linux-stable/net
Dominique Martinet 30f3e4afe0 9p/client: fix data race on req->status
[ Upstream commit 1a4f69ef15 ]

KCSAN reported a race between writing req->status in p9_client_cb and
accessing it in p9_client_rpc's wait_event.

Accesses to req itself is protected by the data barrier (writing req
fields, write barrier, writing status // reading status, read barrier,
reading other req fields), but status accesses themselves apparently
also must be annotated properly with WRITE_ONCE/READ_ONCE when we
access it without locks.

Follows:
 - error paths writing status in various threads all can notify
p9_client_rpc, so these all also need WRITE_ONCE
 - there's a similar read loop in trans_virtio for zc case that also
needs READ_ONCE
 - other reads in trans_fd should be protected by the trans_fd lock and
lists state machine, as corresponding writers all are within trans_fd
and should be under the same lock. If KCSAN complains on them we likely
will have something else to fix as well, so it's better to leave them
unmarked and look again if required.

Link: https://lkml.kernel.org/r/20221205124756.426350-1-asmadeus@codewreck.org
Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Suggested-by: Marco Elver <elver@google.com>
Acked-by: Marco Elver <elver@google.com>
Reviewed-by: Christian Schoenebeck <linux_oss@crudebyte.com>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-01-12 12:02:36 +01:00
..
6lowpan
9p 9p/client: fix data race on req->status 2023-01-12 12:02:36 +01:00
802 mrp: introduce active flags to prevent UAF when applicant uninit 2022-12-31 13:33:02 +01:00
8021q net: gro: skb_gro_header helper function 2022-08-25 10:33:21 +02:00
appletalk
atm net/atm: fix proc_mpc_write incorrect return value 2022-10-15 11:08:36 +01:00
ax25 ax25: move from strlcpy with unused retval to strscpy 2022-08-22 17:55:50 -07:00
batman-adv Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-09-22 13:02:10 -07:00
bluetooth Bluetooth: Add quirk to disable MWS Transport Configuration 2022-12-31 13:33:05 +01:00
bpf bpf: Move skb->len == 0 checks into __bpf_redirect 2022-12-31 13:32:14 +01:00
bpfilter
bridge bridge: switchdev: Fix memory leaks when changing VLAN protocol 2022-11-15 13:38:11 +01:00
caif caif: fix memory leak in cfctrl_linkup_request() 2023-01-12 12:02:33 +01:00
can can: af_can: fix NULL pointer dereference in can_rcv_filter 2022-12-07 10:30:47 +01:00
ceph Random number generator fixes for Linux 6.1-rc1. 2022-10-16 15:27:07 -07:00
core bpf: pull before calling skb_postpull_rcsum() 2023-01-12 12:01:57 +01:00
dcb
dccp dccp/tcp: Fixup bhash2 bucket when connect() fails. 2022-11-22 20:15:37 -08:00
dns_resolver
dsa net: dsa: tag_8021q: avoid leaking ctx on dsa_tag_8021q_register() error path 2022-12-31 13:32:29 +01:00
ethernet net: gro: skb_gro_header helper function 2022-08-25 10:33:21 +02:00
ethtool ethtool: avoiding integer overflow in ethtool_phys_id() 2022-12-31 13:33:03 +01:00
hsr hsr: Synchronize sequence number updates. 2022-12-31 13:32:22 +01:00
ieee802154 net: ieee802154: fix error return code in dgram_bind() 2022-10-07 09:29:17 +02:00
ife
ipv4 net/ulp: prevent ULP without clone op from entering the LISTEN status 2023-01-12 12:02:33 +01:00
ipv6 ipv6/sit: use DEV_STATS_INC() to avoid data-races 2022-12-31 13:33:02 +01:00
