diff options
| author | Eric Dumazet <edumazet@google.com> | 2024-03-28 17:40:29 +0300 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2024-03-30 01:03:10 +0300 |
| commit | 60557969951304dad829f2829019907dfb43ecb3 (patch) | |
| tree | 10496cd31f28970e7294766127d8a3fdc27cd213 /net | |
| parent | 46dc11bee2d5272f200ac419f9e7e238c246b802 (diff) | |
| download | linux-60557969951304dad829f2829019907dfb43ecb3.tar.xz | |
udp: annotate data-race in __udp_enqueue_schedule_skb()
sk->sk_rcvbuf is read locklessly twice, while other threads
could change its value.
Use a READ_ONCE() to annotate the race.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20240328144032.1864988-2-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv4/udp.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 531882f321f2..6a39e7fa0616 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -1492,13 +1492,14 @@ int __udp_enqueue_schedule_skb(struct sock *sk, struct sk_buff *skb) struct sk_buff_head *list = &sk->sk_receive_queue; int rmem, err = -ENOMEM; spinlock_t *busy = NULL; - int size; + int size, rcvbuf; - /* try to avoid the costly atomic add/sub pair when the receive - * queue is full; always allow at least a packet + /* Immediately drop when the receive queue is full. + * Always allow at least one packet. */ rmem = atomic_read(&sk->sk_rmem_alloc); - if (rmem > sk->sk_rcvbuf) + rcvbuf = READ_ONCE(sk->sk_rcvbuf); + if (rmem > rcvbuf) goto drop; /* Under mem pressure, it might be helpful to help udp_recvmsg() @@ -1507,7 +1508,7 @@ int __udp_enqueue_schedule_skb(struct sock *sk, struct sk_buff *skb) * - Less cache line misses at copyout() time * - Less work at consume_skb() (less alien page frag freeing) */ - if (rmem > (sk->sk_rcvbuf >> 1)) { + if (rmem > (rcvbuf >> 1)) { skb_condense(skb); busy = busylock_acquire(sk); |