From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: stable-review@kernel.org, torvalds@linux-foundation.org,
akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk,
Xufeng Zhang <xufeng.zhang@windriver.com>,
Paul Gortmaker <paul.gortmaker@windriver.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [33/35] ipv6/udp: Use the correct variable to determine non-blocking condition
Date: Fri, 08 Jul 2011 15:50:22 -0700 [thread overview]
Message-ID: <20110708225121.996088069@clark.kroah.org> (raw)
In-Reply-To: <20110708225343.GA14402@kroah.com>
2.6.32-longterm review patch. If anyone has any objections, please let us know.
------------------
From: Xufeng Zhang <xufeng.zhang@windriver.com>
[ Upstream commit 32c90254ed4a0c698caa0794ebb4de63fcc69631 ]
udpv6_recvmsg() function is not using the correct variable to determine
whether or not the socket is in non-blocking operation, this will lead
to unexpected behavior when a UDP checksum error occurs.
Consider a non-blocking udp receive scenario: when udpv6_recvmsg() is
called by sock_common_recvmsg(), MSG_DONTWAIT bit of flags variable in
udpv6_recvmsg() is cleared by "flags & ~MSG_DONTWAIT" in this call:
err = sk->sk_prot->recvmsg(iocb, sk, msg, size, flags & MSG_DONTWAIT,
flags & ~MSG_DONTWAIT, &addr_len);
i.e. with udpv6_recvmsg() getting these values:
int noblock = flags & MSG_DONTWAIT
int flags = flags & ~MSG_DONTWAIT
So, when udp checksum error occurs, the execution will go to
csum_copy_err, and then the problem happens:
csum_copy_err:
...............
if (flags & MSG_DONTWAIT)
return -EAGAIN;
goto try_again;
...............
But it will always go to try_again as MSG_DONTWAIT has been cleared
from flags at call time -- only noblock contains the original value
of MSG_DONTWAIT, so the test should be:
if (noblock)
return -EAGAIN;
This is also consistent with what the ipv4/udp code does.
Signed-off-by: Xufeng Zhang <xufeng.zhang@windriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/ipv6/udp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -304,7 +304,7 @@ csum_copy_err:
}
release_sock(sk);
- if (flags & MSG_DONTWAIT)
+ if (noblock)
return -EAGAIN;
goto try_again;
}
next prev parent reply other threads:[~2011-07-09 5:57 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-07-08 22:53 [00/35] 2.6.32.43-longterm review Greg KH
2011-07-08 22:49 ` [01/35] ksm: fix NULL pointer dereference in scan_get_next_rmap_item() Greg KH
2011-07-08 22:49 ` [02/35] migrate: dont account swapcache as shmem Greg KH
2011-07-08 22:49 ` [03/35] xen: partially revert "xen: set max_pfn_mapped to the last pfn mapped" Greg KH
2011-07-08 22:49 ` [04/35] clocksource: Make watchdog robust vs. interruption Greg KH
2011-07-08 22:49 ` [05/35] TTY: ldisc, do not close until there are readers Greg KH
2011-07-08 22:49 ` [06/35] xhci: Reject double add of active endpoints Greg KH
2011-07-08 22:49 ` [07/35] PM: Free memory bitmaps if opening /dev/snapshot fails Greg KH
2011-07-08 22:49 ` [08/35] ath5k: fix memory leak when fewer than N_PD_CURVES are in use Greg KH
2011-07-08 22:49 ` [09/35] ath9k: Fix suspend/resume when no interface is UP Greg KH
2011-07-09 15:58 ` Paul Gortmaker
2011-07-11 5:21 ` Rajkumar Manoharan
2011-07-13 3:28 ` [Stable-review] " Greg KH
2011-07-08 22:49 ` [10/35] mm: fix negative commitlimit when gigantic hugepages are allocated Greg KH
2011-07-08 22:50 ` [11/35] [media] uvcvideo: Remove buffers from the queues when freeing Greg KH
2011-07-08 22:50 ` [12/35] watchdog: mtx1-wdt: request gpio before using it Greg KH
2011-07-08 22:50 ` [13/35] debugobjects: Fix boot crash when kmemleak and debugobjects enabled Greg KH
2011-07-08 22:50 ` [14/35] cfq-iosched: fix locking around ioc->ioc_data assignment Greg KH
2011-07-08 22:50 ` [15/35] cfq-iosched: fix a rcu warning Greg KH
2011-07-08 22:50 ` [16/35] i2c-taos-evm: Fix log messages Greg KH
2011-07-08 22:50 ` [17/35] md: avoid endless recovery loop when waiting for fail device to complete Greg KH
2011-07-08 22:50 ` [18/35] SUNRPC: Ensure the RPC client only quits on fatal signals Greg KH
2011-07-08 22:50 ` [19/35] 6pack,mkiss: fix lock inconsistency Greg KH
2011-07-08 22:50 ` [20/35] taskstats: dont allow duplicate entries in listener mode Greg KH
2011-07-08 22:50 ` [21/35] USB: dont let errors prevent system sleep Greg KH
2011-07-08 22:50 ` [22/35] USB: dont let the hub driver " Greg KH
2011-07-08 22:50 ` [23/35] uml: fix CONFIG_STATIC_LINK=y build failure with newer glibc Greg KH
2011-07-08 22:50 ` [24/35] um: os-linux/mem.c needs sys/stat.h Greg KH
2011-07-08 22:50 ` [25/35] netlink: Make nlmsg_find_attr take a const nlmsghdr* Greg KH
2011-07-08 22:50 ` [26/35] inet_diag: fix inet_diag_bc_audit() Greg KH
2011-07-08 22:50 ` [27/35] PM / Hibernate: Avoid hitting OOM during preallocation of memory Greg KH
2011-07-08 22:50 ` [28/35] PM / Hibernate: Fix free_unnecessary_pages() Greg KH
2011-07-08 22:50 ` [29/35] bug.h: Add WARN_RATELIMIT Greg KH
2011-07-08 22:50 ` [30/35] net: filter: Use WARN_RATELIMIT Greg KH
2011-07-08 22:50 ` [31/35] af_packet: prevent information leak Greg KH
2011-07-08 22:50 ` [32/35] net/ipv4: Check for mistakenly passed in non-IPv4 address Greg KH
2011-07-08 22:50 ` Greg KH [this message]
2011-07-08 22:50 ` [34/35] udp/recvmsg: Clear MSG_TRUNC flag when starting over for a new packet Greg KH
2011-07-08 22:50 ` [35/35] mm: prevent concurrent unmap_mapping_range() on the same inode Greg KH
2011-07-08 23:01 [00/35] 2.6.33.16-longterm review Greg KH
2011-07-08 23:00 ` [33/35] ipv6/udp: Use the correct variable to determine non-blocking condition Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110708225121.996088069@clark.kroah.org \
--to=gregkh@suse.de \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=paul.gortmaker@windriver.com \
--cc=stable-review@kernel.org \
--cc=stable@kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=xufeng.zhang@windriver.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome