Eric Dumazet
d56c69c5ef
tcp: fix data-race in tcp_recvmsg()
...
[ Upstream commit a5a7daa52e
]
Reading tp->recvmsg_inq after socket lock is released
raises a KCSAN warning [1]
Replace has_tss & has_cmsg by cmsg_flags and make
sure to not read tp->recvmsg_inq a second time.
[1]
BUG: KCSAN: data-race in tcp_chrono_stop / tcp_recvmsg
write to 0xffff888126adef24 of 2 bytes by interrupt on cpu 0:
tcp_chrono_set net/ipv4/tcp_output.c:2309 [inline]
tcp_chrono_stop+0x14c/0x280 net/ipv4/tcp_output.c:2338
tcp_clean_rtx_queue net/ipv4/tcp_input.c:3165 [inline]
tcp_ack+0x274f/0x3170 net/ipv4/tcp_input.c:3688
tcp_rcv_established+0x37e/0xf50 net/ipv4/tcp_input.c:5696
tcp_v4_do_rcv+0x381/0x4e0 net/ipv4/tcp_ipv4.c:1561
tcp_v4_rcv+0x19dc/0x1bb0 net/ipv4/tcp_ipv4.c:1942
ip_protocol_deliver_rcu+0x4d/0x420 net/ipv4/ip_input.c:204
ip_local_deliver_finish+0x110/0x140 net/ipv4/ip_input.c:231
NF_HOOK include/linux/netfilter.h:305 [inline]
NF_HOOK include/linux/netfilter.h:299 [inline]
ip_local_deliver+0x133/0x210 net/ipv4/ip_input.c:252
dst_input include/net/dst.h:442 [inline]
ip_rcv_finish+0x121/0x160 net/ipv4/ip_input.c:413
NF_HOOK include/linux/netfilter.h:305 [inline]
NF_HOOK include/linux/netfilter.h:299 [inline]
ip_rcv+0x18f/0x1a0 net/ipv4/ip_input.c:523
__netif_receive_skb_one_core+0xa7/0xe0 net/core/dev.c:5010
__netif_receive_skb+0x37/0xf0 net/core/dev.c:5124
netif_receive_skb_internal+0x59/0x190 net/core/dev.c:5214
napi_skb_finish net/core/dev.c:5677 [inline]
napi_gro_receive+0x28f/0x330 net/core/dev.c:5710
read to 0xffff888126adef25 of 1 bytes by task 7275 on cpu 1:
tcp_recvmsg+0x77b/0x1a30 net/ipv4/tcp.c:2187
inet_recvmsg+0xbb/0x250 net/ipv4/af_inet.c:838
sock_recvmsg_nosec net/socket.c:871 [inline]
sock_recvmsg net/socket.c:889 [inline]
sock_recvmsg+0x92/0xb0 net/socket.c:885
sock_read_iter+0x15f/0x1e0 net/socket.c:967
call_read_iter include/linux/fs.h:1889 [inline]
new_sync_read+0x389/0x4f0 fs/read_write.c:414
__vfs_read+0xb1/0xc0 fs/read_write.c:427
vfs_read fs/read_write.c:461 [inline]
vfs_read+0x143/0x2c0 fs/read_write.c:446
ksys_read+0xd5/0x1b0 fs/read_write.c:587
__do_sys_read fs/read_write.c:597 [inline]
__se_sys_read fs/read_write.c:595 [inline]
__x64_sys_read+0x4c/0x60 fs/read_write.c:595
do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 7275 Comm: sshd Not tainted 5.4.0-rc3+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Fixes: b75eba76d3
("tcp: send in-queue bytes in cmsg upon read")
Signed-off-by: Eric Dumazet <edumazet@google.com >
Acked-by: Soheil Hassas Yeganeh <soheil@google.com >
Reported-by: syzbot <syzkaller@googlegroups.com >
Signed-off-by: David S. Miller <davem@davemloft.net >
Signed-off-by: Sasha Levin <sashal@kernel.org >
2020-01-09 10:19:54 +01:00
..
