mirror of
https://github.com/hardkernel/linux.git
synced 2026-06-05 18:41:58 +09:00
af_unix: Annotate data-races around sk->sk_state in sendmsg() and recvmsg().
[ Upstream commit 8a34d4e8d9742a24f74998f45a6a98edd923319b ] The following functions read sk->sk_state locklessly and proceed only if the state is TCP_ESTABLISHED. * unix_stream_sendmsg * unix_stream_read_generic * unix_seqpacket_sendmsg * unix_seqpacket_recvmsg Let's use READ_ONCE() there. Fixes:a05d2ad1c1("af_unix: Only allow recv on connected seqpacket sockets.") Fixes:1da177e4c3("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
committed by
Greg Kroah-Hartman
parent
018fc5d9db
commit
f53cf0449e
@@ -2190,7 +2190,7 @@ static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg,
|
|||||||
}
|
}
|
||||||
|
|
||||||
if (msg->msg_namelen) {
|
if (msg->msg_namelen) {
|
||||||
err = sk->sk_state == TCP_ESTABLISHED ? -EISCONN : -EOPNOTSUPP;
|
err = READ_ONCE(sk->sk_state) == TCP_ESTABLISHED ? -EISCONN : -EOPNOTSUPP;
|
||||||
goto out_err;
|
goto out_err;
|
||||||
} else {
|
} else {
|
||||||
err = -ENOTCONN;
|
err = -ENOTCONN;
|
||||||
@@ -2402,7 +2402,7 @@ static int unix_seqpacket_sendmsg(struct socket *sock, struct msghdr *msg,
|
|||||||
if (err)
|
if (err)
|
||||||
return err;
|
return err;
|
||||||
|
|
||||||
if (sk->sk_state != TCP_ESTABLISHED)
|
if (READ_ONCE(sk->sk_state) != TCP_ESTABLISHED)
|
||||||
return -ENOTCONN;
|
return -ENOTCONN;
|
||||||
|
|
||||||
if (msg->msg_namelen)
|
if (msg->msg_namelen)
|
||||||
@@ -2416,7 +2416,7 @@ static int unix_seqpacket_recvmsg(struct socket *sock, struct msghdr *msg,
|
|||||||
{
|
{
|
||||||
struct sock *sk = sock->sk;
|
struct sock *sk = sock->sk;
|
||||||
|
|
||||||
if (sk->sk_state != TCP_ESTABLISHED)
|
if (READ_ONCE(sk->sk_state) != TCP_ESTABLISHED)
|
||||||
return -ENOTCONN;
|
return -ENOTCONN;
|
||||||
|
|
||||||
return unix_dgram_recvmsg(sock, msg, size, flags);
|
return unix_dgram_recvmsg(sock, msg, size, flags);
|
||||||
@@ -2740,7 +2740,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state,
|
|||||||
size_t size = state->size;
|
size_t size = state->size;
|
||||||
unsigned int last_len;
|
unsigned int last_len;
|
||||||
|
|
||||||
if (unlikely(sk->sk_state != TCP_ESTABLISHED)) {
|
if (unlikely(READ_ONCE(sk->sk_state) != TCP_ESTABLISHED)) {
|
||||||
err = -EINVAL;
|
err = -EINVAL;
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user