Files
kernel_google_wahoo/include/linux
Qian Cai 862495f91f skbuff: fix a data race in skb_queue_len()
[ Upstream commit 86b18aaa2b5b5bb48e609cd591b3d2d0fdbe0442 ]

sk_buff.qlen can be accessed concurrently as noticed by KCSAN,

 BUG: KCSAN: data-race in __skb_try_recv_from_queue / unix_dgram_sendmsg

 read to 0xffff8a1b1d8a81c0 of 4 bytes by task 5371 on cpu 96:
  unix_dgram_sendmsg+0x9a9/0xb70 include/linux/skbuff.h:1821
				 net/unix/af_unix.c:1761
  ____sys_sendmsg+0x33e/0x370
  ___sys_sendmsg+0xa6/0xf0
  __sys_sendmsg+0x69/0xf0
  __x64_sys_sendmsg+0x51/0x70
  do_syscall_64+0x91/0xb47
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

 write to 0xffff8a1b1d8a81c0 of 4 bytes by task 1 on cpu 99:
  __skb_try_recv_from_queue+0x327/0x410 include/linux/skbuff.h:2029
  __skb_try_recv_datagram+0xbe/0x220
  unix_dgram_recvmsg+0xee/0x850
  ____sys_recvmsg+0x1fb/0x210
  ___sys_recvmsg+0xa2/0xf0
  __sys_recvmsg+0x66/0xf0
  __x64_sys_recvmsg+0x51/0x70
  do_syscall_64+0x91/0xb47
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

Since only the read is operating as lockless, it could introduce a logic
bug in unix_recvq_full() due to the load tearing. Fix it by adding
a lockless variant of skb_queue_len() and unix_recvq_full() where
READ_ONCE() is on the read while WRITE_ONCE() is on the write similar to
the commit d7d16a89350a ("net: add skb_queue_empty_lockless()").

Signed-off-by: Qian Cai <cai@lca.pw>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-01 11:11:52 +02:00
..
2015-10-01 12:48:11 -07:00
2015-10-17 21:22:08 -07:00
2015-10-07 18:08:15 +01:00
2016-03-09 15:34:52 -08:00
2018-04-08 11:51:57 +02:00
2018-04-24 09:32:12 +02:00
2015-11-07 10:40:47 -07:00
2015-09-08 15:35:28 -07:00
2015-10-18 10:14:39 -07:00
2019-03-23 08:44:38 +01:00
2019-11-25 15:54:25 +01:00
2017-07-15 11:57:44 +02:00
2015-10-30 01:47:27 -04:00
2018-01-17 09:35:30 +01:00
2020-09-03 11:19:27 +02:00
2017-08-06 19:19:42 -07:00
2020-04-02 19:02:31 +02:00
2015-09-08 15:35:28 -07:00
2016-04-20 15:42:02 +09:00
2015-10-23 05:44:28 -07:00
2015-10-01 15:06:43 +02:00
2015-10-13 19:01:25 +02:00
2016-10-28 03:01:30 -04:00
2015-08-18 15:49:15 -07:00
2015-07-28 08:50:42 +01:00
2020-04-02 19:02:39 +02:00
2020-06-29 20:07:55 -04:00
2015-11-23 09:44:58 +01:00
2015-10-27 18:55:31 -07:00
2015-10-20 22:10:45 +08:00
2016-03-03 15:07:28 -08:00
2015-09-10 13:29:01 -07:00
2015-11-06 17:50:42 -08:00
2016-12-08 07:15:24 +01:00
2017-08-24 17:02:36 -07:00
2015-10-09 17:00:32 -04:00
2015-10-22 08:59:18 -07:00
2020-04-24 07:57:12 +02:00
2020-04-02 19:02:39 +02:00
2016-09-30 10:18:37 +02:00
2019-04-27 09:33:54 +02:00
2018-11-21 09:27:36 +01:00
2016-04-12 09:08:35 -07:00
2015-08-17 11:25:28 -07:00
2015-10-01 09:57:59 -07:00
2015-10-19 01:01:21 +02:00
2020-05-20 08:11:48 +02:00
2015-11-23 09:44:58 +01:00
2020-04-02 19:02:31 +02:00
2020-04-02 19:02:39 +02:00
2015-12-13 14:30:59 -08:00
2015-11-13 20:34:33 -05:00
2015-09-08 15:35:28 -07:00