When a message is retransmitted, a memmove is used to remove the entry
that was retransmitted from the list.  In the case that the retransmit
list is large 20+ entries, it will memmove from 20 to 19, for a range of
30.  Instead it should memmove from 20 to 19 for a range of 11. The
extra memmove corrupts the stack and corosync coredumps during this very
lossy network setup.

Regards
-steve
Index: exec/totemsrp.c
===================================================================
--- exec/totemsrp.c	(revision 2793)
+++ exec/totemsrp.c	(revision 2794)
@@ -2466,7 +2466,7 @@
 			orf_token->rtr_list_entries -= 1;
 			assert (orf_token->rtr_list_entries >= 0);
 			memmove (&rtr_list[i], &rtr_list[i + 1],
-				sizeof (struct rtr_item) * (orf_token->rtr_list_entries));
+				sizeof (struct rtr_item) * (orf_token->rtr_list_entries - i));
 
 			instance->stats.mcast_retx++;
 			instance->fcc_remcast_current++;
_______________________________________________
Openais mailing list
[email protected]
https://lists.linux-foundation.org/mailman/listinfo/openais

Reply via email to