mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/net/llc
History
Eric Dumazet a21fb2be5d net: deal with most data-races in sk_wait_event() 
[ Upstream commit d0ac89f6f9 ]

__condition is evaluated twice in sk_wait_event() macro.

First invocation is lockless, and reads can race with writes,
as spotted by syzbot.

BUG: KCSAN: data-race in sk_stream_wait_connect / tcp_disconnect

write to 0xffff88812d83d6a0 of 4 bytes by task 9065 on cpu 1:
tcp_disconnect+0x2cd/0xdb0
inet_shutdown+0x19e/0x1f0 net/ipv4/af_inet.c:911
__sys_shutdown_sock net/socket.c:2343 [inline]
__sys_shutdown net/socket.c:2355 [inline]
__do_sys_shutdown net/socket.c:2363 [inline]
__se_sys_shutdown+0xf8/0x140 net/socket.c:2361
__x64_sys_shutdown+0x31/0x40 net/socket.c:2361
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

read to 0xffff88812d83d6a0 of 4 bytes by task 9040 on cpu 0:
sk_stream_wait_connect+0x1de/0x3a0 net/core/stream.c:75
tcp_sendmsg_locked+0x2e4/0x2120 net/ipv4/tcp.c:1266
tcp_sendmsg+0x30/0x50 net/ipv4/tcp.c:1484
inet6_sendmsg+0x63/0x80 net/ipv6/af_inet6.c:651
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg net/socket.c:747 [inline]
__sys_sendto+0x246/0x300 net/socket.c:2142
__do_sys_sendto net/socket.c:2154 [inline]
__se_sys_sendto net/socket.c:2150 [inline]
__x64_sys_sendto+0x78/0x90 net/socket.c:2150
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

value changed: 0x00000000 -> 0x00000068

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2023-05-24 17:29:59 +01:00
..
Kconfig net: remove redundant 'depends on NET' 2021-01-27 17:04:12 -08:00
Makefile llc: fix whitespace issues 2018-07-24 14:10:42 -07:00
af_llc.c net: deal with most data-races in sk_wait_event() 2023-05-24 17:29:59 +01:00
llc_c_ac.c llc/snap: constify dev_addr passing 2021-10-13 09:40:46 -07:00
llc_c_ev.c net: llc: Correct some function names in header 2021-03-26 15:24:14 -07:00
llc_c_st.c llc: Make llc_conn_ev_qfyr_t function pointer arrays const 2014-12-10 15:21:24 -05:00
llc_conn.c net: llc: Fix kerneldoc warnings 2020-10-30 11:34:09 -07:00
llc_core.c llc: llc_core.c: COuple of typo fixes 2021-03-28 17:31:13 -07:00
llc_if.c llc/snap: constify dev_addr passing 2021-10-13 09:40:46 -07:00
llc_input.c net: llc: kerneldoc fixes 2020-07-13 17:20:39 -07:00
llc_output.c llc/snap: constify dev_addr passing 2021-10-13 09:40:46 -07:00
llc_pdu.c net: llc: Correct function name llc_pdu_set_pf_bit() in header 2021-03-26 15:24:14 -07:00
llc_proc.c sock: Use sock_owned_by_user_nocheck() instead of sk_lock.owned. 2021-12-10 19:43:00 -08:00
llc_s_ac.c net: llc: fix skb_over_panic 2021-07-27 13:05:56 +01:00
llc_s_ev.c
…
llc_s_st.c llc: Make llc_sap_action_t function pointer arrays const 2014-12-10 15:21:24 -05:00
llc_sap.c net: llc: kerneldoc fixes 2020-07-13 17:20:39 -07:00
llc_station.c llc2: Remove redundant assignment to rc 2021-04-27 14:16:14 -07:00
sysctl_net_llc.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00