From: Greg Kroah-Hartman Date: Tue, 23 Jul 2013 16:29:39 +0000 (-0700) Subject: 3.10-stable patches X-Git-Tag: v3.10.3~18 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9265d71964c59cfdca4425bbd505ff093e6bea63;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: svcrpc-don-t-error-out-on-small-tcp-fragment.patch --- diff --git a/queue-3.10/series b/queue-3.10/series index 2bffb0229b5..7889fff4fdc 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -74,3 +74,4 @@ printk-fix-rq-lock-vs-logbuf_lock-unlock-lock-inversion.patch uprobes-fix-return-value-in-error-handling-path.patch svcrpc-fix-failures-to-handle-1-uid-s.patch svcrpc-fix-handling-of-too-short-rpc-s.patch +svcrpc-don-t-error-out-on-small-tcp-fragment.patch diff --git a/queue-3.10/svcrpc-don-t-error-out-on-small-tcp-fragment.patch b/queue-3.10/svcrpc-don-t-error-out-on-small-tcp-fragment.patch new file mode 100644 index 00000000000..4c9ed7bc113 --- /dev/null +++ b/queue-3.10/svcrpc-don-t-error-out-on-small-tcp-fragment.patch @@ -0,0 +1,35 @@ +From 1f691b07c5dc51b2055834f58c0f351defd97f27 Mon Sep 17 00:00:00 2001 +From: "J. Bruce Fields" +Date: Wed, 26 Jun 2013 10:55:40 -0400 +Subject: svcrpc: don't error out on small tcp fragment + +From: "J. Bruce Fields" + +commit 1f691b07c5dc51b2055834f58c0f351defd97f27 upstream. + +Though clients we care about mostly don't do this, it is possible for +rpc requests to be sent in multiple fragments. Here we have a sanity +check to ensure that the final received rpc isn't too small--except that +the number we're actually checking is the length of just the final +fragment, not of the whole rpc. So a perfectly legal rpc that's +unluckily fragmented could cause the server to close the connection +here. + +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/svcsock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/sunrpc/svcsock.c ++++ b/net/sunrpc/svcsock.c +@@ -1095,7 +1095,7 @@ static int svc_tcp_recvfrom(struct svc_r + goto err_noclose; + } + +- if (svc_sock_reclen(svsk) < 8) { ++ if (svsk->sk_datalen < 8) { + svsk->sk_datalen = 0; + goto err_delete; /* client is nuts. */ + }