Commit 93ff85da authored by Eric Dumazet's avatar Eric Dumazet Committed by sanglipeng
Browse files

netlink: annotate data races around dst_portid and dst_group 

stable inclusion
from stable-v5.10.166
commit 8583f52c23c33b411a9c2e1546d6761f41e44d69
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7TH9O

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8583f52c23c33b411a9c2e1546d6761f41e44d69



--------------------------------

[ Upstream commit 004db64d ]

netlink_getname(), netlink_sendmsg() and netlink_getsockbyportid()
can read nlk->dst_portid and nlk->dst_group while another
thread is changing them.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarsanglipeng <sanglipeng1@jd.com>
parent 1585ad2c

net/netlink/af_netlink.c

+14 −9
Original line number Diff line number Diff line
@@ -1082,8 +1082,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr, 


	if (addr->sa_family == AF_UNSPEC) {

		sk->sk_state	= NETLINK_UNCONNECTED;

		nlk->dst_portid	= 0;

		nlk->dst_group  = 0;

		/* dst_portid and dst_group can be read locklessly */

		WRITE_ONCE(nlk->dst_portid, 0);

		WRITE_ONCE(nlk->dst_group, 0);

		return 0;

	}

	if (addr->sa_family != AF_NETLINK)
@@ -1105,8 +1106,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr, 


	if (err == 0) {

		sk->sk_state	= NETLINK_CONNECTED;

		nlk->dst_portid = nladdr->nl_pid;

		nlk->dst_group  = ffs(nladdr->nl_groups);

		/* dst_portid and dst_group can be read locklessly */

		WRITE_ONCE(nlk->dst_portid, nladdr->nl_pid);

		WRITE_ONCE(nlk->dst_group, ffs(nladdr->nl_groups));

	}



	return err;
@@ -1123,8 +1125,9 @@ static int netlink_getname(struct socket *sock, struct sockaddr *addr, 
	nladdr->nl_pad = 0;



	if (peer) {

		nladdr->nl_pid = nlk->dst_portid;

		nladdr->nl_groups = netlink_group_mask(nlk->dst_group);

		/* Paired with WRITE_ONCE() in netlink_connect() */

		nladdr->nl_pid = READ_ONCE(nlk->dst_portid);

		nladdr->nl_groups = netlink_group_mask(READ_ONCE(nlk->dst_group));

	} else {

		/* Paired with WRITE_ONCE() in netlink_insert() */

		nladdr->nl_pid = READ_ONCE(nlk->portid);
@@ -1154,8 +1157,9 @@ static struct sock *netlink_getsockbyportid(struct sock *ssk, u32 portid) 


	/* Don't bother queuing skb if kernel socket has no input function */

	nlk = nlk_sk(sock);

	/* dst_portid can be changed in netlink_connect() */

	if (sock->sk_state == NETLINK_CONNECTED &&

	    nlk->dst_portid != nlk_sk(ssk)->portid) {

	    READ_ONCE(nlk->dst_portid) != nlk_sk(ssk)->portid) {

		sock_put(sock);

		return ERR_PTR(-ECONNREFUSED);

	}
@@ -1891,8 +1895,9 @@ static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) 
			goto out;

		netlink_skb_flags |= NETLINK_SKB_DST;

	} else {

		dst_portid = nlk->dst_portid;

		dst_group = nlk->dst_group;

		/* Paired with WRITE_ONCE() in netlink_connect() */

		dst_portid = READ_ONCE(nlk->dst_portid);

		dst_group = READ_ONCE(nlk->dst_group);

	}



	/* Paired with WRITE_ONCE() in netlink_insert() */