linux/net
Breno Leitao 540bf24fba af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
A data-race condition has been identified in af_unix. In one data path,
the write function unix_release_sock() atomically writes to
sk->sk_shutdown using WRITE_ONCE. However, on the reader side,
unix_stream_sendmsg() does not read it atomically. Consequently, this
issue is causing the following KCSAN splat to occur:

	BUG: KCSAN: data-race in unix_release_sock / unix_stream_sendmsg

	write (marked) to 0xffff88867256ddbb of 1 bytes by task 7270 on cpu 28:
	unix_release_sock (net/unix/af_unix.c:640)
	unix_release (net/unix/af_unix.c:1050)
	sock_close (net/socket.c:659 net/socket.c:1421)
	__fput (fs/file_table.c:422)
	__fput_sync (fs/file_table.c:508)
	__se_sys_close (fs/open.c:1559 fs/open.c:1541)
	__x64_sys_close (fs/open.c:1541)
	x64_sys_call (arch/x86/entry/syscall_64.c:33)
	do_syscall_64 (arch/x86/entry/common.c:?)
	entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)

	read to 0xffff88867256ddbb of 1 bytes by task 989 on cpu 14:
	unix_stream_sendmsg (net/unix/af_unix.c:2273)
	__sock_sendmsg (net/socket.c:730 net/socket.c:745)
	____sys_sendmsg (net/socket.c:2584)
	__sys_sendmmsg (net/socket.c:2638 net/socket.c:2724)
	__x64_sys_sendmmsg (net/socket.c:2753 net/socket.c:2750 net/socket.c:2750)
	x64_sys_call (arch/x86/entry/syscall_64.c:33)
	do_syscall_64 (arch/x86/entry/common.c:?)
	entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)

	value changed: 0x01 -> 0x03

The line numbers are related to commit dd5a440a31 ("Linux 6.9-rc7").

Commit e1d09c2c2f ("af_unix: Fix data races around sk->sk_shutdown.")
addressed a comparable issue in the past regarding sk->sk_shutdown.
However, it overlooked resolving this particular data path.
This patch only offending unix_stream_sendmsg() function, since the
other reads seem to be protected by unix_state_lock() as discussed in
Link: https://lore.kernel.org/all/20240508173324.53565-1-kuniyu@amazon.com/

