diff options
| -rw-r--r-- | meta/recipes-connectivity/nfs-utils/nfs-utils/0001-nfs-utils-statd-fix-a-segfault-caused-by-improper-us.patch | 113 | ||||
| -rw-r--r-- | meta/recipes-connectivity/nfs-utils/nfs-utils_1.3.1.bb | 1 |
2 files changed, 114 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/nfs-utils/nfs-utils/0001-nfs-utils-statd-fix-a-segfault-caused-by-improper-us.patch b/meta/recipes-connectivity/nfs-utils/nfs-utils/0001-nfs-utils-statd-fix-a-segfault-caused-by-improper-us.patch new file mode 100644 index 0000000000..de0b045c8c --- /dev/null +++ b/meta/recipes-connectivity/nfs-utils/nfs-utils/0001-nfs-utils-statd-fix-a-segfault-caused-by-improper-us.patch @@ -0,0 +1,113 @@ +Upstream-Status: Pending + +Subject: nfs-utils/statd: fix a segfault caused by improper usage of RPC interface + +There is a hack which uses the bottom-level RPC improperly as below +in the current statd implementation: +insert a socket in the svc_fdset without a corresponding transport handle +and passes the socket to the svc_getreqset subroutine, this usage causes +a segfault of statd on a huge amount of sm-notifications. + +Fix the issue by separating the non-RPC-server sock from RPC dispatcher. + +Signed-off-by: Shan Hai <shan.hai@windriver.com> +Signed-off-by: Chen Qi <Qi.Chen@windriver.com> +--- + utils/statd/rmtcall.c | 1 - + utils/statd/statd.c | 5 +++-- + utils/statd/statd.h | 2 +- + utils/statd/svc_run.c | 8 ++++++-- + 4 files changed, 10 insertions(+), 6 deletions(-) + +diff --git a/utils/statd/rmtcall.c b/utils/statd/rmtcall.c +index fd576d9..cde091b 100644 +--- a/utils/statd/rmtcall.c ++++ b/utils/statd/rmtcall.c +@@ -104,7 +104,6 @@ statd_get_socket(void) + if (sockfd < 0) + return -1; + +- FD_SET(sockfd, &SVC_FDSET); + return sockfd; + } + +diff --git a/utils/statd/statd.c b/utils/statd/statd.c +index 51a016e..e21a259 100644 +--- a/utils/statd/statd.c ++++ b/utils/statd/statd.c +@@ -247,6 +247,7 @@ int main (int argc, char **argv) + int port = 0, out_port = 0; + int nlm_udp = 0, nlm_tcp = 0; + struct rlimit rlim; ++ int notify_sockfd; + + int pipefds[2] = { -1, -1}; + char status; +@@ -473,7 +474,7 @@ int main (int argc, char **argv) + } + + /* Make sure we have a privilege port for calling into the kernel */ +- if (statd_get_socket() < 0) ++ if ((notify_sockfd = statd_get_socket()) < 0) + exit(1); + + /* If sm-notify didn't take all the state files, load +@@ -528,7 +529,7 @@ int main (int argc, char **argv) + * Handle incoming requests: SM_NOTIFY socket requests, as + * well as callbacks from lockd. + */ +- my_svc_run(); /* I rolled my own, Olaf made it better... */ ++ my_svc_run(notify_sockfd); /* I rolled my own, Olaf made it better... */ + + /* Only get here when simulating a crash so we should probably + * start sm-notify running again. As we have already dropped +diff --git a/utils/statd/statd.h b/utils/statd/statd.h +index a1d8035..231ac7e 100644 +--- a/utils/statd/statd.h ++++ b/utils/statd/statd.h +@@ -28,7 +28,7 @@ extern _Bool statd_present_address(const struct sockaddr *sap, char *buf, + __attribute__((__malloc__)) + extern char * statd_canonical_name(const char *hostname); + +-extern void my_svc_run(void); ++extern void my_svc_run(int); + extern void notify_hosts(void); + extern void shuffle_dirs(void); + extern int statd_get_socket(void); +diff --git a/utils/statd/svc_run.c b/utils/statd/svc_run.c +index d98ecee..28c1ad6 100644 +--- a/utils/statd/svc_run.c ++++ b/utils/statd/svc_run.c +@@ -78,7 +78,7 @@ my_svc_exit(void) + * The heart of the server. A crib from libc for the most part... + */ + void +-my_svc_run(void) ++my_svc_run(int sockfd) + { + FD_SET_TYPE readfds; + int selret; +@@ -96,6 +96,8 @@ my_svc_run(void) + } + + readfds = SVC_FDSET; ++ /* Set notify sockfd for waiting for reply */ ++ FD_SET(sockfd, &readfds); + if (notify) { + struct timeval tv; + +@@ -125,8 +127,10 @@ my_svc_run(void) + + default: + selret -= process_reply(&readfds); +- if (selret) ++ if (selret) { ++ FD_CLR(sockfd, &readfds); + svc_getreqset(&readfds); ++ } + } + } + } +-- +1.9.1 + diff --git a/meta/recipes-connectivity/nfs-utils/nfs-utils_1.3.1.bb b/meta/recipes-connectivity/nfs-utils/nfs-utils_1.3.1.bb index 42101de795..317ee85062 100644 --- a/meta/recipes-connectivity/nfs-utils/nfs-utils_1.3.1.bb +++ b/meta/recipes-connectivity/nfs-utils/nfs-utils_1.3.1.bb @@ -31,6 +31,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/nfs-utils/${PV}/nfs-utils-${PV}.tar.x file://proc-fs-nfsd.mount \ file://nfs-utils-Do-not-pass-CFLAGS-to-gcc-while-building.patch \ file://nfs-utils-debianize-start-statd.patch \ + file://0001-nfs-utils-statd-fix-a-segfault-caused-by-improper-us.patch \ " SRC_URI[md5sum] = "8de676b9ff34b8f9addc1d0800fabdf8" |