[Cluster-devel] cluster/cman/daemon daemon.c

[Cluster-devel] cluster/cman/daemon daemon.c

[pcaulfield]

CVSROOT:	/cvs/cluster
Module name:	cluster
Changes by:	pcaulfield at sourceware.org	2006-09-14 13:01:06

Modified files:
	cman/daemon    : daemon.c 

Log message:
	Cope with short writes to the cman socket.
	bz#206093

Patches:
http://sourceware.org/cgi-bin/cvsweb.cgi/cluster/cman/daemon/daemon.c.diff?cvsroot=cluster&r1=1.31&r2=1.32

--- cluster/cman/daemon/daemon.c	2006/08/17 13:22:39	1.31
+++ cluster/cman/daemon/daemon.c	2006/09/14 13:01:06	1.32
@@ -44,6 +44,7 @@
 struct queued_reply
 {
 	struct list list;
+	int offset;
 	char buf[1];
 };
 
@@ -66,7 +67,8 @@
 
 	P_DAEMON("sending reply %x to fd %d\n", msg->command, con->fd);
 	ret = send(con->fd, (char *)msg, msg->length, MSG_DONTWAIT);
-	if (ret == -1 && errno == EAGAIN) {
+	if ((ret > 0 && ret != msg->length) ||
+	    (ret == -1 && errno == EAGAIN)) {
 		/* Queue it */
 		struct queued_reply *qm = malloc(sizeof(struct queued_reply) + msg->length);
 		if (!qm)
@@ -75,6 +77,10 @@
 			return -1;
 		}
 		memcpy(qm->buf, msg, msg->length);
+		if (ret > 0)
+			qm->offset = ret;
+		else
+			qm->offset = 0;
 		list_add(&con->write_msgs, &qm->list);
 		P_DAEMON("queued last message\n");
 		poll_dispatch_modify(ais_poll_handle, con->fd, POLLIN | POLLOUT, process_client);
@@ -108,14 +114,16 @@
 	list_iterate_safe(qmh, tmp, &con->write_msgs) {
 		qm = list_item(qmh, struct queued_reply);
 		msg = (struct sock_header *)qm->buf;
-		ret = send(con->fd, qm->buf, msg->length, MSG_DONTWAIT);
-		if (ret == msg->length)
+		ret = send(con->fd, qm->buf + qm->offset, msg->length - qm->offset, MSG_DONTWAIT);
+		if (ret == msg->length - qm->offset)
 		{
 			list_del(&qm->list);
 			free(qm);
 		}
 		else
 		{
+			if (ret > 0)
+				qm->offset += ret;
 			break;
 		}
 	}

[Cluster-devel] cluster/cman/daemon daemon.c

[pcaulfield]

CVSROOT:	/cvs/cluster
Module name:	cluster
Changes by:	pcaulfield at sourceware.org	2007-01-08 10:07:52

Modified files:
	cman/daemon    : daemon.c 

Log message:
	If there are already queued messages for a client then don't send new ones
	out of order

Patches:
http://sourceware.org/cgi-bin/cvsweb.cgi/cluster/cman/daemon/daemon.c.diff?cvsroot=cluster&r1=1.32&r2=1.33

--- cluster/cman/daemon/daemon.c	2006/09/14 13:01:06	1.32
+++ cluster/cman/daemon/daemon.c	2007/01/08 10:07:52	1.33
@@ -66,7 +66,17 @@
 	int ret;
 
 	P_DAEMON("sending reply %x to fd %d\n", msg->command, con->fd);
-	ret = send(con->fd, (char *)msg, msg->length, MSG_DONTWAIT);
+
+	/* If there are already queued messages then don't send this one
+	   out of order */
+	if (!list_empty(&con->write_msgs)) {
+		ret = -1;
+		errno = EAGAIN;
+	}
+	else {
+		ret = send(con->fd, (char *)msg, msg->length, MSG_DONTWAIT);
+	}
+
 	if ((ret > 0 && ret != msg->length) ||
 	    (ret == -1 && errno == EAGAIN)) {
 		/* Queue it */

[Cluster-devel] cluster/cman/daemon daemon.c

[pcaulfield]

CVSROOT:	/cvs/cluster
Module name:	cluster
Branch: 	RHEL5
Changes by:	pcaulfield at sourceware.org	2007-01-08 10:08:48

Modified files:
	cman/daemon    : daemon.c 

Log message:
	If there are already queued messages for a client then don't send new ones
	out of order

Patches:
http://sourceware.org/cgi-bin/cvsweb.cgi/cluster/cman/daemon/daemon.c.diff?cvsroot=cluster&only_with_tag=RHEL5&r1=1.32&r2=1.32.2.1

--- cluster/cman/daemon/daemon.c	2006/09/14 13:01:06	1.32
+++ cluster/cman/daemon/daemon.c	2007/01/08 10:08:48	1.32.2.1
@@ -66,7 +66,17 @@
 	int ret;
 
 	P_DAEMON("sending reply %x to fd %d\n", msg->command, con->fd);
-	ret = send(con->fd, (char *)msg, msg->length, MSG_DONTWAIT);
+
+	/* If there are already queued messages then don't send this one
+	   out of order */
+	if (!list_empty(&con->write_msgs)) {
+		ret = -1;
+		errno = EAGAIN;
+	}
+	else {
+		ret = send(con->fd, (char *)msg, msg->length, MSG_DONTWAIT);
+	}
+
 	if ((ret > 0 && ret != msg->length) ||
 	    (ret == -1 && errno == EAGAIN)) {
 		/* Queue it */

[Cluster-devel] cluster/cman/daemon daemon.c

[fabbione]

CVSROOT:	/cvs/cluster
Module name:	cluster
Changes by:	fabbione at sourceware.org	2007-06-19 12:32:19

Modified files:
	cman/daemon    : daemon.c 

Log message:
	Make sure to cleanup the buffer when processing each request or dirty data
	can be passed from one request to another.
	
