Patch "af_unix: Fix wrong ioctl(SIOCATMARK) when consumed OOB skb is at the head." has been added to the 6.9-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    af_unix: Fix wrong ioctl(SIOCATMARK) when consumed OOB skb is at the head.

to the 6.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     af_unix-fix-wrong-ioctl-siocatmark-when-consumed-oob.patch
and it can be found in the queue-6.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 2f3ef1c681be686de19c983d43596450e0c6665e
Author: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
Date:   Mon Jun 24 18:36:44 2024 -0700

    af_unix: Fix wrong ioctl(SIOCATMARK) when consumed OOB skb is at the head.
    
    [ Upstream commit e400cfa38bb0419cf1313e5494ea2b7d114e86d7 ]
    
    Even if OOB data is recv()ed, ioctl(SIOCATMARK) must return 1 when the
    OOB skb is at the head of the receive queue and no new OOB data is queued.
    
    Without fix:
    
      #  RUN           msg_oob.no_peek.oob ...
      # msg_oob.c:305:oob:Expected answ[0] (0) == oob_head (1)
      # oob: Test terminated by assertion
      #          FAIL  msg_oob.no_peek.oob
      not ok 2 msg_oob.no_peek.oob
    
    With fix:
    
      #  RUN           msg_oob.no_peek.oob ...
      #            OK  msg_oob.no_peek.oob
      ok 2 msg_oob.no_peek.oob
    
    Fixes: 314001f0bf92 ("af_unix: Add OOB support")
    Signed-off-by: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
    Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index e0fea73317de8..24286ce0ef3ee 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -3154,12 +3154,23 @@ static int unix_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 #if IS_ENABLED(CONFIG_AF_UNIX_OOB)
 	case SIOCATMARK:
 		{
+			struct unix_sock *u = unix_sk(sk);
 			struct sk_buff *skb;
 			int answ = 0;
 
+			mutex_lock(&u->iolock);
+
 			skb = skb_peek(&sk->sk_receive_queue);
-			if (skb && skb == READ_ONCE(unix_sk(sk)->oob_skb))
-				answ = 1;
+			if (skb) {
+				struct sk_buff *oob_skb = READ_ONCE(u->oob_skb);
+
+				if (skb == oob_skb ||
+				    (!oob_skb && !unix_skb_len(skb)))
+					answ = 1;
+			}
+
+			mutex_unlock(&u->iolock);
+
 			err = put_user(answ, (int __user *)arg);
 		}
 		break;