iucv
kcm kcm: close race conditions on sk_receive_queue 2022-11-15 12:42:26 +01:00
key xfrm: Fix oops in __xfrm_state_delete() 2022-11-22 07:14:55 +01:00
l2tp l2tp: Don't sleep and disable BH under writer-side sk_callback_lock 2022-11-23 12:45:19 +00:00
l3mdev
lapb
llc
mac80211 wifi: mac80211: fix maybe-unused warning 2022-12-31 13:32:20 +01:00
mac802154 mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() 2022-12-05 09:53:08 +01:00
mctp mctp: Remove device type check at unregister 2022-12-31 13:32:56 +01:00
mpls net: Use u64_stats_fetch_begin_irq() for stats fetch. 2022-08-29 13:02:27 +01:00
mptcp mptcp: fix lockdep false positive 2023-01-12 12:01:58 +01:00
ncsi genetlink: start to validate reserved header bytes 2022-08-29 12:47:15 +01:00
netfilter netfilter: ipset: Rework long task execution when adding/deleting entries 2023-01-12 12:02:26 +01:00
netlabel genetlink: start to validate reserved header bytes 2022-08-29 12:47:15 +01:00
netlink genetlink: limit the use of validation workarounds to old ops 2022-10-27 08:20:21 -07:00
netrom
nfc nfc: Fix potential resource leaks 2023-01-12 12:02:03 +01:00
nsh
openvswitch openvswitch: Use kmalloc_size_roundup() to match ksize() usage 2022-12-31 13:32:59 +01:00
packet packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE 2022-11-29 08:30:18 -08:00
phonet
psample genetlink: start to validate reserved header bytes 2022-08-29 12:47:15 +01:00
qrtr net: qrtr: start MHI channel after endpoit creation 2022-08-15 11:21:42 +01:00
rds treewide: use get_random_{u8,u16}() when possible, part 2 2022-10-11 17:42:58 -06:00
rfkill
rose rose: Fix NULL pointer dereference in rose_send_frame() 2022-11-02 11:57:30 +00:00
rxrpc rxrpc: Fix missing unlock in rxrpc_do_sendmsg() 2022-12-31 13:32:55 +01:00
sched net: sched: cbq: dont intepret cls results when asked to drop 2023-01-12 12:02:24 +01:00
sctp sctp: sysctl: make extra pointers netns aware 2022-12-31 13:32:28 +01:00
smc net/smc: Fix possible leaked pernet namespace in smc_init() 2022-11-02 20:42:09 -07:00
strparser
sunrpc SUNRPC: ensure the matching upcall is in-flight upon downcall 2023-01-12 12:01:56 +01:00
switchdev
tipc tipc: call tipc_lxc_xmit without holding node_read_lock 2022-12-07 11:32:04 +01:00
tls bpf, sockmap: Fix missing BPF_F_INGRESS flag when using apply_bytes 2022-12-31 13:32:20 +01:00
unix unix: Fix race in SOCK_SEQPACKET's unix_dgram_sendmsg() 2022-12-31 13:32:54 +01:00
vmw_vsock net: vmw_vsock: vmci: Check memcpy_from_msg() 2022-12-31 13:32:26 +01:00
wireless wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails 2022-12-31 13:32:20 +01:00
x25 net/x25: Fix skb leak in x25_lapb_receive_frame() 2022-11-15 20:22:19 -08:00
xdp Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-10-03 17:44:18 -07:00
xfrm Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec 2022-11-23 19:18:59 -08:00
compat.c net: clear msg_get_inq in __get_compat_msghdr() 2022-09-20 08:23:20 -07:00
devres.c
Kconfig Remove DECnet support from kernel 2022-08-22 14:26:30 +01:00
Kconfig.debug net: make NET_(DEV|NS)_REFCNT_TRACKER depend on NET 2022-09-20 14:23:56 -07:00
Makefile Remove DECnet support from kernel 2022-08-22 14:26:30 +01:00
socket.c d_path pile 2022-10-06 16:55:41 -07:00
sysctl_net.c