Patch "udp: fix poll() issue with zero sized packets" has been added to the 4.7-stable tree

This is a note to let you know that I've just added the patch titled

udp: fix poll() issue with zero sized packets

to the 4.7-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
udp-fix-poll-issue-with-zero-sized-packets.patch
and it can be found in the queue-4.7 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Eric Dumazet <[email protected]>
Date: Tue, 23 Aug 2016 13:59:33 -0700
Subject: udp: fix poll() issue with zero sized packets

From: Eric Dumazet <[email protected]>

[ Upstream commit e83c6744e81abc93a20d0eb3b7f504a176a6126a ]

Laura tracked poll() [and friends] regression caused by commit e6afc8ace6dd ("udp: remove headers from UDP packets before queueing")

udp_poll() needs to know if there is a valid packet in receive queue, even if its payload length is 0.

Change first_packet_length() to return an signed int, and use -1 as the indication of an empty queue.

---
 net/ipv4/udp.c |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

@@ -1182,13 +1182,13 @@ out:
  *	@sk: socket
  *
  *	Drops all bad checksum frames, until a valid one is found.
- *	Returns the length of found skb, or 0 if none is found.
+ *	Returns the length of found skb, or -1 if none is found.
  */
-static unsigned int first_packet_length(struct sock *sk)
+static int first_packet_length(struct sock *sk)
 {
 	struct sk_buff_head list_kill, *rcvq = &sk->sk_receive_queue;
 	struct sk_buff *skb;
-	unsigned int res;
+	int res;
 
 	__skb_queue_head_init(&list_kill);
 

@@ -1203,7 +1203,7 @@ static unsigned int first_packet_length(
 		__skb_unlink(skb, rcvq);
 		__skb_queue_tail(&list_kill, skb);
 	}
-	res = skb ? skb->len : 0;
+	res = skb ? skb->len : -1;
 	spin_unlock_bh(&rcvq->lock);
 
 	if (!skb_queue_empty(&list_kill)) {

@@ -1232,7 +1232,7 @@ int udp_ioctl(struct sock *sk, int cmd,
 
 	case SIOCINQ:
 	{
-		unsigned int amount = first_packet_length(sk);
+		int amount = max_t(int, 0, first_packet_length(sk));
 
 		return put_user(amount, (int __user *)arg);
 	}

@@ -2184,7 +2184,7 @@ unsigned int udp_poll(struct file *file,
 
 	/* Check for false positives due to checksum errors */
 	if ((mask & POLLRDNORM) && !(file->f_flags & O_NONBLOCK) &&
-	    !(sk->sk_shutdown & RCV_SHUTDOWN) && !first_packet_length(sk))
+	    !(sk->sk_shutdown & RCV_SHUTDOWN) && first_packet_length(sk) == -1)
 		mask &= ~(POLLIN | POLLRDNORM);
 
 	return mask;

Patches currently in stable-queue which might be from [email protected] are

queue-4.7/bonding-fix-bonding-crash.patch queue-4.7/tcp-properly-scale-window-in-tcp_v_reqsk_send_ack.patch queue-4.7/tcp-fastopen-avoid-negative-sk_forward_alloc.patch queue-4.7/udp-fix-poll-issue-with-zero-sized-packets.patch queue-4.7/tcp-fix-use-after-free-in-tcp_xmit_retransmit_queue.patch queue-4.7/tun-fix-transmit-timestamp-support.patch