On 07/28/2017 04:22 PM, Tom Herbert wrote:
> Add new proto_ops sendmsg_locked and sendpage_locked that can be
> called when the socket lock is already held. Correspondingly, add
> kernel_sendmsg_locked and kernel_sendpage_locked as front end
> functions.
>
> These functions will be used in zero proxy so that we can take
> the socket lock in a ULP sendmsg/sendpage and then directly call the
> backend transport proto_ops functions.
>
> Signed-off-by: Tom Herbert <t...@quantonium.net>
> ---
[...]
> diff --git a/net/socket.c b/net/socket.c
> index 79d9bb964cd8..c0a12ad39610 100644
> --- a/net/socket.c
> +++ b/net/socket.c
> @@ -652,6 +652,20 @@ int kernel_sendmsg(struct socket *sock, struct msghdr
> *msg,
> }
> EXPORT_SYMBOL(kernel_sendmsg);
>
> +int kernel_sendmsg_locked(struct sock *sk, struct msghdr *msg,
> + struct kvec *vec, size_t num, size_t size)
> +{
> + struct socket *sock = sk->sk_socket;
> +
> + if (!sock->ops->sendmsg_locked)
> + sock_no_sendmsg_locked(sk, msg, size);
> +
Should be
return sock_no_sendmsg_locked(sk, msg, size);
> + iov_iter_kvec(&msg->msg_iter, WRITE | ITER_KVEC, vec, num, size);
> +
> + return sock->ops->sendmsg_locked(sk, msg, msg_data_left(msg));
Otherwise this is a null ptr deref.
> +}
> +EXPORT_SYMBOL(kernel_sendmsg_locked);
> +
Thanks,
John
