| Message ID | 1366897638-21882-1-git-send-email-bpoirier@suse.de |
|---|---|
| State | Superseded, archived |
| Delegated to: | David Miller |
| Headers | show |
On Thu, 2013-04-25 at 09:47 -0400, Benjamin Poirier wrote: > "77c1090 net: fix infinite loop in __skb_recv_datagram()" (v3.8) introduced a > regression: > After that commit, recv can no longer peek beyond a 0-sized skb in the queue. > __skb_recv_datagram() instead stops at the first skb with len == 0 and results > in the system call failing with -EFAULT via skb_copy_datagram_iovec(). if MSG_PEEK is not used, what happens here ? It doesn't look right to me that we return -EFAULT if skb->len is 0, EFAULT is reserved to faulting (ie reading/writing at least one byte) How are we telling the user message had 0 byte, but its not EOF ? -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/core/datagram.c b/net/core/datagram.c index 368f9c3..02398ae 100644 --- a/net/core/datagram.c +++ b/net/core/datagram.c @@ -187,7 +187,7 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags, skb_queue_walk(queue, skb) { *peeked = skb->peeked; if (flags & MSG_PEEK) { - if (*off >= skb->len && skb->len) { + if (*off >= skb->len && (skb->len || *off)) { *off -= skb->len; continue; }
"77c1090 net: fix infinite loop in __skb_recv_datagram()" (v3.8) introduced a regression: After that commit, recv can no longer peek beyond a 0-sized skb in the queue. __skb_recv_datagram() instead stops at the first skb with len == 0 and results in the system call failing with -EFAULT via skb_copy_datagram_iovec(). Signed-off-by: Benjamin Poirier <bpoirier@suse.de> --- net/core/datagram.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)