From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org,
"David S. Miller" <davem@davemloft.net>,
"Rainer Weikusat" <rweikusat@mobileactivedefense.com>,
"Joseph Salisbury" <joseph.salisbury@canonical.com>
Subject: [PATCH 3.2 20/62] af_unix: Don't set err in unix_stream_read_generic unless there was an error
Date: Tue, 29 Mar 2016 20:18:22 +0100 [thread overview]
Message-ID: <lsq.1459279102.305043493@decadent.org.uk> (raw)
In-Reply-To: <lsq.1459279101.951687763@decadent.org.uk>
3.2.79-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Rainer Weikusat <rweikusat@mobileactivedefense.com>
commit 1b92ee3d03af6643df395300ba7748f19ecdb0c5 upstream.
The present unix_stream_read_generic contains various code sequences of
the form
err = -EDISASTER;
if (<test>)
goto out;
This has the unfortunate side effect of possibly causing the error code
to bleed through to the final
out:
return copied ? : err;
and then to be wrongly returned if no data was copied because the caller
didn't supply a data buffer, as demonstrated by the program available at
http://pad.lv/1540731
Change it such that err is only set if an error condition was detected.
Fixes: 3822b5c2fc62 ("af_unix: Revert 'lock_interruptible' in stream receive code")
Reported-by: Joseph Salisbury <joseph.salisbury@canonical.com>
Signed-off-by: Rainer Weikusat <rweikusat@mobileactivedefense.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/unix/af_unix.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2059,13 +2059,15 @@ static int unix_stream_recvmsg(struct ki
int err = 0;
long timeo;
- err = -EINVAL;
- if (sk->sk_state != TCP_ESTABLISHED)
+ if (unlikely(sk->sk_state != TCP_ESTABLISHED)) {
+ err = -EINVAL;
goto out;
+ }
- err = -EOPNOTSUPP;
- if (flags&MSG_OOB)
+ if (unlikely(flags & MSG_OOB)) {
+ err = -EOPNOTSUPP;
goto out;
+ }
target = sock_rcvlowat(sk, flags&MSG_WAITALL, size);
timeo = sock_rcvtimeo(sk, noblock);
@@ -2107,9 +2109,11 @@ static int unix_stream_recvmsg(struct ki
goto unlock;
unix_state_unlock(sk);
- err = -EAGAIN;
- if (!timeo)
+ if (!timeo) {
+ err = -EAGAIN;
break;
+ }
+
mutex_unlock(&u->readlock);
timeo = unix_stream_data_wait(sk, timeo);
next prev parent reply other threads:[~2016-03-29 19:18 UTC|newest]
Thread overview: 66+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-03-29 19:18 [PATCH 3.2 00/62] 3.2.79-rc1 review Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 37/62] Revert "jffs2: Fix lock acquisition order bug in jffs2_write_begin" Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 56/62] MIPS: traps: Fix SIGFPE information leak from `do_ov' and `do_trap_or_bp' Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 58/62] Revert "drm/radeon: call hpd_irq_event on resume" Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 59/62] s390/mm: four page table levels vs. fork Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 54/62] IB/core: Use GRH when the path hop-limit > 0 Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 12/62] libata: fix HDIO_GET_32BIT ioctl Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 49/62] ASoC: wm8958: Fix enum ctl accesses in a wrong type Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 53/62] PM / sleep / x86: Fix crash on graph trace through x86 suspend Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 46/62] ALSA: hdspm: Fix wrong boolean ctl value accesses Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 48/62] USB: cp210x: Add ID for Parrot NMEA GPS Flight Recorder Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 43/62] mm: thp: fix SMP race condition between THP page fault and MADV_DONTNEED Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 44/62] hpfs: don't truncate the file when delete fails Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 14/62] xen/pciback: Save the number of MSI-X entries to be copied later Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 60/62] Input: aiptek - fix crash on detecting device without endpoints Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 18/62] tracing: Fix freak link error caused by branch tracer Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 50/62] ASoC: wm8994: Fix enum ctl accesses in a wrong type Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 51/62] USB: serial: option: add support for Quectel UC20 Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 21/62] af_unix: Guard against other == sk in unix_dgram_sendmsg Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 33/62] can: ems_usb: Fix possible tx overflow Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 17/62] tracepoints: Do not trace when cpu is offline Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 32/62] kernel/resource.c: fix muxed resource handling in __request_region() Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 35/62] sunrpc/cache: fix off-by-one in