[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[commits] r1341 - in /fsf/trunk/libc: ./ nscd/
- To: commits@xxxxxxxxxx
- Subject: [commits] r1341 - in /fsf/trunk/libc: ./ nscd/
- From: eglibc@xxxxxxxxxx
- Date: Thu, 01 Feb 2007 08:01:28 -0000
Author: eglibc
Date: Thu Feb 1 00:01:28 2007
New Revision: 1341
Log:
Import glibc-mainline for 2007-02-01
Modified:
fsf/trunk/libc/ChangeLog
fsf/trunk/libc/nscd/nscd-client.h
fsf/trunk/libc/nscd/nscd_getai.c
fsf/trunk/libc/nscd/nscd_getgr_r.c
fsf/trunk/libc/nscd/nscd_gethst_r.c
fsf/trunk/libc/nscd/nscd_getpw_r.c
fsf/trunk/libc/nscd/nscd_getserv_r.c
fsf/trunk/libc/nscd/nscd_helper.c
fsf/trunk/libc/nscd/nscd_initgroups.c
Modified: fsf/trunk/libc/ChangeLog
==============================================================================
--- fsf/trunk/libc/ChangeLog (original)
+++ fsf/trunk/libc/ChangeLog Thu Feb 1 00:01:28 2007
@@ -1,3 +1,30 @@
+2007-01-31 Ulrich Drepper <drepper@xxxxxxxxxx>
+
+ * nscd/nscd_helper.c (open_socket): Now takes request type and key
+ as parameter. Construct request record. Try sending request
+ before the first poll use, it usually succeeds. Adjust all
+ callers.
+ * nscd/nscd-client.h: Define MAXKEYLEN.
+
+2007-01-31 Jakub Jelinek <jakub@xxxxxxxxxx>
+
+ * nscd/nscd-client.h (__nscd_cache_search): Remove const qualifier
+ from return value.
+ * nscd/nscd_helper.c: Include string.h.
+ (__nscd_cache_search): Remove const qualifier from return value.
+ On strict alignment architectures check hash entry and data head
+ alignment.
+ * nscd/nscd_getpw_r.c (nscd_getpw_r): Don't crash or fail because
+ mmapped data during GC cycle contains garbage. If
+ __nscd_drop_map_ref fails, decrement mapped->counter when returning
+ error or if retrying with NO_MAPPING, only __nscd_unmap if counter
+ dropped to 0.
+ * nscd/nscd_getgr_r.c (nscd_getgr_r): Likewise.
+ * nscd/nscd_initgroups.c (__nscd_getgrouplist): Likewise.
+ * nscd/nscd_gethst_r.c (nscd_gethst_r): Likewise.
+ * nscd/nscd_getai.c (__nscd_getai): Likewise.
+ * nscd/nscd_getserv_r.c (nscd_getserv_r): Likewise.
+
2007-01-30 Ulrich Drepper <drepper@xxxxxxxxxx>
* misc/hsearch_r.c (hdestroy_r): Remove unnecessary test.
Modified: fsf/trunk/libc/nscd/nscd-client.h
==============================================================================
--- fsf/trunk/libc/nscd/nscd-client.h (original)
+++ fsf/trunk/libc/nscd/nscd-client.h Thu Feb 1 00:01:28 2007
@@ -43,6 +43,9 @@
/* Path for the configuration file. */
#define _PATH_NSCDCONF "/etc/nscd.conf"
+
+/* Maximu allowed length for the key. */
+#define MAXKEYLEN 1024
/* Available services. */
@@ -323,10 +326,10 @@
/* Search the mapped database. */
-extern const struct datahead *__nscd_cache_search (request_type type,
- const char *key,
- size_t keylen,
- const struct mapped_database *mapped);
+extern struct datahead *__nscd_cache_search (request_type type,
+ const char *key,
+ size_t keylen,
+ const struct mapped_database *mapped);
/* Wrappers around read, readv and write that only read/write less than LEN
bytes on error or EOF. */
Modified: fsf/trunk/libc/nscd/nscd_getai.c
==============================================================================
--- fsf/trunk/libc/nscd/nscd_getai.c (original)
+++ fsf/trunk/libc/nscd/nscd_getai.c Thu Feb 1 00:01:28 2007
@@ -1,4 +1,4 @@
-/* Copyright (C) 2004, 2005, 2006 Free Software Foundation, Inc.
+/* Copyright (C) 2004, 2005, 2006, 2007 Free Software Foundation, Inc.
This file is part of the GNU C Library.
Contributed by Ulrich Drepper <drepper@xxxxxxxxxx>, 2004.
@@ -42,6 +42,7 @@
{
size_t keylen = strlen (key) + 1;
int gc_cycle;
+ int nretries = 0;
/* If the mapping is available, try to search there instead of
communicating with the nscd. */
@@ -50,49 +51,53 @@
&gc_cycle);
retry:;
- const ai_response_header *ai_resp = NULL;
struct nscd_ai_result *resultbuf = NULL;
const char *recend = (const char *) ~UINTMAX_C (0);
char *respdata = NULL;
int retval = -1;
int sock = -1;
+ ai_response_header ai_resp;
if (mapped != NO_MAPPING)
{
- const struct datahead *found = __nscd_cache_search (GETAI, key, keylen,
- mapped);
+ struct datahead *found = __nscd_cache_search (GETAI, key, keylen,
+ mapped);
if (found != NULL)
{
- ai_resp = &found->data[0].aidata;
- respdata = (char *) (ai_resp + 1);
+ respdata = (char *) (&found->data[0].aidata + 1);
+ ai_resp = found->data[0].aidata;
recend = (const char *) found->data + found->recsize;
+ /* Now check if we can trust ai_resp fields. If GC is
+ in progress, it can contain anything. */
+ if (mapped->head->gc_cycle != gc_cycle)
+ {
+ retval = -2;
+ goto out;
+ }
}
}
/* If we do not have the cache mapped, try to get the data over the
socket. */
- ai_response_header ai_resp_mem;
- if (ai_resp == NULL)
- {
- sock = __nscd_open_socket (key, keylen, GETAI, &ai_resp_mem,
- sizeof (ai_resp_mem));
+ if (respdata == NULL)
+ {
+ sock = __nscd_open_socket (key, keylen, GETAI, &ai_resp,
+ sizeof (ai_resp));
if (sock == -1)
{
/* nscd not running or wrong version. */
__nss_not_use_nscd_hosts = 1;
goto out;
}
-
- ai_resp = &ai_resp_mem;
- }
-
- if (ai_resp->found == 1)
- {
- size_t datalen = ai_resp->naddrs + ai_resp->addrslen + ai_resp->canonlen;
-
- /* This check is really only affects the case where the data
+ }
+
+ if (ai_resp.found == 1)
+ {
+ size_t datalen = ai_resp.naddrs + ai_resp.addrslen + ai_resp.canonlen;
+
+ /* This check really only affects the case where the data
comes from the mapped cache. */
- if ((char *) (ai_resp + 1) + datalen > recend)
+ if (respdata + datalen > recend)
{
assert (sock == -1);
goto out;
@@ -108,10 +113,10 @@
}
/* Set up the data structure, including pointers. */
- resultbuf->naddrs = ai_resp->naddrs;
+ resultbuf->naddrs = ai_resp.naddrs;
resultbuf->addrs = (char *) (resultbuf + 1);
- resultbuf->family = (uint8_t *) (resultbuf->addrs + ai_resp->addrslen);
- if (ai_resp->canonlen != 0)
+ resultbuf->family = (uint8_t *) (resultbuf->addrs + ai_resp.addrslen);
+ if (ai_resp.canonlen != 0)
resultbuf->canon = (char *) (resultbuf->family + resultbuf->naddrs);
else
resultbuf->canon = NULL;
@@ -137,10 +142,13 @@
/* Try to detect corrupt databases. */
