[SSI] openssi/kernel/cluster/ssi/ipc ipcmsg_svr.c,1.13,1.14

Update of /cvsroot/ssic-linux/openssi/kernel/cluster/ssi/ipc
In directory sfp-cvsdas-3.v30.ch3.sourceforge.com:/tmp/cvs-serv7945/kernel/cluster/ssi/ipc

Modified Files:
      Tag: OPENSSI-FC
	ipcmsg_svr.c 
Log Message:
- Fix memory corruption in sys_msgsnd() due to double kfree of msg_msgseg structures after sending to remote message queue. ssi_msgpack() already freed msg_msgseg. The second kfree is done in free_msg() prior returning to user space.
- Eliminate unnecessary struct msgbuf de-serialization in sys_msgsnd() at remote clients. The existing implementation de-serializes the user's buffer into msg_msg structure for the local message queue first. Then if it determines the queue is remote the msg_msg structure is re-serialized for transport. The new implementation skips all that and instead sends a copy of the user's buffer to the server.
- Remove ssi_msgpack() it is no longer used.
- Create ssi_load_msg() based on ipc/msgutil.c:load_msg() to load kernel space buffer.
- ssi_remote_msgrcv() to skip zero'ing of kernel space receive buffer. There is no security issue since the contents of buffer is not copied to user space unless the remote operation is successful.

 cluster/ssi/ipc/ipcmsg_svr.c |   80 +++++----------------
 include/cluster/gen/ipc.svc  |    4 -
 ipc/msg.c                    |  133 +++++++++++++++++++++--------------
 3 files changed, 102 insertions(+), 115 deletions(-)


Index: ipcmsg_svr.c
===================================================================
RCS file: /cvsroot/ssic-linux/openssi/kernel/cluster/ssi/ipc/ipcmsg_svr.c,v
retrieving revision 1.13
retrieving revision 1.14
diff -u -d -r1.13 -r1.14
--- ipcmsg_svr.c	3 Apr 2010 22:00:36 -0000	1.13
+++ ipcmsg_svr.c	5 Apr 2010 05:10:50 -0000	1.14
@@ -46,6 +46,7 @@
 #ifdef SSI_NOTUSED
 extern int ssi_msg_get_check (ipc_obj_t *objp, long size);
 #endif
+extern struct msg_msg *ssi_load_msg(const void *, int);
 extern int ssi_msgsnd (int, struct msg_msg **, size_t, int);
 extern int ssi_msgrcv (int, struct msgbuf *, size_t, long, int, char *, long *);
 extern long sys_msgctl(int, int, struct msqid_ds *);
@@ -145,73 +146,30 @@
 
 int
 ripc_msgsnd(
-clusternode_t	node,
-int	*rval,
-int	msqid,
-struct msg_msg	*msgp,
-int	size,
-char 	*msgsegs,
-int	segsize,
-int	flags)
+	clusternode_t node,
+	int *rval,
+	int msqid,
+	long mtype,
+	char *msgtxt,
+	int msgsz,
+	int msgflg)
 {
-	struct msg_msgseg *segs, *temp;
-	struct msg_msgseg **pseg = NULL;
-	char *currptr;
-	int len;
+	struct msg_msg *msg;
 
 #ifdef TEST_IPC
-	printk("size = %d, segsize = %d\n",size,segsize);
+	printk("msqid = %d, msgsz = %d\n",msqid,msgsz);
 #endif
-	/*
-	 * load_msg() for kernel-space
-	 */
-	currptr = msgsegs;
-	*rval = 0;
-	if (segsize > 0) {
-		len = segsize;
-		if (len > DATALEN_SEG)
-			len = DATALEN_SEG;
-		segs = (struct msg_msgseg *)kmalloc(sizeof(*segs) + len,
-				GFP_KERNEL);
-		if (segs == NULL) {
-			*rval = -ENOMEM;
-			return *rval;
-		}
-		msgp->next = segs;
-		segs->next = NULL;
-		memcpy (segs+1, currptr, len);
-		pseg = &segs->next;
-		segsize -= len;
-		currptr += len;
-	}
-	while (segsize > 0) {
-		len = segsize;
-		if (len > DATALEN_SEG)
-			len = DATALEN_SEG;
-		segs = (struct msg_msgseg *)kmalloc(sizeof(*segs) + len,
-				GFP_KERNEL);
-		if (segs == NULL) {
-			*rval = -ENOMEM;
-			segs = msgp->next;
-			while (segs != NULL) {
-				temp = segs->next;
-				kfree(segs);
-				segs = temp;
-			}
-			return *rval;
-		}
-		*pseg = segs;
-		segs->next = NULL;
-		memcpy (segs+1, currptr, len);
-		pseg = &segs->next;
-		segsize -= len;
-		currptr += len;
-	}
+	msg = ssi_load_msg(msgtxt, msgsz);
+	if(IS_ERR(msg))
+		return (*rval = PTR_ERR(msg));
 
-	*rval = ssi_msgsnd(msqid, &msgp, msgp->m_ts, flags);
+	msg->m_type = mtype;
+	msg->m_ts = msgsz;
+
+	*rval = ssi_msgsnd(msqid, &msg, msgsz, msgflg);
 	/* msgp will be NULL if message is queued. */
-	if (msgp)
-		free_msg(msgp);
+	if (msg)
+		free_msg(msg);
 	return *rval;
 }
 


------------------------------------------------------------------------------
Download Intel® Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev