Commit 640bce62 authored May 09, 2023 by Eric Dumazet Committed by Greg Kroah-Hartman May 30, 2023

net: annotate sk->sk_err write from do_recvmmsg()



[ Upstream commit e05a5f510f26607616fecdd4ac136310c8bea56b ]

do_recvmmsg() can write to sk->sk_err from multiple threads.

As said before, many other points reading or writing sk_err
need annotations.

Fixes: 34b88a68 ("net: Fix use after free in the recvmmsg exit path")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 840a6474

net/socket.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -2555,7 +2555,7 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
		* error to return on the next call or if the
		* app asks about it using getsockopt(SO_ERROR).
		*/
		sock->sk->sk_err = -err;
		WRITE_ONCE(sock->sk->sk_err, -err);
		}
		out_put:
		fput_light(sock->file, fput_needed);