af_unix: Fix wrong ioctl(SIOCATMARK) when consumed OOB skb is at the head.

[ Upstream commit e400cfa38bb0419cf1313e5494ea2b7d114e86d7 ]

Even if OOB data is recv()ed, ioctl(SIOCATMARK) must return 1 when the
OOB skb is at the head of the receive queue and no new OOB data is queued.

Without fix:

  #  RUN           msg_oob.no_peek.oob ...
  # msg_oob.c:305:oob:Expected answ[0] (0) == oob_head (1)
  # oob: Test terminated by assertion
  #          FAIL  msg_oob.no_peek.oob
  not ok 2 msg_oob.no_peek.oob

With fix:

  #  RUN           msg_oob.no_peek.oob ...
  #            OK  msg_oob.no_peek.oob
  ok 2 msg_oob.no_peek.oob

Fixes: 314001f0bf92 ("af_unix: Add OOB support")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index e0fea73317de8e53812c47d62473797a94c52e87..24286ce0ef3ee6e5fe243971d8bd7602c4828a40 100644 (file)
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -3154,12 +3154,23 @@ static int unix_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 #if IS_ENABLED(CONFIG_AF_UNIX_OOB)
        case SIOCATMARK:
                {
+                       struct unix_sock *u = unix_sk(sk);
                        struct sk_buff *skb;
                        int answ = 0;
 
+                       mutex_lock(&u->iolock);
+
                        skb = skb_peek(&sk->sk_receive_queue);
-                       if (skb && skb == READ_ONCE(unix_sk(sk)->oob_skb))
-                               answ = 1;
+                       if (skb) {
+                               struct sk_buff *oob_skb = READ_ONCE(u->oob_skb);
+
+                               if (skb == oob_skb ||
+                                   (!oob_skb && !unix_skb_len(skb)))
+                                       answ = 1;
+                       }
+
+                       mutex_unlock(&u->iolock);
+
                        err = put_user(answ, (int __user *)arg);
                }
                break;