qword_get() Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 10/62] s390/dasd: prevent incorrect length error under z/VM after PAV changes Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 02/62] crypto: {blk,giv}cipher: Set has_setkey Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 11/62] s390/dasd: fix refcount for PAV reassignment Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 30/62] Adding Intel Lewisburg device IDs for SATA Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 52/62] ALSA: seq: oss: Don't drain at closing a client Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 13/62] xen/pciback: Check PF instead of VF for PCI_COMMAND_MEMORY Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 15/62] xen/pcifront: Fix mysterious crashes when NUMA locality information was extracted Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 01/62] Revert "crypto: algif_skcipher - Do not dereference ctx without socket lock" Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 07/62] nfs: fix nfs_size_to_loff_t Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 40/62] libata: Align ata_device's id on a cacheline Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 39/62] Fix directory hardlinks from deleted directories Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 55/62] mld, igmp: Fix reserved tailroom calculation Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 24/62] x86/uaccess/64: Handle the caching of 4-byte nocache copies properly in __copy_user_nocache() Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 62/62] HID: usbhid: fix recursive deadlock Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 28/62] USB: cp210x: add IDs for GE B650V3 and B850V3 boards Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 42/62] ipr: Fix regression when loading firmware Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 29/62] USB: option: add "4G LTE usb-modem U901" Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 06/62] mac80211: fix use of uninitialised values in RX aggregation Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 26/62] net/mlx4_en: Count HW buffer overrun only once Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 31/62] ext4: fix bh->b_state corruption Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 41/62] ipr: Fix out-of-bounds null overwrite Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 08/62] drm/i915: fix error path in intel_setup_gmbus() Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 03/62] iommu/vt-d: Fix 64-bit accesses to 32-bit DMAR_GSTS_REG Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 05/62] cfg80211/wext: fix message ordering Ben Hutchings
2016-03-29 19:18 ` Ben Hutchings [this message]
2016-03-29 19:18 ` [PATCH 3.2 47/62] ALSA: hdsp: Fix wrong boolean ctl value accesses Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 27/62] USB: option: add support for SIM7100E Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 38/62] jffs2: Fix page lock / f->sem deadlock Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 04/62] wext: fix message delay/ordering Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 36/62] KVM: async_pf: do not warn on page allocation failures Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 45/62] ALSA: timer: Fix broken compat timer user status ioctl Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 19/62] ALSA: seq: Fix double port list deletion Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 57/62] ubi: Fix out of bounds write in volume update code Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 16/62] ALSA: seq: Fix leak of pool buffer at concurrent writes Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 09/62] cifs: fix erroneous return value Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 22/62] x86, extable: Remove open-coded exception table entries in arch/x86/lib/copy_user_nocache_64.S Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 34/62] mac80211: minstrel_ht: set default tx aggregation timeout to 0 Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 61/62] include/linux/poison.h: fix LIST_POISON{1,2} offset Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 25/62] usb: dwc3: Fix assignment of EP transfer resources Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 23/62] x86/uaccess/64: Make the __copy_user_nocache() assembly code more readable Ben Hutchings
2016-03-29 20:19 ` [PATCH 3.2 00/62] 3.2.79-rc1 review Ben Hutchings
2016-03-29 20:26 ` Guenter Roeck
2016-03-29 21:03 ` Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1459279102.305043493@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=davem@davemloft.net \
--cc=joseph.salisbury@canonical.com \
--cc=linux-kernel@vger.kernel.org \
--cc=rweikusat@mobileactivedefense.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox