[PATCH net] mptcp: sendmsg: reset iter on error

[PATCH net] mptcp: sendmsg: reset iter on error

[Florian Westphal]

Once we've copied data from the iterator we need to revert in case we
end up not sending any data.

This bug doesn't trigger with normal 'poll' based tests, because
we only feed a small chunk of data to kernel after poll indicated
POLLOUT.  With blocking IO and large writes this triggers. Receiver
ends up with less data than it should get.

Fixes: 72511aab95c94d ("mptcp: avoid blocking in tcp_sendpages")
Signed-off-by: Florian Westphal <fw@strlen.de>
---
 net/mptcp/protocol.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index d5aaa98b9136..2e7e87304930 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -725,8 +725,10 @@ static int mptcp_sendmsg_frag(struct sock *sk, struct sock *ssk,
 		if (!psize)
 			return -EINVAL;
 
-		if (!sk_wmem_schedule(sk, psize + dfrag->overhead))
+		if (!sk_wmem_schedule(sk, psize + dfrag->overhead)) {
+			iov_iter_revert(&msg->msg_iter, psize);
 			return -ENOMEM;
+		}
 	} else {
 		offset = dfrag->offset;
 		psize = min_t(size_t, dfrag->data_len, avail_size);
@@ -737,8 +739,10 @@ static int mptcp_sendmsg_frag(struct sock *sk, struct sock *ssk,
 	 */
 	ret = do_tcp_sendpages(ssk, page, offset, psize,
 			       msg->msg_flags | MSG_SENDPAGE_NOTLAST | MSG_DONTWAIT);
-	if (ret <= 0)
+	if (ret <= 0) {
+		iov_iter_revert(&msg->msg_iter, psize);
 		return ret;
+	}
 
 	frag_truesize += ret;
 	if (!retransmission) {
-- 
2.26.2

Re: [PATCH net] mptcp: sendmsg: reset iter on error

[Mat Martineau]

On Fri, 14 Aug 2020, Florian Westphal wrote:

> Once we've copied data from the iterator we need to revert in case we
> end up not sending any data.
>
> This bug doesn't trigger with normal 'poll' based tests, because
> we only feed a small chunk of data to kernel after poll indicated
> POLLOUT.  With blocking IO and large writes this triggers. Receiver
> ends up with less data than it should get.
>
> Fixes: 72511aab95c94d ("mptcp: avoid blocking in tcp_sendpages")
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
> net/mptcp/protocol.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>

Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>

--
Mat Martineau
Intel

Re: [PATCH net] mptcp: sendmsg: reset iter on error

[David Miller]

From: Florian Westphal <fw@strlen.de>
Date: Fri, 14 Aug 2020 15:56:34 +0200

> Once we've copied data from the iterator we need to revert in case we
> end up not sending any data.
> 
> This bug doesn't trigger with normal 'poll' based tests, because
> we only feed a small chunk of data to kernel after poll indicated
> POLLOUT.  With blocking IO and large writes this triggers. Receiver
> ends up with less data than it should get.
> 
> Fixes: 72511aab95c94d ("mptcp: avoid blocking in tcp_sendpages")
> Signed-off-by: Florian Westphal <fw@strlen.de>

Applied and queued up for -stable, thanks.