diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c index 2f191e50d4fc..51f2409d6113 100644 --- a/net/kcm/kcmsock.c +++ b/net/kcm/kcmsock.c @@ -748,7 +748,7 @@ static int kcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) { struct sock *sk = sock->sk; struct kcm_sock *kcm = kcm_sk(sk); - struct sk_buff *skb = NULL, *head = NULL; + struct sk_buff *skb = NULL, *head = NULL, *seq_skb; size_t copy, copied = 0; long timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT); int eor = (sock->type == SOCK_DGRAM) ? @@ -763,6 +763,7 @@ static int kcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) if (sk->sk_err) goto out_error; + seq_skb = kcm->seq_skb; if (kcm->seq_skb) { /* Previously opened message */ head = kcm->seq_skb; @@ -888,6 +889,8 @@ static int kcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) err = sk_stream_wait_memory(sk, &timeo); if (err) goto out_error; + if (seq_skb && seq_skb != kcm->seq_skb) + goto out_stolen; } if (eor) { @@ -943,7 +946,7 @@ static int kcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) kfree_skb(head); kcm->seq_skb = NULL; } - +out_stolen: err = sk_stream_error(sk, msg->msg_flags, err); /* make sure we wake any epoll edge trigger waiter */