Some socket syscalls fail to return an error on bad file-descriptor# argument

[Tony Griffiths <tonyg@agile.tv>]

[-- Attachment #1: Type: text/plain, Size: 723 bytes --]

Description:

The sockfd_lookup_light() function does not set the return error status 
on a particular failure mode when the passed-in fd# is erroneous.

Environment:

2.6.16 kernel with the -mm2 patch-set applied.  Linux 2.6.17 kernels are 
also affected.  Without the fix, a number of tests in LTP fail!  Any 
program calling one of the syscalls listed below with a bad fd# will not 
get an error return indicating that the syscall failed.

Fix:

The attached patch correctly sets *err = -EBADF if the attempt to map 
the fd# to a file pointer returns NULL.  The following syscalls are 
affected-

bind()
listen()
accept()
connect()
getsockname()
getpeername()
setsockopt()
setsockopt()
shutdown()
sendmsg()
recvmsg()




[-- Attachment #2: atv-40018-socket-fix-2.6.16.patch --]
[-- Type: text/x-patch, Size: 338 bytes --]

diff -urpN ./net/socket.c.orig ./net/socket.c
--- ./net/socket.c.orig	2006-06-01 10:28:30.000000000 +1000
+++ ./net/socket.c	2006-06-01 10:34:09.000000000 +1000
@@ -496,6 +496,8 @@ static struct socket *sockfd_lookup_ligh
 		if (sock)
 			return sock;
 		fput_light(file, *fput_needed);
+	} else {
+		*err = -EBADF;
 	}
 	return NULL;
 }