Commit ac30ef83 authored Jul 09, 2014 by Ben Pfaff Committed by David S. Miller Jul 09, 2014

netlink: Fix handling of error from netlink_dump().

netlink_dump() returns a negative errno value on error.  Until now,
netlink_recvmsg() directly recorded that negative value in sk->sk_err, but
that's wrong since sk_err takes positive errno values.  (This manifests as
userspace receiving a positive return value from the recv() system call,
falsely indicating success.) This bug was introduced in the commit that
started checking the netlink_dump() return value, commit b44d211e (netlink:
handle errors from netlink_dump()).

Multithreaded Netlink dumps are one way to trigger this behavior in
practice, as described in the commit message for the userspace workaround
posted here:
    http://openvswitch.org/pipermail/dev/2014-June/042339.html



This commit also fixes the same bug in netlink_poll(), introduced in commit
cd1df525 (netlink: add flow control for memory mapped I/O).

Signed-off-by: Ben Pfaff <blp@nicira.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 0a198587

net/netlink/af_netlink.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -636,7 +636,7 @@ static unsigned int netlink_poll(struct file file, struct socket sock,
		while (nlk->cb_running && netlink_dump_space(nlk)) {
		err = netlink_dump(sk);
		if (err < 0) {
		sk->sk_err = err;
		sk->sk_err = -err;
		sk->sk_error_report(sk);
		break;
		}
		@@ -2483,7 +2483,7 @@ static int netlink_recvmsg(struct kiocb kiocb, struct socket sock,
		atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) {
		ret = netlink_dump(sk);
		if (ret) {
		sk->sk_err = ret;
		sk->sk_err = -ret;
		sk->sk_error_report(sk);
		}
		}