tcp: fix MSG_PEEK race check (77527313) · Commits · 戴 / test

Commit (tcp: Fix recvmsg MSG_PEEK influence of blocking behavior) lets the loop run longer than the race check did previously expect, so we need to be more careful with this check and consider the work we have been doing. I tried my best to deal with urg hole madness too which happens here: if (!sock_flag(sk, SOCK_URGINLINE)) { ++*seq; ... by using additional offset by one but I certainly have very little interest in testing that part. Signed-off-by:

Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Tested-by:

Frans Pop <elendil@planet.nl> Tested-by:

Ian Zimmermann <itz@buug.org> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv4/tcp.c

+4 −1

Original line number	Original line	Diff line number	Diff line
	@@ -1321,6 +1321,7 @@ int tcp_recvmsg(struct kiocb iocb, struct sock sk, struct msghdr *msg,
	struct task_struct *user_recv = NULL;		struct task_struct *user_recv = NULL;
	int copied_early = 0;		int copied_early = 0;
	struct sk_buff *skb;		struct sk_buff *skb;
			u32 urg_hole = 0;

	lock_sock(sk);		lock_sock(sk);

	@@ -1532,7 +1533,8 @@ do_prequeue:
	}		}
	}		}
	}		}
	if ((flags & MSG_PEEK) && peek_seq != tp->copied_seq) {		if ((flags & MSG_PEEK) &&
			(peek_seq - copied - urg_hole != tp->copied_seq)) {
	if (net_ratelimit())		if (net_ratelimit())
	printk(KERN_DEBUG "TCP(%s:%d): Application bug, race in MSG_PEEK.\n",		printk(KERN_DEBUG "TCP(%s:%d): Application bug, race in MSG_PEEK.\n",
	current->comm, task_pid_nr(current));		current->comm, task_pid_nr(current));
	@@ -1553,6 +1555,7 @@ do_prequeue:
	if (!urg_offset) {		if (!urg_offset) {
	if (!sock_flag(sk, SOCK_URGINLINE)) {		if (!sock_flag(sk, SOCK_URGINLINE)) {
	++*seq;		++*seq;
			urg_hole++;
	offset++;		offset++;
	used--;		used--;
	if (!used)		if (!used)

Admin message