• Eric Dumazet's avatar
    net: deal with most data-races in sk_wait_event() · d0ac89f6
    Eric Dumazet authored
    __condition is evaluated twice in sk_wait_event() macro.
    
    First invocation is lockless, and reads can race with writes,
    as spotted by syzbot.
    
    BUG: KCSAN: data-race in sk_stream_wait_connect / tcp_disconnect
    
    write to 0xffff88812d83d6a0 of 4 bytes by task 9065 on cpu 1:
    tcp_disconnect+0x2cd/0xdb0
    inet_shutdown+0x19e/0x1f0 net/ipv4/af_inet.c:911
    __sys_shutdown_sock net/socket.c:2343 [inline]
    __sys_shutdown net/socket.c:2355 [inline]
    __do_sys_shutdown net/socket.c:2363 [inline]
    __se_sys_shutdown+0xf8/0x140 net/socket.c:2361
    __x64_sys_shutdown+0x31/0x40 net/socket.c:2361
    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
    entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
    read to 0xffff88812d83d6a0 of 4 bytes by task 9040 on cpu 0:
    sk_stream_wait_connect+0x1de/0x3a0 net/core/stream.c:75
    tcp_sendmsg_locked+0x2e4/0x2120 net/ipv4/tcp.c:1266
    tcp_sendmsg+0x30/0x50 net/ipv4/tcp.c:1484
    inet6_sendmsg+0x63/0x80 net/ipv6/af_inet6.c:651
    sock_sendmsg_nosec net/socket.c:724 [inline]
    sock_sendmsg net/socket.c:747 [inline]
    __sys_sendto+0x246/0x300 net/socket.c:2142
    __do_sys_sendto net/socket.c:2154 [inline]
    __se_sys_sendto net/socket.c:2150 [inline]
    __x64_sys_sendto+0x78/0x90 net/socket.c:2150
    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
    entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
    value changed: 0x00000000 -> 0x00000068
    
    Fixes: 1da177e4 ("Linux-2.6.12-rc2")
    Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    d0ac89f6
tls_main.c 30.2 KB