From: VMware, Inc <> Date: Fri, 12 Apr 2013 19:54:44 +0000 (-0700) Subject: HGFS: clean up the VMCI mapping of transport status from the packet X-Git-Tag: 2013.04.16-1098359~16 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4af52d0e1e7d305d93d0f77ae01db41df0c87b6d;p=thirdparty%2Fopen-vm-tools.git HGFS: clean up the VMCI mapping of transport status from the packet The mapping was a little messy and made some assumptions which we get away with but should be made more robust. The first IOV length was never correctly verified against the size of the transport status and if it was contained completely in the first page. There was an assumption that this was always the case but the Windows client would send pings containing IOVs of buffers on the stack and as such could easily break the VMX. The adjust of the packet IOVs by the VMCI code to skip over the VMCI transport status before passing to the HGFS server to process has also been cleaned up. As has the restoration of the packet IOVs on final processing to access the packet VMCI transport status to set complete. In order to simplify this the HgfsPacket structure now contains an IOV field for the transport channel to use which holds the start of the VMCI channel transport status IOVs. This is then used to restore once the HGFS server has completed processing and the transport channel is doing the final send processing. Signed-off-by: Dmitry Torokhov --- diff --git a/open-vm-tools/lib/include/hgfsServer.h b/open-vm-tools/lib/include/hgfsServer.h index c497cb061..3b221c076 100644 --- a/open-vm-tools/lib/include/hgfsServer.h +++ b/open-vm-tools/lib/include/hgfsServer.h @@ -75,6 +75,9 @@ struct HgfsPacket { size_t replyPacketSize; Bool replyPacketIsAllocated; + /* Iov for the packet private to the channel. */ + HgfsVmxIov channelIov[2]; + uint32 iovCount; HgfsVmxIov iov[1];