2006-12-19 09:03:20

by Tuomas Suutari

[permalink] [raw]
Subject: [Bluez-devel] rfcomm_sock_sendmsg with len==0 (in Linux 2.6.18)

Hello.

I've made a buffer for socket connections to use with C++ iostreams.
It's quite simple; just uses send and recv to fill and empty the buffer
when needed.

It worked fine for a while, but yesterday some strange errors occured
with it. After few hours of debugging I found that code responsible was
using syscall send() to Bluetooth socket with buffer length set to 0.
Problem was that I assumed it to return either -1 on error or 0 when
success, but instead it returned positive values sometimes.

Ok, it was stupid calling send() with len==0 anyway, but still (at least
according to manual) send shouldn't return anything positive then. So I
traced what kernel code is responsible and found it's
rfcomm_sock_sendmsg() in net/bluetooth/rfcomm/sock.c. It returns
uninitialized variable err, if called with len==0.

Simple fix is to initialize err to 0.

--
Tuomas Suutari | +358 50 3806983 | [email protected]

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel


2006-12-19 10:57:37

by Tuomas Suutari

[permalink] [raw]
Subject: Re: [Bluez-devel] rfcomm_sock_sendmsg with len==0 (in Linux 2.6.18)

On 2006-12-19 Tuesday 12:31, Marcel Holtmann wrote:
> that is really strange. A recent compiler should detect that err can
> be used uninitialized.

It (gcc 4.1.1) didn't, maybe that's because it can't know if len is
always >0. Though it should have warned anyway.


> How about the attached patch. Does it work for you?

Yes. Now it returns 0 when called with len==0.

Thanks.

--
Tuomas Suutari | +358 50 3806983 | [email protected]

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel

2006-12-19 10:41:46

by Luciano Coelho

[permalink] [raw]
Subject: Re: [Bluez-devel] rfcomm_sock_sendmsg with len==0 (in Linux 2.6.18)

ext Marcel Holtmann wrote:
> that is really strange. A recent compiler should detect that err can be
> used uninitialized.

Yes, it *should* ;-) But I have noticed at least one case in which GCC
(version 3.4.4) doesn't recognize the use of uninitialized values... :-(
It happened when compiling an ugly piece of code with gotos and stuff
like that, but still...

Cheers,
Luca

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel

2006-12-19 09:47:39

by Tuomas Suutari

[permalink] [raw]
Subject: Re: [Bluez-devel] rfcomm_sock_sendmsg with len==0 (in Linux 2.6.18)

On 2006-12-19 Tuesday 11:39, Marcel Holtmann wrote:
> > rfcomm_sock_sendmsg() in net/bluetooth/rfcomm/sock.c. It returns
> > uninitialized variable err, if called with len==0.
> >
> > Simple fix is to initialize err to 0.
>
> this would only hide the real problem. It should only return err if
> the sent is still 0. The return statement is
>
> return sent ? sent : err;

Yep, exactly. It returns err, which isn't initialized, so it could be
positive.

Am I missing something?

--
Tuomas Suutari | +358 50 3806983 | [email protected]

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel

2006-12-19 09:39:14

by Marcel Holtmann

[permalink] [raw]
Subject: Re: [Bluez-devel] rfcomm_sock_sendmsg with len==0 (in Linux 2.6.18)

Hi Tuomas,

> I've made a buffer for socket connections to use with C++ iostreams.
> It's quite simple; just uses send and recv to fill and empty the buffer
> when needed.
>
> It worked fine for a while, but yesterday some strange errors occured
> with it. After few hours of debugging I found that code responsible was
> using syscall send() to Bluetooth socket with buffer length set to 0.
> Problem was that I assumed it to return either -1 on error or 0 when
> success, but instead it returned positive values sometimes.
>
> Ok, it was stupid calling send() with len==0 anyway, but still (at least
> according to manual) send shouldn't return anything positive then. So I
> traced what kernel code is responsible and found it's
> rfcomm_sock_sendmsg() in net/bluetooth/rfcomm/sock.c. It returns
> uninitialized variable err, if called with len==0.
>
> Simple fix is to initialize err to 0.

this would only hide the real problem. It should only return err if the
sent is still 0. The return statement is

return sent ? sent : err;

And sent is initialized with 0 and if len is also zero it will never
enter the while loop and thus not modify sent at all.

Please add some printk to the code before and after the loop. Something
is really wrong on your side. I would suspect a compiler error.

Regards

Marcel



-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel