Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 77527313 authored by Ilpo Järvinen's avatar Ilpo Järvinen Committed by David S. Miller
Browse files

tcp: fix MSG_PEEK race check 



Commit 518a09ef (tcp: Fix recvmsg MSG_PEEK influence of
blocking behavior) lets the loop run longer than the race check
did previously expect, so we need to be more careful with this
check and consider the work we have been doing.

I tried my best to deal with urg hole madness too which happens
here:
	if (!sock_flag(sk, SOCK_URGINLINE)) {
		++*seq;
		...
by using additional offset by one but I certainly have very
little interest in testing that part.

Signed-off-by: default avatarIlpo Järvinen <ilpo.jarvinen@helsinki.fi>
Tested-by: default avatarFrans Pop <elendil@planet.nl>
Tested-by: default avatarIan Zimmermann <itz@buug.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 705efc3b

net/ipv4/tcp.c

+4 −1
Original line number Diff line number Diff line
@@ -1321,6 +1321,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, 
	struct task_struct *user_recv = NULL;

	int copied_early = 0;

	struct sk_buff *skb;

	u32 urg_hole = 0;



	lock_sock(sk);
@@ -1532,7 +1533,8 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, 
				}

			}

		}

		if ((flags & MSG_PEEK) && peek_seq != tp->copied_seq) {

		if ((flags & MSG_PEEK) &&

		    (peek_seq - copied - urg_hole != tp->copied_seq)) {

			if (net_ratelimit())

				printk(KERN_DEBUG "TCP(%s:%d): Application bug, race in MSG_PEEK.\n",

				       current->comm, task_pid_nr(current));
@@ -1553,6 +1555,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, 
				if (!urg_offset) {

					if (!sock_flag(sk, SOCK_URGINLINE)) {

						++*seq;

						urg_hole++;

						offset++;

						used--;

						if (!used)