Patch for a receive data path bug where the iocb length was
going negative, and the iocb was not getting completed when it
should have. Instead it was generating a connection abort later
in the pipe. The patch makes sure that the data being copied
from a buffer to an iocb is bounded by the size of the iocb as
well as the buffer.
-Libor
Index: sdp_recv.c
===================================================================
--- sdp_recv.c (revision 2071)
+++ sdp_recv.c (working copy)
@@ -670,7 +670,7 @@
copy = min((PAGE_SIZE - offset),
(unsigned long)(buff->tail - buff->data));
-
+ copy = min(iocb->len, copy);
#ifndef _SDP_DATA_PATH_NULL
memcpy((addr + offset), buff->data, copy);
#endif
@@ -1459,7 +1459,7 @@
iocb->req = req;
iocb->key = req->ki_key;
iocb->addr = (unsigned long)msg->msg_iov->iov_base;
-
+
req->ki_cancel = sdp_inet_read_cancel;
result = sdp_iocb_lock(iocb);
_______________________________________________
openib-general mailing list
[email protected]
http://openib.org/mailman/listinfo/openib-general
To unsubscribe, please visit http://openib.org/mailman/listinfo/openib-general