if (resultbuf->canon != NULL
- && resultbuf->canon[ai_resp->canonlen - 1] != '\0')
+ && resultbuf->canon[ai_resp.canonlen - 1] != '\0')
/* We cannot use the database. */
{
- free (resultbuf);
+ if (mapped->head->gc_cycle != gc_cycle)
+ retval = -2;
+ else
+ free (resultbuf);
goto out_close;
}
@@ -150,7 +158,7 @@
}
else
{
- if (__builtin_expect (ai_resp->found == -1, 0))
+ if (__builtin_expect (ai_resp.found == -1, 0))
{
/* The daemon does not cache this database. */
__nss_not_use_nscd_hosts = 1;
@@ -158,7 +166,7 @@
}
/* Store the error number. */
- *h_errnop = ai_resp->error;
+ *h_errnop = ai_resp.error;
/* The `errno' to some value != ERANGE. */
__set_errno (ENOENT);
@@ -170,22 +178,25 @@
if (sock != -1)
close_not_cancel_no_status (sock);
out:
- if (__nscd_drop_map_ref (mapped, &gc_cycle) != 0 && retval != -1)
+ if (__nscd_drop_map_ref (mapped, &gc_cycle) != 0)
{
/* When we come here this means there has been a GC cycle while we
were looking for the data. This means the data might have been
inconsistent. Retry if possible. */
- if ((gc_cycle & 1) != 0)
+ if ((gc_cycle & 1) != 0 || ++nretries == 5 || retval == -1)
{
/* nscd is just running gc now. Disable using the mapping. */
- __nscd_unmap (mapped);
+ if (atomic_decrement_val (&mapped->counter) == 0)
+ __nscd_unmap (mapped);
mapped = NO_MAPPING;
}
- *result = NULL;
- free (resultbuf);
-
- goto retry;
+ if (retval != -1)
+ {
+ *result = NULL;
+ free (resultbuf);
+ goto retry;
+ }
}
return retval;
Modified: fsf/trunk/libc/nscd/nscd_getgr_r.c
==============================================================================
--- fsf/trunk/libc/nscd/nscd_getgr_r.c (original)
+++ fsf/trunk/libc/nscd/nscd_getgr_r.c Thu Feb 1 00:01:28 2007
@@ -1,4 +1,5 @@
-/* Copyright (C) 1998-2000, 2002-2005, 2006 Free Software Foundation, Inc.
+/* Copyright (C) 1998-2000, 2002-2005, 2006, 2007
+ Free Software Foundation, Inc.
This file is part of the GNU C Library.
Contributed by Thorsten Kukuk <kukuk@xxxxxxxxxxxxxxxx>, 1998.
@@ -88,6 +89,7 @@
struct group **result)
{
int gc_cycle;
+ int nretries = 0;
const uint32_t *len = NULL;
size_t lensize = 0;
@@ -97,55 +99,59 @@
&__gr_map_handle,
&gc_cycle);
retry:;
- const gr_response_header *gr_resp = NULL;
const char *gr_name = NULL;
size_t gr_name_len = 0;
int retval = -1;
const char *recend = (const char *) ~UINTMAX_C (0);
+ gr_response_header gr_resp;
if (mapped != NO_MAPPING)
{
- const struct datahead *found = __nscd_cache_search (type, key, keylen,
- mapped);
+ struct datahead *found = __nscd_cache_search (type, key, keylen, mapped);
if (found != NULL)
{
- gr_resp = &found->data[0].grdata;
- len = (const uint32_t *) (gr_resp + 1);
- /* The alignment is always sufficient. */
+ len = (const uint32_t *) (&found->data[0].grdata + 1);
+ gr_resp = found->data[0].grdata;
+ gr_name = ((const char *) len
+ + gr_resp.gr_mem_cnt * sizeof (uint32_t));
+ gr_name_len = gr_resp.gr_name_len + gr_resp.gr_passwd_len;
+ recend = (const char *) found->data + found->recsize;
+ /* Now check if we can trust gr_resp fields. If GC is
+ in progress, it can contain anything. */
+ if (mapped->head->gc_cycle != gc_cycle)
+ {
+ retval = -2;
+ goto out;
+ }
+
+ /* The alignment is always sufficient, unless GC is in progress. */
assert (((uintptr_t) len & (__alignof__ (*len) - 1)) == 0);
- gr_name = ((const char *) len
- + gr_resp->gr_mem_cnt * sizeof (uint32_t));
- gr_name_len = gr_resp->gr_name_len + gr_resp->gr_passwd_len;
- recend = (const char *) found->data + found->recsize;
- }
- }
-
- gr_response_header gr_resp_mem;
+ }
+ }
+
int sock = -1;
- if (gr_resp == NULL)
- {
- sock = __nscd_open_socket (key, keylen, type, &gr_resp_mem,
- sizeof (gr_resp_mem));
+ if (gr_name == NULL)
+ {
+ sock = __nscd_open_socket (key, keylen, type, &gr_resp,
+ sizeof (gr_resp));
if (sock == -1)
{
__nss_not_use_nscd_group = 1;
goto out;
}
-
- gr_resp = &gr_resp_mem;
}
/* No value found so far. */
*result = NULL;
- if (__builtin_expect (gr_resp->found == -1, 0))
+ if (__builtin_expect (gr_resp.found == -1, 0))
{
/* The daemon does not cache this database. */
__nss_not_use_nscd_group = 1;
goto out_close;
}
- if (gr_resp->found == 1)
+ if (gr_resp.found == 1)
{
struct iovec vec[2];
char *p = buffer;
@@ -157,8 +163,8 @@
align the pointer. */
align = ((__alignof__ (char *) - (p - ((char *) 0)))
& (__alignof__ (char *) - 1));
- total_len = (align + (1 + gr_resp->gr_mem_cnt) * sizeof (char *)
- + gr_resp->gr_name_len + gr_resp->gr_passwd_len);
+ total_len = (align + (1 + gr_resp.gr_mem_cnt) * sizeof (char *)
+ + gr_resp.gr_name_len + gr_resp.gr_passwd_len);
if (__builtin_expect (buflen < total_len, 0))
{
no_room:
@@ -170,16 +176,16 @@
p += align;
resultbuf->gr_mem = (char **) p;
- p += (1 + gr_resp->gr_mem_cnt) * sizeof (char *);
+ p += (1 + gr_resp.gr_mem_cnt) * sizeof (char *);
/* Set pointers for strings. */
resultbuf->gr_name = p;
- p += gr_resp->gr_name_len;
+ p += gr_resp.gr_name_len;
resultbuf->gr_passwd = p;
- p += gr_resp->gr_passwd_len;
+ p += gr_resp.gr_passwd_len;
/* Fill in what we know now. */
- resultbuf->gr_gid = gr_resp->gr_gid;
+ resultbuf->gr_gid = gr_resp.gr_gid;
/* Read the length information, group name, and password. */
if (gr_name == NULL)
@@ -187,17 +193,17 @@
/* Allocate array to store lengths. */
if (lensize == 0)
{
- lensize = gr_resp->gr_mem_cnt * sizeof (uint32_t);
+ lensize = gr_resp.gr_mem_cnt * sizeof (uint32_t);
len = (uint32_t *) alloca (lensize);
}
- else if (gr_resp->gr_mem_cnt * sizeof (uint32_t) > lensize)
+ else if (gr_resp.gr_mem_cnt * sizeof (uint32_t) > lensize)
len = extend_alloca (len, lensize,
- gr_resp->gr_mem_cnt * sizeof (uint32_t));
+ gr_resp.gr_mem_cnt * sizeof (uint32_t));
vec[0].iov_base = (void *) len;
- vec[0].iov_len = gr_resp->gr_mem_cnt * sizeof (uint32_t);
+ vec[0].iov_len = gr_resp.gr_mem_cnt * sizeof (uint32_t);
vec[1].iov_base = resultbuf->gr_name;
- vec[1].iov_len = gr_resp->gr_name_len + gr_resp->gr_passwd_len;
+ vec[1].iov_len = gr_resp.gr_name_len + gr_resp.gr_passwd_len;
total_len = vec[0].iov_len + vec[1].iov_len;
/* Get this data. */
@@ -209,14 +215,14 @@
