Commit 17688897 authored by Eric Dumazet's avatar Eric Dumazet Committed by Zhengchao Shao
Browse files

net: fix possible store tearing in neigh_periodic_work()

stable inclusion
from stable-v5.10.198
commit 2ea52a2fb8e87067e26bbab4efb8872639240eb0
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AWK
CVE: CVE-2023-52522

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2ea52a2fb8e87067e26bbab4efb8872639240eb0



--------------------------------

[ Upstream commit 25563b58 ]

While looking at a related syzbot report involving neigh_periodic_work(),
I found that I forgot to add an annotation when deleting an
RCU protected item from a list.

Readers use rcu_deference(*np), we need to use either
rcu_assign_pointer() or WRITE_ONCE() on writer side
to prevent store tearing.

I use rcu_assign_pointer() to have lockdep support,
this was the choice made in neigh_flush_dev().

Fixes: 767e97e1 ("neigh: RCU conversion of struct neighbour")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reviewed-by: default avatarDavid Ahern <dsahern@kernel.org>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarZhengchao Shao <shaozhengchao@huawei.com>
parent 70c98c7d
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment