Reviewed-by: Jan Friesse <[email protected]>

Steven Dake napsal(a):
> a memb_join operation that occurs during flushing can result in an
> entry into the GATHER state from the RECOVERY state.  This results in the
> regular sort queue being used instead of the recovery sort queue, resulting
> in segfault.
> 
> Signed-off-by: Steven Dake <[email protected]>
> ---
>  exec/totemudp.c |   13 +++++++++++++
>  1 files changed, 13 insertions(+), 0 deletions(-)
> 
> diff --git a/exec/totemudp.c b/exec/totemudp.c
> index 96849b7..0c12b56 100644
> --- a/exec/totemudp.c
> +++ b/exec/totemudp.c
> @@ -90,6 +90,8 @@
>  #define BIND_STATE_REGULAR   1
>  #define BIND_STATE_LOOPBACK  2
>  
> +#define MESSAGE_TYPE_MCAST   1
> +
>  #define HMAC_HASH_SIZE 20
>  struct security_header {
>       unsigned char hash_digest[HMAC_HASH_SIZE]; /* The hash *MUST* be first 
> in the data structure */
> @@ -1172,6 +1174,7 @@ static int net_deliver_fn (
>       int res = 0;
>       unsigned char *msg_offset;
>       unsigned int size_delv;
> +     char *message_type;
>  
>       if (instance->flushing == 1) {
>               iovec = &instance->totemudp_iov_recv_flush;
> @@ -1234,6 +1237,16 @@ static int net_deliver_fn (
>       }
>  
>       /*
> +      * Drop all non-mcast messages (more specifically join
> +      * messages should be dropped)
> +      */
> +     message_type = (char *)msg_offset;
> +     if (instance->flushing == 1 && *message_type != MESSAGE_TYPE_MCAST) {
> +             iovec->iov_len = FRAME_SIZE_MAX;
> +             return (0);
> +     }
> +     
> +     /*
>        * Handle incoming message
>        */
>       instance->totemudp_deliver_fn (

_______________________________________________
Openais mailing list
[email protected]
https://lists.linux-foundation.org/mailman/listinfo/openais

Reply via email to