/* We already have the data. Just copy the group name and
password. */
memcpy (resultbuf->gr_name, gr_name,
- gr_resp->gr_name_len + gr_resp->gr_passwd_len);
+ gr_resp.gr_name_len + gr_resp.gr_passwd_len);
/* Clear the terminating entry. */
- resultbuf->gr_mem[gr_resp->gr_mem_cnt] = NULL;
+ resultbuf->gr_mem[gr_resp.gr_mem_cnt] = NULL;
/* Prepare reading the group members. */
total_len = 0;
- for (cnt = 0; cnt < gr_resp->gr_mem_cnt; ++cnt)
+ for (cnt = 0; cnt < gr_resp.gr_mem_cnt; ++cnt)
{
resultbuf->gr_mem[cnt] = p;
total_len += len[cnt];
@@ -224,9 +230,25 @@
}
if (__builtin_expect (gr_name + gr_name_len + total_len > recend, 0))
- goto out_close;
+ {
+ /* len array might contain garbage during nscd GC cycle,
+ retry rather than fail in that case. */
+ if (gr_name != NULL && mapped->head->gc_cycle != gc_cycle)
+ retval = -2;
+ goto out_close;
+ }
if (__builtin_expect (total_len > buflen, 0))
- goto no_room;
+ {
+ /* len array might contain garbage during nscd GC cycle,
+ retry rather than fail in that case. */
+ if (gr_name != NULL && mapped->head->gc_cycle != gc_cycle)
+ {
+ retval = -2;
+ goto out_close;
+ }
+ else
+ goto no_room;
+ }
retval = 0;
if (gr_name == NULL)
@@ -248,14 +270,14 @@
/* Try to detect corrupt databases. */
if (resultbuf->gr_name[gr_name_len - 1] != '\0'
- || resultbuf->gr_passwd[gr_resp->gr_passwd_len - 1] != '\0'
- || ({for (cnt = 0; cnt < gr_resp->gr_mem_cnt; ++cnt)
+ || resultbuf->gr_passwd[gr_resp.gr_passwd_len - 1] != '\0'
+ || ({for (cnt = 0; cnt < gr_resp.gr_mem_cnt; ++cnt)
if (resultbuf->gr_mem[cnt][len[cnt] - 1] != '\0')
break;
- cnt < gr_resp->gr_mem_cnt; }))
+ cnt < gr_resp.gr_mem_cnt; }))
{
/* We cannot use the database. */
- retval = -1;
+ retval = mapped->head->gc_cycle != gc_cycle ? -2 : -1;
goto out_close;
}
@@ -274,19 +296,21 @@
if (sock != -1)
close_not_cancel_no_status (sock);
out:
- if (__nscd_drop_map_ref (mapped, &gc_cycle) != 0 && retval != -1)
+ if (__nscd_drop_map_ref (mapped, &gc_cycle) != 0)
{
/* When we come here this means there has been a GC cycle while we
were looking for the data. This means the data might have been
inconsistent. Retry if possible. */
- if ((gc_cycle & 1) != 0)
+ if ((gc_cycle & 1) != 0 || ++nretries == 5 || retval == -1)
{
/* nscd is just running gc now. Disable using the mapping. */
- __nscd_unmap (mapped);
+ if (atomic_decrement_val (&mapped->counter) == 0)
+ __nscd_unmap (mapped);
mapped = NO_MAPPING;
}
- goto retry;
+ if (retval != -1)
+ goto retry;
}
return retval;
Modified: fsf/trunk/libc/nscd/nscd_gethst_r.c
==============================================================================
--- fsf/trunk/libc/nscd/nscd_gethst_r.c (original)
+++ fsf/trunk/libc/nscd/nscd_gethst_r.c Thu Feb 1 00:01:28 2007
@@ -113,7 +113,6 @@
&gc_cycle);
retry:;
- const hst_response_header *hst_resp = NULL;
const char *h_name = NULL;
const uint32_t *aliases_len = NULL;
const char *addr_list = NULL;
@@ -121,18 +120,27 @@
int retval = -1;
const char *recend = (const char *) ~UINTMAX_C (0);
int sock = -1;
+ hst_response_header hst_resp;
if (mapped != NO_MAPPING)
{
- const struct datahead *found = __nscd_cache_search (type, key, keylen,
- mapped);
+ /* No const qualifier, as it can change during garbage collection. */
+ struct datahead *found = __nscd_cache_search (type, key, keylen, mapped);
if (found != NULL)
{
- hst_resp = &found->data[0].hstdata;
- h_name = (char *) (hst_resp + 1);
- aliases_len = (uint32_t *) (h_name + hst_resp->h_name_len);
+ h_name = (char *) (&found->data[0].hstdata + 1);
+ hst_resp = found->data[0].hstdata;
+ aliases_len = (uint32_t *) (h_name + hst_resp.h_name_len);
addr_list = ((char *) aliases_len
- + hst_resp->h_aliases_cnt * sizeof (uint32_t));
- addr_list_len = hst_resp->h_addr_list_cnt * INADDRSZ;
+ + hst_resp.h_aliases_cnt * sizeof (uint32_t));
+ addr_list_len = hst_resp.h_addr_list_cnt * INADDRSZ;
+ recend = (const char *) found->data + found->recsize;
+ /* Now check if we can trust hst_resp fields. If GC is
+ in progress, it can contain anything. */
+ if (mapped->head->gc_cycle != gc_cycle)
+ {
+ retval = -2;
+ goto out;
+ }
#ifndef _STRING_ARCH_unaligned
/* The aliases_len array in the mapped database might very
@@ -142,51 +150,47 @@
if (((uintptr_t) aliases_len & (__alignof__ (*aliases_len) - 1))
!= 0)
{
- uint32_t *tmp = alloca (hst_resp->h_aliases_cnt
+ uint32_t *tmp = alloca (hst_resp.h_aliases_cnt
* sizeof (uint32_t));
aliases_len = memcpy (tmp, aliases_len,
- hst_resp->h_aliases_cnt
+ hst_resp.h_aliases_cnt
* sizeof (uint32_t));
}
#endif
if (type != GETHOSTBYADDR && type != GETHOSTBYNAME)
{
- if (hst_resp->h_length == INADDRSZ)
+ if (hst_resp.h_length == INADDRSZ)
addr_list += addr_list_len;
- addr_list_len = hst_resp->h_addr_list_cnt * IN6ADDRSZ;
- }
- recend = (const char *) found->data + found->recsize;
+ addr_list_len = hst_resp.h_addr_list_cnt * IN6ADDRSZ;
+ }
if (__builtin_expect ((const char *) addr_list + addr_list_len
> recend, 0))
- goto out_close;
- }
- }
-
- hst_response_header hst_resp_mem;
- if (hst_resp == NULL)
- {
- sock = __nscd_open_socket (key, keylen, type, &hst_resp_mem,
- sizeof (hst_resp_mem));
+ goto out;
+ }
+ }
+
+ if (h_name == NULL)
+ {
+ sock = __nscd_open_socket (key, keylen, type, &hst_resp,
+ sizeof (hst_resp));
if (sock == -1)
{
__nss_not_use_nscd_hosts = 1;
goto out;
}
-
- hst_resp = &hst_resp_mem;
}
/* No value found so far. */
*result = NULL;
- if (__builtin_expect (hst_resp->found == -1, 0))
+ if (__builtin_expect (hst_resp.found == -1, 0))
{
/* The daemon does not cache this database. */
__nss_not_use_nscd_hosts = 1;
goto out_close;
}
- if (hst_resp->found == 1)
+ if (hst_resp.found == 1)
{
char *cp = buffer;
uintptr_t align1;
@@ -201,15 +205,15 @@
align the pointer and the base of the h_addr_list pointers. */
align1 = ((__alignof__ (char *) - (cp - ((char *) 0)))
& (__alignof__ (char *) - 1));
- align2 = ((__alignof__ (char *) - ((cp + align1 + hst_resp->h_name_len)
+ align2 = ((__alignof__ (char *) - ((cp + align1 + hst_resp.h_name_len)
- ((char *) 0)))
& (__alignof__ (char *) - 1));
- if (buflen < (align1 + hst_resp->h_name_len + align2
