From nobody Wed Dec 17 23:56:56 2025 Received: from smtp.priv.miraclelinux.com (202x210x215x66.ap202.ftth.ucom.ne.jp [202.210.215.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4FE5A57CB0; Fri, 28 Jun 2024 05:40:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=202.210.215.66 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1719553243; cv=none; b=B0mrtYHSBK3/kBFDA2PwWjf9q9i2xHKryCfMWmHH2DKSY/AOmSmfACd+AKt47QRHQsDGXmT5RYBvjuyunkTTbMXngRXSbPhgbAiPrBBUi1LW78kOyo0lbJ1QqdQVixBn9Dbr3769wip0ey7WVQNE7l/2ajCRAeGrselyKzprzBQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1719553243; c=relaxed/simple; bh=Mi+aa3JSfwzotmfLl/omKBvWdtMGLKREDPAoze9thcs=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References; b=QUsN9+MgkvCIueg1I+TbhcjiLX6mn58e6nZx6tBbR0ezHmqkeoYtXSe8ODg4hgAFj29vuoMPOidvfRQYEkkRaCdfVLI6n7Vh0hF3EaoXA+AuIa9DU7kze6LFAl/dFEkoF6inpc6PdstsyBtp070jJOIorxvELMnjAu9QtmvhH1Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=miraclelinux.com; spf=pass smtp.mailfrom=miraclelinux.com; arc=none smtp.client-ip=202.210.215.66 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=miraclelinux.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=miraclelinux.com Received: from cip-lava-a.miraclelinux.com (cip-lava-a.miraclelinux.com [10.2.1.116]) by smtp.priv.miraclelinux.com (Postfix) with ESMTP id C2EB6140105; Fri, 28 Jun 2024 14:40:39 +0900 (JST) From: Kazunori Kobayashi To: netdev@vger.kernel.org Cc: stable@vger.kernel.org, linux-kernel@vger.kernel.org, hiraku.toyooka@miraclelinux.com, Kuniyuki Iwashima , Jakub Kicinski , Kazunori Kobayashi Subject: [PATCH 5.4 3/3] tcp: Fix data races around icsk->icsk_af_ops. Date: Mon, 17 Apr 2023 16:54:06 +0000 Message-Id: <20230417165406.26237-4-kazunori.kobayashi@miraclelinux.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20230417165406.26237-1-kazunori.kobayashi@miraclelinux.com> References: <20230417165406.26237-1-kazunori.kobayashi@miraclelinux.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima commit f49cd2f4d6170d27a2c61f1fecb03d8a70c91f57 upstream. setsockopt(IPV6_ADDRFORM) and tcp_v6_connect() change icsk->icsk_af_ops under lock_sock(), but tcp_(get|set)sockopt() read it locklessly. To avoid load/store tearing, we need to add READ_ONCE() and WRITE_ONCE() for the reads and writes. Thanks to Eric Dumazet for providing the syzbot report: BUG: KCSAN: data-race in tcp_setsockopt / tcp_v6_connect write to 0xffff88813c624518 of 8 bytes by task 23936 on cpu 0: tcp_v6_connect+0x5b3/0xce0 net/ipv6/tcp_ipv6.c:240 __inet_stream_connect+0x159/0x6d0 net/ipv4/af_inet.c:660 inet_stream_connect+0x44/0x70 net/ipv4/af_inet.c:724 __sys_connect_file net/socket.c:1976 [inline] __sys_connect+0x197/0x1b0 net/socket.c:1993 __do_sys_connect net/socket.c:2003 [inline] __se_sys_connect net/socket.c:2000 [inline] __x64_sys_connect+0x3d/0x50 net/socket.c:2000 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffff88813c624518 of 8 bytes by task 23937 on cpu 1: tcp_setsockopt+0x147/0x1c80 net/ipv4/tcp.c:3789 sock_common_setsockopt+0x5d/0x70 net/core/sock.c:3585 __sys_setsockopt+0x212/0x2b0 net/socket.c:2252 __do_sys_setsockopt net/socket.c:2263 [inline] __se_sys_setsockopt net/socket.c:2260 [inline] __x64_sys_setsockopt+0x62/0x70 net/socket.c:2260 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0xffffffff8539af68 -> 0xffffffff8539aff8 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 23937 Comm: syz-executor.5 Not tainted 6.0.0-rc4-syzkaller-00331-g4ed9c1e971b1-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot Reported-by: Eric Dumazet Signed-off-by: Kuniyuki Iwashima Signed-off-by: Jakub Kicinski Signed-off-by: Kazunori Kobayashi --- net/ipv4/tcp.c | 10 ++++++---- net/ipv6/ipv6_sockglue.c | 3 ++- net/ipv6/tcp_ipv6.c | 6 ++++-- 3 files changed, 12 insertions(+), 7 deletions(-) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 9a4a3f6d9cb06..445ccba7d0831 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -3204,8 +3204,9 @@ int tcp_setsockopt(struct sock *sk, int level, int op= tname, char __user *optval, const struct inet_connection_sock *icsk =3D inet_csk(sk); =20 if (level !=3D SOL_TCP) - return icsk->icsk_af_ops->setsockopt(sk, level, optname, - optval, optlen); + /* Paired with WRITE_ONCE() in do_ipv6_setsockopt() and tcp_v6_connect()= */ + return READ_ONCE(icsk->icsk_af_ops)->setsockopt(sk, level, optname, + optval, optlen); return do_tcp_setsockopt(sk, level, optname, optval, optlen); } EXPORT_SYMBOL(tcp_setsockopt); @@ -3729,8 +3730,9 @@ int tcp_getsockopt(struct sock *sk, int level, int op= tname, char __user *optval, struct inet_connection_sock *icsk =3D inet_csk(sk); =20 if (level !=3D SOL_TCP) - return icsk->icsk_af_ops->getsockopt(sk, level, optname, - optval, optlen); + /* Paired with WRITE_ONCE() in do_ipv6_setsockopt() and tcp_v6_connect()= */ + return READ_ONCE(icsk->icsk_af_ops)->getsockopt(sk, level, optname, + optval, optlen); return do_tcp_getsockopt(sk, level, optname, optval, optlen); } EXPORT_SYMBOL(tcp_getsockopt); diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index 4e4a34a40001b..1ceb6de0152ff 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -224,7 +224,8 @@ static int do_ipv6_setsockopt(struct sock *sk, int leve= l, int optname, local_bh_enable(); /* Paired with READ_ONCE(sk->sk_prot) in inet6_stream_ops */ WRITE_ONCE(sk->sk_prot, &tcp_prot); - icsk->icsk_af_ops =3D &ipv4_specific; + /* Paired with READ_ONCE() in tcp_(get|set)sockopt() */ + WRITE_ONCE(icsk->icsk_af_ops, &ipv4_specific); sk->sk_socket->ops =3D &inet_stream_ops; sk->sk_family =3D PF_INET; tcp_sync_mss(sk, icsk->icsk_pmtu_cookie); diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index 7cb622d300aa2..7ad50bb1941c7 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -236,7 +236,8 @@ static int tcp_v6_connect(struct sock *sk, struct socka= ddr *uaddr, sin.sin_port =3D usin->sin6_port; sin.sin_addr.s_addr =3D usin->sin6_addr.s6_addr32[3]; =20 - icsk->icsk_af_ops =3D &ipv6_mapped; + /* Paired with READ_ONCE() in tcp_(get|set)sockopt() */ + WRITE_ONCE(icsk->icsk_af_ops, &ipv6_mapped); sk->sk_backlog_rcv =3D tcp_v4_do_rcv; #ifdef CONFIG_TCP_MD5SIG tp->af_specific =3D &tcp_sock_ipv6_mapped_specific; @@ -246,7 +247,8 @@ static int tcp_v6_connect(struct sock *sk, struct socka= ddr *uaddr, =20 if (err) { icsk->icsk_ext_hdr_len =3D exthdrlen; - icsk->icsk_af_ops =3D &ipv6_specific; + /* Paired with READ_ONCE() in tcp_(get|set)sockopt() */ + WRITE_ONCE(icsk->icsk_af_ops, &ipv6_specific); sk->sk_backlog_rcv =3D tcp_v6_do_rcv; #ifdef CONFIG_TCP_MD5SIG tp->af_specific =3D &tcp_sock_ipv6_specific; --=20 2.39.2