Patch "af_unix: Read with MSG_PEEK loops if the first unread byte is OOB" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    af_unix: Read with MSG_PEEK loops if the first unread byte is OOB

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     af_unix-read-with-msg_peek-loops-if-the-first-unread.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 0287273ab0d26c26b43ded5238b074546416829a
Author: Rao Shoaib <Rao.Shoaib@xxxxxxxxxx>
Date:   Tue Jun 11 01:46:39 2024 -0700

    af_unix: Read with MSG_PEEK loops if the first unread byte is OOB
    
    [ Upstream commit a6736a0addd60fccc3a3508461d72314cc609772 ]
    
    Read with MSG_PEEK flag loops if the first byte to read is an OOB byte.
    commit 22dd70eb2c3d ("af_unix: Don't peek OOB data without MSG_OOB.")
    addresses the loop issue but does not address the issue that no data
    beyond OOB byte can be read.
    
    >>> from socket import *
    >>> c1, c2 = socketpair(AF_UNIX, SOCK_STREAM)
    >>> c1.send(b'a', MSG_OOB)
    1
    >>> c1.send(b'b')
    1
    >>> c2.recv(1, MSG_PEEK | MSG_DONTWAIT)
    b'b'
    
    >>> from socket import *
    >>> c1, c2 = socketpair(AF_UNIX, SOCK_STREAM)
    >>> c2.setsockopt(SOL_SOCKET, SO_OOBINLINE, 1)
    >>> c1.send(b'a', MSG_OOB)
    1
    >>> c1.send(b'b')
    1
    >>> c2.recv(1, MSG_PEEK | MSG_DONTWAIT)
    b'a'
    >>> c2.recv(1, MSG_PEEK | MSG_DONTWAIT)
    b'a'
    >>> c2.recv(1, MSG_DONTWAIT)
    b'a'
    >>> c2.recv(1, MSG_PEEK | MSG_DONTWAIT)
    b'b'
    >>>
    
    Fixes: 314001f0bf92 ("af_unix: Add OOB support")
    Signed-off-by: Rao Shoaib <Rao.Shoaib@xxxxxxxxxx>
    Reviewed-by: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240611084639.2248934-1-Rao.Shoaib@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 5fb705ce15ea5..5ec188209bdd5 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2600,18 +2600,18 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk,
 		if (skb == u->oob_skb) {
 			if (copied) {
 				skb = NULL;
-			} else if (sock_flag(sk, SOCK_URGINLINE)) {
-				if (!(flags & MSG_PEEK)) {
+			} else if (!(flags & MSG_PEEK)) {
+				if (sock_flag(sk, SOCK_URGINLINE)) {
 					WRITE_ONCE(u->oob_skb, NULL);
 					consume_skb(skb);
+				} else {
+					__skb_unlink(skb, &sk->sk_receive_queue);
+					WRITE_ONCE(u->oob_skb, NULL);
+					unlinked_skb = skb;
+					skb = skb_peek(&sk->sk_receive_queue);
 				}
-			} else if (flags & MSG_PEEK) {
-				skb = NULL;
-			} else {
-				__skb_unlink(skb, &sk->sk_receive_queue);
-				WRITE_ONCE(u->oob_skb, NULL);
-				unlinked_skb = skb;
-				skb = skb_peek(&sk->sk_receive_queue);
+			} else if (!sock_flag(sk, SOCK_URGINLINE)) {
+				skb = skb_peek_next(skb, &sk->sk_receive_queue);
 			}
 		}