Messages in this thread Patch in this message | | | From | Kuniyuki Iwashima <> | Subject | [PATCH v1 net 14/16] cipso: Fix data-races around boolean sysctl. | Date | Tue, 5 Jul 2022 22:21:28 -0700 |
| |
While reading sysctl variables, they can be changed concurrently. So, we need to add READ_ONCE(). Then we can set lockless variants as the handler to mark it safe.
Also, these sysctl knob are boolean, so this patch changes their int handler to boolean one.
- cipso_v4_cache_enabled - cipso_v4_rbm_optfmt - cipso_v4_rbm_strictvalid
Fixes: 446fda4f2682 ("[NetLabel]: CIPSOv4 engine") Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> --- CC: Paul Moore <paul.moore@hp.com> --- net/ipv4/cipso_ipv4.c | 9 +++++---- net/ipv4/sysctl_net_ipv4.c | 6 +++--- 2 files changed, 8 insertions(+), 7 deletions(-)
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c index 0600e9b06e1a..2756170e470f 100644 --- a/net/ipv4/cipso_ipv4.c +++ b/net/ipv4/cipso_ipv4.c @@ -239,7 +239,7 @@ static int cipso_v4_cache_check(const unsigned char *key, struct cipso_v4_map_cache_entry *prev_entry = NULL; u32 hash; - if (!cipso_v4_cache_enabled) + if (!READ_ONCE(cipso_v4_cache_enabled)) return -ENOENT; hash = cipso_v4_map_cache_hash(key, key_len); @@ -302,7 +302,7 @@ int cipso_v4_cache_add(const unsigned char *cipso_ptr, u32 bkt, cipso_ptr_len; int ret_val = -EPERM; - if (!cipso_v4_cache_enabled || bkt_size <= 0) + if (!READ_ONCE(cipso_v4_cache_enabled) || bkt_size <= 0) return 0; cipso_ptr_len = cipso_ptr[1]; @@ -1199,7 +1199,8 @@ static int cipso_v4_gentag_rbm(const struct cipso_v4_doi *doi_def, /* This will send packets using the "optimized" format when * possible as specified in section 3.4.2.6 of the * CIPSO draft. */ - if (cipso_v4_rbm_optfmt && ret_val > 0 && ret_val <= 10) + if (READ_ONCE(cipso_v4_rbm_optfmt) && ret_val > 0 && + ret_val <= 10) tag_len = 14; else tag_len = 4 + ret_val; @@ -1603,7 +1604,7 @@ int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option) * all the CIPSO validations here but it doesn't * really specify _exactly_ what we need to validate * ... so, just make it a sysctl tunable. */ - if (cipso_v4_rbm_strictvalid) { + if (READ_ONCE(cipso_v4_rbm_strictvalid)) { if (cipso_v4_map_lvl_valid(doi_def, tag[3]) < 0) { err_offset = opt_iter + 3; diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c index 5cd32b33bbac..706795a3b369 100644 --- a/net/ipv4/sysctl_net_ipv4.c +++ b/net/ipv4/sysctl_net_ipv4.c @@ -520,7 +520,7 @@ static struct ctl_table ipv4_table[] = { .data = &cipso_v4_cache_enabled, .maxlen = sizeof(int), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dobool_lockless, }, { .procname = "cipso_cache_bucket_size", @@ -534,14 +534,14 @@ static struct ctl_table ipv4_table[] = { .data = &cipso_v4_rbm_optfmt, .maxlen = sizeof(int), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dobool_lockless, }, { .procname = "cipso_rbm_strictvalid", .data = &cipso_v4_rbm_strictvalid, .maxlen = sizeof(int), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dobool_lockless, }, #endif /* CONFIG_NETLABEL */ { -- 2.30.2
| |