lkml.org 
[lkml]   [2021]   [Jul]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.19 03/11] net: annotate data race around sk_ll_usec
    Date
    From: Eric Dumazet <edumazet@google.com>

    [ Upstream commit 0dbffbb5335a1e3aa6855e4ee317e25e669dd302 ]

    sk_ll_usec is read locklessly from sk_can_busy_loop()
    while another thread can change its value in sock_setsockopt()

    This is correct but needs annotations.

    BUG: KCSAN: data-race in __skb_try_recv_datagram / sock_setsockopt

    write to 0xffff88814eb5f904 of 4 bytes by task 14011 on cpu 0:
    sock_setsockopt+0x1287/0x2090 net/core/sock.c:1175
    __sys_setsockopt+0x14f/0x200 net/socket.c:2100
    __do_sys_setsockopt net/socket.c:2115 [inline]
    __se_sys_setsockopt net/socket.c:2112 [inline]
    __x64_sys_setsockopt+0x62/0x70 net/socket.c:2112
    do_syscall_64+0x4a/0x90 arch/x86/entry/common.c:47
    entry_SYSCALL_64_after_hwframe+0x44/0xae

    read to 0xffff88814eb5f904 of 4 bytes by task 14001 on cpu 1:
    sk_can_busy_loop include/net/busy_poll.h:41 [inline]
    __skb_try_recv_datagram+0x14f/0x320 net/core/datagram.c:273
    unix_dgram_recvmsg+0x14c/0x870 net/unix/af_unix.c:2101
    unix_seqpacket_recvmsg+0x5a/0x70 net/unix/af_unix.c:2067
    ____sys_recvmsg+0x15d/0x310 include/linux/uio.h:244
    ___sys_recvmsg net/socket.c:2598 [inline]
    do_recvmmsg+0x35c/0x9f0 net/socket.c:2692
    __sys_recvmmsg net/socket.c:2771 [inline]
    __do_sys_recvmmsg net/socket.c:2794 [inline]
    __se_sys_recvmmsg net/socket.c:2787 [inline]
    __x64_sys_recvmmsg+0xcf/0x150 net/socket.c:2787
    do_syscall_64+0x4a/0x90 arch/x86/entry/common.c:47
    entry_SYSCALL_64_after_hwframe+0x44/0xae

    value changed: 0x00000000 -> 0x00000101

    Reported by Kernel Concurrency Sanitizer on:
    CPU: 1 PID: 14001 Comm: syz-executor.3 Not tainted 5.13.0-syzkaller #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Reported-by: syzbot <syzkaller@googlegroups.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    include/net/busy_poll.h | 2 +-
    net/core/sock.c | 2 +-
    2 files changed, 2 insertions(+), 2 deletions(-)

    diff --git a/include/net/busy_poll.h b/include/net/busy_poll.h
    index cf8f792743ec..c76a5e9894da 100644
    --- a/include/net/busy_poll.h
    +++ b/include/net/busy_poll.h
    @@ -48,7 +48,7 @@ static inline bool net_busy_loop_on(void)

    static inline bool sk_can_busy_loop(const struct sock *sk)
    {
    - return sk->sk_ll_usec && !signal_pending(current);
    + return READ_ONCE(sk->sk_ll_usec) && !signal_pending(current);
    }

    bool sk_busy_loop_end(void *p, unsigned long start_time);
    diff --git a/net/core/sock.c b/net/core/sock.c
    index e6cbe137cb6f..956af38aa0d6 100644
    --- a/net/core/sock.c
    +++ b/net/core/sock.c
    @@ -989,7 +989,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
    if (val < 0)
    ret = -EINVAL;
    else
    - sk->sk_ll_usec = val;
    + WRITE_ONCE(sk->sk_ll_usec, val);
    }
    break;
    #endif
    --
    2.30.2
    \
     
     \ /
      Last update: 2021-07-23 06:00    [W:3.331 / U:0.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site