On Tue, Nov 15, 2011 at 11:57 AM, M. Mohan Kumar <mo...@in.ibm.com> wrote:
> +static void send_fd(int sockfd, int fd)
> +{
> + struct msghdr msg = { };
> + struct iovec iov;
> + struct cmsghdr *cmsg;
> + int retval, data;
> + union MsgControl msg_control;
> +
> + iov.iov_base = &data;
> + iov.iov_len = sizeof(data);
> +
> + memset(&msg, 0, sizeof(msg));
> + msg.msg_iov = &iov;
> + msg.msg_iovlen = 1;
> + /* No ancillary data on error */
> + if (fd < 0) {
> + /*
> + * fd is really negative errno if the request failed. Or simply
> + * zero if the request is successful and it doesn't need a file
> + * descriptor.
> + */
It cannot be zero because the if statement is fd < 0. The comment is confusing.
> +/*
> + * create a file and send fd on success
> + * return -errno on error
> + */
> +static int do_create(struct iovec *iovec)
> +{
> + V9fsString path;
> + int flags, fd, mode, uid, gid, cur_uid, cur_gid;
> + proxy_unmarshal(iovec, 1, HDR_SZ, "sdddd",
> + &path, &flags, &mode, &uid, &gid);
Unmarshalling can fail if the iovec size does not match what the
format string describes. We should fail here rather than continuing
on. If execution continues some of the variables may be
uninitialized.
Stefan