2019-05-21 12:33:38 -07:00
2019-10-01 18:42:15 +02:00
2019-08-19 18:22:54 -07:00
2019-06-06 08:34:50 +02:00
2019-05-30 11:26:32 -07:00
2019-05-21 11:28:45 +02:00
2019-11-01 14:57:52 -07:00
2019-12-18 16:08:17 +01:00
2019-07-05 15:01:15 -07:00
2019-07-01 06:16:40 +02:00
2019-10-26 11:25:53 -07:00
2019-06-04 19:26:49 -07:00
2017-11-02 11:10:55 +01:00
2019-06-07 11:00:14 -07:00
2019-11-07 16:14:36 -08:00
2019-08-24 16:49:48 -07:00
2019-05-21 10:50:45 +02:00
2019-12-18 16:08:51 +01:00
2019-05-30 11:26:32 -07:00
2020-01-04 19:18:40 +01:00
2019-08-20 12:48:06 -07:00
2020-01-04 19:18:58 +01:00
2020-01-04 19:19:13 +01:00
2019-08-08 15:55:10 -07:00
2020-01-04 19:19:13 +01:00
2019-05-21 10:50:45 +02:00
2020-01-04 19:18:39 +01:00
2019-09-20 18:23:33 -07:00
2019-08-08 15:55:10 -07:00
2019-10-29 17:36:42 -07:00
2019-10-01 18:42:15 +02:00
2019-06-21 18:35:51 +02:00
2019-12-18 16:08:17 +01:00
2019-05-25 11:00:50 -07:00
2019-06-18 20:48:45 -04:00
2020-01-04 19:19:02 +01:00
2020-01-04 19:19:03 +01:00
2019-07-05 15:01:15 -07:00
2019-02-01 15:24:13 -08:00
2019-07-25 17:23:40 -07:00
2019-05-07 17:22:09 -07:00
2019-11-16 13:06:54 -08:00
2019-09-26 08:56:17 +02:00
2019-05-28 21:37:30 -07:00
2019-05-21 10:50:45 +02:00
2019-01-28 11:32:58 +01:00
2019-05-21 10:50:45 +02:00
2019-08-22 12:14:05 -07:00
2019-09-13 21:44:19 +02:00
2019-06-17 20:20:36 -07:00
2019-05-30 11:26:32 -07:00
2019-07-03 11:26:35 -07:00
2019-10-01 18:42:15 +02:00
2020-01-04 19:18:58 +01:00
2019-05-30 11:26:32 -07:00
2019-11-18 17:25:36 -08:00
2019-09-27 20:37:50 +02:00
2019-05-21 10:50:45 +02:00
2019-12-04 22:31:01 +01:00
2019-05-21 10:50:45 +02:00
2019-07-18 20:33:48 -07:00
2019-05-21 10:50:45 +02:00
2019-05-30 11:26:32 -07:00
2018-10-10 22:26:00 -07:00
2019-10-13 10:13:08 -07:00
2019-10-13 10:13:08 -07:00
2019-05-21 10:50:45 +02:00
2019-05-21 10:50:45 +02:00
2019-05-21 10:50:45 +02:00
2019-05-21 10:50:45 +02:00
2019-10-13 10:13:08 -07:00
2020-01-04 19:19:13 +01:00
2019-05-21 10:50:45 +02:00
2019-05-01 11:47:54 -04:00
2019-10-13 10:13:08 -07:00
2019-05-21 10:50:45 +02:00
2019-05-30 11:26:32 -07:00
2020-01-04 19:19:12 +01:00
2019-05-21 10:50:45 +02:00
2018-09-21 19:37:59 -07:00
2019-05-21 10:50:45 +02:00
2019-10-13 10:13:08 -07:00
2019-07-22 16:04:17 +02:00
2019-05-21 10:50:45 +02:00
2017-11-02 11:10:55 +01:00
2019-05-21 10:50:45 +02:00
2019-05-21 10:50:45 +02:00
2019-05-21 10:50:45 +02:00
2020-01-09 10:19:54 +01:00
2019-05-21 10:50:45 +02:00
2019-05-30 11:26:32 -07:00
2019-01-17 15:01:08 -08:00
2019-06-22 08:59:24 -04:00
2019-05-21 10:50:45 +02:00
2020-01-04 19:18:49 +01:00
2019-05-30 11:26:32 -07:00
2018-09-04 10:26:30 +02:00
2019-05-30 11:26:32 -07:00
2020-01-04 19:18:58 +01:00
2019-05-30 11:26:32 -07:00
2019-06-06 08:34:50 +02:00
2019-06-06 08:34:50 +02:00