1. 11 Sep, 2009 2 commits
    • Miklos Szeredi's avatar
      net: unix: fix sending fds in multiple buffers · 8ba69ba6
      Miklos Szeredi authored
      Kalle Olavi Niemitalo reported that:
      
        "..., when one process calls sendmsg once to send 43804 bytes of
        data and one file descriptor, and another process then calls recvmsg
        three times to receive the 16032+16032+11740 bytes, each of those
        recvmsg calls returns the file descriptor in the ancillary data.  I
        confirmed this with strace.  The behaviour differs from Linux
        2.6.26, where reportedly only one of those recvmsg calls (I think
        the first one) returned the file descriptor."
      
      This bug was introduced by a patch from me titled "net: unix: fix inflight
      counting bug in garbage collector", commit 6209344f.
      
      And the reason is, quoting Kalle:
      
        "Before your patch, unix_attach_fds() would set scm->fp = NULL, so
        that if the loop in unix_stream_sendmsg() ran multiple iterations,
        it could not call unix_attach_fds() again.  But now,
        unix_attach_fds() leaves scm->fp unchanged, and I think this causes
        it to be called multiple times and duplicate the same file
        descriptors to each struct sk_buff."
      
      Fix this by introducing a flag that is cleared at the start and set
      when the fds attached to the first buffer.  The resulting code should
      work equivalently to the one on 2.6.26.
      Reported-by: default avatarKalle Olavi Niemitalo <kon@iki.fi>
      Signed-off-by: default avatarMiklos Szeredi <mszeredi@suse.cz>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8ba69ba6
    • David S. Miller's avatar
  2. 10 Sep, 2009 6 commits
  3. 09 Sep, 2009 17 commits
  4. 08 Sep, 2009 15 commits