Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix panic on dropping RecvAncillaryBuffer after failed recvmsg #676

Merged
merged 2 commits into from
Jun 10, 2023
Merged

Fix panic on dropping RecvAncillaryBuffer after failed recvmsg #676

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ae94409
Fix panic on dropping `RecvAncillaryBuffer` after failed `recvmsg`
ids1024 May 22, 2023
68717e5
Clear any messages from `RecvAncillaryBuffer` at start of recv
ids1024 May 24, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 9 additions & 5 deletions src/backend/libc/net/msghdr.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ use super::super::c;
use super::super::conv::{msg_control_len, msg_iov_len};
use super::super::net::write_sockaddr::{encode_sockaddr_v4, encode_sockaddr_v6};

use crate::io::{IoSlice, IoSliceMut};
use crate::io::{self, IoSlice, IoSliceMut};
use crate::net::{RecvAncillaryBuffer, SendAncillaryBuffer, SocketAddrV4, SocketAddrV6};
use crate::utils::as_ptr;

Expand All @@ -19,8 +19,10 @@ pub(crate) fn with_recv_msghdr<R>(
name: &mut MaybeUninit<c::sockaddr_storage>,
iov: &mut [IoSliceMut<'_>],
control: &mut RecvAncillaryBuffer<'_>,
f: impl FnOnce(&mut c::msghdr) -> R,
) -> R {
f: impl FnOnce(&mut c::msghdr) -> io::Result<R>,
) -> io::Result<R> {
control.clear();

let namelen = size_of::<c::sockaddr_storage>() as c::socklen_t;
let mut msghdr = {
let mut h: c::msghdr = unsafe { zeroed() };
Expand All @@ -36,8 +38,10 @@ pub(crate) fn with_recv_msghdr<R>(
let res = f(&mut msghdr);

// Reset the control length.
unsafe {
control.set_control_len(msghdr.msg_controllen.try_into().unwrap_or(usize::MAX));
if res.is_ok() {
unsafe {
control.set_control_len(msghdr.msg_controllen.try_into().unwrap_or(usize::MAX));
}
Comment on lines +41 to +44
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure if the contents of the control buffer are defined on error. I think it would be safest to set the buffer's length to zero on error.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

set_control_len just sets the length (and read) field of the RecvAncillaryBuffer, which isn't part of the buffer that libc will be touching so it won't be changed by the recvmsg call if this set_control_len line isn't run.

And for a newly allocated RecvAncillaryBuffer, it will already be 0. So there's no need to set it, in that case.

If the same RecvAncillaryBuffer is re-used in multiple calls, I'm not sure how that works currently. Should check that doesn't leak file descriptors or anything.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should probably be clearing out all of the inner data before we do anything with it.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added a commit that clears the RecvAncillaryBuffer at the start of the recv operation.

}

res
Expand Down
14 changes: 9 additions & 5 deletions src/backend/linux_raw/net/msghdr.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
use super::super::c;
use super::super::net::write_sockaddr::{encode_sockaddr_v4, encode_sockaddr_v6};

use crate::io::{IoSlice, IoSliceMut};
use crate::io::{self, IoSlice, IoSliceMut};
use crate::net::{RecvAncillaryBuffer, SendAncillaryBuffer, SocketAddrV4, SocketAddrV6};
use crate::utils::as_ptr;

Expand All @@ -31,8 +31,10 @@ pub(crate) fn with_recv_msghdr<R>(
name: &mut MaybeUninit<c::sockaddr_storage>,
iov: &mut [IoSliceMut<'_>],
control: &mut RecvAncillaryBuffer<'_>,
f: impl FnOnce(&mut c::msghdr) -> R,
) -> R {
f: impl FnOnce(&mut c::msghdr) -> io::Result<R>,
) -> io::Result<R> {
control.clear();

let namelen = size_of::<c::sockaddr_storage>() as c::c_int;
let mut msghdr = c::msghdr {
msg_name: name.as_mut_ptr().cast(),
Expand All @@ -49,8 +51,10 @@ pub(crate) fn with_recv_msghdr<R>(
let res = f(&mut msghdr);

// Reset the control length.
unsafe {
control.set_control_len(msghdr.msg_controllen.try_into().unwrap_or(usize::MAX));
if res.is_ok() {
unsafe {
control.set_control_len(msghdr.msg_controllen.try_into().unwrap_or(usize::MAX));
}
}
Comment on lines +54 to 58
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ditto here.


res
Expand Down
7 changes: 6 additions & 1 deletion src/net/send_recv/msg.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -248,6 +248,11 @@ impl<'buf> RecvAncillaryBuffer<'buf> {
self.read = 0;
}

/// Delete all messages from the buffer.
pub(crate) fn clear(&mut self) {
self.drain().for_each(drop);
}

/// Drain all messages from the buffer.
pub fn drain(&mut self) -> AncillaryDrain<'_> {
AncillaryDrain {
Expand All @@ -260,7 +265,7 @@ impl<'buf> RecvAncillaryBuffer<'buf> {

impl Drop for RecvAncillaryBuffer<'_> {
fn drop(&mut self) {
self.drain().for_each(drop);
self.clear();
}
}

Expand Down