Eric Dumazet 1ded5e5a59 net: annotate data-races around sock->ops ... IPV6_ADDRFORM socket option is evil, because it can change sock->ops while other threads might read it. Same issue for sk->sk_family being set to AF_INET. Adding READ_ONCE() over sock->ops reads is needed for sockets that might be impacted by IPV6_ADDRFORM. Note that mptcp_is_tcpsk() can also overwrite sock->ops. Adding annotations for all sk->sk_family reads will require more patches :/ BUG: KCSAN: data-race in ____sys_sendmsg / do_ipv6_setsockopt write to 0xffff888109f24ca0 of 8 bytes by task 4470 on cpu 0: do_ipv6_setsockopt+0x2c5e/0x2ce0 net/ipv6/ipv6_sockglue.c:491 ipv6_setsockopt+0x57/0x130 net/ipv6/ipv6_sockglue.c:1012 udpv6_setsockopt+0x95/0xa0 net/ipv6/udp.c:1690 sock_common_setsockopt+0x61/0x70 net/core/sock.c:3663 __sys_setsockopt+0x1c3/0x230 net/socket.c:2273 __do_sys_setsockopt net/socket.c:2284 [inline] __se_sys_setsockopt net/socket.c:2281 [inline] __x64_sys_setsockopt+0x66/0x80 net/socket.c:2281 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffff888109f24ca0 of 8 bytes by task 4469 on cpu 1: sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] ____sys_sendmsg+0x349/0x4c0 net/socket.c:2503 ___sys_sendmsg net/socket.c:2557 [inline] __sys_sendmmsg+0x263/0x500 net/socket.c:2643 __do_sys_sendmmsg net/socket.c:2672 [inline] __se_sys_sendmmsg net/socket.c:2669 [inline] __x64_sys_sendmmsg+0x57/0x60 net/socket.c:2669 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0xffffffff850e32b8 -> 0xffffffff850da890 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 4469 Comm: syz-executor.1 Not tainted 6.4.0-rc5-syzkaller-00313-g4c605260bc60 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Link: https://lore.kernel.org/r/20230808135809.2300241-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2023-08-09 15:32:43 -07:00
..
client.c	9p: remove dead stores (variable set again without being read)	2023-07-20 19:14:50 +00:00
error.c	9p: fix a bunch of checkpatch warnings	2021-11-04 21:04:25 +09:00
Kconfig	9p: Remove INET dependency	2023-05-04 21:46:57 +01:00
Makefile	9p/trans_fd: split into dedicated module	2022-01-10 09:58:30 +09:00
mod.c	net/p9: load default transports	2022-01-10 10:00:09 +09:00
protocol.c	net/9p: add p9_msg_buf_size()	2022-10-05 07:05:41 +09:00
protocol.h	net/9p: add p9_msg_buf_size()	2022-10-05 07:05:41 +09:00
trans_common.c	9p: fix file headers	2021-11-03 17:45:04 +09:00
trans_common.h	9p: fix a bunch of checkpatch warnings	2021-11-04 21:04:25 +09:00
trans_fd.c	net: annotate data-races around sock->ops	2023-08-09 15:32:43 -07:00
trans_rdma.c	9p/rdma: unmap receive dma buffer in rdma_request()/post_recv()	2023-02-24 13:42:28 +00:00
trans_virtio.c	9p: virtio: skip incrementing unused variable	2023-07-20 19:14:50 +00:00
trans_xen.c	9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition	2023-04-02 01:00:31 +00:00