diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2024-04-12 19:05:51 -0700 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2024-04-12 19:05:51 -0700 |
| commit | 27f58f7f079b93d91fdd12caf3036b2d8921e0b2 (patch) | |
| tree | fd087e4e3dd8a3cc3c7dd8178f9d8b313ce312f8 | |
| parent | 90be7a5ce0e5faec62782c8af37ad4ea0b9ecd40 (diff) | |
| parent | 22dd70eb2c3d754862964377a75abafd3167346b (diff) | |
| download | linux-27f58f7f079b93d91fdd12caf3036b2d8921e0b2.tar.gz | |
Merge branch 'af_unix-fix-msg_oob-bugs-with-msg_peek'
Kuniyuki Iwashima says:
====================
af_unix: Fix MSG_OOB bugs with MSG_PEEK.
Currently, OOB data can be read without MSG_OOB accidentally
in two cases, and this seris fixes the bugs.
v1: https://lore.kernel.org/netdev/20240409225209.58102-1-kuniyu@amazon.com/
====================
Link: https://lore.kernel.org/r/20240410171016.7621-1-kuniyu@amazon.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | net/unix/af_unix.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index d032eb5fa6df1e..9a6ad5974dff5e 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -2663,7 +2663,9 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk, WRITE_ONCE(u->oob_skb, NULL); consume_skb(skb); } - } else if (!(flags & MSG_PEEK)) { + } else if (flags & MSG_PEEK) { + skb = NULL; + } else { skb_unlink(skb, &sk->sk_receive_queue); WRITE_ONCE(u->oob_skb, NULL); if (!WARN_ON_ONCE(skb_unref(skb))) @@ -2741,18 +2743,16 @@ redo: last = skb = skb_peek(&sk->sk_receive_queue); last_len = last ? last->len : 0; +again: #if IS_ENABLED(CONFIG_AF_UNIX_OOB) if (skb) { skb = manage_oob(skb, sk, flags, copied); - if (!skb) { + if (!skb && copied) { unix_state_unlock(sk); - if (copied) - break; - goto redo; + break; } } #endif -again: if (skb == NULL) { if (copied >= target) goto unlock; |