lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

llc: llc_cmsg_rcv was getting called after sk_eat_skb.

Browse Source 
Received non stream protocol packets were calling llc_cmsg_rcv that used a
skb after that skb was released by sk_eat_skb. This caused received STP
packets to generate kernel panics.

Signed-off-by: Alexandru Juncu <ajuncu@ixiacom.com>
Signed-off-by: Kunjan Naik <knaik@ixiacom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Alex Juncu
2011-12-15 23:01:25 +00:00
committed by David S. Miller
parent a03ffcf873
commit 9cef310fcd
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
net/llc/af_llc.c
View File

@@ -833,15 +833,15 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
copied += used; copied += used;
len -= used; len -= used;
/* For non stream protcols we get one packet per recvmsg call */
if (sk->sk_type != SOCK_STREAM)
goto copy_uaddr;
if (!(flags & MSG_PEEK)) { if (!(flags & MSG_PEEK)) {
sk_eat_skb(sk, skb, 0); sk_eat_skb(sk, skb, 0);
*seq = 0; *seq = 0;
} }
/* For non stream protcols we get one packet per recvmsg call */
if (sk->sk_type != SOCK_STREAM)
goto copy_uaddr;
/* Partial read */ /* Partial read */
if (used + offset < skb->len) if (used + offset < skb->len)
continue; continue;
@@ -857,6 +857,12 @@ copy_uaddr:
} }
if (llc_sk(sk)->cmsg_flags) if (llc_sk(sk)->cmsg_flags)
llc_cmsg_rcv(msg, skb); llc_cmsg_rcv(msg, skb);
if (!(flags & MSG_PEEK)) {
sk_eat_skb(sk, skb, 0);
*seq = 0;
}
goto out; goto out;
} }