lkml.org 
[lkml]   [2014]   [Jul]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.14 53/87] netlink: Fix handling of error from netlink_dump().
    Date
    3.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Ben Pfaff <blp@nicira.com>

    [ Upstream commit ac30ef832e6af0505b6f0251a6659adcfa74975e ]

    netlink_dump() returns a negative errno value on error. Until now,
    netlink_recvmsg() directly recorded that negative value in sk->sk_err, but
    that's wrong since sk_err takes positive errno values. (This manifests as
    userspace receiving a positive return value from the recv() system call,
    falsely indicating success.) This bug was introduced in the commit that
    started checking the netlink_dump() return value, commit b44d211 (netlink:
    handle errors from netlink_dump()).

    Multithreaded Netlink dumps are one way to trigger this behavior in
    practice, as described in the commit message for the userspace workaround
    posted here:
    http://openvswitch.org/pipermail/dev/2014-June/042339.html

    This commit also fixes the same bug in netlink_poll(), introduced in commit
    cd1df525d (netlink: add flow control for memory mapped I/O).

    Signed-off-by: Ben Pfaff <blp@nicira.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/netlink/af_netlink.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/net/netlink/af_netlink.c
    +++ b/net/netlink/af_netlink.c
    @@ -636,7 +636,7 @@ static unsigned int netlink_poll(struct
    while (nlk->cb_running && netlink_dump_space(nlk)) {
    err = netlink_dump(sk);
    if (err < 0) {
    - sk->sk_err = err;
    + sk->sk_err = -err;
    sk->sk_error_report(sk);
    break;
    }
    @@ -2448,7 +2448,7 @@ static int netlink_recvmsg(struct kiocb
    atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) {
    ret = netlink_dump(sk);
    if (ret) {
    - sk->sk_err = ret;
    + sk->sk_err = -ret;
    sk->sk_error_report(sk);
    }
    }



    \
     
     \ /
      Last update: 2014-07-26 23:01    [W:3.056 / U:0.116 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site