	Add a barrier to make sure that the socket data are not bigger than the buffer
	or we overflow somewhere at random.
	
	These 2 changes should be backported to different stable branches.

Patches:
http://sourceware.org/cgi-bin/cvsweb.cgi/cluster/cman/daemon/daemon.c.diff?cvsroot=cluster&r1=1.34&r2=1.35

--- cluster/cman/daemon/daemon.c	2007/05/21 10:48:40	1.34
+++ cluster/cman/daemon/daemon.c	2007/06/19 12:32:19	1.35
@@ -158,6 +158,8 @@
 		int len;
 		int totallen = 0;
 
+		memset(buf, 0, (MAX_CLUSTER_MESSAGE + sizeof(struct sock_header)));
+
 		len = read(fd, buf, sizeof(struct sock_header));
 
 		P_DAEMON("read %d bytes from fd %d\n", len, fd);
@@ -186,6 +188,11 @@
 			send_status_return(con, msg->command, -EINVAL);
 			return 0;
 		}
+		if ((msg->length-len) > MAX_CLUSTER_MESSAGE) {
+			P_DAEMON("message on socket is too big\n");
+			send_status_return(con, msg->command, -EINVAL);
+			return 0;
+		}
 
 		totallen = len;
 

[Cluster-devel] cluster/cman/daemon daemon.c

[pcaulfield]

CVSROOT:	/cvs/cluster
Module name:	cluster
Branch: 	RHEL5
Changes by:	pcaulfield at sourceware.org	2007-06-21 07:39:49

Modified files:
	cman/daemon    : daemon.c 

Log message:
	Patch potential local buffer overflow DoS. Thanks to Fabio Massimo Di Nitto
	bz#244891

Patches:
http://sourceware.org/cgi-bin/cvsweb.cgi/cluster/cman/daemon/daemon.c.diff?cvsroot=cluster&only_with_tag=RHEL5&r1=1.32.2.1&r2=1.32.2.2

--- cluster/cman/daemon/daemon.c	2007/01/08 10:08:48	1.32.2.1
+++ cluster/cman/daemon/daemon.c	2007/06/21 07:39:49	1.32.2.2
@@ -157,6 +157,8 @@
 		int len;
 		int totallen = 0;
 
+		memset(buf, 0, (MAX_CLUSTER_MESSAGE + sizeof(struct sock_header)));
+
 		len = read(fd, buf, sizeof(struct sock_header));
 
 		P_DAEMON("read %d bytes from fd %d\n", len, fd);
@@ -185,6 +187,11 @@
 			send_status_return(con, msg->command, -EINVAL);
 			return 0;
 		}
+		if ((msg->length-len) > MAX_CLUSTER_MESSAGE) {
+			P_DAEMON("message on socket is too big\n");
+			send_status_return(con, msg->command, -EINVAL);
+			return 0;
+		}
 
 		totallen = len;
 

[Cluster-devel] cluster/cman/daemon daemon.c

[pcaulfield]

CVSROOT:	/cvs/cluster
Module name:	cluster
Branch: 	RHEL50
Changes by:	pcaulfield at sourceware.org	2007-06-28 08:07:35

Modified files:
	cman/daemon    : daemon.c 

Log message:
	Make sure to cleanup the buffer when processing each request or dirty data
	can be passed from one request to another.
	
	Add a barrier to make sure that the socket data are not bigger than the buffer
	or we overflow somewhere at random.
	
	21:41 #sistina: < feist> pjc:  can you commit that first cman security fix to
	RHEL50, (the rpm has already been built, but it would
	be nice for tracking purposes).

Patches:
http://sourceware.org/cgi-bin/cvsweb.cgi/cluster/cman/daemon/daemon.c.diff?cvsroot=cluster&only_with_tag=RHEL50&r1=1.32&r2=1.32.4.1

--- cluster/cman/daemon/daemon.c	2006/09/14 13:01:06	1.32
+++ cluster/cman/daemon/daemon.c	2007/06/28 08:07:34	1.32.4.1
@@ -147,6 +147,8 @@
 		int len;
 		int totallen = 0;
 
+		memset(buf, 0, (MAX_CLUSTER_MESSAGE + sizeof(struct sock_header)));
+
 		len = read(fd, buf, sizeof(struct sock_header));
 
 		P_DAEMON("read %d bytes from fd %d\n", len, fd);
@@ -175,6 +177,11 @@
 			send_status_return(con, msg->command, -EINVAL);
 			return 0;
 		}
+		if ((msg->length-len) > MAX_CLUSTER_MESSAGE) {
+			P_DAEMON("message on socket is too big\n");
+			send_status_return(con, msg->command, -EINVAL);
+			return 0;
+		}
 
 		totallen = len;