Patch "af_unix: Don't peek OOB data without MSG_OOB." has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    af_unix: Don't peek OOB data without MSG_OOB.

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     af_unix-don-t-peek-oob-data-without-msg_oob.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 5089cc040c785b3919c4a2907448a224974895c3
Author: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
Date:   Wed Apr 10 10:10:16 2024 -0700

    af_unix: Don't peek OOB data without MSG_OOB.
    
    [ Upstream commit 22dd70eb2c3d754862964377a75abafd3167346b ]
    
    Currently, we can read OOB data without MSG_OOB by using MSG_PEEK
    when OOB data is sitting on the front row, which is apparently
    wrong.
    
      >>> from socket import *
      >>> c1, c2 = socketpair(AF_UNIX, SOCK_STREAM)
      >>> c1.send(b'a', MSG_OOB)
      1
      >>> c2.recv(1, MSG_PEEK | MSG_DONTWAIT)
      b'a'
    
    If manage_oob() is called when no data has been copied, we only
    check if the socket enables SO_OOBINLINE or MSG_PEEK is not used.
    Otherwise, the skb is returned as is.
    
    However, here we should return NULL if MSG_PEEK is set and no data
    has been copied.
    
    Also, in such a case, we should not jump to the redo label because
    we will be caught in the loop and hog the CPU until normal data
    comes in.
    
    Then, we need to handle skb == NULL case with the if-clause below
    the manage_oob() block.
    
    With this patch:
    
      >>> from socket import *
      >>> c1, c2 = socketpair(AF_UNIX, SOCK_STREAM)
      >>> c1.send(b'a', MSG_OOB)
      1
      >>> c2.recv(1, MSG_PEEK | MSG_DONTWAIT)
      Traceback (most recent call last):
        File "<stdin>", line 1, in <module>
      BlockingIOError: [Errno 11] Resource temporarily unavailable
    
    Fixes: 314001f0bf92 ("af_unix: Add OOB support")
    Signed-off-by: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240410171016.7621-3-kuniyu@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 1340cb86f104c..6eab35a5e2f3b 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2587,7 +2587,9 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk,
 					WRITE_ONCE(u->oob_skb, NULL);
 					consume_skb(skb);
 				}
-			} else if (!(flags & MSG_PEEK)) {
+			} else if (flags & MSG_PEEK) {
+				skb = NULL;
+			} else {
 				skb_unlink(skb, &sk->sk_receive_queue);
 				WRITE_ONCE(u->oob_skb, NULL);
 				if (!WARN_ON_ONCE(skb_unref(skb)))
@@ -2669,11 +2671,9 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state,
 #if IS_ENABLED(CONFIG_AF_UNIX_OOB)
 		if (skb) {
 			skb = manage_oob(skb, sk, flags, copied);
-			if (!skb) {
+			if (!skb && copied) {
 				unix_state_unlock(sk);
-				if (copied)
-					break;
-				goto redo;
+				break;
 			}
 		}
 #endif