Re: [PATCH net v2] unix: Fix race in SOCK_SEQPACKET's unix_dgram_sendmsg()

[Paolo Abeni <pabeni@redhat.com>]

On Sun, 2022-11-27 at 01:46 +0300, Kirill Tkhai wrote:
> There is a race resulting in alive SOCK_SEQPACKET socket
> may change its state from TCP_ESTABLISHED to TCP_CLOSE:
> 
> unix_release_sock(peer)                  unix_dgram_sendmsg(sk)
>   sock_orphan(peer)
>     sock_set_flag(peer, SOCK_DEAD)
>                                            sock_alloc_send_pskb()
>                                              if !(sk->sk_shutdown & SEND_SHUTDOWN)
>                                                OK
>                                            if sock_flag(peer, SOCK_DEAD)
>                                              sk->sk_state = TCP_CLOSE
>   sk->sk_shutdown = SHUTDOWN_MASK
> 
> 
> After that socket sk remains almost normal: it is able to connect, listen, accept
> and recvmsg, while it can't sendmsg.
> 
> Since this is the only possibility for alive SOCK_SEQPACKET to change
> the state in such way, we should better fix this strange and potentially
> danger corner case.
> 
> Also, move TCP_CLOSE assignment for SOCK_DGRAM sockets under state lock
> to fix race with unix_dgram_connect():
> 
> unix_dgram_connect(other)            unix_dgram_sendmsg(sk)
>                                        unix_peer(sk) = NULL
>                                        unix_state_unlock(sk)
>   unix_state_double_lock(sk, other)
>   sk->sk_state  = TCP_ESTABLISHED
>   unix_peer(sk) = other
>   unix_state_double_unlock(sk, other)
>                                        sk->sk_state  = TCP_CLOSED
> 
> This patch fixes both of these races.
> 
> Fixes: 83301b5367a9 ("af_unix: Set TCP_ESTABLISHED for datagram sockets too")

I don't think this commmit introduces the issues, both behavior
described above appear to be present even before?


Thank!

Paolo