diff options
author | Ben Pfaff <blp@nicira.com> | 2014-07-09 10:31:22 -0700 |
---|---|---|
committer | Jiri Slaby <jslaby@suse.cz> | 2014-07-29 17:01:37 +0200 |
commit | 8df19ce788d3d18eb4054862daa55a7ee4c883b0 (patch) | |
tree | adc9cc55d54119c10e9ee24bfdb48ae476c1736d /drivers/hid/hid-icade.c | |
parent | 477e05a67bb496ecbecceafa502e4f1af31a360a (diff) |
netlink: Fix handling of error from netlink_dump().
[ Upstream commit ac30ef832e6af0505b6f0251a6659adcfa74975e ]
netlink_dump() returns a negative errno value on error. Until now,
netlink_recvmsg() directly recorded that negative value in sk->sk_err, but
that's wrong since sk_err takes positive errno values. (This manifests as
userspace receiving a positive return value from the recv() system call,
falsely indicating success.) This bug was introduced in the commit that
started checking the netlink_dump() return value, commit b44d211 (netlink:
handle errors from netlink_dump()).
Multithreaded Netlink dumps are one way to trigger this behavior in
practice, as described in the commit message for the userspace workaround
posted here:
http://openvswitch.org/pipermail/dev/2014-June/042339.html
This commit also fixes the same bug in netlink_poll(), introduced in commit
cd1df525d (netlink: add flow control for memory mapped I/O).
Signed-off-by: Ben Pfaff <blp@nicira.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Diffstat (limited to 'drivers/hid/hid-icade.c')
0 files changed, 0 insertions, 0 deletions