From: Paolo Abeni Date: Mon, 25 Mar 2019 13:18:06 +0000 (+0100) Subject: net: datagram: fix unbounded loop in __skb_try_recv_datagram() X-Git-Tag: v4.19.33~124 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=88c64f9c7d3ffaca070c01c1564afeeaffd472f1;p=platform%2Fkernel%2Flinux-rpi.git net: datagram: fix unbounded loop in __skb_try_recv_datagram() [ Upstream commit 0b91bce1ebfc797ff3de60c8f4a1e6219a8a3187 ] Christoph reported a stall while peeking datagram with an offset when busy polling is enabled. __skb_try_recv_datagram() uses as the loop termination condition 'queue empty'. When peeking, the socket queue can be not empty, even when no additional packets are received. Address the issue explicitly checking for receive queue changes, as currently done by __skb_wait_for_more_packets(). Fixes: 2b5cd0dfa384 ("net: Change return type of sk_busy_loop from bool to void") Reported-and-tested-by: Christoph Paasch Signed-off-by: Paolo Abeni Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- diff --git a/net/core/datagram.c b/net/core/datagram.c index 57f3a6fc..a487df5 100644 --- a/net/core/datagram.c +++ b/net/core/datagram.c @@ -279,7 +279,7 @@ struct sk_buff *__skb_try_recv_datagram(struct sock *sk, unsigned int flags, break; sk_busy_loop(sk, flags & MSG_DONTWAIT); - } while (!skb_queue_empty(&sk->sk_receive_queue)); + } while (sk->sk_receive_queue.prev != *last); error = -EAGAIN;