From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Eric Dumazet <edumazet@google.com>,
syzbot <syzkaller@googlegroups.com>,
"David S . Miller" <davem@davemloft.net>,
Sasha Levin <sashal@kernel.org>,
netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.10 17/35] net: annotate data race in sock_error()
Date: Mon, 21 Jun 2021 13:52:42 -0400 [thread overview]
Message-ID: <20210621175300.735437-17-sashal@kernel.org> (raw)
In-Reply-To: <20210621175300.735437-1-sashal@kernel.org>
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit f13ef10059ccf5f4ed201cd050176df62ec25bb8 ]
sock_error() is known to be racy. The code avoids
an atomic operation is sk_err is zero, and this field
could be changed under us, this is fine.
Sysbot reported:
BUG: KCSAN: data-race in sock_alloc_send_pskb / unix_release_sock
write to 0xffff888131855630 of 4 bytes by task 9365 on cpu 1:
unix_release_sock+0x2e9/0x6e0 net/unix/af_unix.c:550
unix_release+0x2f/0x50 net/unix/af_unix.c:859
__sock_release net/socket.c:599 [inline]
sock_close+0x6c/0x150 net/socket.c:1258
__fput+0x25b/0x4e0 fs/file_table.c:280
____fput+0x11/0x20 fs/file_table.c:313
task_work_run+0xae/0x130 kernel/task_work.c:164
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
exit_to_user_mode_loop kernel/entry/common.c:174 [inline]
exit_to_user_mode_prepare+0x156/0x190 kernel/entry/common.c:208
__syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
syscall_exit_to_user_mode+0x20/0x40 kernel/entry/common.c:301
do_syscall_64+0x56/0x90 arch/x86/entry/common.c:57
entry_SYSCALL_64_after_hwframe+0x44/0xae
read to 0xffff888131855630 of 4 bytes by task 9385 on cpu 0:
sock_error include/net/sock.h:2269 [inline]
sock_alloc_send_pskb+0xe4/0x4e0 net/core/sock.c:2336
unix_dgram_sendmsg+0x478/0x1610 net/unix/af_unix.c:1671
unix_seqpacket_sendmsg+0xc2/0x100 net/unix/af_unix.c:2055
sock_sendmsg_nosec net/socket.c:654 [inline]
sock_sendmsg net/socket.c:674 [inline]
____sys_sendmsg+0x360/0x4d0 net/socket.c:2350
__sys_sendmsg_sock+0x25/0x30 net/socket.c:2416
io_sendmsg fs/io_uring.c:4367 [inline]
io_issue_sqe+0x231a/0x6750 fs/io_uring.c:6135
__io_queue_sqe+0xe9/0x360 fs/io_uring.c:6414
__io_req_task_submit fs/io_uring.c:2039 [inline]
io_async_task_func+0x312/0x590 fs/io_uring.c:5074
__tctx_task_work fs/io_uring.c:1910 [inline]
tctx_task_work+0x1d4/0x3d0 fs/io_uring.c:1924
task_work_run+0xae/0x130 kernel/task_work.c:164
tracehook_notify_signal include/linux/tracehook.h:212 [inline]
handle_signal_work kernel/entry/common.c:145 [inline]
exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
exit_to_user_mode_prepare+0xf8/0x190 kernel/entry/common.c:208
__syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
syscall_exit_to_user_mode+0x20/0x40 kernel/entry/common.c:301
do_syscall_64+0x56/0x90 arch/x86/entry/common.c:57
entry_SYSCALL_64_after_hwframe+0x44/0xae
value changed: 0x00000000 -> 0x00000068
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 9385 Comm: syz-executor.3 Not tainted 5.13.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/sock.h | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/include/net/sock.h b/include/net/sock.h
index f68184b8c0aa..9199ab7ab2da 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2232,8 +2232,13 @@ struct sk_buff *sock_dequeue_err_skb(struct sock *sk);
static inline int sock_error(struct sock *sk)
{
int err;
- if (likely(!sk->sk_err))
+
+ /* Avoid an atomic operation for the common case.
