Commit 8a34d4e8 authored by Kuniyuki Iwashima's avatar Kuniyuki Iwashima Committed by Paolo Abeni
Browse files

af_unix: Annotate data-races around sk->sk_state in sendmsg() and recvmsg(). 



The following functions read sk->sk_state locklessly and proceed only if
the state is TCP_ESTABLISHED.

  * unix_stream_sendmsg
  * unix_stream_read_generic
  * unix_seqpacket_sendmsg
  * unix_seqpacket_recvmsg

Let's use READ_ONCE() there.

Fixes: a05d2ad1 ("af_unix: Only allow recv on connected seqpacket sockets.")
Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parent 1b536948

net/unix/af_unix.c

+4 −4
Original line number Diff line number Diff line
@@ -2226,7 +2226,7 @@ static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg, 
	}



	if (msg->msg_namelen) {

		err = sk->sk_state == TCP_ESTABLISHED ? -EISCONN : -EOPNOTSUPP;

		err = READ_ONCE(sk->sk_state) == TCP_ESTABLISHED ? -EISCONN : -EOPNOTSUPP;

		goto out_err;

	} else {

		err = -ENOTCONN;
@@ -2340,7 +2340,7 @@ static int unix_seqpacket_sendmsg(struct socket *sock, struct msghdr *msg, 
	if (err)

		return err;



	if (sk->sk_state != TCP_ESTABLISHED)

	if (READ_ONCE(sk->sk_state) != TCP_ESTABLISHED)

		return -ENOTCONN;



	if (msg->msg_namelen)
@@ -2354,7 +2354,7 @@ static int unix_seqpacket_recvmsg(struct socket *sock, struct msghdr *msg, 
{

	struct sock *sk = sock->sk;



	if (sk->sk_state != TCP_ESTABLISHED)

	if (READ_ONCE(sk->sk_state) != TCP_ESTABLISHED)

		return -ENOTCONN;



	return unix_dgram_recvmsg(sock, msg, size, flags);
@@ -2683,7 +2683,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state, 
	size_t size = state->size;

	unsigned int last_len;



	if (unlikely(sk->sk_state != TCP_ESTABLISHED)) {

	if (unlikely(READ_ONCE(sk->sk_state) != TCP_ESTABLISHED)) {

		err = -EINVAL;

		goto out;

	}