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Link: https://lore.kernel.org/r/20240509081459.2807828-1-leitao@debian.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2024-05-10 19:22:26 -07:00
..
6lowpan net: fill in MODULE_DESCRIPTION()s for 6LoWPAN 2024-02-09 14:12:01 -08:00
9p 9p: Fix read/write debug statements to report server reply 2024-02-12 21:18:54 +09:00
802
8021q net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb 2024-05-02 11:02:48 +02:00
appletalk appletalk: Improve handling of broadcast packets 2024-05-08 12:17:19 +01:00
atm net: fill in MODULE_DESCRIPTION()s for mpoa 2024-02-09 14:12:01 -08:00
ax25 ax25: Fix netdev refcount issue 2024-04-23 11:35:52 +02:00
batman-adv batman-adv: Avoid infinite loop trying to resize local TT 2024-03-29 20:18:43 +01:00
bluetooth Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout 2024-05-03 13:05:54 -04:00
bpf for-netdev 2024-03-11 18:06:04 -07:00
bridge net: bridge: fix corrupted ethernet header on multicast-to-unicast 2024-05-08 10:37:57 +01:00
caif
can linux-can-next-for-6.9-20240220 2024-02-20 15:32:45 +01:00
ceph libceph: init the cursor when preparing sparse read in msgr2 2024-03-06 12:43:01 +01:00
core net: fix out-of-bounds access in ops_init 2024-05-06 13:38:14 +02:00
dcb
dccp Kbuild updates for v6.9 2024-03-21 14:41:00 -07:00
devlink devlink: fix port new reply cmd type 2024-03-19 19:37:57 -07:00
dns_resolver
dsa net: dsa: Leverage core stats allocator 2024-03-07 20:37:13 -08:00
ethernet ethernet: Add helper for assigning packet type when dest address does not match device address 2024-04-25 08:20:54 -07:00
ethtool ethtool: remove ethtool_eee_use_linkmodes 2024-03-06 20:40:20 -08:00
handshake net/handshake: Fix handshake_req_destroy_test1 2024-02-08 18:32:29 -08:00
hsr hsr: Simplify code for announcing HSR nodes timer setup 2024-05-08 18:56:30 -07:00
ieee802154 Merge tag 'ieee802154-for-net-next-2024-03-07' of git://git.kernel.org/pub/scm/linux/kernel/git/wpan/wpan-next 2024-03-08 20:35:33 -08:00
ife
ipv4 ipsec-2024-05-02 2024-05-03 15:56:15 -07:00
ipv6 ipv6: prevent NULL dereference in ip6_output() 2024-05-08 18:57:12 -07:00
iucv more s390 updates for 6.9 merge window 2024-03-19 11:38:27 -07:00
kcm net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function 2024-03-11 09:53:22 +00:00
key net: fill in MODULE_DESCRIPTION()s for af_key 2024-02-09 14:12:01 -08:00
l2tp net l2tp: drop flow hash on forward 2024-04-26 13:48:24 +02:00
l3mdev
lapb
llc
mac80211 wifi: mac80211: fix unaligned le16 access 2024-04-19 10:02:27 +02:00
mac802154 mac802154: fix llsec key resources release in mac802154_llsec_key_del 2024-03-06 21:01:26 +01:00
mctp Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-02-29 14:24:56 -08:00
mpls - Kuan-Wei Chiu has developed the well-named series "lib min_heap: Min 2024-03-14 18:03:09 -07:00
mptcp mptcp: only allow set existing scheduler for net.mptcp.scheduler 2024-05-07 17:23:35 -07:00
ncsi
netfilter netfilter: nf_tables: honor table dormant flag from netdev release event path 2024-04-25 10:42:57 +02:00
netlabel netlabel: remove impossible return value in netlbl_bitmap_walk 2024-02-28 19:37:34 -08:00
netlink net/netlink: Add getsockopt support for NETLINK_LISTEN_ALL_NSID 2024-03-11 15:48:34 -07:00
netrom netrom: Fix data-races around sysctl_net_busy_read 2024-03-07 10:36:58 +01:00
nfc nfc: nci: Fix kcov check in nci_rx_work() 2024-05-07 16:40:06 -07:00
nsh nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). 2024-04-26 12:20:01 +02:00
openvswitch net: openvswitch: Fix Use-After-Free in ovs_ct_exit 2024-04-24 17:14:24 -07:00
packet Revert "net: Re-use and set mono_delivery_time bit for userspace tstamp packets" 2024-03-18 12:29:53 +00:00
phonet phonet: fix rtm_phonet_notify() skb allocation 2024-05-06 18:30:00 -07:00
psample
qrtr
rds net/rds: fix possible cp null dereference 2024-03-29 12:04:09 -07:00
rfkill
rose
rxrpc rxrpc: Only transmit one ACK per jumbo packet received 2024-05-08 08:05:03 -07:00
sched net/sched: Fix mirred deadlock on device recursion 2024-04-17 18:22:52 -07:00
sctp net: introduce include/net/rps.h 2024-03-07 21:12:43 -08:00
smc net/smc: fix neighbour and rtable leak in smc_ib_find_route() 2024-05-09 10:03:43 +02:00
strparser
sunrpc NFS client bugfixes for Linux 6.9 2024-04-29 12:07:37 -07:00
switchdev net: bridge: switchdev: Skip MDB replays of deferred events on offload 2024-02-16 09:36:37 +00:00
tipc tipc: fix a possible memleak in tipc_buf_append 2024-05-01 18:39:44 -07:00
tls tls: fix lockless read of strp->msg_ready in ->poll 2024-04-25 08:32:37 -07:00
unix af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg 2024-05-10 19:22:26 -07:00
vmw_vsock vsock/virtio: fix packet delivery to tap device 2024-04-02 18:00:24 -07:00
wireless wifi: nl80211: don't free NULL coalescing rule 2024-04-19 10:02:17 +02:00
x25 net/x25: fix incorrect parameter validation in the x25_getsockopt() function 2024-03-11 09:53:22 +00:00
xdp xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING 2024-04-05 22:47:22 -07:00
xfrm xfrm: Preserve vlan tags for transport mode software GRO 2024-04-26 06:44:33 +02:00
compat.c
devres.c
Kconfig net: bql: allow the config to be disabled 2024-02-18 10:19:21 +00:00
Kconfig.debug
Makefile
socket.c net: remove {revc,send}msg_copy_msghdr() from exports 2024-03-14 16:48:53 -07:00
sysctl_net.c