Commit 9cef310f authored by Alex Juncu's avatar Alex Juncu Committed by David S. Miller

llc: llc_cmsg_rcv was getting called after sk_eat_skb.

Received non stream protocol packets were calling llc_cmsg_rcv that used a
skb after that skb was released by sk_eat_skb. This caused received STP
packets to generate kernel panics.
Signed-off-by: default avatarAlexandru Juncu <ajuncu@ixiacom.com>
Signed-off-by: default avatarKunjan Naik <knaik@ixiacom.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent a03ffcf8
...@@ -833,15 +833,15 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock, ...@@ -833,15 +833,15 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
copied += used; copied += used;
len -= used; len -= used;
/* For non stream protcols we get one packet per recvmsg call */
if (sk->sk_type != SOCK_STREAM)
goto copy_uaddr;
if (!(flags & MSG_PEEK)) { if (!(flags & MSG_PEEK)) {
sk_eat_skb(sk, skb, 0); sk_eat_skb(sk, skb, 0);
*seq = 0; *seq = 0;
} }
/* For non stream protcols we get one packet per recvmsg call */
if (sk->sk_type != SOCK_STREAM)
goto copy_uaddr;
/* Partial read */ /* Partial read */
if (used + offset < skb->len) if (used + offset < skb->len)
continue; continue;
...@@ -857,6 +857,12 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock, ...@@ -857,6 +857,12 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
} }
if (llc_sk(sk)->cmsg_flags) if (llc_sk(sk)->cmsg_flags)
llc_cmsg_rcv(msg, skb); llc_cmsg_rcv(msg, skb);
if (!(flags & MSG_PEEK)) {
sk_eat_skb(sk, skb, 0);
*seq = 0;
}
goto out; goto out;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment