Patch "af_unix: Set sk->sk_state under unix_state_lock() for truly disconencted peer." has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    af_unix: Set sk->sk_state under unix_state_lock() for truly disconencted peer.

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     af_unix-set-sk-sk_state-under-unix_state_lock-for-tr.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit e4131c30c30e955025d38f3eddc42b96a9b59f23
Author: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
Date:   Tue Jun 4 09:52:27 2024 -0700

    af_unix: Set sk->sk_state under unix_state_lock() for truly disconencted peer.
    
    [ Upstream commit 26bfb8b57063f52b867f9b6c8d1742fcb5bd656c ]
    
    When a SOCK_DGRAM socket connect()s to another socket, the both sockets'
    sk->sk_state are changed to TCP_ESTABLISHED so that we can register them
    to BPF SOCKMAP.
    
    When the socket disconnects from the peer by connect(AF_UNSPEC), the state
    is set back to TCP_CLOSE.
    
    Then, the peer's state is also set to TCP_CLOSE, but the update is done
    locklessly and unconditionally.
    
    Let's say socket A connect()ed to B, B connect()ed to C, and A disconnects
    from B.
    
    After the first two connect()s, all three sockets' sk->sk_state are
    TCP_ESTABLISHED:
    
      $ ss -xa
      Netid State  Recv-Q Send-Q  Local Address:Port  Peer Address:PortProcess
      u_dgr ESTAB  0      0       @A 641              * 642
      u_dgr ESTAB  0      0       @B 642              * 643
      u_dgr ESTAB  0      0       @C 643              * 0
    
    And after the disconnect, B's state is TCP_CLOSE even though it's still
    connected to C and C's state is TCP_ESTABLISHED.
    
      $ ss -xa
      Netid State  Recv-Q Send-Q  Local Address:Port  Peer Address:PortProcess
      u_dgr UNCONN 0      0       @A 641              * 0
      u_dgr UNCONN 0      0       @B 642              * 643
      u_dgr ESTAB  0      0       @C 643              * 0
    
    In this case, we cannot register B to SOCKMAP.
    
    So, when a socket disconnects from the peer, we should not set TCP_CLOSE to
    the peer if the peer is connected to yet another socket, and this must be
    done under unix_state_lock().
    
    Note that we use WRITE_ONCE() for sk->sk_state as there are many lockless
    readers.  These data-races will be fixed in the following patches.
    
    Fixes: 83301b5367a9 ("af_unix: Set TCP_ESTABLISHED for datagram sockets too")
    Signed-off-by: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
    Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index d01314dc86ecb..348f9e34f6696 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -571,7 +571,6 @@ static void unix_dgram_disconnected(struct sock *sk, struct sock *other)
 			sk_error_report(other);
 		}
 	}
-	other->sk_state = TCP_CLOSE;
 }
 
 static void unix_sock_destructor(struct sock *sk)
@@ -1434,8 +1433,15 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
 
 		unix_state_double_unlock(sk, other);
 
-		if (other != old_peer)
+		if (other != old_peer) {
 			unix_dgram_disconnected(sk, old_peer);
+
+			unix_state_lock(old_peer);
+			if (!unix_peer(old_peer))
+				WRITE_ONCE(old_peer->sk_state, TCP_CLOSE);
+			unix_state_unlock(old_peer);
+		}
+
 		sock_put(old_peer);
 	} else {
 		unix_peer(sk) = other;