Commit 2e23acd9 authored by Cong Wang's avatar Cong Wang Committed by Jakub Kicinski
Browse files

tcp: handle pure FIN case correctly 



When skb->len==0, the recv_actor() returns 0 too, but we also use 0
for error conditions. This patch amends this by propagating the errors
to tcp_read_skb() so that we can distinguish skb->len==0 case from
error cases.

Fixes: 04919bed ("tcp: Introduce tcp_read_skb()")
Reported-by: default avatarEric Dumazet <edumazet@google.com>
Cc: John Fastabend <john.fastabend@gmail.com>
Cc: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: default avatarCong Wang <cong.wang@bytedance.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent a8688821

net/core/skmsg.c

+3 −2
Original line number Diff line number Diff line
@@ -1194,8 +1194,9 @@ static int sk_psock_verdict_recv(struct sock *sk, struct sk_buff *skb) 
		ret = bpf_prog_run_pin_on_cpu(prog, skb);

		ret = sk_psock_map_verd(ret, skb_bpf_redirect_fetch(skb));

	}

	if (sk_psock_verdict_apply(psock, skb, ret) < 0)

		len = 0;

	ret = sk_psock_verdict_apply(psock, skb, ret);

	if (ret < 0)

		len = ret;

out:

	rcu_read_unlock();

	return len;

net/ipv4/tcp.c

+1 −1
Original line number Diff line number Diff line
@@ -1768,7 +1768,7 @@ int tcp_read_skb(struct sock *sk, skb_read_actor_t recv_actor) 
	__skb_unlink(skb, &sk->sk_receive_queue);

	WARN_ON(!skb_set_owner_sk_safe(skb, sk));

	copied = recv_actor(sk, skb);

	if (copied > 0) {

	if (copied >= 0) {

		seq += copied;

		if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)

			++seq;