releases/2.6.27.46/net-unix-fix-sending-fds-in-multiple-buffers.patch

   1 From 8ba69ba6a324b13e1190fc31e41954d190fd4f1d Mon Sep 17 00:00:00 2001
   2 From: Miklos Szeredi <mszeredi@suse.cz>
   3 Date: Fri, 11 Sep 2009 11:31:45 -0700
   4 Subject: net: unix: fix sending fds in multiple buffers
   5
   6 From: Miklos Szeredi <mszeredi@suse.cz>
   7
   8 commit 8ba69ba6a324b13e1190fc31e41954d190fd4f1d upstream.
   9
  10 Kalle Olavi Niemitalo reported that:
  11
  12   "..., when one process calls sendmsg once to send 43804 bytes of
  13   data and one file descriptor, and another process then calls recvmsg
  14   three times to receive the 16032+16032+11740 bytes, each of those
  15   recvmsg calls returns the file descriptor in the ancillary data.  I
  16   confirmed this with strace.  The behaviour differs from Linux
  17   2.6.26, where reportedly only one of those recvmsg calls (I think
  18   the first one) returned the file descriptor."
  19
  20 This bug was introduced by a patch from me titled "net: unix: fix inflight
  21 counting bug in garbage collector", commit 6209344f5.
  22
  23 And the reason is, quoting Kalle:
  24
  25   "Before your patch, unix_attach_fds() would set scm->fp = NULL, so
  26   that if the loop in unix_stream_sendmsg() ran multiple iterations,
  27   it could not call unix_attach_fds() again.  But now,
  28   unix_attach_fds() leaves scm->fp unchanged, and I think this causes
  29   it to be called multiple times and duplicate the same file
  30   descriptors to each struct sk_buff."
  31
  32 Fix this by introducing a flag that is cleared at the start and set
  33 when the fds attached to the first buffer.  The resulting code should
  34 work equivalently to the one on 2.6.26.
  35
  36 Reported-by: Kalle Olavi Niemitalo <kon@iki.fi>
  37 Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
  38 Signed-off-by: David S. Miller <davem@davemloft.net>
  39 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  40
  41 ---
  42  net/unix/af_unix.c |    5 ++++-
  43  1 file changed, 4 insertions(+), 1 deletion(-)
  44
  45 --- a/net/unix/af_unix.c
  46 +++ b/net/unix/af_unix.c
  47 @@ -1491,6 +1491,7 @@ static int unix_stream_sendmsg(struct ki
  48         struct sk_buff *skb;
  49         int sent=0;
  50         struct scm_cookie tmp_scm;
  51 +       bool fds_sent = false;
  52
  53         if (NULL == siocb->scm)
  54                 siocb->scm = &tmp_scm;
  55 @@ -1552,12 +1553,14 @@ static int unix_stream_sendmsg(struct ki
  56                 size = min_t(int, size, skb_tailroom(skb));
  57
  58                 memcpy(UNIXCREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
  59 -               if (siocb->scm->fp) {
  60 +               /* Only send the fds in the first buffer */
  61 +               if (siocb->scm->fp && !fds_sent) {
  62                         err = unix_attach_fds(siocb->scm, skb);
  63                         if (err) {
  64                                 kfree_skb(skb);
  65                                 goto out_err;
  66                         }
  67 +                       fds_sent = true;
  68                 }
  69
  70                 if ((err = memcpy_fromiovec(skb_put(skb,size), msg->msg_iov, size)) != 0) {