diff options
| author | Kuniyuki Iwashima <kuniyu@amazon.com> | 2024-06-04 09:52:29 -0700 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2024-06-06 12:57:14 +0200 |
| commit | 3a0f38eb285c8c2eead4b3230c7ac2983707599d (patch) | |
| tree | f09fc28897bf150f7e88fa18ca979758d58759d4 /net/unix/af_unix.c | |
| parent | 942238f9735a4a4ebf8274b218d9a910158941d1 (diff) | |
| download | linux-3a0f38eb285c8c2eead4b3230c7ac2983707599d.tar.gz linux-3a0f38eb285c8c2eead4b3230c7ac2983707599d.tar.bz2 linux-3a0f38eb285c8c2eead4b3230c7ac2983707599d.zip | |
af_unix: Annotate data-race of sk->sk_state in unix_inq_len().
ioctl(SIOCINQ) calls unix_inq_len() that checks sk->sk_state first
and returns -EINVAL if it's TCP_LISTEN.
Then, for SOCK_STREAM sockets, unix_inq_len() returns the number of
bytes in recvq.
However, unix_inq_len() does not hold unix_state_lock(), and the
concurrent listen() might change the state after checking sk->sk_state.
If the race occurs, 0 is returned for the listener, instead of -EINVAL,
because the length of skb with embryo is 0.
We could hold unix_state_lock() in unix_inq_len(), but it's overkill
given the result is true for pre-listen() TCP_CLOSE state.
So, let's use READ_ONCE() for sk->sk_state in unix_inq_len().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Diffstat (limited to 'net/unix/af_unix.c')
| -rw-r--r-- | net/unix/af_unix.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index 424d021a4d7d..b37b53767b29 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -3017,7 +3017,7 @@ long unix_inq_len(struct sock *sk) struct sk_buff *skb; long amount = 0; - if (sk->sk_state == TCP_LISTEN) + if (READ_ONCE(sk->sk_state) == TCP_LISTEN) return -EINVAL; spin_lock(&sk->sk_receive_queue.lock); |