mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-04 08:08:54 +00:00
Code Issues Releases Wiki Activity

unix_bpf: Fix a potential deadlock in unix_dgram_bpf_recvmsg()

Browse source 
As Eric noticed, __unix_dgram_recvmsg() may acquire u->iolock
too, so we have to release it before calling this function.

Fixes: 9825d866ce ("af_unix: Implement unix_dgram_bpf_recvmsg()")
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Cong Wang <cong.wang@bytedance.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Jakub Sitnicki <jakub@cloudflare.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
This commit is contained in:
Cong Wang 2021-07-23 11:36:30 -07:00 committed by Andrii Nakryiko
parent a710eed386
commit 0b84644598
1 changed files with 8 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
net/unix/unix_bpf.c
View file

@ -44,7 +44,7 @@ static int unix_dgram_bpf_recvmsg(struct sock *sk, struct msghdr *msg,
{
struct unix_sock *u = unix_sk(sk);
struct sk_psock *psock;
int copied, ret;
int copied;
psock = sk_psock_get(sk);
if (unlikely(!psock))
@ -53,8 +53,9 @@ static int unix_dgram_bpf_recvmsg(struct sock *sk, struct msghdr *msg,
mutex_lock(&u->iolock);
if (!skb_queue_empty(&sk->sk_receive_queue) &&
sk_psock_queue_empty(psock)) {
ret = __unix_dgram_recvmsg(sk, msg, len, flags);
goto out;
mutex_unlock(&u->iolock);
sk_psock_put(sk, psock);
return __unix_dgram_recvmsg(sk, msg, len, flags);
}
msg_bytes_ready:
@ -68,16 +69,15 @@ static int unix_dgram_bpf_recvmsg(struct sock *sk, struct msghdr *msg,
if (data) {
if (!sk_psock_queue_empty(psock))
goto msg_bytes_ready;
ret = __unix_dgram_recvmsg(sk, msg, len, flags);
goto out;
mutex_unlock(&u->iolock);
sk_psock_put(sk, psock);
return __unix_dgram_recvmsg(sk, msg, len, flags);
}
copied = -EAGAIN;
}
ret = copied;
out:
mutex_unlock(&u->iolock);
sk_psock_put(sk, psock);
return ret;
return copied;
}
static struct proto *unix_prot_saved __read_mostly;