Patch "af_unix: Stop recv(MSG_PEEK) at consumed OOB skb." has been added to the 6.9-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    af_unix: Stop recv(MSG_PEEK) at consumed OOB skb.

to the 6.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     af_unix-stop-recv-msg_peek-at-consumed-oob-skb.patch
and it can be found in the queue-6.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit ffffae0b7d7368d64c6b8110af30a4f466c9f1c2
Author: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
Date:   Mon Jun 24 18:36:37 2024 -0700

    af_unix: Stop recv(MSG_PEEK) at consumed OOB skb.
    
    [ Upstream commit b94038d841a91d0e3f59cfe4d073e210910366ee ]
    
    After consuming OOB data, recv() reading the preceding data must break at
    the OOB skb regardless of MSG_PEEK.
    
    Currently, MSG_PEEK does not stop recv() for AF_UNIX, and the behaviour is
    not compliant with TCP.
    
      >>> from socket import *
      >>> c1, c2 = socketpair(AF_UNIX)
      >>> c1.send(b'hello', MSG_OOB)
      5
      >>> c1.send(b'world')
      5
      >>> c2.recv(1, MSG_OOB)
      b'o'
      >>> c2.recv(9, MSG_PEEK)  # This should return b'hell'
      b'hellworld'              # even with enough buffer.
    
    Let's fix it by returning NULL for consumed skb and unlinking it only if
    MSG_PEEK is not specified.
    
    This patch also adds test cases that add recv(MSG_PEEK) before each recv().
    
    Without fix:
    
      #  RUN           msg_oob.peek.oob_ahead_break ...
      # msg_oob.c:134:oob_ahead_break:AF_UNIX :hellworld
      # msg_oob.c:135:oob_ahead_break:Expected:hell
      # msg_oob.c:137:oob_ahead_break:Expected ret[0] (9) == expected_len (4)
      # oob_ahead_break: Test terminated by assertion
      #          FAIL  msg_oob.peek.oob_ahead_break
      not ok 13 msg_oob.peek.oob_ahead_break
    
    With fix:
    
      #  RUN           msg_oob.peek.oob_ahead_break ...
      #            OK  msg_oob.peek.oob_ahead_break
      ok 13 msg_oob.peek.oob_ahead_break
    
    Fixes: 314001f0bf92 ("af_unix: Add OOB support")
    Signed-off-by: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
    Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 68a58bc07cf23..d687670e84990 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2660,9 +2660,12 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk,
 {
 	struct unix_sock *u = unix_sk(sk);
 
-	if (!unix_skb_len(skb) && !(flags & MSG_PEEK)) {
-		skb_unlink(skb, &sk->sk_receive_queue);
-		consume_skb(skb);
+	if (!unix_skb_len(skb)) {
+		if (!(flags & MSG_PEEK)) {
+			skb_unlink(skb, &sk->sk_receive_queue);
+			consume_skb(skb);
+		}
+
 		skb = NULL;
 	} else {
 		struct sk_buff *unlinked_skb = NULL;