tree aae1c5f147dc2e0ba571453c205cbb1ffbb3af99
parent e32d008da8e2cc1941ec0252a9662b1257cf20d6
author Miklos Szeredi <mszeredi@redhat.com> 1627476440 +0200
committer Karsten Tausche <karsten@fairphone.com> 1634054545 +0200

af_unix: fix garbage collect vs MSG_PEEK

commit cbcf01128d0a92e131bd09f1688fe032480b65ca upstream.

unix_gc() assumes that candidate sockets can never gain an external
reference (i.e.  be installed into an fd) while the unix_gc_lock is
held.  Except for MSG_PEEK this is guaranteed by modifying inflight
count under the unix_gc_lock.

MSG_PEEK does not touch any variable protected by unix_gc_lock (file
count is not), yet it needs to be serialized with garbage collection.
Do this by locking/unlocking unix_gc_lock:

 1) increment file count

 2) lock/unlock barrier to make sure incremented file count is visible
    to garbage collection

 3) install file into fd

This is a lock barrier (unlike smp_mb()) that ensures that garbage
collection is run completely before or completely after the barrier.

Cc: <stable@vger.kernel.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Issue: FP3SEC-122
(cherry picked from commit a805a7bd94644207d762d9c287078fecfcf52b3e)
Change-Id: I905b16f8d08324541f3281427d3f633bc5373769