Eric Dumazet d0ac89f6f9 net: deal with most data-races in sk_wait_event() ... __condition is evaluated twice in sk_wait_event() macro. First invocation is lockless, and reads can race with writes, as spotted by syzbot. BUG: KCSAN: data-race in sk_stream_wait_connect / tcp_disconnect write to 0xffff88812d83d6a0 of 4 bytes by task 9065 on cpu 1: tcp_disconnect+0x2cd/0xdb0 inet_shutdown+0x19e/0x1f0 net/ipv4/af_inet.c:911 __sys_shutdown_sock net/socket.c:2343 [inline] __sys_shutdown net/socket.c:2355 [inline] __do_sys_shutdown net/socket.c:2363 [inline] __se_sys_shutdown+0xf8/0x140 net/socket.c:2361 __x64_sys_shutdown+0x31/0x40 net/socket.c:2361 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffff88812d83d6a0 of 4 bytes by task 9040 on cpu 0: sk_stream_wait_connect+0x1de/0x3a0 net/core/stream.c:75 tcp_sendmsg_locked+0x2e4/0x2120 net/ipv4/tcp.c:1266 tcp_sendmsg+0x30/0x50 net/ipv4/tcp.c:1484 inet6_sendmsg+0x63/0x80 net/ipv6/af_inet6.c:651 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] __sys_sendto+0x246/0x300 net/socket.c:2142 __do_sys_sendto net/socket.c:2154 [inline] __se_sys_sendto net/socket.c:2150 [inline] __x64_sys_sendto+0x78/0x90 net/socket.c:2150 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x00000000 -> 0x00000068 Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2023-05-10 10:03:32 +01:00
..
addr.c
addr.h
bcast.c	net: tipc: fix FB_MTU eat two pages	2021-06-28 13:31:57 -07:00
bcast.h
bearer.c	net: rename reference+tracking helpers	2022-06-09 21:52:55 -07:00
bearer.h	tipc: constify dev_addr passing	2021-10-13 09:40:46 -07:00
core.c	tipc: fix use-after-free Read in tipc_named_reinit	2022-06-17 11:39:10 +01:00
core.h	tipc: simplify the finalize work queue	2021-05-18 13:22:09 -07:00
crypto.c	tipc: Remove completion function scaffolding	2023-02-13 18:35:15 +08:00
crypto.h
diag.c
discover.c	treewide: Convert del_timer*() to timer_shutdown*()	2022-12-25 13:38:09 -08:00
discover.h
eth_media.c	tipc: constify dev_addr passing	2021-10-13 09:40:46 -07:00
group.c
group.h
ib_media.c	tipc: constify dev_addr passing	2021-10-13 09:40:46 -07:00
Kconfig
link.c	tipc: Fix potential OOB in tipc_link_proto_rcv()	2022-12-06 12:58:38 +01:00
link.h	tipc: simplify the finalize work queue	2021-05-18 13:22:09 -07:00
Makefile
monitor.c	treewide: Convert del_timer*() to timer_shutdown*()	2022-12-25 13:38:09 -08:00
monitor.h
msg.c	net: tipc: replace align() with ALIGN in msg.c	2021-06-28 13:31:57 -07:00
msg.h	net: tipc: remove unused static inlines	2022-01-27 13:53:27 +00:00
name_distr.c	net/tipc: Remove unused struct distr_queue_item	2022-09-29 18:48:32 -07:00
name_distr.h
name_table.c	tipc: cleanup unused function	2022-06-17 11:43:57 +01:00
name_table.h	tipc: cleanup unused function	2022-06-17 11:43:57 +01:00
net.c	tipc: simplify the finalize work queue	2021-05-18 13:22:09 -07:00
net.h
netlink_compat.c	string_helpers: Move string_is_valid() to the header	2023-02-09 22:30:24 -08:00
netlink.c	genetlink: start to validate reserved header bytes	2022-08-29 12:47:15 +01:00
netlink.h
node.c	tipc: fix unexpected link reset due to discovery messages	2023-01-06 12:53:10 +00:00
node.h
socket.c	net: deal with most data-races in sk_wait_event()	2023-05-10 10:03:32 +01:00
socket.h
subscr.c	tipc:subscr.c: fix a spelling mistake	2021-06-10 13:48:43 -07:00
subscr.h
sysctl.c
topsrv.c	net/sock: Introduce trace_sk_data_ready()	2023-01-23 11:26:50 +00:00
topsrv.h
trace.c
trace.h
udp_media.c	tipc: wait and exit until all work queues are done	2021-05-17 14:07:48 -07:00
udp_media.h