- + ((hst_resp->h_aliases_cnt + hst_resp->h_addr_list_cnt
+ if (buflen < (align1 + hst_resp.h_name_len + align2
+ + ((hst_resp.h_aliases_cnt + hst_resp.h_addr_list_cnt
+ 2)
* sizeof (char *))
- + hst_resp->h_addr_list_cnt * (type == AF_INET
- ? INADDRSZ : IN6ADDRSZ)))
+ + hst_resp.h_addr_list_cnt * (type == AF_INET
+ ? INADDRSZ : IN6ADDRSZ)))
{
no_room:
*h_errnop = NETDB_INTERNAL;
@@ -221,12 +225,12 @@
/* Prepare the result as far as we can. */
resultbuf->h_aliases = (char **) cp;
- cp += (hst_resp->h_aliases_cnt + 1) * sizeof (char *);
+ cp += (hst_resp.h_aliases_cnt + 1) * sizeof (char *);
resultbuf->h_addr_list = (char **) cp;
- cp += (hst_resp->h_addr_list_cnt + 1) * sizeof (char *);
+ cp += (hst_resp.h_addr_list_cnt + 1) * sizeof (char *);
resultbuf->h_name = cp;
- cp += hst_resp->h_name_len + align2;
+ cp += hst_resp.h_name_len + align2;
if (type == GETHOSTBYADDR || type == GETHOSTBYNAME)
{
@@ -238,7 +242,7 @@
resultbuf->h_addrtype = AF_INET6;
resultbuf->h_length = IN6ADDRSZ;
}
- for (cnt = 0; cnt < hst_resp->h_addr_list_cnt; ++cnt)
+ for (cnt = 0; cnt < hst_resp.h_addr_list_cnt; ++cnt)
{
resultbuf->h_addr_list[cnt] = cp;
cp += resultbuf->h_length;
@@ -250,47 +254,47 @@
struct iovec vec[4];
vec[0].iov_base = resultbuf->h_name;
- vec[0].iov_len = hst_resp->h_name_len;
- total_len = hst_resp->h_name_len;
+ vec[0].iov_len = hst_resp.h_name_len;
+ total_len = hst_resp.h_name_len;
n = 1;
- if (hst_resp->h_aliases_cnt > 0)
- {
- aliases_len = alloca (hst_resp->h_aliases_cnt
+ if (hst_resp.h_aliases_cnt > 0)
+ {
+ aliases_len = alloca (hst_resp.h_aliases_cnt
* sizeof (uint32_t));
vec[n].iov_base = (void *) aliases_len;
- vec[n].iov_len = hst_resp->h_aliases_cnt * sizeof (uint32_t);
-
- total_len += hst_resp->h_aliases_cnt * sizeof (uint32_t);
+ vec[n].iov_len = hst_resp.h_aliases_cnt * sizeof (uint32_t);
+
+ total_len += hst_resp.h_aliases_cnt * sizeof (uint32_t);
++n;
}
if (type == GETHOSTBYADDR || type == GETHOSTBYNAME)
{
vec[n].iov_base = resultbuf->h_addr_list[0];
- vec[n].iov_len = hst_resp->h_addr_list_cnt * INADDRSZ;
-
- total_len += hst_resp->h_addr_list_cnt * INADDRSZ;
+ vec[n].iov_len = hst_resp.h_addr_list_cnt * INADDRSZ;
+
+ total_len += hst_resp.h_addr_list_cnt * INADDRSZ;
++n;
}
else
{
- if (hst_resp->h_length == INADDRSZ)
+ if (hst_resp.h_length == INADDRSZ)
{
- ignore = alloca (hst_resp->h_addr_list_cnt * INADDRSZ);
+ ignore = alloca (hst_resp.h_addr_list_cnt * INADDRSZ);
vec[n].iov_base = ignore;
- vec[n].iov_len = hst_resp->h_addr_list_cnt * INADDRSZ;
-
- total_len += hst_resp->h_addr_list_cnt * INADDRSZ;
+ vec[n].iov_len = hst_resp.h_addr_list_cnt * INADDRSZ;
+
+ total_len += hst_resp.h_addr_list_cnt * INADDRSZ;
++n;
}
vec[n].iov_base = resultbuf->h_addr_list[0];
- vec[n].iov_len = hst_resp->h_addr_list_cnt * IN6ADDRSZ;
-
- total_len += hst_resp->h_addr_list_cnt * IN6ADDRSZ;
+ vec[n].iov_len = hst_resp.h_addr_list_cnt * IN6ADDRSZ;
+
+ total_len += hst_resp.h_addr_list_cnt * IN6ADDRSZ;
++n;
}
@@ -300,13 +304,13 @@
}
else
{
- memcpy (resultbuf->h_name, h_name, hst_resp->h_name_len);
+ memcpy (resultbuf->h_name, h_name, hst_resp.h_name_len);
memcpy (resultbuf->h_addr_list[0], addr_list, addr_list_len);
}
/* Now we also can read the aliases. */
total_len = 0;
- for (cnt = 0; cnt < hst_resp->h_aliases_cnt; ++cnt)
+ for (cnt = 0; cnt < hst_resp.h_aliases_cnt; ++cnt)
{
resultbuf->h_aliases[cnt] = cp;
cp += aliases_len[cnt];
@@ -316,10 +320,25 @@
if (__builtin_expect ((const char *) addr_list + addr_list_len
+ total_len > recend, 0))
- goto out_close;
+ {
+ /* aliases_len array might contain garbage during nscd GC cycle,
+ retry rather than fail in that case. */
+ if (addr_list != NULL && mapped->head->gc_cycle != gc_cycle)
+ retval = -2;
+ goto out_close;
+ }
/* See whether this would exceed the buffer capacity. */
if (__builtin_expect (cp > buffer + buflen, 0))
- goto no_room;
+ {
+ /* aliases_len array might contain garbage during nscd GC cycle,
+ retry rather than fail in that case. */
+ if (addr_list != NULL && mapped->head->gc_cycle != gc_cycle)
+ {
+ retval = -2;
+ goto out_close;
+ }
+ goto no_room;
+ }
/* And finally read the aliases. */
if (addr_list == NULL)
@@ -338,14 +357,18 @@
(const char *) addr_list + addr_list_len, total_len);
/* Try to detect corrupt databases. */
- if (resultbuf->h_name[hst_resp->h_name_len - 1] != '\0'
- || ({for (cnt = 0; cnt < hst_resp->h_aliases_cnt; ++cnt)
+ if (resultbuf->h_name[hst_resp.h_name_len - 1] != '\0'
+ || ({for (cnt = 0; cnt < hst_resp.h_aliases_cnt; ++cnt)
if (resultbuf->h_aliases[cnt][aliases_len[cnt] - 1]
!= '\0')
break;
- cnt < hst_resp->h_aliases_cnt; }))
- /* We cannot use the database. */
- goto out_close;
+ cnt < hst_resp.h_aliases_cnt; }))
+ {
+ /* We cannot use the database. */
+ if (mapped->head->gc_cycle != gc_cycle)
+ retval = -2;
+ goto out_close;
+ }
retval = 0;
*result = resultbuf;
@@ -354,7 +377,7 @@
else
{
/* Store the error number. */
- *h_errnop = hst_resp->error;
+ *h_errnop = hst_resp.error;
/* The `errno' to some value != ERANGE. */
__set_errno (ENOENT);
@@ -366,19 +389,21 @@
if (sock != -1)
close_not_cancel_no_status (sock);
out:
- if (__nscd_drop_map_ref (mapped, &gc_cycle) != 0 && retval != -1)
+ if (__nscd_drop_map_ref (mapped, &gc_cycle) != 0)
{
/* When we come here this means there has been a GC cycle while we
were looking for the data. This means the data might have been
inconsistent. Retry if possible. */
- if ((gc_cycle & 1) != 0 || ++nretries == 5)
+ if ((gc_cycle & 1) != 0 || ++nretries == 5 || retval == -1)
{
/* nscd is just running gc now. Disable using the mapping. */
- __nscd_unmap (mapped);
+ if (atomic_decrement_val (&mapped->counter) == 0)
+ __nscd_unmap (mapped);
mapped = NO_MAPPING;
}
- goto retry;
+ if (retval != -1)
+ goto retry;
}
return retval;
Modified: fsf/trunk/libc/nscd/nscd_getpw_r.c
==============================================================================
--- fsf/trunk/libc/nscd/nscd_getpw_r.c (original)
+++ fsf/trunk/libc/nscd/nscd_getpw_r.c Thu Feb 1 00:01:28 2007
@@ -1,4 +1,5 @@
-/* Copyright (C) 1998, 1999, 2003, 2004, 2005 Free Software Foundation, Inc.
