summaryrefslogtreecommitdiffstats
path: root/net/ipv4/udplite.c
diff options
context:
space:
mode:
authorMiklos Szeredi <mszeredi@suse.cz>2007-06-05 13:10:29 -0700
committerDavid S. Miller <davem@sunset.davemloft.net>2007-06-07 13:40:44 -0700
commit3c0d2f3780fc94746c4842e965bd2570e2119bb6 (patch)
tree993e21657b05a2e299e699006aa53a0c0a380e4c /net/ipv4/udplite.c
parentc764c9ade6d9b710bad2b9c631ede9864333b98c (diff)
downloadlinux-3c0d2f3780fc94746c4842e965bd2570e2119bb6.tar.gz
linux-3c0d2f3780fc94746c4842e965bd2570e2119bb6.tar.bz2
linux-3c0d2f3780fc94746c4842e965bd2570e2119bb6.zip
[AF_UNIX]: Fix stream recvmsg() race.
A recv() on an AF_UNIX, SOCK_STREAM socket can race with a send()+close() on the peer, causing recv() to return zero, even though the sent data should be received. This happens if the send() and the close() is performed between skb_dequeue() and checking sk->sk_shutdown in unix_stream_recvmsg(): process A skb_dequeue() returns NULL, there's no data in the socket queue process B new data is inserted onto the queue by unix_stream_sendmsg() process B sk->sk_shutdown is set to SHUTDOWN_MASK by unix_release_sock() process A sk->sk_shutdown is checked, unix_release_sock() returns zero I'm surprised nobody noticed this, it's not hard to trigger. Maybe it's just (un)luck with the timing. It's possible to work around this bug in userspace, by retrying the recv() once in case of a zero return value. Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/udplite.c')
0 files changed, 0 insertions, 0 deletions