Patch "af_unix: Don't stop recv() at consumed ex-OOB skb." has been added to the 6.9-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    af_unix: Don't stop recv() at consumed ex-OOB skb.

to the 6.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     af_unix-don-t-stop-recv-at-consumed-ex-oob-skb.patch
and it can be found in the queue-6.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 16344483e0461c164e98cac18f4e6b3e9719facf
Author: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
Date:   Mon Jun 24 18:36:40 2024 -0700

    af_unix: Don't stop recv() at consumed ex-OOB skb.
    
    [ Upstream commit 36893ef0b661671ee64eb37bf5f345f33d2cabb7 ]
    
    Currently, recv() is stopped at a consumed OOB skb even if a new
    OOB skb is queued and we can ignore the old OOB skb.
    
      >>> from socket import *
      >>> c1, c2 = socket(AF_UNIX, SOCK_STREAM)
      >>> c1.send(b'hellowor', MSG_OOB)
      8
      >>> c2.recv(1, MSG_OOB)  # consume OOB data stays at middle of recvq.
      b'r'
      >>> c1.send(b'ld', MSG_OOB)
      2
      >>> c2.recv(10)          # recv() stops at the old consumed OOB
      b'hellowo'               # should be 'hellowol'
    
    manage_oob() should not stop recv() at the old consumed OOB skb if
    there is a new OOB data queued.
    
    Note that TCP behaviour is apparently wrong in this test case because
    we can recv() the same OOB data twice.
    
    Without fix:
    
      #  RUN           msg_oob.no_peek.ex_oob_ahead_break ...
      # msg_oob.c:138:ex_oob_ahead_break:AF_UNIX :hellowo
      # msg_oob.c:139:ex_oob_ahead_break:Expected:hellowol
      # msg_oob.c:141:ex_oob_ahead_break:Expected ret[0] (7) == expected_len (8)
      # ex_oob_ahead_break: Test terminated by assertion
      #          FAIL  msg_oob.no_peek.ex_oob_ahead_break
      not ok 11 msg_oob.no_peek.ex_oob_ahead_break
    
    With fix:
    
      #  RUN           msg_oob.no_peek.ex_oob_ahead_break ...
      # msg_oob.c:146:ex_oob_ahead_break:AF_UNIX :hellowol
      # msg_oob.c:147:ex_oob_ahead_break:TCP     :helloworl
      #            OK  msg_oob.no_peek.ex_oob_ahead_break
      ok 11 msg_oob.no_peek.ex_oob_ahead_break
    
    Fixes: 314001f0bf92 ("af_unix: Add OOB support")
    Signed-off-by: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
    Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 645ac77e4dda3..e0fea73317de8 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2665,7 +2665,7 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk,
 
 		spin_lock(&sk->sk_receive_queue.lock);
 
-		if (copied) {
+		if (copied && (!u->oob_skb || skb == u->oob_skb)) {
 			skb = NULL;
 		} else if (flags & MSG_PEEK) {
 			skb = skb_peek_next(skb, &sk->sk_receive_queue);