1 files changed, 33 insertions, 8 deletions

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index ef31b40ad550..955ec152cb71 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -326,9 +326,10 @@ found:
         return s;
 }
 
-static inline int unix_writable(struct sock *sk)
+static int unix_writable(const struct sock *sk)
 {
-        return (atomic_read(&sk->sk_wmem_alloc) << 2) <= sk->sk_sndbuf;
+        return sk->sk_state != TCP_LISTEN &&
+               (atomic_read(&sk->sk_wmem_alloc) << 2) <= sk->sk_sndbuf;
 }
 
 static void unix_write_space(struct sock *sk)
@@ -440,6 +441,7 @@ static void unix_release_sock(struct sock *sk, int embrion)
                 if (state == TCP_LISTEN)
                         unix_release_sock(skb->sk, 1);
                 /* passed fds are erased in the kfree_skb hook        */
+                UNIXCB(skb).consumed = skb->len;
                 kfree_skb(skb);
         }
 
@@ -1798,6 +1800,7 @@ alloc_skb:
                  * this - does no harm
                  */
                 consume_skb(newskb);
+                newskb = NULL;
         }
 
         if (skb_append_pagefrags(skb, page, offset, size)) {
@@ -1810,8 +1813,11 @@ alloc_skb:
         skb->truesize += size;
         atomic_add(size, &sk->sk_wmem_alloc);
 
-        if (newskb)
+        if (newskb) {
+                spin_lock(&other->sk_receive_queue.lock);
                 __skb_queue_tail(&other->sk_receive_queue, newskb);
+                spin_unlock(&other->sk_receive_queue.lock);
+        }
 
         unix_state_unlock(other);
         mutex_unlock(&unix_sk(other)->readlock);
@@ -2064,8 +2070,14 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state)
                 goto out;
         }
 
+        if (flags & MSG_PEEK)
+                skip = sk_peek_offset(sk, flags);
+        else
+                skip = 0;
+
         do {
                 int chunk;
+                bool drop_skb;
                 struct sk_buff *skb, *last;
 
                 unix_state_lock(sk);
@@ -2112,7 +2124,6 @@ unlock:
                         break;
                 }
 
-                skip = sk_peek_offset(sk, flags);
                 while (skip >= unix_skb_len(skb)) {
                         skip -= unix_skb_len(skb);
                         last = skb;
@@ -2147,7 +2158,11 @@ unlock:
                 }
 
                 chunk = min_t(unsigned int, unix_skb_len(skb) - skip, size);
+                skb_get(skb);
                 chunk = state->recv_actor(skb, skip, chunk, state);
+                drop_skb = !unix_skb_len(skb);
+                /* skb is only safe to use if !drop_skb */
+                consume_skb(skb);
                 if (chunk < 0) {
                         if (copied == 0)
                                 copied = -EFAULT;
@@ -2156,6 +2171,18 @@ unlock:
                 copied += chunk;
                 size -= chunk;
 
+                if (drop_skb) {
+                        /* the skb was touched by a concurrent reader;
+                         * we should not expect anything from this skb
+                         * anymore and assume it invalid - we can be
+                         * sure it was dropped from the socket queue
+                         *
+                         * let's report a short read
+                         */
+                        err = 0;
+                        break;
+                }
+
                 /* Mark read part of skb as used */
                 if (!(flags & MSG_PEEK)) {
                         UNIXCB(skb).consumed += chunk;
@@ -2179,14 +2206,12 @@ unlock:
                         if (UNIXCB(skb).fp)
                                 scm.fp = scm_fp_dup(UNIXCB(skb).fp);
 
-                        if (skip) {
-                                sk_peek_offset_fwd(sk, chunk);
-                                skip -= chunk;
-                        }
+                        sk_peek_offset_fwd(sk, chunk);
 
                         if (UNIXCB(skb).fp)
                                 break;
 
+                        skip = 0;
                         last = skb;
                         last_len = skb->len;
                         unix_state_lock(sk);