Patch "af_unix: Call manage_oob() for every skb in unix_stream_read_generic()." has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    af_unix: Call manage_oob() for every skb in unix_stream_read_generic().

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     af_unix-call-manage_oob-for-every-skb-in-unix_stream.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 206ccb4ef4003b80cde5b7ae272fff67282b2a63
Author: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
Date:   Wed Apr 10 10:10:15 2024 -0700

    af_unix: Call manage_oob() for every skb in unix_stream_read_generic().
    
    [ Upstream commit 283454c8a123072e5c386a5a2b5fc576aa455b6f ]
    
    When we call recv() for AF_UNIX socket, we first peek one skb and
    calls manage_oob() to check if the skb is sent with MSG_OOB.
    
    However, when we fetch the next (and the following) skb, manage_oob()
    is not called now, leading a wrong behaviour.
    
    Let's say a socket send()s "hello" with MSG_OOB and the peer tries
    to recv() 5 bytes with MSG_PEEK.  Here, we should get only "hell"
    without 'o', but actually not:
    
      >>> from socket import *
      >>> c1, c2 = socketpair(AF_UNIX, SOCK_STREAM)
      >>> c1.send(b'hello', MSG_OOB)
      5
      >>> c2.recv(5, MSG_PEEK)
      b'hello'
    
    The first skb fills 4 bytes, and the next skb is peeked but not
    properly checked by manage_oob().
    
    Let's move up the again label to call manage_oob() for evry skb.
    
    With this patch:
    
      >>> from socket import *
      >>> c1, c2 = socketpair(AF_UNIX, SOCK_STREAM)
      >>> c1.send(b'hello', MSG_OOB)
      5
      >>> c2.recv(5, MSG_PEEK)
      b'hell'
    
    Fixes: 314001f0bf92 ("af_unix: Add OOB support")
    Signed-off-by: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240410171016.7621-2-kuniyu@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 628d97c195a7e..e2a2e22d210f6 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2644,6 +2644,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state,
 		last = skb = skb_peek(&sk->sk_receive_queue);
 		last_len = last ? last->len : 0;
 
+again:
 #if IS_ENABLED(CONFIG_AF_UNIX_OOB)
 		if (skb) {
 			skb = manage_oob(skb, sk, flags, copied);
@@ -2655,7 +2656,6 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state,
 			}
 		}
 #endif
-again:
 		if (skb == NULL) {
 			if (copied >= target)
 				goto unlock;