From fcd828a22844649c69e061f8b2a956bf09441c33 Mon Sep 17 00:00:00 2001 From: Jackie Huang Date: Wed, 10 Jan 2018 09:53:06 +0800 Subject: rpcbind: Stop freeing a static pointer commit 7ea36ee introduced a svc_freeargs() call that ended up freeing static pointer. It turns out the allocations for the rmt_args is not necessary . The xdr routines (xdr_bytes) will handle the memory management and the largest possible message size is UDPMSGSIZE (due to UDP only) which is smaller than RPC_BUF_MAX (From OE-Core rev: 1d78875de924d794130c86b27ed516a1df40a59d) Signed-off-by: Jackie Huang Signed-off-by: Ross Burton Signed-off-by: Richard Purdie --- ..._callit_com-Stop-freeing-a-static-pointer.patch | 100 +++++++++++++++++++++ meta/recipes-extended/rpcbind/rpcbind_0.2.4.bb | 1 + 2 files changed, 101 insertions(+) create mode 100644 meta/recipes-extended/rpcbind/rpcbind/rpcbproc_callit_com-Stop-freeing-a-static-pointer.patch (limited to 'meta/recipes-extended') diff --git a/meta/recipes-extended/rpcbind/rpcbind/rpcbproc_callit_com-Stop-freeing-a-static-pointer.patch b/meta/recipes-extended/rpcbind/rpcbind/rpcbproc_callit_com-Stop-freeing-a-static-pointer.patch new file mode 100644 index 0000000000..9a000d0285 --- /dev/null +++ b/meta/recipes-extended/rpcbind/rpcbind/rpcbproc_callit_com-Stop-freeing-a-static-pointer.patch @@ -0,0 +1,100 @@ +From 7c7590ad536c0e24bef790cb1e65702fc54db566 Mon Sep 17 00:00:00 2001 +From: Steve Dickson +Date: Tue, 30 May 2017 11:27:22 -0400 +Subject: [PATCH] rpcbproc_callit_com: Stop freeing a static pointer + +commit 7ea36ee introduced a svc_freeargs() call +that ended up freeing static pointer. + +It turns out the allocations for the rmt_args +is not necessary . The xdr routines (xdr_bytes) will +handle the memory management and the largest +possible message size is UDPMSGSIZE (due to UDP only) +which is smaller than RPC_BUF_MAX + +Signed-off-by: Steve Dickson + +Upstream-Status: Backport + +Signed-off-by: Jackie Huang +--- + src/rpcb_svc_com.c | 39 ++++++--------------------------------- + 1 file changed, 6 insertions(+), 33 deletions(-) + +diff --git a/src/rpcb_svc_com.c b/src/rpcb_svc_com.c +index cb63afd..1fc2229 100644 +--- a/src/rpcb_svc_com.c ++++ b/src/rpcb_svc_com.c +@@ -612,9 +612,9 @@ rpcbproc_callit_com(struct svc_req *rqstp, SVCXPRT *transp, + struct netconfig *nconf; + struct netbuf *caller; + struct r_rmtcall_args a; +- char *buf_alloc = NULL, *outbufp; ++ char *outbufp; + char *outbuf_alloc = NULL; +- char buf[RPC_BUF_MAX], outbuf[RPC_BUF_MAX]; ++ char outbuf[RPC_BUF_MAX]; + struct netbuf *na = (struct netbuf *) NULL; + struct rpc_msg call_msg; + int outlen; +@@ -635,36 +635,10 @@ rpcbproc_callit_com(struct svc_req *rqstp, SVCXPRT *transp, + } + if (si.si_socktype != SOCK_DGRAM) + return; /* Only datagram type accepted */ +- sendsz = __rpc_get_t_size(si.si_af, si.si_proto, UDPMSGSIZE); +- if (sendsz == 0) { /* data transfer not supported */ +- if (reply_type == RPCBPROC_INDIRECT) +- svcerr_systemerr(transp); +- return; +- } +- /* +- * Should be multiple of 4 for XDR. +- */ +- sendsz = ((sendsz + 3) / 4) * 4; +- if (sendsz > RPC_BUF_MAX) { +-#ifdef notyet +- buf_alloc = alloca(sendsz); /* not in IDR2? */ +-#else +- buf_alloc = malloc(sendsz); +-#endif /* notyet */ +- if (buf_alloc == NULL) { +- if (debugging) +- xlog(LOG_DEBUG, +- "rpcbproc_callit_com: No Memory!\n"); +- if (reply_type == RPCBPROC_INDIRECT) +- svcerr_systemerr(transp); +- return; +- } +- a.rmt_args.args = buf_alloc; +- } else { +- a.rmt_args.args = buf; +- } ++ sendsz = UDPMSGSIZE; + + call_msg.rm_xid = 0; /* For error checking purposes */ ++ memset(&a, 0, sizeof(a)); /* Zero out the input buffer */ + if (!svc_getargs(transp, (xdrproc_t) xdr_rmtcall_args, (char *) &a)) { + if (reply_type == RPCBPROC_INDIRECT) + svcerr_decode(transp); +@@ -704,7 +678,8 @@ rpcbproc_callit_com(struct svc_req *rqstp, SVCXPRT *transp, + if (rbl == (rpcblist_ptr)NULL) { + #ifdef RPCBIND_DEBUG + if (debugging) +- xlog(LOG_DEBUG, "not found\n"); ++ xlog(LOG_DEBUG, "prog %lu vers %lu: not found\n", ++ a.rmt_prog, a.rmt_vers); + #endif + if (reply_type == RPCBPROC_INDIRECT) + svcerr_noprog(transp); +@@ -937,8 +912,6 @@ out: + } + if (local_uaddr) + free(local_uaddr); +- if (buf_alloc) +- free(buf_alloc); + if (outbuf_alloc) + free(outbuf_alloc); + if (na) { +-- +2.7.4 + diff --git a/meta/recipes-extended/rpcbind/rpcbind_0.2.4.bb b/meta/recipes-extended/rpcbind/rpcbind_0.2.4.bb index d3eeaf94b6..dcdee6c468 100644 --- a/meta/recipes-extended/rpcbind/rpcbind_0.2.4.bb +++ b/meta/recipes-extended/rpcbind/rpcbind_0.2.4.bb @@ -17,6 +17,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/rpcbind/rpcbind-${PV}.tar.bz2 \ file://rpcbind.service \ file://0001-rpcbind-pair-all-svc_getargs-calls-with-svc_freeargs.patch \ file://pmapproc_dump-Fixed-typo-in-memory-leak-patch.patch \ + file://rpcbproc_callit_com-Stop-freeing-a-static-pointer.patch \ " SRC_URI[md5sum] = "cf10cd41ed8228fc54c316191c1f07fe" SRC_URI[sha256sum] = "074a9a530dc7c11e0d905aa59bcb0847c009313f02e98d3d798aa9568f414c66" -- cgit v1.2.3-54-g00ecf