[Devel] [PATCH RHEL7 COMMIT] ms/af_unix: Guard against other == sk in unix_dgram_sendmsg

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-327.10.1.vz7.12.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-327.10.1.vz7.12.2
------>
commit e96bb37b9bcba3e36dae57d1ef6b5180c4d7a57c
Author: Rainer Weikusat <rweikusat at mobileactivedefense.com>
Date:   Wed Mar 16 14:08:10 2016 +0400

    ms/af_unix: Guard against other == sk in unix_dgram_sendmsg
    
    ms commit: a5527dda344fff0514b7989ef7a755729769daa1
    ("af_unix: Guard against other == sk in unix_dgram_sendmsg")
    
        The unix_dgram_sendmsg routine use the following test
    
        if (unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {
    
        to determine if sk and other are in an n:1 association (either
        established via connect or by using sendto to send messages to an
        unrelated socket identified by address). This isn't correct as the
        specified address could have been bound to the sending socket itself or
        because this socket could have been connected to itself by the time of
        the unix_peer_get but disconnected before the unix_state_lock(other). In
        both cases, the if-block would be entered despite other == sk which
        might either block the sender unintentionally or lead to trying to unlock
        the same spin lock twice for a non-blocking send. Add a other != sk
        check to guard against this.
    
        Fixes: 7d267278a9ec ("unix: avoid use-after-free in ep_remove_wait_queue")
        Reported-By: Philipp Hahn <pmhahn at pmhahn.de>
        Signed-off-by: Rainer Weikusat <rweikusat at mobileactivedefense.com>
        Tested-by: Philipp Hahn <pmhahn at pmhahn.de>
        Signed-off-by: David S. Miller <davem at davemloft.net>
    
    https://access.redhat.com/solutions/2176521
    https://jira.sw.ru/browse/PSBM-43080
    
    Signed-off-by: Vasily Averin <vvs at virtuozzo.com>
---
 net/unix/af_unix.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index d64141f..0e629f5 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1711,7 +1711,12 @@ restart_locked:
 			goto out_unlock;
 	}
 
-	if (unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {
+	/* other == sk && unix_peer(other) != sk if
+	 * - unix_peer(sk) == NULL, destination address bound to sk
+	 * - unix_peer(sk) == sk by time of get but disconnected before lock
+	 */
+	if (other != sk &&
+	    unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {
 		if (timeo) {
 			timeo = unix_wait_for_peer(other, timeo);