From: Jiri Pirko <jiri@resnulli.us>
To: Eric Dumazet <edumazet@google.com>
Cc: "David S . Miller" <davem@davemloft.net>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
David Ahern <dsahern@kernel.org>,
Willem de Bruijn <willemb@google.com>,
netdev@vger.kernel.org, eric.dumazet@gmail.com,
syzbot+8d482d0e407f665d9d10@syzkaller.appspotmail.com
Subject: Re: [PATCH net] udp: annotate data-races around up->pending
Date: Fri, 12 Jan 2024 13:56:19 +0100 [thread overview]
Message-ID: <ZaE28zQdlP0hhWOD@nanopsycho> (raw)
In-Reply-To: <20240112104427.324983-1-edumazet@google.com>
Fri, Jan 12, 2024 at 11:44:27AM CET, edumazet@google.com wrote:
>up->pending can be read without holding the socket lock,
>as pointed out by syzbot [1]
>
>Add READ_ONCE() in lockless contexts, and WRITE_ONCE()
>on write side.
>
>[1]
>BUG: KCSAN: data-race in udpv6_sendmsg / udpv6_sendmsg
>
>write to 0xffff88814e5eadf0 of 4 bytes by task 15547 on cpu 1:
> udpv6_sendmsg+0x1405/0x1530 net/ipv6/udp.c:1596
> inet6_sendmsg+0x63/0x80 net/ipv6/af_inet6.c:657
> sock_sendmsg_nosec net/socket.c:730 [inline]
> __sock_sendmsg net/socket.c:745 [inline]
> __sys_sendto+0x257/0x310 net/socket.c:2192
> __do_sys_sendto net/socket.c:2204 [inline]
> __se_sys_sendto net/socket.c:2200 [inline]
> __x64_sys_sendto+0x78/0x90 net/socket.c:2200
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x63/0x6b
>
>read to 0xffff88814e5eadf0 of 4 bytes by task 15551 on cpu 0:
> udpv6_sendmsg+0x22c/0x1530 net/ipv6/udp.c:1373
> inet6_sendmsg+0x63/0x80 net/ipv6/af_inet6.c:657
> sock_sendmsg_nosec net/socket.c:730 [inline]
> __sock_sendmsg net/socket.c:745 [inline]
> ____sys_sendmsg+0x37c/0x4d0 net/socket.c:2586
> ___sys_sendmsg net/socket.c:2640 [inline]
> __sys_sendmmsg+0x269/0x500 net/socket.c:2726
> __do_sys_sendmmsg net/socket.c:2755 [inline]
> __se_sys_sendmmsg net/socket.c:2752 [inline]
> __x64_sys_sendmmsg+0x57/0x60 net/socket.c:2752
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x63/0x6b
>
>value changed: 0x00000000 -> 0x0000000a
>
>Reported by Kernel Concurrency Sanitizer on:
>CPU: 0 PID: 15551 Comm: syz-executor.1 Tainted: G W 6.7.0-syzkaller #0
>Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
>
>Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
>Reported-by: syzbot+8d482d0e407f665d9d10@syzkaller.appspotmail.com
>Link: https://lore.kernel.org/netdev/0000000000009e46c3060ebcdffd@google.com/
>Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
next prev parent reply other threads:[~2024-01-12 12:56 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-01-12 10:44 [PATCH net] udp: annotate data-races around up->pending Eric Dumazet
2024-01-12 12:56 ` Jiri Pirko [this message]
2024-01-13 15:50 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZaE28zQdlP0hhWOD@nanopsycho \
--to=jiri@resnulli.us \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=eric.dumazet@gmail.com \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=syzbot+8d482d0e407f665d9d10@syzkaller.appspotmail.com \
--cc=willemb@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).