• E
    net/packet: annotate accesses to po->bind · c7d2ef5d
    Eric Dumazet 提交于
    tpacket_snd(), packet_snd(), packet_getname() and packet_seq_show()
    can read po->num without holding a lock. This means other threads
    can change po->num at the same time.
    
    KCSAN complained about this known fact [1]
    Add READ_ONCE()/WRITE_ONCE() to address the issue.
    
    [1] BUG: KCSAN: data-race in packet_do_bind / packet_sendmsg
    
    write to 0xffff888131a0dcc0 of 2 bytes by task 24714 on cpu 0:
     packet_do_bind+0x3ab/0x7e0 net/packet/af_packet.c:3181
     packet_bind+0xc3/0xd0 net/packet/af_packet.c:3255
     __sys_bind+0x200/0x290 net/socket.c:1637
     __do_sys_bind net/socket.c:1648 [inline]
     __se_sys_bind net/socket.c:1646 [inline]
     __x64_sys_bind+0x3d/0x50 net/socket.c:1646
     do_syscall_64+0x4a/0x90 arch/x86/entry/common.c:47
     entry_SYSCALL_64_after_hwframe+0x44/0xae
    
    read to 0xffff888131a0dcc0 of 2 bytes by task 24719 on cpu 1:
     packet_snd net/packet/af_packet.c:2899 [inline]
     packet_sendmsg+0x317/0x3570 net/packet/af_packet.c:3040
     sock_sendmsg_nosec net/socket.c:654 [inline]
     sock_sendmsg net/socket.c:674 [inline]
     ____sys_sendmsg+0x360/0x4d0 net/socket.c:2350
     ___sys_sendmsg net/socket.c:2404 [inline]
     __sys_sendmsg+0x1ed/0x270 net/socket.c:2433
     __do_sys_sendmsg net/socket.c:2442 [inline]
     __se_sys_sendmsg net/socket.c:2440 [inline]
     __x64_sys_sendmsg+0x42/0x50 net/socket.c:2440
     do_syscall_64+0x4a/0x90 arch/x86/entry/common.c:47
     entry_SYSCALL_64_after_hwframe+0x44/0xae
    
    value changed: 0x0000 -> 0x1200
    
    Reported by Kernel Concurrency Sanitizer on:
    CPU: 1 PID: 24719 Comm: syz-executor.5 Not tainted 5.13.0-rc4-syzkaller #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Signed-off-by: NEric Dumazet <edumazet@google.com>
    Reported-by: Nsyzbot <syzkaller@googlegroups.com>
    Signed-off-by: NDavid S. Miller <davem@davemloft.net>
    c7d2ef5d
af_packet.c 110.2 KB