Commit 239af197 authored by Ilia Gavrilov's avatar Ilia Gavrilov Committed by David S. Miller
Browse files

llc: fix data loss when reading from a socket in llc_ui_recvmsg() 



For SOCK_STREAM sockets, if user buffer size (len) is less
than skb size (skb->len), the remaining data from skb
will be lost after calling kfree_skb().

To fix this, move the statement for partial reading
above skb deletion.

Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org)

Fixes: 30a584d9 ("[LLX]: SOCK_DGRAM interface fixes")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarIlia Gavrilov <Ilia.Gavrilov@infotecs.ru>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c46286fd

net/llc/af_llc.c

+4 −4
Original line number Diff line number Diff line
@@ -887,15 +887,15 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, 
		if (sk->sk_type != SOCK_STREAM)

			goto copy_uaddr;



		/* Partial read */

		if (used + offset < skb_len)

			continue;



		if (!(flags & MSG_PEEK)) {

			skb_unlink(skb, &sk->sk_receive_queue);

			kfree_skb(skb);

			*seq = 0;

		}



		/* Partial read */

		if (used + offset < skb_len)

			continue;

	} while (len > 0);



out: