mirror of
https://abf.rosa.ru/djam/kernel-5.13.git
synced 2025-02-25 16:12:50 +00:00
47 lines
1.5 KiB
Diff
47 lines
1.5 KiB
Diff
From foo@baz Thu Feb 23 21:13:05 CET 2017
|
|
From: Maxime Jayat <maxime.jayat@mobile-devices.fr>
|
|
Date: Tue, 21 Feb 2017 18:35:51 +0100
|
|
Subject: net: socket: fix recvmmsg not returning error from sock_error
|
|
|
|
From: Maxime Jayat <maxime.jayat@mobile-devices.fr>
|
|
|
|
|
|
[ Upstream commit e623a9e9dec29ae811d11f83d0074ba254aba374 ]
|
|
|
|
Commit 34b88a68f26a ("net: Fix use after free in the recvmmsg exit path"),
|
|
changed the exit path of recvmmsg to always return the datagrams
|
|
variable and modified the error paths to set the variable to the error
|
|
code returned by recvmsg if necessary.
|
|
|
|
However in the case sock_error returned an error, the error code was
|
|
then ignored, and recvmmsg returned 0.
|
|
|
|
Change the error path of recvmmsg to correctly return the error code
|
|
of sock_error.
|
|
|
|
The bug was triggered by using recvmmsg on a CAN interface which was
|
|
not up. Linux 4.6 and later return 0 in this case while earlier
|
|
releases returned -ENETDOWN.
|
|
|
|
Fixes: 34b88a68f26a ("net: Fix use after free in the recvmmsg exit path")
|
|
Signed-off-by: Maxime Jayat <maxime.jayat@mobile-devices.fr>
|
|
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
---
|
|
net/socket.c | 4 +++-
|
|
1 file changed, 3 insertions(+), 1 deletion(-)
|
|
|
|
--- a/net/socket.c
|
|
+++ b/net/socket.c
|
|
@@ -2197,8 +2197,10 @@ int __sys_recvmmsg(int fd, struct mmsghd
|
|
return err;
|
|
|
|
err = sock_error(sock->sk);
|
|
- if (err)
|
|
+ if (err) {
|
|
+ datagrams = err;
|
|
goto out_put;
|
|
+ }
|
|
|
|
entry = mmsg;
|
|
compat_entry = (struct compat_mmsghdr __user *)mmsg;
|