From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-lj1-f169.google.com (mail-lj1-f169.google.com [209.85.208.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B00F72D9780 for ; Wed, 24 Jun 2026 12:16:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782303386; cv=none; b=mw6WG18R5EYFiKJ3XbyAVyFPRtwN7JviUF5A/9sX3ktfcPzPzLrGN+cCttD1/fSuMlLwwFWWPo19M2seWNbb727Ki/Um/p02EE5+T0+vy1bXO23+A61/fKpIaA5pRTGyBLn4QKLkFKewyJVJNKTvT2qoUDgPVC1B+B0+NYmC1UA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782303386; c=relaxed/simple; bh=8mTZuUoiyhNRN3gTKiUmzENom/VFrrl5XjY2DI/t9pU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=BBI1s/qnE8R+mim2+4NggOydBAWKrsW9N1FhCPwHNe4HM3Qp9MosrewhVlqAHXXj8ISZb8XvYTS31y69MqlwfL81ui7M+Lbgkp/a5THVvJ7WumjCpgcdCoeLt9UtTGjuL50bq91ZXurEBalzk9+OeUedpMa6JO9JccJlWdz4bTs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=V2raHcm4; arc=none smtp.client-ip=209.85.208.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="V2raHcm4" Received: by mail-lj1-f169.google.com with SMTP id 38308e7fff4ca-399389dae7fso10076231fa.0 for ; Wed, 24 Jun 2026 05:16:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782303383; x=1782908183; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=ZWN+ktVTYkpSQqdNFGaR2EYDD+puHcc21cFbcKJgBfs=; b=V2raHcm4aq59i6qi0YfjMaqw8TXp1JbHv1JaNVBJ1C0bXP7+3dHBVRQqMBY0KHnvMm AkG+HFYcLqUUWHwx6Ch0UQEWHrMch9cq/7r1ANOBfHHgpPQPLZSa7kQgD+XCS8rW2QFZ jO1H2gIPQwJmogZ1qKqrSIX9k/VrTj8zNA5ll/vaw8fEoYF1VoG129P0Ayq1mYKXdk3+ pXm948Uir2MbhKX1PCUySlzsLAQBHYuytszwn91cmxfRX0tKzwy3Irt0hHiPmyjbwVaT XI9Jt/Rm1oyumHGhgOCN8c1FBXaOvtm4XIWMGeJPw9TJUD5Nmrn0d5jO6QJQi/50LnSD 8ddA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782303383; x=1782908183; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=ZWN+ktVTYkpSQqdNFGaR2EYDD+puHcc21cFbcKJgBfs=; b=HntJ/8/GqqDG0pNophb8djhB36geo7rQao/OKewsq/zkjJf6uIhjRLYrZNcejHZUaf M4DTgQjwO1Yp3BFeswFXHYP76QEjt6TiGbXBJT2NwC+pkJagUfgs8SVq2PKMRza1fL2H Ex0sus4A0vLNzpeHeMwldHcLSBV4plrIok9hjl4GSi+c3DFe3Z4DWeKqWczZ/7PKi4uA 4hnCcIlGkXuBcx0H/WYFpXxG0Uur0yDZ9cDhno8goLukZ4ZKuh7fyR0J44aBt33Rv+ts B0LzJkXHQFn1YAsvErj1r9VBUW2UxFzo98qsLnxIF867/dj/n3J3XH8gPPNrvH2zgRB9 gi5A== X-Forwarded-Encrypted: i=1; AHgh+RrnqDWZNhh1czTcJfPjwo4hWFI4vJsAu1M4Bv3S5MJ3lTUVIidzszeF1RvqFRNMSIrzGFhlcMi+JVVI7Qo=@vger.kernel.org X-Gm-Message-State: AOJu0Yw9WmrY33+5P0kALUMYswOkqEPYVJWZBCmqm3Y1m5MTNweOlNWs Ji2dz758s126YWt0J0K7RZtWhektIt4xi5GAPawrI1duw7hfIQw3XJuY X-Gm-Gg: AfdE7cleAZfv0kcDC9MeAospQjnmeCI7FYreBuEmi/P8AfIHFqOnk04sYReGHwuzcLR DfGuiPoGmHuFMEvvYkZyRuscj/s+o3DtRFrVSkKYJZQx+7TKOajJa9y/W/uP7v1ZpYxm7W2826c jnp1v93y8Hn5SV0ZeW0rMTLfLQton7i4FiQt3eIsM8u/rg6a9HmYkF2mPuX8noWnzAdfPE6EM74 FtGKO+ivpYRXj44JajyZyYxBPoPeMudJXgGhhw/jzQeH8mJZhhoWMmKx7PBB7AOX+fPyaRjB8kG SgRHvG8x+MFHbTb2mlLNJv8ILJDSoiP27LSEWEYW79sACYtO2ofipyT27SUx4welol/fIfRX3Jp i2wWyFAVAN2cYR2qUGUhz9+MZ7FEfxq9Vgpd36ihxYLABW09qiKR5kCfQatpg4qq+cCG7EN8qOJ oONPSM7uFJTNf3O1sq2erAER156sYY X-Received: by 2002:a2e:a913:0:b0:38e:8357:c5ae with SMTP id 38308e7fff4ca-39ac25ddbedmr400571fa.9.1782303382591; Wed, 24 Jun 2026 05:16:22 -0700 (PDT) Received: from grower.astra-academy.ru ([185.32.135.49]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-3999b156f23sm33089191fa.27.2026.06.24.05.16.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 24 Jun 2026 05:16:22 -0700 (PDT) From: Alexander Martyniuk To: stable@vger.kernel.org, Greg Kroah-Hartman Cc: Alexander Martyniuk , "David S. Miller" , Jakub Kicinski , Paolo Abeni , Kuniyuki Iwashima , Jann Horn , Lee Jones , Sasha Levin , Rao Shoaib , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, stable@kernel.org, Yuan Tan , Yifan Wu , Juefei Pu , Xin Liu , Jiexun Wang , Ren Wei Subject: [PATCH 5.15/6.1/6.6] af_unix: Reject SIOCATMARK on non-stream sockets Date: Wed, 24 Jun 2026 15:16:48 +0000 Message-ID: <20260624151651.38894-1-alexevgmart@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Jiexun Wang commit d119775f2bad827edc28071c061fdd4a91f889a5 upstream. SIOCATMARK reports whether the receive queue is at the urgent mark for MSG_OOB. In AF_UNIX, MSG_OOB is supported only for SOCK_STREAM sockets. SOCK_DGRAM and SOCK_SEQPACKET reject MSG_OOB in sendmsg() and recvmsg(), so they should not support SIOCATMARK either. Return -EOPNOTSUPP for non-stream sockets before checking the receive queue. Fixes: 314001f0bf92 ("af_unix: Add OOB support") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Suggested-by: Kuniyuki Iwashima Signed-off-by: Jiexun Wang Signed-off-by: Ren Wei Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260506140825.2987635-1-n05ec@lzu.edu.cn Signed-off-by: Jakub Kicinski Signed-off-by: Alexander Martyniuk --- Backport fix for CVE-2026-52928 net/unix/af_unix.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index 32892a40d139..8bd78cad69e7 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -3139,6 +3139,9 @@ static int unix_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) struct sk_buff *skb; int answ = 0; + if (sk->sk_type != SOCK_STREAM) + return -EOPNOTSUPP; + skb = skb_peek(&sk->sk_receive_queue); if (skb && skb == READ_ONCE(unix_sk(sk)->oob_skb)) answ = 1; -- 2.43.0