Commit a9f59707 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

net: udp: annotate data race around udp_sk(sk)->corkflag 



up->corkflag field can be read or written without any lock.
Annotate accesses to avoid possible syzbot/KCSAN reports.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 103bde37

net/ipv4/udp.c

+5 −5
Original line number Diff line number Diff line
@@ -1053,7 +1053,7 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) 
	__be16 dport;

	u8  tos;

	int err, is_udplite = IS_UDPLITE(sk);

	int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;

	int corkreq = READ_ONCE(up->corkflag) || msg->msg_flags&MSG_MORE;

	int (*getfrag)(void *, char *, int, int, int, struct sk_buff *);

	struct sk_buff *skb;

	struct ip_options_data opt_copy;
@@ -1361,7 +1361,7 @@ int udp_sendpage(struct sock *sk, struct page *page, int offset, 
	}



	up->len += size;

	if (!(up->corkflag || (flags&MSG_MORE)))

	if (!(READ_ONCE(up->corkflag) || (flags&MSG_MORE)))

		ret = udp_push_pending_frames(sk);

	if (!ret)

		ret = size;
@@ -2662,9 +2662,9 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname, 
	switch (optname) {

	case UDP_CORK:

		if (val != 0) {

			up->corkflag = 1;

			WRITE_ONCE(up->corkflag, 1);

		} else {

			up->corkflag = 0;

			WRITE_ONCE(up->corkflag, 0);

			lock_sock(sk);

			push_pending_frames(sk);

			release_sock(sk);
@@ -2787,7 +2787,7 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname, 


	switch (optname) {

	case UDP_CORK:

		val = up->corkflag;

		val = READ_ONCE(up->corkflag);

		break;



	case UDP_ENCAP:

net/ipv6/udp.c

+1 −1
Original line number Diff line number Diff line
@@ -1303,7 +1303,7 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) 
	int addr_len = msg->msg_namelen;

	bool connected = false;

	int ulen = len;

	int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;

	int corkreq = READ_ONCE(up->corkflag) || msg->msg_flags&MSG_MORE;

	int err;

	int is_udplite = IS_UDPLITE(sk);

	int (*getfrag)(void *, char *, int, int, int, struct sk_buff *);