmsg with a size that's the minimum of the
>amount of buffer space in the kvec passed in or req->rq_rlen (which
>represents the length of the response). This does not take into account
>any response data that was read in an earlier pass through smb_receive.
>
>If the first pass through smb_receive receives some but not all of the
>response, then the next pass can call kernel_recvmsg with a size field
>that's too big. kernel_recvmsg can overrun into the next response,
>throwing off the alignment and making it unrecognizable.
>
>This causes messages like this to pop up in the ring buffer:
>
>smb_get_length: Invalid NBT packet, code=69
>
>as well as other errors indicating that the response is unrecognizable.
>Typically this is seen on a smbfs mount under heavy I/O.
>
>This patch changes the code to use (req->rq_rlen - req->rq_bytes_recvd)
>instead instead of just req->rq_rlen, since that should represent the
>amount of unread data in the response.
>
>Signed-off-by: Jeff Layton <jlayton@redhat.com>
>Acked-by: Guenter Kukkukk <linux@kukkukk.com>
>---
> fs/smbfs/sock.c |    5 ++---
> 1 files changed, 2 insertions(+), 3 deletions(-)
>
>diff --git a/fs/smbfs/sock.c b/fs/smbfs/sock.c
>index e48bd82..e37fe4d 100644
>--- a/fs/smbfs/sock.c
>+++ b/fs/smbfs/sock.c
>@@ -329,9 +329,8 @@ smb_receive(struct smb_sb_info *server, struct smb_request *req)
> 	msg.msg_control = NULL;
> 
> 	/* Dont repeat bytes and count available bufferspace */
>-	rlen = smb_move_iov(&p, &num, iov, req->rq_bytes_recvd);
>-	if (req->rq_rlen < rlen)
>-		rlen = req->rq_rlen;
>+	rlen = min_t(int, smb_move_iov(&p, &num, iov, req->rq_bytes_recvd),
>+			(req->rq_rlen - req->rq_bytes_recvd));
> 
> 	result = kernel_recvmsg(sock, &msg, p, num, rlen, flags);
> 
>-- 
>1.5.2.1
>

Actions: View | Diff

Attachments on bug 241545: 236241 | 239561 | 249001