diff options
| author | Kuniyuki Iwashima <kuniyu@amazon.com> | 2024-06-24 18:36:44 -0700 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2024-06-27 12:05:01 +0200 |
| commit | e400cfa38bb0419cf1313e5494ea2b7d114e86d7 (patch) | |
| tree | 5b6fb74b7a7d19478f7a648fb6e7557239d33137 /net/unix | |
| parent | 48a998373090f33e558a20a976c6028e11e93184 (diff) | |
| download | linux-stable-e400cfa38bb0419cf1313e5494ea2b7d114e86d7.tar.gz linux-stable-e400cfa38bb0419cf1313e5494ea2b7d114e86d7.tar.bz2 linux-stable-e400cfa38bb0419cf1313e5494ea2b7d114e86d7.zip | |
af_unix: Fix wrong ioctl(SIOCATMARK) when consumed OOB skb is at the head.
Even if OOB data is recv()ed, ioctl(SIOCATMARK) must return 1 when the
OOB skb is at the head of the receive queue and no new OOB data is queued.
Without fix:
# RUN msg_oob.no_peek.oob ...
# msg_oob.c:305:oob:Expected answ[0] (0) == oob_head (1)
# oob: Test terminated by assertion
# FAIL msg_oob.no_peek.oob
not ok 2 msg_oob.no_peek.oob
With fix:
# RUN msg_oob.no_peek.oob ...
# OK msg_oob.no_peek.oob
ok 2 msg_oob.no_peek.oob
Fixes: 314001f0bf92 ("af_unix: Add OOB support")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Diffstat (limited to 'net/unix')
| -rw-r--r-- | net/unix/af_unix.c | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index 07f5eaa04b5b..142f56770b77 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -3107,12 +3107,23 @@ static int unix_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) #if IS_ENABLED(CONFIG_AF_UNIX_OOB) case SIOCATMARK: { + struct unix_sock *u = unix_sk(sk); struct sk_buff *skb; int answ = 0; + mutex_lock(&u->iolock); + skb = skb_peek(&sk->sk_receive_queue); - if (skb && skb == READ_ONCE(unix_sk(sk)->oob_skb)) - answ = 1; + if (skb) { + struct sk_buff *oob_skb = READ_ONCE(u->oob_skb); + + if (skb == oob_skb || + (!oob_skb && !unix_skb_len(skb))) + answ = 1; + } + + mutex_unlock(&u->iolock); + err = put_user(answ, (int __user *)arg); } break; |