Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-26 06:02:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

llc: Fix race condition in llc_ui_recvmsg

Browse Source 
There is a race on sk_receive_queue between llc_ui_recvmsg and
sock_queue_rcv_skb.

Our current solution is to protect skb_eat in llc_ui_recvmsg
with the queue spinlock.

Signed-off-by: Radu Iliescu <riliescu@ixiacom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Radu Iliescu 2012-01-19 03:57:57 +00:00 committed by David S. Miller
parent 90b9a5454f
commit 56ac11cf2f
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
net/llc/af_llc.c
View File

@ -713,6 +713,7 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
struct sk_buff *skb = NULL; struct sk_buff *skb = NULL;
struct sock *sk = sock->sk; struct sock *sk = sock->sk;
struct llc_sock *llc = llc_sk(sk); struct llc_sock *llc = llc_sk(sk);
unsigned long cpu_flags;
size_t copied = 0; size_t copied = 0;
u32 peek_seq = 0; u32 peek_seq = 0;
u32 *seq; u32 *seq;
@ -838,7 +839,9 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
goto copy_uaddr; goto copy_uaddr;
if (!(flags & MSG_PEEK)) { if (!(flags & MSG_PEEK)) {
spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags);
sk_eat_skb(sk, skb, 0); sk_eat_skb(sk, skb, 0);
spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags);
*seq = 0; *seq = 0;
} }
@ -859,7 +862,9 @@ copy_uaddr:
llc_cmsg_rcv(msg, skb); llc_cmsg_rcv(msg, skb);
if (!(flags & MSG_PEEK)) { if (!(flags & MSG_PEEK)) {
spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags);
sk_eat_skb(sk, skb, 0); sk_eat_skb(sk, skb, 0);
spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags);
*seq = 0; *seq = 0;
} }