Commit 2861f09c authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'af_unix-data-races' 



Kuniyuki Iwashima says:

====================
af_unix: Fix four data-races.

While running syzkaller, KCSAN reported 3 data-races with
systemd-coredump using AF_UNIX sockets.

This series fixes the three and another one inspiered by
one of the reports.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 718e6b51 b1928129

net/core/sock.c

+3 −3
Original line number Diff line number Diff line
@@ -2747,9 +2747,9 @@ static long sock_wait_for_wmem(struct sock *sk, long timeo) 
		prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);

		if (refcount_read(&sk->sk_wmem_alloc) < READ_ONCE(sk->sk_sndbuf))

			break;

		if (sk->sk_shutdown & SEND_SHUTDOWN)

		if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN)

			break;

		if (sk->sk_err)

		if (READ_ONCE(sk->sk_err))

			break;

		timeo = schedule_timeout(timeo);

	}
@@ -2777,7 +2777,7 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len, 
			goto failure;



		err = -EPIPE;

		if (sk->sk_shutdown & SEND_SHUTDOWN)

		if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN)

			goto failure;



		if (sk_wmem_alloc_get(sk) < READ_ONCE(sk->sk_sndbuf))

net/unix/af_unix.c

+1 −1
Original line number Diff line number Diff line
@@ -680,7 +680,7 @@ static void unix_release_sock(struct sock *sk, int embrion) 
	 *	  What the above comment does talk about? --ANK(980817)

	 */



	if (unix_tot_inflight)

	if (READ_ONCE(unix_tot_inflight))

		unix_gc();		/* Garbage collect fds */

}

net/unix/scm.c

+3 −3
Original line number Diff line number Diff line
@@ -64,7 +64,7 @@ void unix_inflight(struct user_struct *user, struct file *fp) 
		/* Paired with READ_ONCE() in wait_for_unix_gc() */

		WRITE_ONCE(unix_tot_inflight, unix_tot_inflight + 1);

	}

	user->unix_inflight++;

	WRITE_ONCE(user->unix_inflight, user->unix_inflight + 1);

	spin_unlock(&unix_gc_lock);

}
@@ -85,7 +85,7 @@ void unix_notinflight(struct user_struct *user, struct file *fp) 
		/* Paired with READ_ONCE() in wait_for_unix_gc() */

		WRITE_ONCE(unix_tot_inflight, unix_tot_inflight - 1);

	}

	user->unix_inflight--;

	WRITE_ONCE(user->unix_inflight, user->unix_inflight - 1);

	spin_unlock(&unix_gc_lock);

}
@@ -99,7 +99,7 @@ static inline bool too_many_unix_fds(struct task_struct *p) 
{

	struct user_struct *user = current_user();



	if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE)))

	if (unlikely(READ_ONCE(user->unix_inflight) > task_rlimit(p, RLIMIT_NOFILE)))

		return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN);

	return false;

}