+ * This is racy since another cpu/thread can change sk_err under us.
+ */
+ if (likely(data_race(!sk->sk_err)))
return 0;
+
err = xchg(&sk->sk_err, 0);
return -err;
}
--
2.30.2
next prev parent reply other threads:[~2021-06-21 17:57 UTC|newest]
Thread overview: 49+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-21 17:52 [PATCH AUTOSEL 5.10 01/35] dmaengine: zynqmp_dma: Fix PM reference leak in zynqmp_dma_alloc_chan_resourc() Sasha Levin
2021-06-21 17:52 ` Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 02/35] dmaengine: stm32-mdma: fix PM reference leak in stm32_mdma_alloc_chan_resourc() Sasha Levin
2021-06-21 17:52 ` Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 03/35] dmaengine: xilinx: dpdma: Add missing dependencies to Kconfig Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 04/35] dmaengine: xilinx: dpdma: Limit descriptor IDs to 16 bits Sasha Levin
2021-06-21 17:52 ` Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 05/35] mac80211: remove warning in ieee80211_get_sband() Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 06/35] mac80211_hwsim: drop pending frames on stop Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 07/35] cfg80211: call cfg80211_leave_ocb when switching away from OCB Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 08/35] dmaengine: rcar-dmac: Fix PM reference leak in rcar_dmac_probe() Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 09/35] dmaengine: mediatek: free the proper desc in desc_free handler Sasha Levin
2021-06-21 17:52 ` Sasha Levin
2021-06-21 17:52 ` Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 10/35] dmaengine: mediatek: do not issue a new desc if one is still current Sasha Levin
2021-06-21 17:52 ` Sasha Levin
2021-06-21 17:52 ` Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 11/35] dmaengine: mediatek: use GFP_NOWAIT instead of GFP_ATOMIC in prep_dma Sasha Levin
2021-06-21 17:52 ` Sasha Levin
2021-06-21 17:52 ` Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 12/35] net: ipv4: Remove unneed BUG() function Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 13/35] mac80211: drop multicast fragments Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 14/35] net: ethtool: clear heap allocations for ethtool function Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 15/35] inet: annotate data race in inet_send_prepare() and inet_dgram_connect() Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 16/35] ping: Check return value of function 'ping_queue_rcv_skb' Sasha Levin
2021-06-21 17:52 ` Sasha Levin [this message]
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 18/35] inet: annotate date races around sk->sk_txhash Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 19/35] net/packet: annotate data race in packet_sendmsg() Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 20/35] net: phy: dp83867: perform soft reset and retain established link Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 21/35] riscv32: Use medany C model for modules Sasha Levin
2021-06-21 17:52 ` Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 22/35] net: caif: fix memory leak in ldisc_open Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 23/35] net/packet: annotate accesses to po->bind Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 24/35] net/packet: annotate accesses to po->ifindex Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 25/35] r8152: Avoid memcpy() over-reading of ETH_SS_STATS Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 26/35] sh_eth: " Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 27/35] r8169: " Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 28/35] KVM: selftests: Fix kvm_check_cap() assertion Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 29/35] net: qed: Fix memcpy() overflow of qed_dcbx_params() Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 30/35] mac80211: reset profile_periodicity/ema_ap Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 31/35] mac80211: handle various extensible elements correctly Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 32/35] recordmcount: Correct st_shndx handling Sasha Levin
2021-06-21 17:52 ` Sasha Levin
2021-06-21 17:52 ` Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 33/35] PCI: Add AMD RS690 quirk to enable 64-bit DMA Sasha Levin
2021-06-21 17:52 ` [PATCH AUTOSEL 5.10 34/35] net: ll_temac: Add memory-barriers for TX BD access Sasha Levin
2021-06-21 17:52 ` Sasha Levin
2021-06-21 17:53 ` [PATCH AUTOSEL 5.10 35/35] net: ll_temac: Avoid ndo_start_xmit returning NETDEV_TX_BUSY Sasha Levin
2021-06-21 17:53 ` Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210621175300.735437-17-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.