lkml.org 
[lkml]   [2017]   [Mar]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.2 185/199] net: socket: fix recvmmsg not returning error from sock_error
    3.2.87-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Maxime Jayat <maxime.jayat@mobile-devices.fr>

    [ Upstream commit e623a9e9dec29ae811d11f83d0074ba254aba374 ]

    Commit 34b88a68f26a ("net: Fix use after free in the recvmmsg exit path"),
    changed the exit path of recvmmsg to always return the datagrams
    variable and modified the error paths to set the variable to the error
    code returned by recvmsg if necessary.

    However in the case sock_error returned an error, the error code was
    then ignored, and recvmmsg returned 0.

    Change the error path of recvmmsg to correctly return the error code
    of sock_error.

    The bug was triggered by using recvmmsg on a CAN interface which was
    not up. Linux 4.6 and later return 0 in this case while earlier
    releases returned -ENETDOWN.

    Fixes: 34b88a68f26a ("net: Fix use after free in the recvmmsg exit path")
    Signed-off-by: Maxime Jayat <maxime.jayat@mobile-devices.fr>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    net/socket.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    --- a/net/socket.c
    +++ b/net/socket.c
    @@ -2269,8 +2269,10 @@ int __sys_recvmmsg(int fd, struct mmsghd
    return err;

    err = sock_error(sock->sk);
    - if (err)
    + if (err) {
    + datagrams = err;
    goto out_put;
    + }

    entry = mmsg;
    compat_entry = (struct compat_mmsghdr __user *)mmsg;
    \
     
     \ /
      Last update: 2017-03-10 13:00    [W:2.529 / U:0.448 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site