android_kernel_google_msm/net
Jim Schutt 6d4221b537 libceph: avoid truncation due to racing banners
Because the Ceph client messenger uses a non-blocking connect, it is
possible for the sending of the client banner to race with the
arrival of the banner sent by the peer.

When ceph_sock_state_change() notices the connect has completed, it
schedules work to process the socket via con_work().  During this
time the peer is writing its banner, and arrival of the peer banner
races with con_work().

If con_work() calls try_read() before the peer banner arrives, there
is nothing for it to do, after which con_work() calls try_write() to
send the client's banner.  In this case Ceph's protocol negotiation
can complete succesfully.

The server-side messenger immediately sends its banner and addresses
after accepting a connect request, *before* actually attempting to
read or verify the banner from the client.  As a result, it is
possible for the banner from the server to arrive before con_work()
calls try_read().  If that happens, try_read() will read the banner
and prepare protocol negotiation info via prepare_write_connect().
prepare_write_connect() calls con_out_kvec_reset(), which discards
the as-yet-unsent client banner.  Next, con_work() calls
try_write(), which sends the protocol negotiation info rather than
the banner that the peer is expecting.

The result is that the peer sees an invalid banner, and the client
reports "negotiation failed".

Fix this by moving con_out_kvec_reset() out of
prepare_write_connect() to its callers at all locations except the
one where the banner might still need to be sent.

[elder@inktak.com: added note about server-side behavior]

Signed-off-by: Jim Schutt <jaschut@sandia.gov>
Reviewed-by: Alex Elder <elder@inktank.com>
2012-08-21 15:55:27 -07:00
..
9p
802
8021q
appletalk
atm
ax25
batman-adv batman-adv: Fix mem leak in the batadv_tt_local_event() function 2012-08-08 16:04:04 -07:00
bluetooth
bridge bridge: make port attributes const 2012-07-30 14:53:22 -07:00
caif netvm: prevent a stream-specific deadlock 2012-07-31 18:42:47 -07:00
can
ceph libceph: avoid truncation due to racing banners 2012-08-21 15:55:27 -07:00
core net/core: Fix potential memory leak in dev_set_alias() 2012-08-08 16:06:23 -07:00
dcb
dccp ipv4: Prepare for change of rt->rt_iif encoding. 2012-07-23 16:36:26 -07:00
decnet ipv4: Restore old dst_free() behavior. 2012-07-31 14:41:38 -07:00
dns_resolver
dsa
ethernet
ieee802154
ipv4 ipv4: fix ip_send_skb() 2012-08-10 14:08:57 -07:00
ipv6 net: tcp: ipv6_mapped needs sk_rx_dst_set method 2012-08-09 20:56:09 -07:00
ipx
irda
iucv
key
l2tp
lapb
llc llc: free the right skb 2012-08-06 13:30:01 -07:00
mac80211 Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 2012-08-02 13:49:38 -04:00
mac802154
netfilter
netlabel
netlink genetlink: define lockdep_genl_is_held() when CONFIG_LOCKDEP 2012-07-24 00:01:30 -07:00
netrom
nfc
openvswitch Revert "openvswitch: potential NULL deref in sample()" 2012-07-27 13:45:51 -07:00
packet af_packet: remove BUG statement in tpacket_destruct_skb 2012-08-12 13:42:17 -07:00
phonet
rds rds: set correct msg_namelen 2012-07-23 01:01:44 -07:00
rfkill
rose
rxrpc
sched sched: add missing group change to qfq_change_class 2012-08-08 16:02:05 -07:00
sctp netvm: prevent a stream-specific deadlock 2012-07-31 18:42:47 -07:00
sunrpc Merge branch 'akpm' (Andrew's patch-bomb) 2012-07-31 19:25:39 -07:00
tipc
unix Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2012-08-01 10:26:23 -07:00
wanrouter wanmain: comparing array with NULL 2012-07-24 13:55:21 -07:00
wimax
wireless cfg80211: process pending events when unregistering net device 2012-08-06 14:29:58 -04:00
x25
xfrm Fix unexpected SA hard expiration after changing date 2012-08-02 00:19:17 -07:00
compat.c net: Fix references to out-of-scope variables in put_cmsg_compat() 2012-07-22 17:50:49 -07:00
Kconfig
Makefile
nonet.c
socket.c net: netprio_cgroup: rework update socket logic 2012-07-22 12:44:01 -07:00
sysctl_net.c