Eric Dumazet
d2e919b6e6
udp: annotate data-races around up->pending ...
[ Upstream commit 482521d8e0c6520429478aa6866cd44128b33d5d ]
up->pending can be read without holding the socket lock,
as pointed out by syzbot [1]
Add READ_ONCE() in lockless contexts, and WRITE_ONCE()
on write side.
[1]
BUG: KCSAN: data-race in udpv6_sendmsg / udpv6_sendmsg
write to 0xffff88814e5eadf0 of 4 bytes by task 15547 on cpu 1:
udpv6_sendmsg+0x1405/0x1530 net/ipv6/udp.c:1596
inet6_sendmsg+0x63/0x80 net/ipv6/af_inet6.c:657
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
__sys_sendto+0x257/0x310 net/socket.c:2192
__do_sys_sendto net/socket.c:2204 [inline]
__se_sys_sendto net/socket.c:2200 [inline]
__x64_sys_sendto+0x78/0x90 net/socket.c:2200
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
read to 0xffff88814e5eadf0 of 4 bytes by task 15551 on cpu 0:
udpv6_sendmsg+0x22c/0x1530 net/ipv6/udp.c:1373
inet6_sendmsg+0x63/0x80 net/ipv6/af_inet6.c:657
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0x37c/0x4d0 net/socket.c:2586
___sys_sendmsg net/socket.c:2640 [inline]
__sys_sendmmsg+0x269/0x500 net/socket.c:2726
__do_sys_sendmmsg net/socket.c:2755 [inline]
__se_sys_sendmmsg net/socket.c:2752 [inline]
__x64_sys_sendmmsg+0x57/0x60 net/socket.c:2752
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
value changed: 0x00000000 -> 0x0000000a
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 15551 Comm: syz-executor.1 Tainted: G W 6.7.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+8d482d0e407f665d9d10@syzkaller.appspotmail.com
Link: https://lore.kernel.org/netdev/0000000000009e46c3060ebcdffd@google.com/
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-01-25 15:35:57 -08:00
2024-01-01 12:42:41 +00:00
2024-01-01 12:42:32 +00:00
2023-12-20 17:01:50 +01:00
2023-12-20 17:01:48 +01:00
2023-09-18 12:56:58 +01:00
2023-08-24 10:51:39 -07:00
2024-01-25 15:35:46 -08:00
2023-08-30 08:36:17 +02:00
2023-05-31 13:06:57 +02:00
2023-11-28 17:19:52 +00:00
2023-06-24 15:50:13 -07:00
2023-10-06 12:54:33 +02:00
2023-10-09 13:35:24 +02:00
2024-01-25 15:35:47 -08:00
2023-08-01 21:07:46 -07:00
2023-11-20 11:59:35 +01:00
2023-10-06 15:56:46 -07:00
2024-01-25 15:35:41 -08:00
2023-08-09 13:08:09 -07:00
2023-12-08 08:52:23 +01:00
2023-10-23 10:19:33 -07:00
2023-11-20 11:59:34 +01:00
2023-08-29 17:39:15 -07:00
2024-01-01 12:42:30 +00:00
2024-01-25 15:35:57 -08:00
2024-01-25 15:35:57 -08:00
2023-09-14 10:43:51 +02:00
2023-08-18 12:44:56 -07:00
2023-11-20 11:58:56 +01:00
2023-11-20 11:59:34 +01:00
2024-01-20 11:51:37 +01:00
2023-06-24 15:41:46 -07:00
2023-10-10 19:43:22 -07:00
2023-08-15 15:26:18 -07:00
2024-01-25 15:35:57 -08:00
2024-01-25 15:35:20 -08:00
2024-01-25 15:35:46 -08:00
2024-01-25 15:35:14 -08:00
2023-12-13 18:45:10 +01:00
2023-08-28 06:58:46 +01:00
2024-01-20 11:51:46 +01:00
2023-06-10 00:11:41 -07:00
2023-11-20 11:59:37 +01:00
2023-12-13 18:45:23 +01:00
2023-06-24 15:50:13 -07:00
2023-12-13 18:45:10 +01:00
2024-01-20 11:51:47 +01:00
2023-10-01 19:31:29 +01:00
2024-01-01 12:42:41 +00:00
2024-01-01 12:42:31 +00:00
2024-01-25 15:35:56 -08:00
2024-01-25 15:35:30 -08:00
2024-01-25 15:35:30 -08:00
2024-01-10 17:16:52 +01:00
2024-01-25 15:35:18 -08:00
2023-07-21 08:54:03 +01:00
2023-11-28 17:19:51 +00:00
2023-12-13 18:45:10 +01:00
2024-01-25 15:35:30 -08:00
2024-01-25 15:35:26 -08:00
2024-01-25 15:35:30 -08:00
2023-06-24 15:50:13 -07:00
2024-01-10 17:16:54 +01:00
2023-10-17 18:21:13 -07:00
2023-07-19 10:07:27 -07:00
2023-04-19 18:48:48 -07:00
2024-01-10 17:16:51 +01:00
2023-08-15 15:26:17 -07:00
d2e919b6e6