Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c64bb854 authored by Eric Dumazet's avatar Eric Dumazet Committed by Greg Kroah-Hartman
Browse files

netlink: annotate data races around dst_portid and dst_group 



[ Upstream commit 004db64d185a5f23dfb891d7701e23713b2420ee ]

netlink_getname(), netlink_sendmsg() and netlink_getsockbyportid()
can read nlk->dst_portid and nlk->dst_group while another
thread is changing them.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent ea11a52f

net/netlink/af_netlink.c

+14 −9
Original line number Diff line number Diff line
@@ -1081,8 +1081,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr, 


	if (addr->sa_family == AF_UNSPEC) {

		sk->sk_state	= NETLINK_UNCONNECTED;

		nlk->dst_portid	= 0;

		nlk->dst_group  = 0;

		/* dst_portid and dst_group can be read locklessly */

		WRITE_ONCE(nlk->dst_portid, 0);

		WRITE_ONCE(nlk->dst_group, 0);

		return 0;

	}

	if (addr->sa_family != AF_NETLINK)
@@ -1104,8 +1105,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr, 


	if (err == 0) {

		sk->sk_state	= NETLINK_CONNECTED;

		nlk->dst_portid = nladdr->nl_pid;

		nlk->dst_group  = ffs(nladdr->nl_groups);

		/* dst_portid and dst_group can be read locklessly */

		WRITE_ONCE(nlk->dst_portid, nladdr->nl_pid);

		WRITE_ONCE(nlk->dst_group, ffs(nladdr->nl_groups));

	}



	return err;
@@ -1122,8 +1124,9 @@ static int netlink_getname(struct socket *sock, struct sockaddr *addr, 
	nladdr->nl_pad = 0;



	if (peer) {

		nladdr->nl_pid = nlk->dst_portid;

		nladdr->nl_groups = netlink_group_mask(nlk->dst_group);

		/* Paired with WRITE_ONCE() in netlink_connect() */

		nladdr->nl_pid = READ_ONCE(nlk->dst_portid);

		nladdr->nl_groups = netlink_group_mask(READ_ONCE(nlk->dst_group));

	} else {

		/* Paired with WRITE_ONCE() in netlink_insert() */

		nladdr->nl_pid = READ_ONCE(nlk->portid);
@@ -1153,8 +1156,9 @@ static struct sock *netlink_getsockbyportid(struct sock *ssk, u32 portid) 


	/* Don't bother queuing skb if kernel socket has no input function */

	nlk = nlk_sk(sock);

	/* dst_portid can be changed in netlink_connect() */

	if (sock->sk_state == NETLINK_CONNECTED &&

	    nlk->dst_portid != nlk_sk(ssk)->portid) {

	    READ_ONCE(nlk->dst_portid) != nlk_sk(ssk)->portid) {

		sock_put(sock);

		return ERR_PTR(-ECONNREFUSED);

	}
@@ -1890,8 +1894,9 @@ static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) 
			goto out;

		netlink_skb_flags |= NETLINK_SKB_DST;

	} else {

		dst_portid = nlk->dst_portid;

		dst_group = nlk->dst_group;

		/* Paired with WRITE_ONCE() in netlink_connect() */

		dst_portid = READ_ONCE(nlk->dst_portid);

		dst_group = READ_ONCE(nlk->dst_group);

	}



	/* Paired with WRITE_ONCE() in netlink_insert() */