diff options
| author | Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru> | 2025-05-15 12:20:15 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-06-04 14:42:20 +0200 |
| commit | 4cfe30f681a3df21b77f3d4c668069d6d0cf9840 (patch) | |
| tree | 39ab77c6d348bb99421df5a87875cd60a0d7639c /net | |
| parent | 6764329675f94eae661b1151e236d84ba35f918d (diff) | |
| download | linux-4cfe30f681a3df21b77f3d4c668069d6d0cf9840.tar.gz linux-4cfe30f681a3df21b77f3d4c668069d6d0cf9840.tar.bz2 linux-4cfe30f681a3df21b77f3d4c668069d6d0cf9840.zip | |
llc: fix data loss when reading from a socket in llc_ui_recvmsg()
commit 239af1970bcb039a1551d2c438d113df0010c149 upstream.
For SOCK_STREAM sockets, if user buffer size (len) is less
than skb size (skb->len), the remaining data from skb
will be lost after calling kfree_skb().
To fix this, move the statement for partial reading
above skb deletion.
Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org)
Fixes: 30a584d944fb ("[LLX]: SOCK_DGRAM interface fixes")
Cc: stable@vger.kernel.org
Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/llc/af_llc.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c index cc25fec44f85..19f3de3c24ef 100644 --- a/net/llc/af_llc.c +++ b/net/llc/af_llc.c @@ -888,15 +888,15 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, if (sk->sk_type != SOCK_STREAM) goto copy_uaddr; + /* Partial read */ + if (used + offset < skb_len) + continue; + if (!(flags & MSG_PEEK)) { skb_unlink(skb, &sk->sk_receive_queue); kfree_skb(skb); *seq = 0; } - - /* Partial read */ - if (used + offset < skb_len) - continue; } while (len > 0); out: |