Re: [PATCH 1/3] relay: Fix 4 off-by-one errors occuring when writing to a CPU buffer.

Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
From: Eduard - Gabriel Munteanu
Date: Saturday, June 14, 2008 - 7:52 am

On Fri, 13 Jun 2008 23:40:37 -0500
Tom Zanussi <tzanussi@gmail.com> wrote:


Hi,

I noticed this problem after adding those spinlocks. As far as I can
tell, having (offset == subbuf_size + 1) at any given moment allows the
read() handler to see inconsistent offsets:
1. writer sets offset = subbuf_size + 1
2. writer releases spinlock
3. read() acquires spinlock and reads the wrong offset
4. read() releases spinlock
5. next writer corrects the offset at the next write
 

No, it won't. Maximum length messages result in the following condition:
start + offset == subbuf_size
This happens because a buffer of length subbuf_size actually ranges
from zero to (subbuf_size - 1) in regard to how it is addressed. Then,
subbuf_size + 1 isn't just outside the bounds, but one more byte off.
"Visual" example:
subbuf_size = 4
|[ ][ ][ ][ ]|[ ]
  0  1  2  3   subbuf_size

So, a full subbufer means offset equals subbuf_size, that is, the next
empty slot is just outside the subbuffer.


	Eduard
--
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]

Messages in current thread:
[PATCH 1/3] relay: Fix 4 off-by-one errors occuring when w ..., Eduard - Gabriel Mun ..., (Thu Jun 12, 6:09 pm)
Re: [PATCH 1/3] relay: Fix 4 off-by-one errors occuring wh ..., Eduard - Gabriel Mun ..., (Sat Jun 14, 7:52 am)
Re: [PATCH 1/3] relay: Fix 4 off-by-one errors occuring wh ..., Eduard - Gabriel Mun ..., (Fri Jun 20, 7:06 pm)
Re: [PATCH 1/3] relay: Fix 4 off-by-one errors occuring wh ..., Eduard - Gabriel Mun ..., (Wed Jul 30, 10:48 am)
Re: [PATCH 1/3] relay: Fix 4 off-by-one errors occuring wh ..., Eduard - Gabriel Mun ..., (Thu Aug 14, 9:35 am)