Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1e0c14f4 authored Oct 03, 2006 by Herbert Xu Committed by David S. Miller Oct 04, 2006

[UDP]: Fix MSG_PROBE crash



UDP tracks corking status through the pending variable.  The
IP layer also tracks it through the socket write queue.  It
is possible for the two to get out of sync when MSG_PROBE is
used.

This patch changes UDP to check the write queue to ensure
that the two stay in sync.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 132a55f3

net/ipv4/udp.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -675,6 +675,8 @@ int udp_sendmsg(struct kiocb iocb, struct sock sk, struct msghdr *msg,
		udp_flush_pending_frames(sk);
		else if (!corkreq)
		err = udp_push_pending_frames(sk, up);
		else if (unlikely(skb_queue_empty(&sk->sk_write_queue)))
		up->pending = 0;
		release_sock(sk);

		out:

net/ipv6/udp.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -770,6 +770,8 @@ static int udpv6_sendmsg(struct kiocb iocb, struct sock sk,
		udp_v6_flush_pending_frames(sk);
		else if (!corkreq)
		err = udp_v6_push_pending_frames(sk, up);
		else if (unlikely(skb_queue_empty(&sk->sk_write_queue)))
		up->pending = 0;

		if (dst) {
		if (connected) {