Michal Luczaj 772f9c31bf af_unix: Disable MSG_OOB handling for sockets in sockmap/sockhash ... [ Upstream commit 638f326043 ] AF_UNIX socket tracks the most recent OOB packet (in its receive queue) with an `oob_skb` pointer. BPF redirecting does not account for that: when an OOB packet is moved between sockets, `oob_skb` is left outdated. This results in a single skb that may be accessed from two different sockets. Take the easy way out: silently drop MSG_OOB data targeting any socket that is in a sockmap or a sockhash. Note that such silent drop is akin to the fate of redirected skb's scm_fp_list (SCM_RIGHTS, SCM_CREDENTIALS). For symmetry, forbid MSG_OOB in unix_bpf_recvmsg(). Fixes: 314001f0bf ("af_unix: Add OOB support") Suggested-by: Kuniyuki Iwashima <kuniyu@amazon.com> Signed-off-by: Michal Luczaj <mhal@rbox.co> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Tested-by: Jakub Sitnicki <jakub@cloudflare.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Link: https://lore.kernel.org/bpf/20240713200218.2140950-2-mhal@rbox.co Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-08-03 08:54:36 +02:00
..
af_unix.c	af_unix: Disable MSG_OOB handling for sockets in sockmap/sockhash	2024-08-03 08:54:36 +02:00
diag.c	af_unix: Annotate data-race of sk->sk_shutdown in sk_diag_fill().	2024-06-21 14:38:20 +02:00
garbage.c	af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().	2024-05-02 16:32:40 +02:00
Kconfig	af_unix: Kconfig: make CONFIG_UNIX bool	2023-06-12 10:45:50 +01:00
Makefile	af_unix: Implement ->psock_update_sk_prot()	2021-07-15 18:17:50 -07:00
scm.c	af_unix: Do not use atomic ops for unix_sk(sk)->inflight.	2024-04-17 11:19:32 +02:00
scm.h	net: split out functions related to registering inflight socket files	2019-02-28 08:24:23 -07:00
sysctl_net_unix.c	networking: Update to register_net_sysctl_sz	2023-08-15 15:26:18 -07:00
unix_bpf.c	af_unix: Disable MSG_OOB handling for sockets in sockmap/sockhash	2024-08-03 08:54:36 +02:00