Commit 83690b82 authored by Kuniyuki Iwashima's avatar Kuniyuki Iwashima Committed by Paolo Abeni
Browse files

af_unix: Use skb_queue_empty_lockless() in unix_release_sock(). 



If the socket type is SOCK_STREAM or SOCK_SEQPACKET, unix_release_sock()
checks the length of the peer socket's recvq under unix_state_lock().

However, unix_stream_read_generic() calls skb_unlink() after releasing
the lock.  Also, for SOCK_SEQPACKET, __skb_try_recv_datagram() unlinks
skb without unix_state_lock().

Thues, unix_state_lock() does not protect qlen.

Let's use skb_queue_empty_lockless() in unix_release_sock().

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parent 45d872f0

net/unix/af_unix.c

+1 −1
Original line number Diff line number Diff line
@@ -631,7 +631,7 @@ static void unix_release_sock(struct sock *sk, int embrion) 
			unix_state_lock(skpair);

			/* No more writes */

			WRITE_ONCE(skpair->sk_shutdown, SHUTDOWN_MASK);

			if (!skb_queue_empty(&sk->sk_receive_queue) || embrion)

			if (!skb_queue_empty_lockless(&sk->sk_receive_queue) || embrion)

				WRITE_ONCE(skpair->sk_err, ECONNRESET);

			unix_state_unlock(skpair);

			skpair->sk_state_change(skpair);