Eric Dumazet 65531f5675 net: deal with most data-races in sk_wait_event() ... [ Upstream commit d0ac89f6f9879fae316c155de77b5173b3e2c9c9 ] __condition is evaluated twice in sk_wait_event() macro. First invocation is lockless, and reads can race with writes, as spotted by syzbot. BUG: KCSAN: data-race in sk_stream_wait_connect / tcp_disconnect write to 0xffff88812d83d6a0 of 4 bytes by task 9065 on cpu 1: tcp_disconnect+0x2cd/0xdb0 inet_shutdown+0x19e/0x1f0 net/ipv4/af_inet.c:911 __sys_shutdown_sock net/socket.c:2343 [inline] __sys_shutdown net/socket.c:2355 [inline] __do_sys_shutdown net/socket.c:2363 [inline] __se_sys_shutdown+0xf8/0x140 net/socket.c:2361 __x64_sys_shutdown+0x31/0x40 net/socket.c:2361 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffff88812d83d6a0 of 4 bytes by task 9040 on cpu 0: sk_stream_wait_connect+0x1de/0x3a0 net/core/stream.c:75 tcp_sendmsg_locked+0x2e4/0x2120 net/ipv4/tcp.c:1266 tcp_sendmsg+0x30/0x50 net/ipv4/tcp.c:1484 inet6_sendmsg+0x63/0x80 net/ipv6/af_inet6.c:651 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] __sys_sendto+0x246/0x300 net/socket.c:2142 __do_sys_sendto net/socket.c:2154 [inline] __se_sys_sendto net/socket.c:2150 [inline] __x64_sys_sendto+0x78/0x90 net/socket.c:2150 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x00000000 -> 0x00000068 Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-05-24 17:32:32 +01:00
..
addr.c	tipc: introduce new unified address type for internal use	2021-03-17 11:51:04 -07:00
addr.h	tipc: introduce new unified address type for internal use	2021-03-17 11:51:04 -07:00
bcast.c	net: tipc: fix FB_MTU eat two pages	2021-06-28 13:31:57 -07:00
bcast.h
bearer.c	net: rename reference+tracking helpers	2022-06-09 21:52:55 -07:00
bearer.h	tipc: constify dev_addr passing	2021-10-13 09:40:46 -07:00
core.c	tipc: fix use-after-free Read in tipc_named_reinit	2022-06-17 11:39:10 +01:00
core.h	tipc: simplify the finalize work queue	2021-05-18 13:22:09 -07:00
crypto.c	tipc: re-fetch skb cb after tipc_msg_validate	2022-11-28 18:07:31 -08:00
crypto.h	net/tipc: fix tipc header files for kernel-doc	2020-12-01 15:37:41 -08:00
diag.c
discover.c	tipc: check skb_linearize() return value in tipc_disc_rcv()	2022-11-21 20:50:24 -08:00
discover.h
eth_media.c	tipc: constify dev_addr passing	2021-10-13 09:40:46 -07:00
group.c	tipc: update address terminology in code	2020-11-27 17:34:01 -08:00
group.h	tipc: update address terminology in code	2020-11-27 17:34:01 -08:00
ib_media.c	tipc: constify dev_addr passing	2021-10-13 09:40:46 -07:00
Kconfig
link.c	tipc: Fix potential OOB in tipc_link_proto_rcv()	2022-12-06 12:58:38 +01:00
link.h	tipc: simplify the finalize work queue	2021-05-18 13:22:09 -07:00
Makefile
monitor.c	tipc: fix shift wrapping bug in map_get()	2022-09-02 12:26:29 +01:00
monitor.h
msg.c	net: tipc: replace align() with ALIGN in msg.c	2021-06-28 13:31:57 -07:00
msg.h	net: tipc: remove unused static inlines	2022-01-27 13:53:27 +00:00
name_distr.c	net/tipc: Remove unused struct distr_queue_item	2022-09-29 18:48:32 -07:00
name_distr.h	net/tipc: fix tipc header files for kernel-doc	2020-12-01 15:37:41 -08:00
name_table.c	tipc: cleanup unused function	2022-06-17 11:43:57 +01:00
name_table.h	tipc: cleanup unused function	2022-06-17 11:43:57 +01:00
net.c	tipc: simplify the finalize work queue	2021-05-18 13:22:09 -07:00
net.h
netlink.c	genetlink: start to validate reserved header bytes	2022-08-29 12:47:15 +01:00
netlink.h
netlink_compat.c	tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header	2022-11-07 19:53:40 -08:00
node.c	tipc: fix unexpected link reset due to discovery messages	2023-01-18 11:58:24 +01:00
node.h
socket.c	net: deal with most data-races in sk_wait_event()	2023-05-24 17:32:32 +01:00
socket.h
subscr.c	tipc:subscr.c: fix a spelling mistake	2021-06-10 13:48:43 -07:00
subscr.h	tipc: fix htmldoc and smatch warnings	2021-03-29 16:28:50 -07:00
sysctl.c
topsrv.c	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
topsrv.h
trace.c	net/tipc: fix various kernel-doc warnings	2020-12-01 15:37:46 -08:00
trace.h
udp_media.c	tipc: wait and exit until all work queues are done	2021-05-17 14:07:48 -07:00
udp_media.h