Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 42d579d9 authored by Eric Dumazet's avatar Eric Dumazet Committed by Greg Kroah-Hartman
Browse files

tcp: annotate data-race around tcp_md5sig_pool_populated 



[ Upstream commit aacd467c0a576e5e44d2de4205855dc0fe43f6fb ]

tcp_md5sig_pool_populated can be read while another thread
changes its value.

The race has no consequence because allocations
are protected with tcp_md5sig_mutex.

This patch adds READ_ONCE() and WRITE_ONCE() to document
the race and silence KCSAN.

Reported-by: default avatarAbhishek Shah <abhishek.shah@columbia.edu>
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent ce25d7ca

net/ipv4/tcp.c

+10 −4
Original line number Diff line number Diff line
@@ -3770,12 +3770,16 @@ static void __tcp_alloc_md5sig_pool(void) 
	 * to memory. See smp_rmb() in tcp_get_md5sig_pool()

	 */

	smp_wmb();

	tcp_md5sig_pool_populated = true;

	/* Paired with READ_ONCE() from tcp_alloc_md5sig_pool()

	 * and tcp_get_md5sig_pool().

	*/

	WRITE_ONCE(tcp_md5sig_pool_populated, true);

}



bool tcp_alloc_md5sig_pool(void)

{

	if (unlikely(!tcp_md5sig_pool_populated)) {

	/* Paired with WRITE_ONCE() from __tcp_alloc_md5sig_pool() */

	if (unlikely(!READ_ONCE(tcp_md5sig_pool_populated))) {

		mutex_lock(&tcp_md5sig_mutex);



		if (!tcp_md5sig_pool_populated) {
@@ -3786,7 +3790,8 @@ bool tcp_alloc_md5sig_pool(void) 


		mutex_unlock(&tcp_md5sig_mutex);

	}

	return tcp_md5sig_pool_populated;

	/* Paired with WRITE_ONCE() from __tcp_alloc_md5sig_pool() */

	return READ_ONCE(tcp_md5sig_pool_populated);

}

EXPORT_SYMBOL(tcp_alloc_md5sig_pool);
@@ -3802,7 +3807,8 @@ struct tcp_md5sig_pool *tcp_get_md5sig_pool(void) 
{

	local_bh_disable();



	if (tcp_md5sig_pool_populated) {

	/* Paired with WRITE_ONCE() from __tcp_alloc_md5sig_pool() */

	if (READ_ONCE(tcp_md5sig_pool_populated)) {

		/* coupled with smp_wmb() in __tcp_alloc_md5sig_pool() */

		smp_rmb();

		return this_cpu_ptr(&tcp_md5sig_pool);