LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Petr Vandrovec <vandrove@vc.cvut.cz>
To: Pierre Ossman <drzeus-list@drzeus.cx>
Cc: LKML <linux-kernel@vger.kernel.org>
Subject: Re: NCPFS and brittle connections
Date: Sat, 03 Feb 2007 22:00:53 -0800	[thread overview]
Message-ID: <45C57695.7000707@vc.cvut.cz> (raw)
In-Reply-To: <45B8845E.8070008@drzeus.cx>

Pierre Ossman wrote:
> Ok... how about this baby instead. I've replaced the stack allocated
> request structure by one allocated with kmalloc() and reference counted
> using an atomic_t. I couldn't see anything else that was associated to
> the process, so I believe this should suffice.
> 
> (This is just a RFC. Once I get an ok from you I'll put together a more
> proper patch mail)
> 
> -       req.tx_type = *(u_int16_t*)server->packet;
> -
> -       result = ncp_add_request(server, &req);
> +       struct ncp_request_reply *req;
> +
> +       req = ncp_alloc_req();
> +       if (!req)
> +               return -ENOMEM;
> +
> +       req->reply_buf = reply_buf;
> +       req->datalen = max_reply_size;
> +       req->tx_iov[1].iov_base = server->packet;
> +       req->tx_iov[1].iov_len = size;
> +       req->tx_iovlen = 1;
> +       req->tx_totallen = size;
> +       req->tx_type = *(u_int16_t*)server->packet;

Problem is with these pointers - reply_buf & server->packet.  Now code 
will just read packet from server->packet, and write result to 
reply_buf, most probably transmiting some random data to network, and 
overwriting innocent memory on receiption...  I believe that you need to 
make copies of server->packet/size for transmission, and some simillar 
solution for receive as well.  As both request & response can be up to 
~66000 bytes.
							Petr


  parent reply	other threads:[~2007-02-04  6:00 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2007-01-04 15:04 Pierre Ossman
2007-01-04 17:26 ` Petr Vandrovec
2007-01-04 19:30   ` Pierre Ossman
2007-01-05  7:43     ` Petr Vandrovec
2007-01-24 15:27       ` Pierre Ossman
2007-01-24 17:49         ` Petr Vandrovec
2007-01-24 22:01           ` Pierre Ossman
2007-01-25  8:22             ` Petr Vandrovec
2007-01-25 10:20               ` Pierre Ossman
2007-02-01  8:39                 ` Pierre Ossman
2007-02-04  6:00                 ` Petr Vandrovec [this message]
2007-02-04 17:17                   ` Pierre Ossman
2007-02-05  3:50                     ` Petr Vandrovec
2007-02-19 10:37                       ` Pierre Ossman
2007-02-20  2:47                         ` Petr Vandrovec
2007-02-20  6:37                           ` Pierre Ossman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=45C57695.7000707@vc.cvut.cz \
    --to=vandrove@vc.cvut.cz \
    --cc=drzeus-list@drzeus.cx \
    --cc=linux-kernel@vger.kernel.org \
    --subject='Re: NCPFS and brittle connections' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).