Commit 8bf43be7 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

net: annotate data-races around sk->sk_priority 



sk_getsockopt() runs locklessly. This means sk->sk_priority
can be read while other threads are changing its value.

Other reads also happen without socket lock being held.

Add missing annotations where needed.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent e5f0d2dd

net/core/sock.c

+3 −3
Original line number Diff line number Diff line
@@ -806,7 +806,7 @@ EXPORT_SYMBOL(sock_no_linger); 
void sock_set_priority(struct sock *sk, u32 priority)

{

	lock_sock(sk);

	sk->sk_priority = priority;

	WRITE_ONCE(sk->sk_priority, priority);

	release_sock(sk);

}

EXPORT_SYMBOL(sock_set_priority);
@@ -1216,7 +1216,7 @@ int sk_setsockopt(struct sock *sk, int level, int optname, 
		if ((val >= 0 && val <= 6) ||

		    sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) ||

		    sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))

			sk->sk_priority = val;

			WRITE_ONCE(sk->sk_priority, val);

		else

			ret = -EPERM;

		break;
@@ -1685,7 +1685,7 @@ int sk_getsockopt(struct sock *sk, int level, int optname, 
		break;



	case SO_PRIORITY:

		v.val = sk->sk_priority;

		v.val = READ_ONCE(sk->sk_priority);

		break;



	case SO_LINGER:

net/ipv4/ip_output.c

+2 −2
Original line number Diff line number Diff line
@@ -184,7 +184,7 @@ int ip_build_and_send_pkt(struct sk_buff *skb, const struct sock *sk, 
		ip_options_build(skb, &opt->opt, daddr, rt);

	}



	skb->priority = sk->sk_priority;

	skb->priority = READ_ONCE(sk->sk_priority);

	if (!skb->mark)

		skb->mark = READ_ONCE(sk->sk_mark);
@@ -528,7 +528,7 @@ int __ip_queue_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl, 
			     skb_shinfo(skb)->gso_segs ?: 1);



	/* TODO : should we use skb->sk here instead of sk ? */

	skb->priority = sk->sk_priority;

	skb->priority = READ_ONCE(sk->sk_priority);

	skb->mark = READ_ONCE(sk->sk_mark);



	res = ip_local_out(net, sk, skb);

net/ipv4/ip_sockglue.c

+1 −1
Original line number Diff line number Diff line
@@ -592,7 +592,7 @@ void __ip_sock_set_tos(struct sock *sk, int val) 
	}

	if (inet_sk(sk)->tos != val) {

		inet_sk(sk)->tos = val;

		sk->sk_priority = rt_tos2priority(val);

		WRITE_ONCE(sk->sk_priority, rt_tos2priority(val));

		sk_dst_reset(sk);

	}

}

net/ipv4/raw.c

+1 −1
Original line number Diff line number Diff line
@@ -348,7 +348,7 @@ static int raw_send_hdrinc(struct sock *sk, struct flowi4 *fl4, 
		goto error;

	skb_reserve(skb, hlen);



	skb->priority = sk->sk_priority;

	skb->priority = READ_ONCE(sk->sk_priority);

	skb->mark = sockc->mark;

	skb->tstamp = sockc->transmit_time;

	skb_dst_set(skb, &rt->dst);

net/ipv4/tcp_ipv4.c

+1 −1
Original line number Diff line number Diff line
@@ -933,7 +933,7 @@ static void tcp_v4_send_ack(const struct sock *sk, 
	ctl_sk->sk_mark = (sk->sk_state == TCP_TIME_WAIT) ?

			   inet_twsk(sk)->tw_mark : READ_ONCE(sk->sk_mark);

	ctl_sk->sk_priority = (sk->sk_state == TCP_TIME_WAIT) ?

			   inet_twsk(sk)->tw_priority : sk->sk_priority;

			   inet_twsk(sk)->tw_priority : READ_ONCE(sk->sk_priority);

	transmit_time = tcp_transmit_time(sk);

	ip_send_unicast_reply(ctl_sk,

			      skb, &TCP_SKB_CB(skb)->header.h4.opt,