+/* Copyright (C) 1998, 1999, 2003, 2004, 2005, 2007
+ Free Software Foundation, Inc.
This file is part of the GNU C Library.
Contributed by Thorsten Kukuk <kukuk@xxxxxxxxxxxxxxxx>, 1998.
@@ -88,76 +89,81 @@
struct passwd **result)
{
int gc_cycle;
+ int nretries = 0;
+
/* If the mapping is available, try to search there instead of
communicating with the nscd. */
struct mapped_database *mapped;
mapped = __nscd_get_map_ref (GETFDPW, "passwd", &map_handle, &gc_cycle);
retry:;
- const pw_response_header *pw_resp = NULL;
const char *pw_name = NULL;
int retval = -1;
const char *recend = (const char *) ~UINTMAX_C (0);
+ pw_response_header pw_resp;
if (mapped != NO_MAPPING)
{
- const struct datahead *found = __nscd_cache_search (type, key, keylen,
- mapped);
+ struct datahead *found = __nscd_cache_search (type, key, keylen, mapped);
if (found != NULL)
{
- pw_resp = &found->data[0].pwdata;
- pw_name = (const char *) (pw_resp + 1);
+ pw_name = (const char *) (&found->data[0].pwdata + 1);
+ pw_resp = found->data[0].pwdata;
recend = (const char *) found->data + found->recsize;
- }
- }
-
- pw_response_header pw_resp_mem;
+ /* Now check if we can trust pw_resp fields. If GC is
+ in progress, it can contain anything. */
+ if (mapped->head->gc_cycle != gc_cycle)
+ {
+ retval = -2;
+ goto out;
+ }
+ }
+ }
+
int sock = -1;
- if (pw_resp == NULL)
- {
- sock = __nscd_open_socket (key, keylen, type, &pw_resp_mem,
- sizeof (pw_resp_mem));
+ if (pw_name == NULL)
+ {
+ sock = __nscd_open_socket (key, keylen, type, &pw_resp,
+ sizeof (pw_resp));
if (sock == -1)
{
__nss_not_use_nscd_passwd = 1;
goto out;
}
-
- pw_resp = &pw_resp_mem;
}
/* No value found so far. */
*result = NULL;
- if (__builtin_expect (pw_resp->found == -1, 0))
+ if (__builtin_expect (pw_resp.found == -1, 0))
{
/* The daemon does not cache this database. */
__nss_not_use_nscd_passwd = 1;
goto out_close;
}
- if (pw_resp->found == 1)
+ if (pw_resp.found == 1)
{
/* Set the information we already have. */
- resultbuf->pw_uid = pw_resp->pw_uid;
- resultbuf->pw_gid = pw_resp->pw_gid;
+ resultbuf->pw_uid = pw_resp.pw_uid;
+ resultbuf->pw_gid = pw_resp.pw_gid;
char *p = buffer;
/* get pw_name */
resultbuf->pw_name = p;
- p += pw_resp->pw_name_len;
+ p += pw_resp.pw_name_len;
/* get pw_passwd */
resultbuf->pw_passwd = p;
- p += pw_resp->pw_passwd_len;
+ p += pw_resp.pw_passwd_len;
/* get pw_gecos */
resultbuf->pw_gecos = p;
- p += pw_resp->pw_gecos_len;
+ p += pw_resp.pw_gecos_len;
/* get pw_dir */
resultbuf->pw_dir = p;
- p += pw_resp->pw_dir_len;
+ p += pw_resp.pw_dir_len;
/* get pw_pshell */
resultbuf->pw_shell = p;
- p += pw_resp->pw_shell_len;
+ p += pw_resp.pw_shell_len;
ssize_t total = p - buffer;
if (__builtin_expect (pw_name + total > recend, 0))
@@ -189,14 +195,14 @@
memcpy (resultbuf->pw_name, pw_name, total);
/* Try to detect corrupt databases. */
- if (resultbuf->pw_name[pw_resp->pw_name_len - 1] != '\0'
- || resultbuf->pw_passwd[pw_resp->pw_passwd_len - 1] != '\0'
- || resultbuf->pw_gecos[pw_resp->pw_gecos_len - 1] != '\0'
- || resultbuf->pw_dir[pw_resp->pw_dir_len - 1] != '\0'
- || resultbuf->pw_shell[pw_resp->pw_shell_len - 1] != '\0')
+ if (resultbuf->pw_name[pw_resp.pw_name_len - 1] != '\0'
+ || resultbuf->pw_passwd[pw_resp.pw_passwd_len - 1] != '\0'
+ || resultbuf->pw_gecos[pw_resp.pw_gecos_len - 1] != '\0'
+ || resultbuf->pw_dir[pw_resp.pw_dir_len - 1] != '\0'
+ || resultbuf->pw_shell[pw_resp.pw_shell_len - 1] != '\0')
{
/* We cannot use the database. */
- retval = -1;
+ retval = mapped->head->gc_cycle != gc_cycle ? -2 : -1;
goto out_close;
}
@@ -215,19 +221,21 @@
if (sock != -1)
close_not_cancel_no_status (sock);
out:
- if (__nscd_drop_map_ref (mapped, &gc_cycle) != 0 && retval != -1)
+ if (__nscd_drop_map_ref (mapped, &gc_cycle) != 0)
{
/* When we come here this means there has been a GC cycle while we
were looking for the data. This means the data might have been
inconsistent. Retry if possible. */
- if ((gc_cycle & 1) != 0)
+ if ((gc_cycle & 1) != 0 || ++nretries == 5 || retval == -1)
{
/* nscd is just running gc now. Disable using the mapping. */
- __nscd_unmap (mapped);
+ if (atomic_decrement_val (&mapped->counter) == 0)
+ __nscd_unmap (mapped);
mapped = NO_MAPPING;
}
- goto retry;
+ if (retval != -1)
+ goto retry;
}
return retval;
Modified: fsf/trunk/libc/nscd/nscd_getserv_r.c
==============================================================================
--- fsf/trunk/libc/nscd/nscd_getserv_r.c (original)
+++ fsf/trunk/libc/nscd/nscd_getserv_r.c Thu Feb 1 00:01:28 2007
@@ -93,7 +93,6 @@
"/", 1), proto ?: "", protolen + 1);
retry:;
- const serv_response_header *serv_resp = NULL;
const char *s_name = NULL;
const char *s_proto = NULL;
const uint32_t *aliases_len = NULL;
@@ -101,19 +100,32 @@
int retval = -1;
const char *recend = (const char *) ~UINTMAX_C (0);
int sock = -1;
+ serv_response_header serv_resp;
+
if (mapped != NO_MAPPING)
{
- const struct datahead *found = __nscd_cache_search (type, key, keylen,
- mapped);
+ struct datahead *found = __nscd_cache_search (type, key, keylen, mapped);
if (found != NULL)
{
- serv_resp = &found->data[0].servdata;
- s_name = (char *) (serv_resp + 1);
- s_proto = s_name + serv_resp->s_name_len;
- aliases_len = (uint32_t *) (s_proto + serv_resp->s_proto_len);
+ s_name = (char *) (&found->data[0].servdata + 1);
+ serv_resp = found->data[0].servdata;
+ s_proto = s_name + serv_resp.s_name_len;
+ aliases_len = (uint32_t *) (s_proto + serv_resp.s_proto_len);
aliases_list = ((char *) aliases_len
- + serv_resp->s_aliases_cnt * sizeof (uint32_t));
+ + serv_resp.s_aliases_cnt * sizeof (uint32_t));
+ recend = (const char *) found->data + found->recsize;
