TechPanelGM/kernel_xiaomi_sm8250
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sock_diag: annotate data-races around sock_diag_handlers[family]

Browse Source 
[ Upstream commit efd402537673f9951992aea4ef0f5ff51d858f4b ]

__sock_diag_cmd() and sock_diag_bind() read sock_diag_handlers[family]
without a lock held.

Use READ_ONCE()/WRITE_ONCE() annotations to avoid potential issues.

Fixes: 8ef874bfc7 ("sock_diag: Move the sock_ code to net/core/")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Guillaume Nault <gnault@redhat.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Eric Dumazet
2024-01-22 11:25:55 +00:00
committed by Sasha Levin
parent 1e68b53190
commit cffd4a7c97
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
net/core/sock_diag.c
View File

@@ -187,7 +187,7 @@ int sock_diag_register(const struct sock_diag_handler *hndl)
if (sock_diag_handlers[hndl->family]) if (sock_diag_handlers[hndl->family])
err = -EBUSY; err = -EBUSY;
else else
sock_diag_handlers[hndl->family] = hndl; WRITE_ONCE(sock_diag_handlers[hndl->family], hndl);
mutex_unlock(&sock_diag_table_mutex); mutex_unlock(&sock_diag_table_mutex);
return err; return err;
@@ -203,7 +203,7 @@ void sock_diag_unregister(const struct sock_diag_handler *hnld)
mutex_lock(&sock_diag_table_mutex); mutex_lock(&sock_diag_table_mutex);
BUG_ON(sock_diag_handlers[family] != hnld); BUG_ON(sock_diag_handlers[family] != hnld);
sock_diag_handlers[family] = NULL; WRITE_ONCE(sock_diag_handlers[family], NULL);
mutex_unlock(&sock_diag_table_mutex); mutex_unlock(&sock_diag_table_mutex);
} }
EXPORT_SYMBOL_GPL(sock_diag_unregister); EXPORT_SYMBOL_GPL(sock_diag_unregister);
@@ -221,7 +221,7 @@ static int __sock_diag_cmd(struct sk_buff *skb, struct nlmsghdr *nlh)
return -EINVAL; return -EINVAL;
req->sdiag_family = array_index_nospec(req->sdiag_family, AF_MAX); req->sdiag_family = array_index_nospec(req->sdiag_family, AF_MAX);
if (sock_diag_handlers[req->sdiag_family] == NULL) if (READ_ONCE(sock_diag_handlers[req->sdiag_family]) == NULL)
sock_load_diag_module(req->sdiag_family, 0); sock_load_diag_module(req->sdiag_family, 0);
mutex_lock(&sock_diag_table_mutex); mutex_lock(&sock_diag_table_mutex);
@@ -280,12 +280,12 @@ static int sock_diag_bind(struct net *net, int group)
switch (group) { switch (group) {
case SKNLGRP_INET_TCP_DESTROY: case SKNLGRP_INET_TCP_DESTROY:
case SKNLGRP_INET_UDP_DESTROY: case SKNLGRP_INET_UDP_DESTROY:
if (!sock_diag_handlers[AF_INET]) if (!READ_ONCE(sock_diag_handlers[AF_INET]))
sock_load_diag_module(AF_INET, 0); sock_load_diag_module(AF_INET, 0);
break; break;
case SKNLGRP_INET6_TCP_DESTROY: case SKNLGRP_INET6_TCP_DESTROY:
case SKNLGRP_INET6_UDP_DESTROY: case SKNLGRP_INET6_UDP_DESTROY:
if (!sock_diag_handlers[AF_INET6]) if (!READ_ONCE(sock_diag_handlers[AF_INET6]))
sock_load_diag_module(AF_INET6, 0); sock_load_diag_module(AF_INET6, 0);
break; break;
} }