casaroli commented on code in PR #21492:
URL: https://github.com/apache/nuttx/pull/21492#discussion_r4490026019
##########
net/local/local_sendmsg.c:
##########
@@ -430,26 +431,44 @@ ssize_t local_sendmsg(FAR struct socket *psock, FAR const
struct msghdr *msg,
if (msg->msg_control &&
msg->msg_controllen > sizeof(struct cmsghdr))
{
+ /* Stream sockets require data to be sent with control messages */
+
+ if (psock->s_type == SOCK_STREAM)
+ {
+ size_t total = 0;
+ size_t i;
+
+ for (i = 0; i < iovlen; i++)
+ {
+ total += buf[i].iov_len;
+ }
+
+ if (total == 0)
+ {
+ return -EINVAL;
+ }
+ }
+
count = local_sendctl(conn, msg);
if (count < 0)
{
return count;
}
}
- len = to ? local_sendto(psock, buf, len, flags, to, tolen) :
- local_send(psock, buf, len, flags);
+ ret = to ? local_sendto(psock, buf, iovlen, flags, to, tolen) :
+ local_send(psock, buf, iovlen, flags);
- if (len < 0 && count > 0)
+ if (ret < 0 && count > 0)
Review Comment:
This error path never ran on master, because `len` was a `size_t`, and now
it hangs. With an accepted stream socket: sendmsg() with SCM_RIGHTS blocks on a
full pipe and the peer closes. `local_free()` of the peer clears `lc_peer` and
releases the fds, sendmsg() gets EPIPE, and `local_freectl()` falls back to
`peer = conn`, where `lc_cfpcount` is 0, so `--lc_cfpcount` reads
`lc_cfps[65535]`. On qemu-armv8a:nsh and knsh the program never ends and the
prompt does not come back; on master it ends with EPIPE.
Fix: call `local_freectl()` only if `conn->lc_peer` is still the peer that
`local_sendctl()` used, and stop in `local_freectl()` when `lc_cfpcount` is 0,
because the receiver can take the fds first.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
