Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ea438df4 authored by Karsten Graul's avatar Karsten Graul Committed by Greg Kroah-Hartman
Browse files

net/smc: receive pending data after RCV_SHUTDOWN 



[ Upstream commit 107529e31a87acd475ff6a0f82745821b8f70fec ]

smc_rx_recvmsg() first checks if data is available, and then if
RCV_SHUTDOWN is set. There is a race when smc_cdc_msg_recv_action() runs
in between these 2 checks, receives data and sets RCV_SHUTDOWN.
In that case smc_rx_recvmsg() would return from receive without to
process the available data.
Fix that with a final check for data available if RCV_SHUTDOWN is set.
Move the check for data into a function and call it twice.
And use the existing helper smc_rx_data_available().

Fixes: 952310cc ("smc: receive data from RMBE")
Reviewed-by: default avatarUrsula Braun <ubraun@linux.ibm.com>
Signed-off-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent ccb7eb9b

net/smc/smc_rx.c

+20 −5
Original line number Diff line number Diff line
@@ -262,6 +262,18 @@ static int smc_rx_recv_urg(struct smc_sock *smc, struct msghdr *msg, int len, 
	return -EAGAIN;

}



static bool smc_rx_recvmsg_data_available(struct smc_sock *smc)

{

	struct smc_connection *conn = &smc->conn;



	if (smc_rx_data_available(conn))

		return true;

	else if (conn->urg_state == SMC_URG_VALID)

		/* we received a single urgent Byte - skip */

		smc_rx_update_cons(smc, 0);

	return false;

}



/* smc_rx_recvmsg - receive data from RMBE

 * @msg:	copy data to receive buffer

 * @pipe:	copy data to pipe if set - indicates splice() call
@@ -303,15 +315,18 @@ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg, 
		if (read_done >= target || (pipe && read_done))

			break;



		if (atomic_read(&conn->bytes_to_rcv))

		if (smc_rx_recvmsg_data_available(smc))

			goto copy;

		else if (conn->urg_state == SMC_URG_VALID)

			/* we received a single urgent Byte - skip */

			smc_rx_update_cons(smc, 0);



		if (sk->sk_shutdown & RCV_SHUTDOWN ||

		    conn->local_tx_ctrl.conn_state_flags.peer_conn_abort)

		    conn->local_tx_ctrl.conn_state_flags.peer_conn_abort) {

			/* smc_cdc_msg_recv_action() could have run after

			 * above smc_rx_recvmsg_data_available()

			 */

			if (smc_rx_recvmsg_data_available(smc))

				goto copy;

			break;

		}



		if (read_done) {

			if (sk->sk_err ||