+ /* Now check if we can trust serv_resp fields. If GC is
+ in progress, it can contain anything. */
+ if (mapped->head->gc_cycle != gc_cycle)
+ {
+ retval = -2;
+ goto out;
+ }
+ if (__builtin_expect ((const char *) aliases_len
+ + serv_resp.s_aliases_cnt * sizeof (uint32_t)
+ > recend, 0))
+ goto out;
#ifndef _STRING_ARCH_unaligned
/* The aliases_len array in the mapped database might very
@@ -123,46 +135,38 @@
if (((uintptr_t) aliases_len & (__alignof__ (*aliases_len) - 1))
!= 0)
{
- uint32_t *tmp = alloca (serv_resp->s_aliases_cnt
+ uint32_t *tmp = alloca (serv_resp.s_aliases_cnt
* sizeof (uint32_t));
aliases_len = memcpy (tmp, aliases_len,
- serv_resp->s_aliases_cnt
+ serv_resp.s_aliases_cnt
* sizeof (uint32_t));
}
#endif
- recend = (const char *) found->data + found->recsize;
- if (__builtin_expect ((const char *) aliases_len
- + serv_resp->s_aliases_cnt * sizeof (uint32_t)
- > recend, 0))
- goto out_close;
- }
- }
-
- serv_response_header serv_resp_mem;
- if (serv_resp == NULL)
- {
- sock = __nscd_open_socket (key, keylen, type, &serv_resp_mem,
- sizeof (serv_resp_mem));
+ }
+ }
+
+ if (s_name == NULL)
+ {
+ sock = __nscd_open_socket (key, keylen, type, &serv_resp,
+ sizeof (serv_resp));
if (sock == -1)
{
__nss_not_use_nscd_services = 1;
goto out;
}
-
- serv_resp = &serv_resp_mem;
}
/* No value found so far. */
*result = NULL;
- if (__builtin_expect (serv_resp->found == -1, 0))
+ if (__builtin_expect (serv_resp.found == -1, 0))
{
/* The daemon does not cache this database. */
__nss_not_use_nscd_services = 1;
goto out_close;
}
- if (serv_resp->found == 1)
+ if (serv_resp.found == 1)
{
char *cp = buf;
uintptr_t align1;
@@ -176,13 +180,13 @@
align the pointer and the base of the h_addr_list pointers. */
align1 = ((__alignof__ (char *) - (cp - ((char *) 0)))
& (__alignof__ (char *) - 1));
- align2 = ((__alignof__ (char *) - ((cp + align1 + serv_resp->s_name_len
- + serv_resp->s_proto_len)
+ align2 = ((__alignof__ (char *) - ((cp + align1 + serv_resp.s_name_len
+ + serv_resp.s_proto_len)
- ((char *) 0)))
& (__alignof__ (char *) - 1));
- if (buflen < (align1 + serv_resp->s_name_len + serv_resp->s_proto_len
+ if (buflen < (align1 + serv_resp.s_name_len + serv_resp.s_proto_len
+ align2
- + (serv_resp->s_aliases_cnt + 1) * sizeof (char *)))
+ + (serv_resp.s_aliases_cnt + 1) * sizeof (char *)))
{
no_room:
__set_errno (ERANGE);
@@ -193,31 +197,31 @@
/* Prepare the result as far as we can. */
resultbuf->s_aliases = (char **) cp;
- cp += (serv_resp->s_aliases_cnt + 1) * sizeof (char *);
+ cp += (serv_resp.s_aliases_cnt + 1) * sizeof (char *);
resultbuf->s_name = cp;
- cp += serv_resp->s_name_len;
+ cp += serv_resp.s_name_len;
resultbuf->s_proto = cp;
- cp += serv_resp->s_proto_len + align2;
- resultbuf->s_port = serv_resp->s_port;
+ cp += serv_resp.s_proto_len + align2;
+ resultbuf->s_port = serv_resp.s_port;
if (s_name == NULL)
{
struct iovec vec[2];
vec[0].iov_base = resultbuf->s_name;
- vec[0].iov_len = serv_resp->s_name_len + serv_resp->s_proto_len;
+ vec[0].iov_len = serv_resp.s_name_len + serv_resp.s_proto_len;
total_len = vec[0].iov_len;
n = 1;
- if (serv_resp->s_aliases_cnt > 0)
- {
- aliases_len = alloca (serv_resp->s_aliases_cnt
+ if (serv_resp.s_aliases_cnt > 0)
+ {
+ aliases_len = alloca (serv_resp.s_aliases_cnt
* sizeof (uint32_t));
vec[n].iov_base = (void *) aliases_len;
- vec[n].iov_len = serv_resp->s_aliases_cnt * sizeof (uint32_t);
-
- total_len += serv_resp->s_aliases_cnt * sizeof (uint32_t);
+ vec[n].iov_len = serv_resp.s_aliases_cnt * sizeof (uint32_t);
+
+ total_len += serv_resp.s_aliases_cnt * sizeof (uint32_t);
++n;
}
@@ -226,11 +230,11 @@
}
else
memcpy (resultbuf->s_name, s_name,
- serv_resp->s_name_len + serv_resp->s_proto_len);
+ serv_resp.s_name_len + serv_resp.s_proto_len);
/* Now we also can read the aliases. */
total_len = 0;
- for (cnt = 0; cnt < serv_resp->s_aliases_cnt; ++cnt)
+ for (cnt = 0; cnt < serv_resp.s_aliases_cnt; ++cnt)
{
resultbuf->s_aliases[cnt] = cp;
cp += aliases_len[cnt];
@@ -240,10 +244,26 @@
if (__builtin_expect ((const char *) aliases_list + total_len > recend,
0))
- goto out_close;
+ {
+ /* aliases_len array might contain garbage during nscd GC cycle,
+ retry rather than fail in that case. */
+ if (aliases_list != NULL && mapped->head->gc_cycle != gc_cycle)
+ retval = -2;
+ goto out_close;
+ }
+
/* See whether this would exceed the buffer capacity. */
if (__builtin_expect (cp > buf + buflen, 0))
- goto no_room;
+ {
+ /* aliases_len array might contain garbage during nscd GC cycle,
+ retry rather than fail in that case. */
+ if (aliases_list != NULL && mapped->head->gc_cycle != gc_cycle)
+ {
+ retval = -2;
+ goto out_close;
+ }
+ goto no_room;
+ }
/* And finally read the aliases. */
if (aliases_list == NULL)
@@ -261,15 +281,19 @@
memcpy (resultbuf->s_aliases[0], aliases_list, total_len);
/* Try to detect corrupt databases. */
- if (resultbuf->s_name[serv_resp->s_name_len - 1] != '\0'
- || resultbuf->s_proto[serv_resp->s_proto_len - 1] != '\0'
- || ({for (cnt = 0; cnt < serv_resp->s_aliases_cnt; ++cnt)
+ if (resultbuf->s_name[serv_resp.s_name_len - 1] != '\0'
+ || resultbuf->s_proto[serv_resp.s_proto_len - 1] != '\0'
+ || ({for (cnt = 0; cnt < serv_resp.s_aliases_cnt; ++cnt)
if (resultbuf->s_aliases[cnt][aliases_len[cnt] - 1]
!= '\0')
break;
- cnt < serv_resp->s_aliases_cnt; }))
- /* We cannot use the database. */
- goto out_close;
+ cnt < serv_resp.s_aliases_cnt; }))
+ {
+ /* We cannot use the database. */
+ if (mapped->head->gc_cycle != gc_cycle)
+ retval = -2;
+ goto out_close;
+ }
retval = 0;
*result = resultbuf;
@@ -287,19 +311,21 @@
if (sock != -1)
close_not_cancel_no_status (sock);
out:
