Merge "net: Fix use after free in the recvmmsg exit path" (fd818922) · Commits · e / devices / android_kernel_xiaomi_markw

net/socket.c

+19 −19

Original line number	Diff line number	Diff line
		@@ -2449,13 +2449,14 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
		break;
		}

		out_put:
		fput_light(sock->file, fput_needed);

		if (err == 0)
		return datagrams;
		goto out_put;

		if (datagrams == 0) {
		datagrams = err;
		goto out_put;
		}

		if (datagrams != 0) {
		/*
		* We may return less entries than requested (vlen) if the
		* sock is non block and there aren't enough datagrams...
		@@ -2469,13 +2470,12 @@ out_put:
		*/
		sock->sk->sk_err = -err;
		}
		out_put:
		fput_light(sock->file, fput_needed);

		return datagrams;
		}

		return err;
		}

		SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
		unsigned int, vlen, unsigned int, flags,
		struct timespec __user *, timeout)