[Xen-changelog] [linux-2.6.18-xen] [UDP6]: Fix MSG_PROBE crash

["Xen patchbot-linux-2.6.18-xen" <patchbot-linux-2.6.18-xen@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User Keir Fraser <keir.fraser@xxxxxxxxxx>
# Date 1222678278 -3600
# Node ID fba34c7b1c978795e1bdca72e1d8dadccfc76dad
# Parent  cc6fc966c6139491f72d48a06d45f0767faab225
[UDP6]: Fix MSG_PROBE crash

UDP tracks corking status through the pending variable.  The
IP layer also tracks it through the socket write queue.  It
is possible for the two to get out of sync when MSG_PROBE is
used.

This patch changes UDP to check the write queue to ensure
that the two stay in sync.

Signed-off-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
---
 net/ipv4/udp.c |    2 ++
 net/ipv6/udp.c |    2 ++
 2 files changed, 4 insertions(+)

diff -r cc6fc966c613 -r fba34c7b1c97 net/ipv4/udp.c
--- a/net/ipv4/udp.c    Fri Sep 26 14:07:10 2008 +0100
+++ b/net/ipv4/udp.c    Mon Sep 29 09:51:18 2008 +0100
@@ -651,6 +651,8 @@ do_append_data:
                udp_flush_pending_frames(sk);
        else if (!corkreq)
                err = udp_push_pending_frames(sk, up);
+       else if (unlikely(skb_queue_empty(&sk->sk_write_queue)))
+               up->pending = 0;
        release_sock(sk);
 
 out:
diff -r cc6fc966c613 -r fba34c7b1c97 net/ipv6/udp.c
--- a/net/ipv6/udp.c    Fri Sep 26 14:07:10 2008 +0100
+++ b/net/ipv6/udp.c    Mon Sep 29 09:51:18 2008 +0100
@@ -834,6 +834,8 @@ do_append_data:
                udp_v6_flush_pending_frames(sk);
        else if (!corkreq)
                err = udp_v6_push_pending_frames(sk, up);
+       else if (unlikely(skb_queue_empty(&sk->sk_write_queue)))
+               up->pending = 0;
 
        if (dst) {
                if (connected) {

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog