Skip to content

Commit

Permalink
net: socket: fix recvmmsg not returning error from sock_error
Browse files Browse the repository at this point in the history
Commit 34b88a6 ("net: Fix use after free in the recvmmsg exit path"),
changed the exit path of recvmmsg to always return the datagrams
variable and modified the error paths to set the variable to the error
code returned by recvmsg if necessary.

However in the case sock_error returned an error, the error code was
then ignored, and recvmmsg returned 0.

Change the error path of recvmmsg to correctly return the error code
of sock_error.

The bug was triggered by using recvmmsg on a CAN interface which was
not up. Linux 4.6 and later return 0 in this case while earlier
releases returned -ENETDOWN.

Fixes: 34b88a6 ("net: Fix use after free in the recvmmsg exit path")
Signed-off-by: Maxime Jayat <maxime.jayat@mobile-devices.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Maxime Jayat authored and David S. Miller committed Feb 21, 2017
1 parent 1faaa78 commit e623a9e
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion net/socket.c
Original file line number Diff line number Diff line change
Expand Up @@ -2228,8 +2228,10 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
return err;

err = sock_error(sock->sk);
if (err)
if (err) {
datagrams = err;
goto out_put;
}

entry = mmsg;
compat_entry = (struct compat_mmsghdr __user *)mmsg;
Expand Down

0 comments on commit e623a9e

Please sign in to comment.