Eric Dumazet 65531f5675 net: deal with most data-races in sk_wait_event() ... [ Upstream commit d0ac89f6f9 ] __condition is evaluated twice in sk_wait_event() macro. First invocation is lockless, and reads can race with writes, as spotted by syzbot. BUG: KCSAN: data-race in sk_stream_wait_connect / tcp_disconnect write to 0xffff88812d83d6a0 of 4 bytes by task 9065 on cpu 1: tcp_disconnect+0x2cd/0xdb0 inet_shutdown+0x19e/0x1f0 net/ipv4/af_inet.c:911 __sys_shutdown_sock net/socket.c:2343 [inline] __sys_shutdown net/socket.c:2355 [inline] __do_sys_shutdown net/socket.c:2363 [inline] __se_sys_shutdown+0xf8/0x140 net/socket.c:2361 __x64_sys_shutdown+0x31/0x40 net/socket.c:2361 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffff88812d83d6a0 of 4 bytes by task 9040 on cpu 0: sk_stream_wait_connect+0x1de/0x3a0 net/core/stream.c:75 tcp_sendmsg_locked+0x2e4/0x2120 net/ipv4/tcp.c:1266 tcp_sendmsg+0x30/0x50 net/ipv4/tcp.c:1484 inet6_sendmsg+0x63/0x80 net/ipv6/af_inet6.c:651 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] __sys_sendto+0x246/0x300 net/socket.c:2142 __do_sys_sendto net/socket.c:2154 [inline] __se_sys_sendto net/socket.c:2150 [inline] __x64_sys_sendto+0x78/0x90 net/socket.c:2150 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x00000000 -> 0x00000068 Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-05-24 17:32:32 +01:00
..
Kconfig	…
Makefile	…
addr.c	…
addr.h	…
bcast.c	…
bcast.h	…
bearer.c	net: rename reference+tracking helpers	2022-06-09 21:52:55 -07:00
bearer.h	…
core.c	tipc: fix use-after-free Read in tipc_named_reinit	2022-06-17 11:39:10 +01:00
core.h	…
crypto.c	tipc: re-fetch skb cb after tipc_msg_validate	2022-11-28 18:07:31 -08:00
crypto.h	…
diag.c	…
discover.c	tipc: check skb_linearize() return value in tipc_disc_rcv()	2022-11-21 20:50:24 -08:00
discover.h	…
eth_media.c	…
group.c	…
group.h	…
ib_media.c	…
link.c	tipc: Fix potential OOB in tipc_link_proto_rcv()	2022-12-06 12:58:38 +01:00
link.h	…
monitor.c	tipc: fix shift wrapping bug in map_get()	2022-09-02 12:26:29 +01:00
monitor.h	…
msg.c	…
msg.h	net: tipc: remove unused static inlines	2022-01-27 13:53:27 +00:00
name_distr.c	net/tipc: Remove unused struct distr_queue_item	2022-09-29 18:48:32 -07:00
name_distr.h	…
name_table.c	tipc: cleanup unused function	2022-06-17 11:43:57 +01:00
name_table.h	tipc: cleanup unused function	2022-06-17 11:43:57 +01:00
net.c	…
net.h	…
netlink.c	genetlink: start to validate reserved header bytes	2022-08-29 12:47:15 +01:00
netlink.h	…
netlink_compat.c	tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header	2022-11-07 19:53:40 -08:00
node.c	tipc: fix unexpected link reset due to discovery messages	2023-01-18 11:58:24 +01:00
node.h	…
socket.c	net: deal with most data-races in sk_wait_event()	2023-05-24 17:32:32 +01:00
socket.h	…
subscr.c	…
subscr.h	…
sysctl.c	…
topsrv.c	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
topsrv.h	…
trace.c	…
trace.h	…
udp_media.c	…
udp_media.h	…