diff options
| author | Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru> | 2025-05-15 12:20:15 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2025-05-19 12:12:54 +0100 |
| commit | 239af1970bcb039a1551d2c438d113df0010c149 (patch) | |
| tree | 78075848cf47ecd99bbb39fb8ff82f98e4b81615 | |
| parent | c46286fdd6aa1d0e33c245bcffe9ff2428a777bd (diff) | |
llc: fix data loss when reading from a socket in llc_ui_recvmsg()
For SOCK_STREAM sockets, if user buffer size (len) is less
than skb size (skb->len), the remaining data from skb
will be lost after calling kfree_skb().
To fix this, move the statement for partial reading
above skb deletion.
Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org)
Fixes: 30a584d944fb ("[LLX]: SOCK_DGRAM interface fixes")
Cc: stable@vger.kernel.org
Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/llc/af_llc.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c index 0259cde394ba..cc77ec5769d8 100644 --- a/net/llc/af_llc.c +++ b/net/llc/af_llc.c @@ -887,15 +887,15 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, if (sk->sk_type != SOCK_STREAM) goto copy_uaddr; + /* Partial read */ + if (used + offset < skb_len) + continue; + if (!(flags & MSG_PEEK)) { skb_unlink(skb, &sk->sk_receive_queue); kfree_skb(skb); *seq = 0; } - - /* Partial read */ - if (used + offset < skb_len) - continue; } while (len > 0); out: |