mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-01 22:54:01 +00:00
netlink: annotate data races around dst_portid and dst_group
[ Upstream commit004db64d18
] netlink_getname(), netlink_sendmsg() and netlink_getsockbyportid() can read nlk->dst_portid and nlk->dst_group while another thread is changing them. Fixes:1da177e4c3
("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
eccb532ada
commit
8583f52c23
1 changed files with 14 additions and 9 deletions
|
@ -1082,8 +1082,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,
|
||||||
|
|
||||||
if (addr->sa_family == AF_UNSPEC) {
|
if (addr->sa_family == AF_UNSPEC) {
|
||||||
sk->sk_state = NETLINK_UNCONNECTED;
|
sk->sk_state = NETLINK_UNCONNECTED;
|
||||||
nlk->dst_portid = 0;
|
/* dst_portid and dst_group can be read locklessly */
|
||||||
nlk->dst_group = 0;
|
WRITE_ONCE(nlk->dst_portid, 0);
|
||||||
|
WRITE_ONCE(nlk->dst_group, 0);
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
if (addr->sa_family != AF_NETLINK)
|
if (addr->sa_family != AF_NETLINK)
|
||||||
|
@ -1105,8 +1106,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,
|
||||||
|
|
||||||
if (err == 0) {
|
if (err == 0) {
|
||||||
sk->sk_state = NETLINK_CONNECTED;
|
sk->sk_state = NETLINK_CONNECTED;
|
||||||
nlk->dst_portid = nladdr->nl_pid;
|
/* dst_portid and dst_group can be read locklessly */
|
||||||
nlk->dst_group = ffs(nladdr->nl_groups);
|
WRITE_ONCE(nlk->dst_portid, nladdr->nl_pid);
|
||||||
|
WRITE_ONCE(nlk->dst_group, ffs(nladdr->nl_groups));
|
||||||
}
|
}
|
||||||
|
|
||||||
return err;
|
return err;
|
||||||
|
@ -1123,8 +1125,9 @@ static int netlink_getname(struct socket *sock, struct sockaddr *addr,
|
||||||
nladdr->nl_pad = 0;
|
nladdr->nl_pad = 0;
|
||||||
|
|
||||||
if (peer) {
|
if (peer) {
|
||||||
nladdr->nl_pid = nlk->dst_portid;
|
/* Paired with WRITE_ONCE() in netlink_connect() */
|
||||||
nladdr->nl_groups = netlink_group_mask(nlk->dst_group);
|
nladdr->nl_pid = READ_ONCE(nlk->dst_portid);
|
||||||
|
nladdr->nl_groups = netlink_group_mask(READ_ONCE(nlk->dst_group));
|
||||||
} else {
|
} else {
|
||||||
/* Paired with WRITE_ONCE() in netlink_insert() */
|
/* Paired with WRITE_ONCE() in netlink_insert() */
|
||||||
nladdr->nl_pid = READ_ONCE(nlk->portid);
|
nladdr->nl_pid = READ_ONCE(nlk->portid);
|
||||||
|
@ -1154,8 +1157,9 @@ static struct sock *netlink_getsockbyportid(struct sock *ssk, u32 portid)
|
||||||
|
|
||||||
/* Don't bother queuing skb if kernel socket has no input function */
|
/* Don't bother queuing skb if kernel socket has no input function */
|
||||||
nlk = nlk_sk(sock);
|
nlk = nlk_sk(sock);
|
||||||
|
/* dst_portid can be changed in netlink_connect() */
|
||||||
if (sock->sk_state == NETLINK_CONNECTED &&
|
if (sock->sk_state == NETLINK_CONNECTED &&
|
||||||
nlk->dst_portid != nlk_sk(ssk)->portid) {
|
READ_ONCE(nlk->dst_portid) != nlk_sk(ssk)->portid) {
|
||||||
sock_put(sock);
|
sock_put(sock);
|
||||||
return ERR_PTR(-ECONNREFUSED);
|
return ERR_PTR(-ECONNREFUSED);
|
||||||
}
|
}
|
||||||
|
@ -1891,8 +1895,9 @@ static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
|
||||||
goto out;
|
goto out;
|
||||||
netlink_skb_flags |= NETLINK_SKB_DST;
|
netlink_skb_flags |= NETLINK_SKB_DST;
|
||||||
} else {
|
} else {
|
||||||
dst_portid = nlk->dst_portid;
|
/* Paired with WRITE_ONCE() in netlink_connect() */
|
||||||
dst_group = nlk->dst_group;
|
dst_portid = READ_ONCE(nlk->dst_portid);
|
||||||
|
dst_group = READ_ONCE(nlk->dst_group);
|
||||||
}
|
}
|
||||||
|
|
||||||
/* Paired with WRITE_ONCE() in netlink_insert() */
|
/* Paired with WRITE_ONCE() in netlink_insert() */
|
||||||
|
|
Loading…
Reference in a new issue