6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima kuniyu@google.com
[ Upstream commit 7bf3a476ce43833c49fceddbe94ff3472e04e9bc ]
Miao Wang reported a bug of SO_PEEK_OFF on AF_UNIX SOCK_STREAM socket.
The unexpected behaviour is triggered when the peek offset is larger than the recv queue and the thread is unblocked by new data.
Let's assume a socket which has "aaaa" in the recv queue and the peek offset is 4.
First, unix_stream_read_generic() reads the offset 4 and skips the skb(s) of "aaaa" with the code below:
skip = max(sk_peek_offset(sk, flags), 0); /* @skip is 4. */
do { ... while (skip >= unix_skb_len(skb)) { skip -= unix_skb_len(skb); ... skb = skb_peek_next(skb, &sk->sk_receive_queue); if (!skb) goto again; /* @skip is 0. */ }
The thread jumps to the 'again' label and goes to sleep since new data has not arrived yet.
Later, new data "bbbb" unblocks the thread, and the thread jumps to the 'redo:' label to restart the entire process from the first skb in the recv queue.
do { ... redo: ... last = skb = skb_peek(&sk->sk_receive_queue); ... again: if (skb == NULL) { ... timeo = unix_stream_data_wait(sk, timeo, last, last_len, freezable); ... goto redo; /* @skip is 0 !! */
However, the peek offset is not reset in the path.
If the buffer size is 8, recv() will return "aaaabbbb" without skipping any data, and the final offset will be 12 (the original offset 4 + peeked skbs' length 8).
After sleeping in unix_stream_read_generic(), we have to fetch the peek offset again.
Let's move the redo label before mutex_lock(&u->iolock).
Fixes: 9f389e35674f ("af_unix: return data from multiple SKBs on recv() with MSG_PEEK flag") Reported-by: Miao Wang shankerwangmiao@gmail.com Closes: https://lore.kernel.org/netdev/3B969F90-F51F-4B9D-AB1A-994D9A54D460@gmail.co... Signed-off-by: Kuniyuki Iwashima kuniyu@google.com Link: https://patch.msgid.link/20251117174740.3684604-2-kuniyu@google.com Signed-off-by: Jakub Kicinski kuba@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- net/unix/af_unix.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index 26d37a90b755d..59911ac719b19 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -2805,6 +2805,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state,
u = unix_sk(sk);
+redo: /* Lock the socket to prevent queue disordering * while sleeps in memcpy_tomsg */ @@ -2816,7 +2817,6 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state, struct sk_buff *skb, *last; int chunk;
-redo: unix_state_lock(sk); if (sock_flag(sk, SOCK_DEAD)) { err = -ECONNRESET; @@ -2866,7 +2866,6 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state, goto out; }
- mutex_lock(&u->iolock); goto redo; unlock: unix_state_unlock(sk);