Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

unix/dgram: fix peeking with an offset larger than data in queue

Browse source 
Currently, peeking on a unix datagram socket with an offset larger than len of
the data in the sk receive queue returns immediately with bogus data. That's
because *off is not reset between each skb_queue_walk().

This patch fixes this so that the behavior is the same as peeking with no
offset on an empty queue: the caller blocks.

Signed-off-by: Benjamin Poirier <bpoirier@suse.de>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Benjamin Poirier 2013-04-29 11:42:13 +00:00 committed by David S. Miller
parent add05ad4e9
commit 39cc86130b
1 changed files with 13 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
net/core/datagram.c
View file

@ -78,9 +78,10 @@ static int receiver_wake_function(wait_queue_t *wait, unsigned int mode, int syn
return autoremove_wake_function(wait, mode, sync, key); return autoremove_wake_function(wait, mode, sync, key);
} }
/* /*
* Wait for a packet.. * Wait for the last received packet to be different from skb
*/ */
static int wait_for_packet(struct sock *sk, int *err, long *timeo_p) static int wait_for_more_packets(struct sock *sk, int *err, long *timeo_p,
const struct sk_buff *skb)
{ {
int error; int error;
DEFINE_WAIT_FUNC(wait, receiver_wake_function); DEFINE_WAIT_FUNC(wait, receiver_wake_function);
@ -92,7 +93,7 @@ static int wait_for_packet(struct sock *sk, int *err, long *timeo_p)
if (error) if (error)
goto out_err; goto out_err;
if (!skb_queue_empty(&sk->sk_receive_queue)) if (sk->sk_receive_queue.prev != skb)
goto out; goto out;
/* Socket shut down? */ /* Socket shut down? */
@ -131,9 +132,9 @@ static int wait_for_packet(struct sock *sk, int *err, long *timeo_p)
* __skb_recv_datagram - Receive a datagram skbuff * __skb_recv_datagram - Receive a datagram skbuff
* @sk: socket * @sk: socket
* @flags: MSG_ flags * @flags: MSG_ flags
* @peeked: returns non-zero if this packet has been seen before
* @off: an offset in bytes to peek skb from. Returns an offset * @off: an offset in bytes to peek skb from. Returns an offset
* within an skb where data actually starts * within an skb where data actually starts
* @peeked: returns non-zero if this packet has been seen before
* @err: error code returned * @err: error code returned
* *
* Get a datagram skbuff, understands the peeking, nonblocking wakeups * Get a datagram skbuff, understands the peeking, nonblocking wakeups
@ -161,7 +162,7 @@ static int wait_for_packet(struct sock *sk, int *err, long *timeo_p)
struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags, struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
int *peeked, int *off, int *err) int *peeked, int *off, int *err)
{ {
struct sk_buff *skb; struct sk_buff *skb, *last;
long timeo; long timeo;
/* /*
* Caller is allowed not to check sk->sk_err before skb_recv_datagram() * Caller is allowed not to check sk->sk_err before skb_recv_datagram()
@ -182,14 +183,17 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
*/ */
unsigned long cpu_flags; unsigned long cpu_flags;
struct sk_buff_head *queue = &sk->sk_receive_queue; struct sk_buff_head *queue = &sk->sk_receive_queue;
int _off = *off;
last = (struct sk_buff *)queue;
spin_lock_irqsave(&queue->lock, cpu_flags); spin_lock_irqsave(&queue->lock, cpu_flags);
skb_queue_walk(queue, skb) { skb_queue_walk(queue, skb) {
last = skb;
*peeked = skb->peeked; *peeked = skb->peeked;
if (flags & MSG_PEEK) { if (flags & MSG_PEEK) {
if (*off >= skb->len && (skb->len || *off || if (_off >= skb->len && (skb->len || _off ||
skb->peeked)) { skb->peeked)) {
*off -= skb->len; _off -= skb->len;
continue; continue;
} }
skb->peeked = 1; skb->peeked = 1;
@ -198,6 +202,7 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
__skb_unlink(skb, queue); __skb_unlink(skb, queue);
spin_unlock_irqrestore(&queue->lock, cpu_flags); spin_unlock_irqrestore(&queue->lock, cpu_flags);
*off = _off;
return skb; return skb;
} }
spin_unlock_irqrestore(&queue->lock, cpu_flags); spin_unlock_irqrestore(&queue->lock, cpu_flags);
@ -207,7 +212,7 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
if (!timeo) if (!timeo)
goto no_packet; goto no_packet;
} while (!wait_for_packet(sk, err, &timeo)); } while (!wait_for_more_packets(sk, err, &timeo, last));
return NULL; return NULL;