Commit 27f58f7f authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge branch 'af_unix-fix-msg_oob-bugs-with-msg_peek' 

Kuniyuki Iwashima says:

====================
af_unix: Fix MSG_OOB bugs with MSG_PEEK.

Currently, OOB data can be read without MSG_OOB accidentally
in two cases, and this seris fixes the bugs.

v1: https://lore.kernel.org/netdev/20240409225209.58102-1-kuniyu@amazon.com/
====================

Link: https://lore.kernel.org/r/20240410171016.7621-1-kuniyu@amazon.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 90be7a5c 22dd70eb

net/unix/af_unix.c

+6 −6
Original line number Diff line number Diff line
@@ -2663,7 +2663,9 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk, 
					WRITE_ONCE(u->oob_skb, NULL);

					consume_skb(skb);

				}

			} else if (!(flags & MSG_PEEK)) {

			} else if (flags & MSG_PEEK) {

				skb = NULL;

			} else {

				skb_unlink(skb, &sk->sk_receive_queue);

				WRITE_ONCE(u->oob_skb, NULL);

				if (!WARN_ON_ONCE(skb_unref(skb)))
@@ -2741,18 +2743,16 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state, 
		last = skb = skb_peek(&sk->sk_receive_queue);

		last_len = last ? last->len : 0;



again:

#if IS_ENABLED(CONFIG_AF_UNIX_OOB)

		if (skb) {

			skb = manage_oob(skb, sk, flags, copied);

			if (!skb) {

			if (!skb && copied) {

				unix_state_unlock(sk);

				if (copied)

				break;

				goto redo;

			}

		}

#endif

again:

		if (skb == NULL) {

			if (copied >= target)

				goto unlock;