korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-13 14:24:11 +08:00
Code Issues Packages Projects Releases Wiki Activity
a7cfa0af0c
linux/net/tipc
History
Eric Dumazet d0ac89f6f9 net: deal with most data-races in sk_wait_event() 
__condition is evaluated twice in sk_wait_event() macro.

First invocation is lockless, and reads can race with writes,
as spotted by syzbot.

BUG: KCSAN: data-race in sk_stream_wait_connect / tcp_disconnect

write to 0xffff88812d83d6a0 of 4 bytes by task 9065 on cpu 1:
tcp_disconnect+0x2cd/0xdb0
inet_shutdown+0x19e/0x1f0 net/ipv4/af_inet.c:911
__sys_shutdown_sock net/socket.c:2343 [inline]
__sys_shutdown net/socket.c:2355 [inline]
__do_sys_shutdown net/socket.c:2363 [inline]
__se_sys_shutdown+0xf8/0x140 net/socket.c:2361
__x64_sys_shutdown+0x31/0x40 net/socket.c:2361
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

read to 0xffff88812d83d6a0 of 4 bytes by task 9040 on cpu 0:
sk_stream_wait_connect+0x1de/0x3a0 net/core/stream.c:75
tcp_sendmsg_locked+0x2e4/0x2120 net/ipv4/tcp.c:1266
tcp_sendmsg+0x30/0x50 net/ipv4/tcp.c:1484
inet6_sendmsg+0x63/0x80 net/ipv6/af_inet6.c:651
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg net/socket.c:747 [inline]
__sys_sendto+0x246/0x300 net/socket.c:2142
__do_sys_sendto net/socket.c:2154 [inline]
__se_sys_sendto net/socket.c:2150 [inline]
__x64_sys_sendto+0x78/0x90 net/socket.c:2150
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

value changed: 0x00000000 -> 0x00000068

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-05-10 10:03:32 +01:00
..
addr.c tipc: introduce new unified address type for internal use 2021-03-17 11:51:04 -07:00
addr.h tipc: introduce new unified address type for internal use 2021-03-17 11:51:04 -07:00
bcast.c net: tipc: fix FB_MTU eat two pages 2021-06-28 13:31:57 -07:00
bcast.h tipc: update a binding service via broadcast 2020-06-17 08:53:34 -07:00
bearer.c net: rename reference+tracking helpers 2022-06-09 21:52:55 -07:00
bearer.h tipc: constify dev_addr passing 2021-10-13 09:40:46 -07:00
core.c tipc: fix use-after-free Read in tipc_named_reinit 2022-06-17 11:39:10 +01:00
core.h tipc: simplify the finalize work queue 2021-05-18 13:22:09 -07:00
crypto.c tipc: Remove completion function scaffolding 2023-02-13 18:35:15 +08:00
crypto.h net/tipc: fix tipc header files for kernel-doc 2020-12-01 15:37:41 -08:00
diag.c
discover.c treewide: Convert del_timer*() to timer_shutdown*() 2022-12-25 13:38:09 -08:00
discover.h
eth_media.c tipc: constify dev_addr passing 2021-10-13 09:40:46 -07:00
group.c tipc: update address terminology in code 2020-11-27 17:34:01 -08:00
group.h tipc: update address terminology in code 2020-11-27 17:34:01 -08:00
ib_media.c tipc: constify dev_addr passing 2021-10-13 09:40:46 -07:00
Kconfig tipc: not enable tipc when ipv6 works as a module 2020-08-16 21:04:55 -07:00
link.c tipc: Fix potential OOB in tipc_link_proto_rcv() 2022-12-06 12:58:38 +01:00
link.h tipc: simplify the finalize work queue 2021-05-18 13:22:09 -07:00
Makefile tipc: remove meaningless assignment in Makefile 2020-01-08 12:38:54 -08:00
monitor.c treewide: Convert del_timer*() to timer_shutdown*() 2022-12-25 13:38:09 -08:00
monitor.h tipc: update mon's self addr when node addr generated 2019-11-12 19:45:45 -08:00
msg.c net: tipc: replace align() with ALIGN in msg.c 2021-06-28 13:31:57 -07:00
msg.h net: tipc: remove unused static inlines 2022-01-27 13:53:27 +00:00
name_distr.c net/tipc: Remove unused struct distr_queue_item 2022-09-29 18:48:32 -07:00
name_distr.h net/tipc: fix tipc header files for kernel-doc 2020-12-01 15:37:41 -08:00
name_table.c tipc: cleanup unused function 2022-06-17 11:43:57 +01:00
name_table.h tipc: cleanup unused function 2022-06-17 11:43:57 +01:00
net.c tipc: simplify the finalize work queue 2021-05-18 13:22:09 -07:00
net.h tipc: fix a deadlock when flushing scheduled work 2020-09-07 12:08:53 -07:00
netlink_compat.c string_helpers: Move string_is_valid() to the header 2023-02-09 22:30:24 -08:00
netlink.c genetlink: start to validate reserved header bytes 2022-08-29 12:47:15 +01:00
netlink.h net: tipc: allocate attrs locally instead of using genl_family_attrbuf in compat_dumpit() 2019-10-06 15:44:47 +02:00
node.c tipc: fix unexpected link reset due to discovery messages 2023-01-06 12:53:10 +00:00
node.h tipc: add automatic session key exchange 2020-09-18 13:58:37 -07:00
socket.c net: deal with most data-races in sk_wait_event() 2023-05-10 10:03:32 +01:00
socket.h tipc: add stricter control of reserved service types 2020-10-30 08:19:18 -07:00
subscr.c tipc:subscr.c: fix a spelling mistake 2021-06-10 13:48:43 -07:00
subscr.h tipc: fix htmldoc and smatch warnings 2021-03-29 16:28:50 -07:00
sysctl.c tipc: add automatic session key exchange 2020-09-18 13:58:37 -07:00
topsrv.c net/sock: Introduce trace_sk_data_ready() 2023-01-23 11:26:50 +00:00
topsrv.h
trace.c net/tipc: fix various kernel-doc warnings 2020-12-01 15:37:46 -08:00
trace.h tipc: add support for broadcast rcv stats dumping 2020-05-26 15:16:52 -07:00
udp_media.c tipc: wait and exit until all work queues are done 2021-05-17 14:07:48 -07:00
udp_media.h