mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: stable-review@kernel.org, torvalds@linux-foundation.org,
	akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk,
	Xufeng Zhang <xufeng.zhang@windriver.com>,
	Paul Gortmaker <paul.gortmaker@windriver.com>,
	"David S. Miller" <davem@davemloft.net>
Subject: [33/35] ipv6/udp: Use the correct variable to determine non-blocking condition
Date: Fri, 08 Jul 2011 15:50:22 -0700	[thread overview]
Message-ID: <20110708225121.996088069@clark.kroah.org> (raw)
In-Reply-To: <20110708225343.GA14402@kroah.com>

2.6.32-longterm review patch.  If anyone has any objections, please let us know.

------------------


From: Xufeng Zhang <xufeng.zhang@windriver.com>

[ Upstream commit 32c90254ed4a0c698caa0794ebb4de63fcc69631 ]

udpv6_recvmsg() function is not using the correct variable to determine
whether or not the socket is in non-blocking operation, this will lead
to unexpected behavior when a UDP checksum error occurs.

Consider a non-blocking udp receive scenario: when udpv6_recvmsg() is
called by sock_common_recvmsg(), MSG_DONTWAIT bit of flags variable in
udpv6_recvmsg() is cleared by "flags & ~MSG_DONTWAIT" in this call:

    err = sk->sk_prot->recvmsg(iocb, sk, msg, size, flags & MSG_DONTWAIT,
                   flags & ~MSG_DONTWAIT, &addr_len);

i.e. with udpv6_recvmsg() getting these values:

	int noblock = flags & MSG_DONTWAIT
	int flags = flags & ~MSG_DONTWAIT

So, when udp checksum error occurs, the execution will go to
csum_copy_err, and then the problem happens:

    csum_copy_err:
            ...............
            if (flags & MSG_DONTWAIT)
                    return -EAGAIN;
            goto try_again;
            ...............

But it will always go to try_again as MSG_DONTWAIT has been cleared
from flags at call time -- only noblock contains the original value
of MSG_DONTWAIT, so the test should be:

            if (noblock)
                    return -EAGAIN;

This is also consistent with what the ipv4/udp code does.

Signed-off-by: Xufeng Zhang <xufeng.zhang@windriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 net/ipv6/udp.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -304,7 +304,7 @@ csum_copy_err:
 	}
 	release_sock(sk);
 
-	if (flags & MSG_DONTWAIT)
+	if (noblock)
 		return -EAGAIN;
 	goto try_again;
 }



  parent reply	other threads:[~2011-07-09  5:57 UTC|newest]

Thread overview: 40+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2011-07-08 22:53 [00/35] 2.6.32.43-longterm review Greg KH
2011-07-08 22:49 ` [01/35] ksm: fix NULL pointer dereference in scan_get_next_rmap_item() Greg KH
2011-07-08 22:49 ` [02/35] migrate: dont account swapcache as shmem Greg KH
2011-07-08 22:49 ` [03/35] xen: partially revert "xen: set max_pfn_mapped to the last pfn mapped" Greg KH
2011-07-08 22:49 ` [04/35] clocksource: Make watchdog robust vs. interruption Greg KH
2011-07-08 22:49 ` [05/35] TTY: ldisc, do not close until there are readers Greg KH
2011-07-08 22:49 ` [06/35] xhci: Reject double add of active endpoints Greg KH
2011-07-08 22:49 ` [07/35] PM: Free memory bitmaps if opening /dev/snapshot fails Greg KH
2011-07-08 22:49 ` [08/35] ath5k: fix memory leak when fewer than N_PD_CURVES are in use Greg KH
2011-07-08 22:49 ` [09/35] ath9k: Fix suspend/resume when no interface is UP Greg KH
2011-07-09 15:58   ` Paul Gortmaker
2011-07-11  5:21     ` Rajkumar Manoharan
2011-07-13  3:28     ` [Stable-review] " Greg KH
2011-07-08 22:49 ` [10/35] mm: fix negative commitlimit when gigantic hugepages are allocated Greg KH
2011-07-08 22:50 ` [11/35] [media] uvcvideo: Remove buffers from the queues when freeing Greg KH
2011-07-08 22:50 ` [12/35] watchdog: mtx1-wdt: request gpio before using it Greg KH
2011-07-08 22:50 ` [13/35] debugobjects: Fix boot crash when kmemleak and debugobjects enabled Greg KH
2011-07-08 22:50 ` [14/35] cfq-iosched: fix locking around ioc->ioc_data assignment Greg KH
2011-07-08 22:50 ` [15/35] cfq-iosched: fix a rcu warning Greg KH
2011-07-08 22:50 ` [16/35] i2c-taos-evm: Fix log messages Greg KH
2011-07-08 22:50 ` [17/35] md: avoid endless recovery loop when waiting for fail device to complete Greg KH
2011-07-08 22:50 ` [18/35] SUNRPC: Ensure the RPC client only quits on fatal signals Greg KH
2011-07-08 22:50 ` [19/35] 6pack,mkiss: fix lock inconsistency Greg KH
2011-07-08 22:50 ` [20/35] taskstats: dont allow duplicate entries in listener mode Greg KH
2011-07-08 22:50 ` [21/35] USB: dont let errors prevent system sleep Greg KH
2011-07-08 22:50 ` [22/35] USB: dont let the hub driver " Greg KH
2011-07-08 22:50 ` [23/35] uml: fix CONFIG_STATIC_LINK=y build failure with newer glibc Greg KH
2011-07-08 22:50 ` [24/35] um: os-linux/mem.c needs sys/stat.h Greg KH
2011-07-08 22:50 ` [25/35] netlink: Make nlmsg_find_attr take a const nlmsghdr* Greg KH
2011-07-08 22:50 ` [26/35] inet_diag: fix inet_diag_bc_audit() Greg KH
2011-07-08 22:50 ` [27/35] PM / Hibernate: Avoid hitting OOM during preallocation of memory Greg KH
2011-07-08 22:50 ` [28/35] PM / Hibernate: Fix free_unnecessary_pages() Greg KH
2011-07-08 22:50 ` [29/35] bug.h: Add WARN_RATELIMIT Greg KH
2011-07-08 22:50 ` [30/35] net: filter: Use WARN_RATELIMIT Greg KH
2011-07-08 22:50 ` [31/35] af_packet: prevent information leak Greg KH
2011-07-08 22:50 ` [32/35] net/ipv4: Check for mistakenly passed in non-IPv4 address Greg KH
2011-07-08 22:50 ` Greg KH [this message]
2011-07-08 22:50 ` [34/35] udp/recvmsg: Clear MSG_TRUNC flag when starting over for a new packet Greg KH
2011-07-08 22:50 ` [35/35] mm: prevent concurrent unmap_mapping_range() on the same inode Greg KH
2011-07-08 23:01 [00/35] 2.6.33.16-longterm review Greg KH
2011-07-08 23:00 ` [33/35] ipv6/udp: Use the correct variable to determine non-blocking condition Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20110708225121.996088069@clark.kroah.org \
    --to=gregkh@suse.de \
    --cc=akpm@linux-foundation.org \
    --cc=alan@lxorguk.ukuu.org.uk \
    --cc=davem@davemloft.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=paul.gortmaker@windriver.com \
    --cc=stable-review@kernel.org \
    --cc=stable@kernel.org \
    --cc=torvalds@linux-foundation.org \
    --cc=xufeng.zhang@windriver.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

Powered by JetHome