diff options
| author | Eric Dumazet <edumazet@google.com> | 2024-01-22 11:25:55 +0000 |
|---|---|---|
| committer | Sasha Levin <sashal@kernel.org> | 2024-03-26 18:22:35 -0400 |
| commit | cffd4a7c975848e2bb7c577e5c814a0d2bc9efd4 (patch) | |
| tree | 55186ce0d2fcb8408189f3a536f66229fa0c55c1 /net/core | |
| parent | 1e68b5319090ee3f810580c059a202ec8b24bdbe (diff) | |
| download | linux-stable-cffd4a7c975848e2bb7c577e5c814a0d2bc9efd4.tar.gz linux-stable-cffd4a7c975848e2bb7c577e5c814a0d2bc9efd4.tar.bz2 linux-stable-cffd4a7c975848e2bb7c577e5c814a0d2bc9efd4.zip | |
sock_diag: annotate data-races around sock_diag_handlers[family]
[ Upstream commit efd402537673f9951992aea4ef0f5ff51d858f4b ]
__sock_diag_cmd() and sock_diag_bind() read sock_diag_handlers[family]
without a lock held.
Use READ_ONCE()/WRITE_ONCE() annotations to avoid potential issues.
Fixes: 8ef874bfc729 ("sock_diag: Move the sock_ code to net/core/")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Guillaume Nault <gnault@redhat.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net/core')
| -rw-r--r-- | net/core/sock_diag.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c index 3312a5849a97..980a2d465062 100644 --- a/net/core/sock_diag.c +++ b/net/core/sock_diag.c @@ -187,7 +187,7 @@ int sock_diag_register(const struct sock_diag_handler *hndl) if (sock_diag_handlers[hndl->family]) err = -EBUSY; else - sock_diag_handlers[hndl->family] = hndl; + WRITE_ONCE(sock_diag_handlers[hndl->family], hndl); mutex_unlock(&sock_diag_table_mutex); return err; @@ -203,7 +203,7 @@ void sock_diag_unregister(const struct sock_diag_handler *hnld) mutex_lock(&sock_diag_table_mutex); BUG_ON(sock_diag_handlers[family] != hnld); - sock_diag_handlers[family] = NULL; + WRITE_ONCE(sock_diag_handlers[family], NULL); mutex_unlock(&sock_diag_table_mutex); } EXPORT_SYMBOL_GPL(sock_diag_unregister); @@ -221,7 +221,7 @@ static int __sock_diag_cmd(struct sk_buff *skb, struct nlmsghdr *nlh) return -EINVAL; req->sdiag_family = array_index_nospec(req->sdiag_family, AF_MAX); - if (sock_diag_handlers[req->sdiag_family] == NULL) + if (READ_ONCE(sock_diag_handlers[req->sdiag_family]) == NULL) sock_load_diag_module(req->sdiag_family, 0); mutex_lock(&sock_diag_table_mutex); @@ -280,12 +280,12 @@ static int sock_diag_bind(struct net *net, int group) switch (group) { case SKNLGRP_INET_TCP_DESTROY: case SKNLGRP_INET_UDP_DESTROY: - if (!sock_diag_handlers[AF_INET]) + if (!READ_ONCE(sock_diag_handlers[AF_INET])) sock_load_diag_module(AF_INET, 0); break; case SKNLGRP_INET6_TCP_DESTROY: case SKNLGRP_INET6_UDP_DESTROY: - if (!sock_diag_handlers[AF_INET6]) + if (!READ_ONCE(sock_diag_handlers[AF_INET6])) sock_load_diag_module(AF_INET6, 0); break; } |