Commit 19eed721 authored by Rao Shoaib's avatar Rao Shoaib Committed by David S. Miller
Browse files

af_unix: check socket state when queuing OOB 



edumazet@google.com pointed out that queue_oob
does not check socket state after acquiring
the lock. He also pointed to an incorrect usage
of kfree_skb and an unnecessary setting of skb
length. This patch addresses those issue.

Signed-off-by: default avatarRao Shoaib <Rao.Shoaib@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6164659f

net/unix/af_unix.c

+9 −2
Original line number Diff line number Diff line
@@ -1908,7 +1908,6 @@ static int queue_oob(struct socket *sock, struct msghdr *msg, struct sock *other 
		return err;



	skb_put(skb, 1);

	skb->len = 1;

	err = skb_copy_datagram_from_iter(skb, 0, &msg->msg_iter, 1);



	if (err) {
@@ -1917,11 +1916,19 @@ static int queue_oob(struct socket *sock, struct msghdr *msg, struct sock *other 
	}



	unix_state_lock(other);



	if (sock_flag(other, SOCK_DEAD) ||

	    (other->sk_shutdown & RCV_SHUTDOWN)) {

		unix_state_unlock(other);

		kfree_skb(skb);

		return -EPIPE;

	}



	maybe_add_creds(skb, sock, other);

	skb_get(skb);



	if (ousk->oob_skb)

		kfree_skb(ousk->oob_skb);

		consume_skb(ousk->oob_skb);



	ousk->oob_skb = skb;