• Eric Dumazet's avatar
    udp: annotate data-races around up->pending · 482521d8
    Eric Dumazet authored
    up->pending can be read without holding the socket lock,
    as pointed out by syzbot [1]
    
    Add READ_ONCE() in lockless contexts, and WRITE_ONCE()
    on write side.
    
    [1]
    BUG: KCSAN: data-race in udpv6_sendmsg / udpv6_sendmsg
    
    write to 0xffff88814e5eadf0 of 4 bytes by task 15547 on cpu 1:
     udpv6_sendmsg+0x1405/0x1530 net/ipv6/udp.c:1596
     inet6_sendmsg+0x63/0x80 net/ipv6/af_inet6.c:657
     sock_sendmsg_nosec net/socket.c:730 [inline]
     __sock_sendmsg net/socket.c:745 [inline]
     __sys_sendto+0x257/0x310 net/socket.c:2192
     __do_sys_sendto net/socket.c:2204 [inline]
     __se_sys_sendto net/socket.c:2200 [inline]
     __x64_sys_sendto+0x78/0x90 net/socket.c:2200
     do_syscall_x64 arch/x86/entry/common.c:52 [inline]
     do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
     entry_SYSCALL_64_after_hwframe+0x63/0x6b
    
    read to 0xffff88814e5eadf0 of 4 bytes by task 15551 on cpu 0:
     udpv6_sendmsg+0x22c/0x1530 net/ipv6/udp.c:1373
     inet6_sendmsg+0x63/0x80 net/ipv6/af_inet6.c:657
     sock_sendmsg_nosec net/socket.c:730 [inline]
     __sock_sendmsg net/socket.c:745 [inline]
     ____sys_sendmsg+0x37c/0x4d0 net/socket.c:2586
     ___sys_sendmsg net/socket.c:2640 [inline]
     __sys_sendmmsg+0x269/0x500 net/socket.c:2726
     __do_sys_sendmmsg net/socket.c:2755 [inline]
     __se_sys_sendmmsg net/socket.c:2752 [inline]
     __x64_sys_sendmmsg+0x57/0x60 net/socket.c:2752
     do_syscall_x64 arch/x86/entry/common.c:52 [inline]
     do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
     entry_SYSCALL_64_after_hwframe+0x63/0x6b
    
    value changed: 0x00000000 -> 0x0000000a
    
    Reported by Kernel Concurrency Sanitizer on:
    CPU: 0 PID: 15551 Comm: syz-executor.1 Tainted: G        W          6.7.0-syzkaller #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
    
    Fixes: 1da177e4 ("Linux-2.6.12-rc2")
    Reported-by: syzbot+8d482d0e407f665d9d10@syzkaller.appspotmail.com
    Link: https://lore.kernel.org/netdev/0000000000009e46c3060ebcdffd@google.com/Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reviewed-by: default avatarJiri Pirko <jiri@nvidia.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    482521d8
udp.c 46.6 KB