diff options
author | Kuniyuki Iwashima <kuniyu@amazon.com> | 2024-06-04 19:52:29 +0300 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-06-21 15:38:19 +0300 |
commit | 4e38d6c04943a52ee8f8cc87bb0e9040647a35fb (patch) | |
tree | 70f80175fae26d04eb395d5605595cfaf52d8c15 /Documentation/watchdog | |
parent | 45733e981e8cac0fd85ced9e4f1f8d71c3988d04 (diff) | |
download | linux-4e38d6c04943a52ee8f8cc87bb0e9040647a35fb.tar.xz |
af_unix: Annotate data-race of sk->sk_state in unix_inq_len().
[ Upstream commit 3a0f38eb285c8c2eead4b3230c7ac2983707599d ]
ioctl(SIOCINQ) calls unix_inq_len() that checks sk->sk_state first
and returns -EINVAL if it's TCP_LISTEN.
Then, for SOCK_STREAM sockets, unix_inq_len() returns the number of
bytes in recvq.
However, unix_inq_len() does not hold unix_state_lock(), and the
concurrent listen() might change the state after checking sk->sk_state.
If the race occurs, 0 is returned for the listener, instead of -EINVAL,
because the length of skb with embryo is 0.
We could hold unix_state_lock() in unix_inq_len(), but it's overkill
given the result is true for pre-listen() TCP_CLOSE state.
So, let's use READ_ONCE() for sk->sk_state in unix_inq_len().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'Documentation/watchdog')
0 files changed, 0 insertions, 0 deletions