Commit 657b991a authored Aug 23, 2022 by Kuniyuki Iwashima Committed by David S. Miller Aug 24, 2022

net: Fix data-races around sysctl_max_skb_frags.



While reading sysctl_max_skb_frags, it can be changed concurrently.
Thus, we need to add READ_ONCE() to its readers.

Fixes: 5f74f82e ("net:Add sysctl_max_skb_frags")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 2e0c4237

net/ipv4/tcp.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -1000,7 +1000,7 @@ static struct sk_buff tcp_build_frag(struct sock sk, int size_goal, int flags,

		i = skb_shinfo(skb)->nr_frags;
		can_coalesce = skb_can_coalesce(skb, i, page, offset);
		if (!can_coalesce && i >= sysctl_max_skb_frags) {
		if (!can_coalesce && i >= READ_ONCE(sysctl_max_skb_frags)) {
		tcp_mark_push(tp, skb);
		goto new_segment;
		}
		@@ -1354,7 +1354,7 @@ int tcp_sendmsg_locked(struct sock sk, struct msghdr msg, size_t size)

		if (!skb_can_coalesce(skb, i, pfrag->page,
		pfrag->offset)) {
		if (i >= sysctl_max_skb_frags) {
		if (i >= READ_ONCE(sysctl_max_skb_frags)) {
		tcp_mark_push(tp, skb);
		goto new_segment;
		}

net/mptcp/protocol.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1263,7 +1263,7 @@ static int mptcp_sendmsg_frag(struct sock sk, struct sock ssk,

		i = skb_shinfo(skb)->nr_frags;
		can_coalesce = skb_can_coalesce(skb, i, dfrag->page, offset);
		if (!can_coalesce && i >= sysctl_max_skb_frags) {
		if (!can_coalesce && i >= READ_ONCE(sysctl_max_skb_frags)) {
		tcp_mark_push(tcp_sk(ssk), skb);
		goto alloc_skb;
		}