diff options
| author | trociny <trociny@FreeBSD.org> | 2012-09-02 07:29:37 +0000 |
|---|---|---|
| committer | trociny <trociny@FreeBSD.org> | 2012-09-02 07:29:37 +0000 |
| commit | e483d14d74961ca2fedcb74f2953b5e1dc67547c (patch) | |
| tree | 0fdb70b2dfbf02bf7d9e9ff583230b9d28ca7294 /sys/kern/uipc_socket.c | |
| parent | fb02ef2ab9c1adb00c0792b5f5d85b7b6c998a1f (diff) | |
| download | FreeBSD-src-e483d14d74961ca2fedcb74f2953b5e1dc67547c.zip FreeBSD-src-e483d14d74961ca2fedcb74f2953b5e1dc67547c.tar.gz | |
In soreceive_generic() when checking if the type of mbuf has changed
check it for MT_CONTROL type too, otherwise the assertion
"m->m_type == MT_DATA" below may be triggered by the following scenario:
- the sender sends some data (MT_DATA) and then a file descriptor
(MT_CONTROL);
- the receiver calls recv(2) with a MSG_WAITALL asking for data larger
than the receive buffer (uio_resid > hiwat).
MFC after: 2 week
Diffstat (limited to 'sys/kern/uipc_socket.c')
| -rw-r--r-- | sys/kern/uipc_socket.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c index 88876fe..afbf41c 100644 --- a/sys/kern/uipc_socket.c +++ b/sys/kern/uipc_socket.c @@ -1695,8 +1695,8 @@ dontblock: * examined ('type'), end the receive operation. */ SOCKBUF_LOCK_ASSERT(&so->so_rcv); - if (m->m_type == MT_OOBDATA) { - if (type != MT_OOBDATA) + if (m->m_type == MT_OOBDATA || m->m_type == MT_CONTROL) { + if (type != m->m_type) break; } else if (type == MT_OOBDATA) break; |
