[UDP]: Fix MSG_PROBE crash (1e0c14f4) · Commits · 戴 / test

UDP tracks corking status through the pending variable. The IP layer also tracks it through the socket write queue. It is possible for the two to get out of sync when MSG_PROBE is used. This patch changes UDP to check the write queue to ensure that the two stay in sync. Signed-off-by:

Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv4/udp.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -675,6 +675,8 @@ do_append_data:
		udp_flush_pending_frames(sk);
		else if (!corkreq)
		err = udp_push_pending_frames(sk, up);
		else if (unlikely(skb_queue_empty(&sk->sk_write_queue)))
		up->pending = 0;
		release_sock(sk);

		out:

net/ipv6/udp.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -770,6 +770,8 @@ do_append_data:
		udp_v6_flush_pending_frames(sk);
		else if (!corkreq)
		err = udp_v6_push_pending_frames(sk, up);
		else if (unlikely(skb_queue_empty(&sk->sk_write_queue)))
		up->pending = 0;

		if (dst) {
		if (connected) {

Admin message