bna: fix Rx data corruption with VLAN stripping enabled and MTU > 4096

[cascardo/linux.git] / net / unix / af_unix.c

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index ef05cd9..c5bf5ef 100644 (file)
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -451,7 +451,7 @@ static void unix_write_space(struct sock *sk)
        rcu_read_lock();
        if (unix_writable(sk)) {
                wq = rcu_dereference(sk->sk_wq);
-               if (wq_has_sleeper(wq))
+               if (skwq_has_sleeper(wq))
                        wake_up_interruptible_sync_poll(&wq->wait,
                                POLLOUT | POLLWRNORM | POLLWRBAND);
                sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
@@ -1513,6 +1513,21 @@ static void unix_destruct_scm(struct sk_buff *skb)
        sock_wfree(skb);
 }
 
+/*
+ * The "user->unix_inflight" variable is protected by the garbage
+ * collection lock, and we just read it locklessly here. If you go
+ * over the limit, there might be a tiny race in actually noticing
+ * it across threads. Tough.
+ */
+static inline bool too_many_unix_fds(struct task_struct *p)
+{
+       struct user_struct *user = current_user();
+
+       if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE)))
+               return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN);
+       return false;
+}
+
 #define MAX_RECURSION_LEVEL 4
 
 static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
@@ -1521,6 +1536,9 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
        unsigned char max_level = 0;
        int unix_sock_count = 0;
 
+       if (too_many_unix_fds(current))
+               return -ETOOMANYREFS;
+
        for (i = scm->fp->count - 1; i >= 0; i--) {
                struct sock *sk = unix_get_socket(scm->fp->fp[i]);
 
@@ -1542,10 +1560,8 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
        if (!UNIXCB(skb).fp)
                return -ENOMEM;
 
-       if (unix_sock_count) {
-               for (i = scm->fp->count - 1; i >= 0; i--)
-                       unix_inflight(scm->fp->fp[i]);
-       }
+       for (i = scm->fp->count - 1; i >= 0; i--)
+               unix_inflight(scm->fp->fp[i]);
        return max_level;
 }
 
@@ -2092,8 +2108,8 @@ static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
        struct scm_cookie scm;
        struct sock *sk = sock->sk;
        struct unix_sock *u = unix_sk(sk);
-       int noblock = flags & MSG_DONTWAIT;
-       struct sk_buff *skb;
+       struct sk_buff *skb, *last;
+       long timeo;
        int err;
        int peeked, skip;
 
@@ -2101,30 +2117,38 @@ static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
        if (flags&MSG_OOB)
                goto out;
 
-       err = mutex_lock_interruptible(&u->readlock);
-       if (unlikely(err)) {
-               /* recvmsg() in non blocking mode is supposed to return -EAGAIN
-                * sk_rcvtimeo is not honored by mutex_lock_interruptible()
-                */
-               err = noblock ? -EAGAIN : -ERESTARTSYS;
-               goto out;
-       }
+       timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
 
-       skip = sk_peek_offset(sk, flags);
+       do {
+               mutex_lock(&u->readlock);
 
-       skb = __skb_recv_datagram(sk, flags, &peeked, &skip, &err);
-       if (!skb) {
+               skip = sk_peek_offset(sk, flags);
+               skb = __skb_try_recv_datagram(sk, flags, &peeked, &skip, &err,
+                                             &last);
+               if (skb)
+                       break;
+
+               mutex_unlock(&u->readlock);
+
+               if (err != -EAGAIN)
+                       break;
+       } while (timeo &&
+                !__skb_wait_for_more_packets(sk, &err, &timeo, last));
+
+       if (!skb) { /* implies readlock unlocked */
                unix_state_lock(sk);
                /* Signal EOF on disconnected non-blocking SEQPACKET socket. */
                if (sk->sk_type == SOCK_SEQPACKET && err == -EAGAIN &&
                    (sk->sk_shutdown & RCV_SHUTDOWN))
                        err = 0;
                unix_state_unlock(sk);
-               goto out_unlock;
+               goto out;
        }
 
-       wake_up_interruptible_sync_poll(&u->peer_wait,
-                                       POLLOUT | POLLWRNORM | POLLWRBAND);
+       if (wq_has_sleeper(&u->peer_wait))
+               wake_up_interruptible_sync_poll(&u->peer_wait,
+                                               POLLOUT | POLLWRNORM |
+                                               POLLWRBAND);
 
        if (msg->msg_name)
                unix_copy_addr(msg, skb->sk);
@@ -2176,7 +2200,6 @@ static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
 
 out_free:
        skb_free_datagram(sk, skb);
-out_unlock:
        mutex_unlock(&u->readlock);
 out:
        return err;