- if (__nscd_drop_map_ref (mapped, &gc_cycle) != 0 && retval != -1)
+ if (__nscd_drop_map_ref (mapped, &gc_cycle) != 0)
{
/* When we come here this means there has been a GC cycle while we
were looking for the data. This means the data might have been
inconsistent. Retry if possible. */
- if ((gc_cycle & 1) != 0 || ++nretries == 5)
+ if ((gc_cycle & 1) != 0 || ++nretries == 5 || retval == -1)
{
/* nscd is just running gc now. Disable using the mapping. */
- __nscd_unmap (mapped);
+ if (atomic_decrement_val (&mapped->counter) == 0)
+ __nscd_unmap (mapped);
mapped = NO_MAPPING;
}
- goto retry;
+ if (retval != -1)
+ goto retry;
}
return retval;
Modified: fsf/trunk/libc/nscd/nscd_helper.c
==============================================================================
--- fsf/trunk/libc/nscd/nscd_helper.c (original)
+++ fsf/trunk/libc/nscd/nscd_helper.c Thu Feb 1 00:01:28 2007
@@ -1,4 +1,5 @@
-/* Copyright (C) 1998-2002,2003,2004,2005,2006 Free Software Foundation, Inc.
+/* Copyright (C) 1998-2002,2003,2004,2005,2006,2007
+ Free Software Foundation, Inc.
This file is part of the GNU C Library.
Contributed by Ulrich Drepper <drepper@xxxxxxxxxx>, 1998.
@@ -21,6 +22,7 @@
#include <errno.h>
#include <fcntl.h>
#include <stdbool.h>
+#include <string.h>
#include <time.h>
#include <unistd.h>
#include <sys/mman.h>
@@ -95,16 +97,20 @@
static int
-open_socket (void)
+open_socket (request_type type, const char *key, size_t keylen)
{
int sock = __socket (PF_UNIX, SOCK_STREAM, 0);
if (sock < 0)
return -1;
+ struct
+ {
+ request_header req;
+ char key[keylen];
+ } reqdata;
+
/* Make socket non-blocking. */
- int fl = __fcntl (sock, F_GETFL);
- if (fl != -1)
- __fcntl (sock, F_SETFL, fl | O_NONBLOCK);
+ __fcntl (sock, F_SETFL, O_RDWR | O_NONBLOCK);
struct sockaddr_un sun;
sun.sun_family = AF_UNIX;
@@ -113,13 +119,56 @@
&& errno != EINPROGRESS)
goto out;
- struct pollfd fds[1];
- fds[0].fd = sock;
- fds[0].events = POLLOUT | POLLERR | POLLHUP;
- if (__poll (fds, 1, 5 * 1000) > 0)
- /* Success. We do not check for success of the connect call here.
- If it failed, the following operations will fail. */
- return sock;
+ reqdata.req.version = NSCD_VERSION;
+ reqdata.req.type = type;
+ reqdata.req.key_len = keylen;
+
+ memcpy (reqdata.key, key, keylen);
+
+ bool first_try = true;
+ struct timeval tvend;
+ while (1)
+ {
+#ifndef MSG_NOSIGNAL
+# define MSG_NOSIGNAL 0
+#endif
+ ssize_t wres = TEMP_FAILURE_RETRY (__send (sock, &reqdata,
+ sizeof (reqdata),
+ MSG_NOSIGNAL));
+ if (__builtin_expect (wres == (ssize_t) sizeof (reqdata), 1))
+ /* We managed to send the request. */
+ return sock;
+
+ if (wres != -1 || errno != EAGAIN)
+ /* Something is really wrong, no chance to continue. */
+ break;
+
+ /* The daemon is busy wait for it. */
+ int to;
+ if (first_try)
+ {
+ gettimeofday (&tvend, NULL);
+ tvend.tv_sec += 5;
+ to = 5 * 1000;
+ first_try = false;
+ }
+ else
+ {
+ struct timeval now;
+ gettimeofday (&now, NULL);
+ to = ((tvend.tv_sec - now.tv_sec) * 1000
+ + (tvend.tv_usec - now.tv_usec) / 1000);
+ }
+
+ struct pollfd fds[1];
+ fds[0].fd = sock;
+ fds[0].events = POLLOUT | POLLERR | POLLHUP;
+ if (__poll (fds, 1, to) <= 0)
+ /* The connection timed out or broke down. */
+ break;
+
+ /* We try to write again. */
+ }
out:
close_not_cancel_no_status (sock);
@@ -179,36 +228,15 @@
int saved_errno = errno;
int mapfd = -1;
-
- /* Send the request. */
- struct
- {
- request_header req;
- char key[keylen];
- } reqdata;
-
- int sock = open_socket ();
+ char resdata[keylen];
+
+ /* Open a socket and send the request. */
+ int sock = open_socket (type, key, keylen);
if (sock < 0)
goto out;
- reqdata.req.version = NSCD_VERSION;
- reqdata.req.type = type;
- reqdata.req.key_len = keylen;
- memcpy (reqdata.key, key, keylen);
-
-# ifndef MSG_NOSIGNAL
-# define MSG_NOSIGNAL 0
-# endif
- if (__builtin_expect (TEMP_FAILURE_RETRY (__send (sock, &reqdata,
- sizeof (reqdata),
- MSG_NOSIGNAL))
- != sizeof (reqdata), 0))
- /* We cannot even write the request. */
- goto out_close2;
-
/* Room for the data sent along with the file descriptor. We expect
the key name back. */
-# define resdata reqdata.key
struct iovec iov[1];
iov[0].iov_base = resdata;
iov[0].iov_len = keylen;
@@ -362,7 +390,10 @@
}
-const struct datahead *
+/* Don't return const struct datahead *, as eventhough the record
+ is normally constant, it can change arbitrarily during nscd
+ garbage collection. */
+struct datahead *
__nscd_cache_search (request_type type, const char *key, size_t keylen,
const struct mapped_database *mapped)
{
@@ -374,15 +405,31 @@
{
struct hashentry *here = (struct hashentry *) (mapped->data + work);
+#ifndef _STRING_ARCH_unaligned
+ /* Although during garbage collection when moving struct hashentry
+ records around we first copy from old to new location and then
+ adjust pointer from previous hashentry to it, there is no barrier
+ between those memory writes. It is very unlikely to hit it,
+ so check alignment only if a misaligned load can crash the
+ application. */
+ if ((uintptr_t) here & (__alignof__ (*here) - 1))
+ return NULL;
+#endif
+
if (type == here->type
&& keylen == here->len
- && here->key + here->len <= datasize
+ && here->key + keylen <= datasize
&& memcmp (key, mapped->data + here->key, keylen) == 0
&& here->packet + sizeof (struct datahead) <= datasize)
{
/* We found the entry. Increment the appropriate counter. */
- const struct datahead *dh
+ struct datahead *dh
= (struct datahead *) (mapped->data + here->packet);
+
+#ifndef _STRING_ARCH_unaligned
+ if ((uintptr_t) dh & (__alignof__ (*dh) - 1))
+ return NULL;
+#endif
/* See whether we must ignore the entry or whether something
