diff options
| author | Jakub Kicinski <[email protected]> | 2024-04-13 02:05:51 +0000 |
|---|---|---|
| committer | Jakub Kicinski <[email protected]> | 2024-04-13 02:05:51 +0000 |
| commit | 27f58f7f079b93d91fdd12caf3036b2d8921e0b2 (patch) | |
| tree | fd087e4e3dd8a3cc3c7dd8178f9d8b313ce312f8 /net/unix/af_unix.c | |
| parent | Merge tag 'nf-24-04-11' of git://git.kernel.org/pub/scm/linux/kernel/git/netf... (diff) | |
| parent | af_unix: Don't peek OOB data without MSG_OOB. (diff) | |
| download | kernel-27f58f7f079b93d91fdd12caf3036b2d8921e0b2.tar.gz kernel-27f58f7f079b93d91fdd12caf3036b2d8921e0b2.zip | |
Merge branch 'af_unix-fix-msg_oob-bugs-with-msg_peek'
Kuniyuki Iwashima says:
====================
af_unix: Fix MSG_OOB bugs with MSG_PEEK.
Currently, OOB data can be read without MSG_OOB accidentally
in two cases, and this seris fixes the bugs.
v1: https://lore.kernel.org/netdev/[email protected]/
====================
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Diffstat (limited to 'net/unix/af_unix.c')
| -rw-r--r-- | net/unix/af_unix.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index d032eb5fa6df..9a6ad5974dff 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -2663,7 +2663,9 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk, WRITE_ONCE(u->oob_skb, NULL); consume_skb(skb); } - } else if (!(flags & MSG_PEEK)) { + } else if (flags & MSG_PEEK) { + skb = NULL; + } else { skb_unlink(skb, &sk->sk_receive_queue); WRITE_ONCE(u->oob_skb, NULL); if (!WARN_ON_ONCE(skb_unref(skb))) @@ -2741,18 +2743,16 @@ redo: last = skb = skb_peek(&sk->sk_receive_queue); last_len = last ? last->len : 0; +again: #if IS_ENABLED(CONFIG_AF_UNIX_OOB) if (skb) { skb = manage_oob(skb, sk, flags, copied); - if (!skb) { + if (!skb && copied) { unix_state_unlock(sk); - if (copied) - break; - goto redo; + break; } } #endif -again: if (skb == NULL) { if (copied >= target) goto unlock; |