| Submitter | Raghavendra G |
|---|---|
| Date | 2011-02-23 15:04:30 |
| Message ID | <20110223150430.GA17949@dev.gluster.com> |
| Download | mbox | patch |
| Permalink | /patch/6250/ |
| State | Accepted |
| Delegated to: | Anand Avati |
| Headers | show |
Comments
Marking it reviewed as this is a needed fix. But we still need to add check and logs here if the 'count' is more than MAX_IOVEC size. Otherwise there is a possibility of crash. Regards, Amar On Wed, Feb 23, 2011 at 8:34 PM, Raghavendra G <raghavendra@gluster.com>wrote: > - fops like write can recieve payload data in more than one vector. This > can > happen with write-behind being loaded on client side. > > Signed-off-by: Raghavendra G <raghavendra@gluster.com> > --- > rpc/rpc-lib/src/rpc-transport.c | 2 +- > rpc/rpc-lib/src/rpcsvc.c | 6 +++++- > rpc/rpc-lib/src/rpcsvc.h | 6 +++++- > 3 files changed, 11 insertions(+), 3 deletions(-) > > diff --git a/rpc/rpc-lib/src/rpc-transport.c > b/rpc/rpc-lib/src/rpc-transport.c > index 61e31e9..e7ffb06 100644 > --- a/rpc/rpc-lib/src/rpc-transport.c > +++ b/rpc/rpc-lib/src/rpc-transport.c > @@ -537,7 +537,7 @@ rpc_transport_pollin_alloc (rpc_transport_t *this, > struct iovec *vector, > goto out; > } > > - if (count == 2) { > + if (count > 1) { > msg->vectored = 1; > } > > diff --git a/rpc/rpc-lib/src/rpcsvc.c b/rpc/rpc-lib/src/rpcsvc.c > index 3d6375a..0f198e5 100644 > --- a/rpc/rpc-lib/src/rpcsvc.c > +++ b/rpc/rpc-lib/src/rpcsvc.c > @@ -800,6 +800,8 @@ rpcsvc_request_init (rpcsvc_t *svc, rpc_transport_t > *trans, > struct iovec progmsg, rpc_transport_pollin_t *msg, > rpcsvc_request_t *req) > { > + int i = 0; > + > if ((!trans) || (!callmsg)|| (!req) || (!msg)) > return NULL; > > @@ -814,7 +816,9 @@ rpcsvc_request_init (rpcsvc_t *svc, rpc_transport_t > *trans, > req->msg[0] = progmsg; > req->iobref = iobref_ref (msg->iobref); > if (msg->vectored) { > - req->msg[1] = msg->vector[1]; > + for (i = 1; i < msg->count; i++) { > + req->msg[i] = msg->vector[i]; > + } > } > > req->svc = svc; > diff --git a/rpc/rpc-lib/src/rpcsvc.h b/rpc/rpc-lib/src/rpcsvc.h > index 98de7fc..8625600 100644 > --- a/rpc/rpc-lib/src/rpcsvc.h > +++ b/rpc/rpc-lib/src/rpcsvc.h > @@ -46,6 +46,10 @@ > #define NGRPS 16 > #endif /* !NGRPS */ > > +#ifndef MAX_IOVEC > +#define MAX_IOVEC 16 > +#endif > + > #define GF_RPCSVC "rpc-service" > #define RPCSVC_THREAD_STACK_SIZE ((size_t)(1024 * GF_UNIT_KB)) > > @@ -193,7 +197,7 @@ struct rpcsvc_request { > * by the program actors. This is the buffer that will need to > * be de-xdred by the actor. > */ > - struct iovec msg[2]; > + struct iovec msg[MAX_IOVEC]; > int count; > > struct iobref *iobref; > -- > 1.5.5 > > _______________________________________________ > glusterfs mailing list > glusterfs@dev.gluster.com > http://dev.gluster.com/cgi-bin/mailman/listinfo/glusterfs >
Patch
diff --git a/rpc/rpc-lib/src/rpc-transport.c b/rpc/rpc-lib/src/rpc-transport.c index 61e31e9..e7ffb06 100644 --- a/rpc/rpc-lib/src/rpc-transport.c +++ b/rpc/rpc-lib/src/rpc-transport.c @@ -537,7 +537,7 @@ rpc_transport_pollin_alloc (rpc_transport_t *this, struct iovec *vector, goto out; } - if (count == 2) { + if (count > 1) { msg->vectored = 1; } diff --git a/rpc/rpc-lib/src/rpcsvc.c b/rpc/rpc-lib/src/rpcsvc.c index 3d6375a..0f198e5 100644 --- a/rpc/rpc-lib/src/rpcsvc.c +++ b/rpc/rpc-lib/src/rpcsvc.c @@ -800,6 +800,8 @@ rpcsvc_request_init (rpcsvc_t *svc, rpc_transport_t *trans, struct iovec progmsg, rpc_transport_pollin_t *msg, rpcsvc_request_t *req) { + int i = 0; + if ((!trans) || (!callmsg)|| (!req) || (!msg)) return NULL; @@ -814,7 +816,9 @@ rpcsvc_request_init (rpcsvc_t *svc, rpc_transport_t *trans, req->msg[0] = progmsg; req->iobref = iobref_ref (msg->iobref); if (msg->vectored) { - req->msg[1] = msg->vector[1]; + for (i = 1; i < msg->count; i++) { + req->msg[i] = msg->vector[i]; + } } req->svc = svc; diff --git a/rpc/rpc-lib/src/rpcsvc.h b/rpc/rpc-lib/src/rpcsvc.h index 98de7fc..8625600 100644 --- a/rpc/rpc-lib/src/rpcsvc.h +++ b/rpc/rpc-lib/src/rpcsvc.h @@ -46,6 +46,10 @@ #define NGRPS 16 #endif /* !NGRPS */ +#ifndef MAX_IOVEC +#define MAX_IOVEC 16 +#endif + #define GF_RPCSVC "rpc-service" #define RPCSVC_THREAD_STACK_SIZE ((size_t)(1024 * GF_UNIT_KB)) @@ -193,7 +197,7 @@ struct rpcsvc_request { * by the program actors. This is the buffer that will need to * be de-xdred by the actor. */ - struct iovec msg[2]; + struct iovec msg[MAX_IOVEC]; int count; struct iobref *iobref;
- fops like write can recieve payload data in more than one vector. This can happen with write-behind being loaded on client side. Signed-off-by: Raghavendra G <raghavendra@gluster.com> --- rpc/rpc-lib/src/rpc-transport.c | 2 +- rpc/rpc-lib/src/rpcsvc.c | 6 +++++- rpc/rpc-lib/src/rpcsvc.h | 6 +++++- 3 files changed, 11 insertions(+), 3 deletions(-)