is wrong because garbage collection is in progress. */
@@ -402,28 +449,22 @@
__nscd_open_socket (const char *key, size_t keylen, request_type type,
void *response, size_t responselen)
{
+ /* This should never happen and it is something the nscd daemon
+ enforces, too. He it helps to limit the amount of stack
+ used. */
+ if (keylen > MAXKEYLEN)
+ return -1;
+
int saved_errno = errno;
- int sock = open_socket ();
+ int sock = open_socket (type, key, keylen);
if (sock >= 0)
{
- request_header req;
- req.version = NSCD_VERSION;
- req.type = type;
- req.key_len = keylen;
-
- struct iovec vec[2];
- vec[0].iov_base = &req;
- vec[0].iov_len = sizeof (request_header);
- vec[1].iov_base = (void *) key;
- vec[1].iov_len = keylen;
-
- ssize_t nbytes = TEMP_FAILURE_RETRY (__writev (sock, vec, 2));
- if (nbytes == (ssize_t) (sizeof (request_header) + keylen)
- /* Wait for data. */
- && wait_on_socket (sock) > 0)
- {
- nbytes = TEMP_FAILURE_RETRY (__read (sock, response, responselen));
+ /* Wait for data. */
+ if (wait_on_socket (sock) > 0)
+ {
+ ssize_t nbytes = TEMP_FAILURE_RETRY (__read (sock, response,
+ responselen));
if (nbytes == (ssize_t) responselen)
return sock;
}
Modified: fsf/trunk/libc/nscd/nscd_initgroups.c
==============================================================================
--- fsf/trunk/libc/nscd/nscd_initgroups.c (original)
+++ fsf/trunk/libc/nscd/nscd_initgroups.c Thu Feb 1 00:01:28 2007
@@ -1,4 +1,4 @@
-/* Copyright (C) 2004, 2005, 2006 Free Software Foundation, Inc.
+/* Copyright (C) 2004, 2005, 2006, 2007 Free Software Foundation, Inc.
This file is part of the GNU C Library.
Contributed by Ulrich Drepper <drepper@xxxxxxxxxx>, 2004.
@@ -39,6 +39,7 @@
{
size_t userlen = strlen (user) + 1;
int gc_cycle;
+ int nretries = 0;
/* If the mapping is available, try to search there instead of
communicating with the nscd. */
@@ -46,44 +47,49 @@
mapped = __nscd_get_map_ref (GETFDGR, "group", &__gr_map_handle, &gc_cycle);
retry:;
- const initgr_response_header *initgr_resp = NULL;
char *respdata = NULL;
int retval = -1;
int sock = -1;
+ initgr_response_header initgr_resp;
if (mapped != NO_MAPPING)
{
- const struct datahead *found = __nscd_cache_search (INITGROUPS, user,
- userlen, mapped);
+ struct datahead *found = __nscd_cache_search (INITGROUPS, user,
+ userlen, mapped);
if (found != NULL)
{
- initgr_resp = &found->data[0].initgrdata;
- respdata = (char *) (initgr_resp + 1);
+ respdata = (char *) (&found->data[0].initgrdata + 1);
+ initgr_resp = found->data[0].initgrdata;
char *recend = (char *) found->data + found->recsize;
- if (respdata + initgr_resp->ngrps * sizeof (int32_t) > recend)
+ /* Now check if we can trust initgr_resp fields. If GC is
+ in progress, it can contain anything. */
+ if (mapped->head->gc_cycle != gc_cycle)
+ {
+ retval = -2;
+ goto out;
+ }
+
+ if (respdata + initgr_resp.ngrps * sizeof (int32_t) > recend)
goto out;
}
}
/* If we do not have the cache mapped, try to get the data over the
socket. */
- initgr_response_header initgr_resp_mem;
- if (initgr_resp == NULL)
+ if (respdata == NULL)
{
- sock = __nscd_open_socket (user, userlen, INITGROUPS, &initgr_resp_mem,
- sizeof (initgr_resp_mem));
+ sock = __nscd_open_socket (user, userlen, INITGROUPS, &initgr_resp,
+ sizeof (initgr_resp));
if (sock == -1)
{
/* nscd not running or wrong version. */
__nss_not_use_nscd_group = 1;
goto out;
}
-
- initgr_resp = &initgr_resp_mem;
}
- if (initgr_resp->found == 1)
+ if (initgr_resp.found == 1)
{
/* The following code assumes that gid_t and int32_t are the
same size. This is the case for al existing implementation.
@@ -91,40 +97,40 @@
doesn't use memcpy but instead copies each array element one
by one. */
assert (sizeof (int32_t) == sizeof (gid_t));
- assert (initgr_resp->ngrps >= 0);
+ assert (initgr_resp.ngrps >= 0);
/* Make sure we have enough room. We always count GROUP in even
though we might not end up adding it. */
- if (*size < initgr_resp->ngrps + 1)
+ if (*size < initgr_resp.ngrps + 1)
{
gid_t *newp = realloc (*groupsp,
- (initgr_resp->ngrps + 1) * sizeof (gid_t));
+ (initgr_resp.ngrps + 1) * sizeof (gid_t));
if (newp == NULL)
/* We cannot increase the buffer size. */
goto out_close;
*groupsp = newp;
- *size = initgr_resp->ngrps + 1;
+ *size = initgr_resp.ngrps + 1;
}
if (respdata == NULL)
{
/* Read the data from the socket. */
- if ((size_t) __readall (sock, *groupsp, initgr_resp->ngrps
+ if ((size_t) __readall (sock, *groupsp, initgr_resp.ngrps
* sizeof (gid_t))
- == initgr_resp->ngrps * sizeof (gid_t))
- retval = initgr_resp->ngrps;
+ == initgr_resp.ngrps * sizeof (gid_t))
+ retval = initgr_resp.ngrps;
}
else
{
/* Just copy the data. */
- retval = initgr_resp->ngrps;
+ retval = initgr_resp.ngrps;
memcpy (*groupsp, respdata, retval * sizeof (gid_t));
}
}
else
{
- if (__builtin_expect (initgr_resp->found == -1, 0))
+ if (__builtin_expect (initgr_resp.found == -1, 0))
{
/* The daemon does not cache this database. */
__nss_not_use_nscd_group = 1;
@@ -153,19 +159,21 @@
if (sock != -1)
close_not_cancel_no_status (sock);
out:
- if (__nscd_drop_map_ref (mapped, &gc_cycle) != 0 && retval != -1)
+ if (__nscd_drop_map_ref (mapped, &gc_cycle) != 0)
{
/* When we come here this means there has been a GC cycle while we
were looking for the data. This means the data might have been
inconsistent. Retry if possible. */
- if ((gc_cycle & 1) != 0)
+ if ((gc_cycle & 1) != 0 || ++nretries == 5 || retval == -1)
{
/* nscd is just running gc now. Disable using the mapping. */
- __nscd_unmap (mapped);
+ if (atomic_decrement_val (&mapped->counter) == 0)
+ __nscd_unmap (mapped);
mapped = NO_MAPPING;
}
- goto retry;
+ if (retval != -1)
+ goto retry;
}
return retval;