kclient: fix bad pointer arithmetic in messenger

This was causing intermittent slab corruption when TCP fragmented the stream in unusual ways.

diff --git a/src/kernel/messenger.c b/src/kernel/messenger.c
index 423e3e9770f984468c35c90c158f585e717c511b..12ac16135437090e8b4c98b460b1efec3b0c7665 100644 (file)
--- a/src/kernel/messenger.c
+++ b/src/kernel/messenger.c
@@ -1006,7 +1006,8 @@ static int read_message_partial(struct ceph_connection *con)
        /* header */
        while (con->in_base_pos < sizeof(m->hdr)) {
                left = sizeof(m->hdr) - con->in_base_pos;
-               ret = ceph_tcp_recvmsg(con->sock, &m->hdr + con->in_base_pos,
+               ret = ceph_tcp_recvmsg(con->sock,
+                                      (char *)&m->hdr + con->in_base_pos,
                                       left);
                if (ret <= 0)
                        return ret;
@@ -1086,7 +1087,7 @@ static int read_message_partial(struct ceph_connection *con)
        /* footer */
        while (con->in_base_pos < sizeof(m->hdr) + sizeof(m->footer)) {
                left = sizeof(m->hdr) + sizeof(m->footer) - con->in_base_pos;
-               ret = ceph_tcp_recvmsg(con->sock, &m->footer +
+               ret = ceph_tcp_recvmsg(con->sock, (char *)&m->footer +
                                       (con->in_base_pos - sizeof(m->hdr)),
                                       left);
                if (ret <= 0)