tree f3970b352bbc51d5c81bc86f8b23ebe0151ae107
parent f19406b09f4f0ae9c1e60f5ad29aa6f76c559e14
author Miklos Szeredi <mszeredi@redhat.com> 1627476440 +0200
committer Bharath <bharath@teamb58.org> 1639163404 +0530

af_unix: fix garbage collect vs MSG_PEEK

commit cbcf01128d0a92e131bd09f1688fe032480b65ca upstream.

unix_gc() assumes that candidate sockets can never gain an external
reference (i.e.  be installed into an fd) while the unix_gc_lock is
held.  Except for MSG_PEEK this is guaranteed by modifying inflight
count under the unix_gc_lock.

MSG_PEEK does not touch any variable protected by unix_gc_lock (file
count is not), yet it needs to be serialized with garbage collection.
Do this by locking/unlocking unix_gc_lock:

 1) increment file count

 2) lock/unlock barrier to make sure incremented file count is visible
    to garbage collection

 3) install file into fd

This is a lock barrier (unlike smp_mb()) that ensures that garbage
collection is run completely before or completely after the barrier.

Cc: <stable@vger.kernel.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Issue: FP3SEC-122
(cherry picked from commit a805a7bd94644207d762d9c287078fecfcf52b3e)
Change-Id: I905b16f8d08324541f3281427d3f633bc5373769
(cherry picked from commit 97106c23a056b030778b59b5231fcf56e3634f42)