<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML xmlns="http://www.w3.org/TR/REC-html40" xmlns:ex12t =
"http://schemas.microsoft.com/exchange/services/2006/types" xmlns:mrels =
"http://schemas.openxmlformats.org/package/2006/relationships" xmlns:m =
"http://schemas.microsoft.com/office/2004/12/omml" xmlns:mver =
"http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:wf =
"http://schemas.microsoft.com/sharepoint/soap/workflow/" xmlns:udcxf =
"http://schemas.microsoft.com/data/udc/xmlfile" xmlns:xsi =
"http://www.w3.org/2001/XMLSchema-instance" xmlns:sps =
"http://schemas.microsoft.com/sharepoint/soap/" xmlns:xsd =
"http://www.w3.org/2001/XMLSchema" xmlns:udc =
"http://schemas.microsoft.com/data/udc" xmlns:dsp =
"http://schemas.microsoft.com/sharepoint/dsp" xmlns:ds =
"http://www.w3.org/2000/09/xmldsig#" xmlns:dir =
"http://schemas.microsoft.com/sharepoint/soap/directory/" xmlns:ois =
"http://schemas.microsoft.com/sharepoint/soap/ois/" xmlns:x2 =
"http://schemas.microsoft.com/office/excel/2003/xml" XMLNS:D = "DAV:" xmlns:q =
"http://schemas.xmlsoap.org/soap/envelope/" xmlns:html =
"http://www.w3.org/TR/REC-html40" xmlns:oa =
"urn:schemas-microsoft-com:office:activation" xmlns:c =
"urn:schemas-microsoft-com:office:component:spreadsheet" xmlns:ss =
"urn:schemas-microsoft-com:office:spreadsheet" xmlns:b =
"urn:schemas-microsoft-com:office:publisher" xmlns:z = "#RowsetSchema" xmlns:rs
= "urn:schemas-microsoft-com:rowset" xmlns:s =
"uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" xmlns:dt =
"uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:a =
"urn:schemas-microsoft-com:office:access" xmlns:p =
"urn:schemas-microsoft-com:office:powerpoint" xmlns:x =
"urn:schemas-microsoft-com:office:excel" xmlns:w =
"urn:schemas-microsoft-com:office:word" xmlns:o =
"urn:schemas-microsoft-com:office:office" xmlns:v =
"urn:schemas-microsoft-com:vml"><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<STYLE>@font-face {
font-family: Cambria Math;
}
@font-face {
font-family: Calibri;
}
@page Section1 {size: 8.5in 11.0in; margin: 1.0in 1.0in 1.0in 1.0in; }
P.MsoNormal {
FONT-SIZE: 11pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Calibri","sans-serif"
}
LI.MsoNormal {
FONT-SIZE: 11pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Calibri","sans-serif"
}
DIV.MsoNormal {
FONT-SIZE: 11pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Calibri","sans-serif"
}
A:link {
COLOR: blue; TEXT-DECORATION: underline; mso-style-priority: 99
}
SPAN.MsoHyperlink {
COLOR: blue; TEXT-DECORATION: underline; mso-style-priority: 99
}
A:visited {
COLOR: purple; TEXT-DECORATION: underline; mso-style-priority: 99
}
SPAN.MsoHyperlinkFollowed {
COLOR: purple; TEXT-DECORATION: underline; mso-style-priority: 99
}
SPAN.EmailStyle17 {
COLOR: windowtext; FONT-FAMILY: "Calibri","sans-serif"; mso-style-type: personal-compose
}
.MsoChpDefault {
mso-style-type: export-only
}
DIV.Section1 {
page: Section1
}
</STYLE>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<META content="MSHTML 6.00.6000.16414" name=GENERATOR></HEAD>
<BODY lang=EN-US vLink=purple link=blue>
<DIV><SPAN class=692222020-21052007><FONT face=Arial color=#0000ff size=2>I'm
also attaching the binaries to help people use the fix. </FONT></SPAN></DIV>
<DIV><SPAN class=692222020-21052007><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=692222020-21052007><FONT face=Arial color=#0000ff size=2>This
binary also has a fix for the bug of the provider calling CompleteOverlapped
after it has already closed the socket.</FONT></SPAN></DIV>
<DIV><SPAN class=692222020-21052007><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=692222020-21052007><FONT face=Arial color=#0000ff size=2>The
files are in 7zip format as my experience has been that other formats are being
blocked by anti virus programs.</FONT></SPAN></DIV>
<DIV><FONT face=Arial color=#0000ff size=2></FONT> </DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=692222020-21052007>Thanks</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=692222020-21052007>Tzachi</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2></FONT> </DIV>
<DIV><BR></DIV>
<BLOCKQUOTE dir=ltr
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px">
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> Tzachi Dar <BR><B>Sent:</B> Friday, May
18, 2007 10:38 AM<BR><B>To:</B> 'Fab Tillier';
ofw@lists.openfabrics.org<BR><B>Subject:</B> RE: [ofw] NULL pointer
dereference in WSD provider<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV><SPAN class=402403707-18052007><FONT face=Arial color=#0000ff
size=2>Fixed on commit 666.</FONT></SPAN></DIV>
<DIV><SPAN class=402403707-18052007><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=402403707-18052007><FONT face=Arial color=#0000ff
size=2>Thanks</FONT></SPAN></DIV>
<DIV><SPAN class=402403707-18052007><FONT face=Arial color=#0000ff
size=2>Tzachi</FONT></SPAN></DIV><BR>
<BLOCKQUOTE dir=ltr
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px">
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> ofw-bounces@lists.openfabrics.org
[mailto:ofw-bounces@lists.openfabrics.org] <B>On Behalf Of </B>Fab
Tillier<BR><B>Sent:</B> Wednesday, May 16, 2007 10:29 PM<BR><B>To:</B>
ofw@lists.openfabrics.org<BR><B>Subject:</B> [ofw] NULL pointer dereference
in WSD provider<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV class=Section1>
<P class=MsoNormal>Hi folks,<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal>We have a customer that ran into an access violation when
testing over the OpenFabrics WSD provider. A quick investigation
showed that when a buffer is freed and the registration cache callback of
the WSD provider is invoked, the WSD provider deregisters the buffer.
Any references to that registration in any socket’s memory node list
is cleared. This results in memory nodes (struct memory_node) having a NULL
p_reg member.<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal>When posting sends or receives, the provider looks up the
appropriate registration (lookup_partial_mr, ibsp_mem.c, line 63). The
function __check_mr does not handle the case where p_reg is NULL, and
lookup_partial_mr doesn’t check for NULL either, and this is why we hit the
NULL pointer dereference (in the __check_mr function).<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal>Could this get fixed and a new build generated?
Please let me know when the build is ready so we can notify the customer and
have them repeat the test.<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal>Thanks!<o:p></o:p></P>
<P class=MsoNormal>-Fab<o:p></o:p></P>
<P
class=MsoNormal><o:p> </o:p></P></DIV></BLOCKQUOTE></BLOCKQUOTE></BODY></HTML>