Eric Dumazet 9707960ecf inet: annotate date races around sk->sk_txhash ... [ Upstream commit b71eaed8c04f72a919a9c44e83e4ee254e69e7f3 ] UDP sendmsg() path can be lockless, it is possible for another thread to re-connect an change sk->sk_txhash under us. There is no serious impact, but we can use READ_ONCE()/WRITE_ONCE() pair to document the race. BUG: KCSAN: data-race in __ip4_datagram_connect / skb_set_owner_w write to 0xffff88813397920c of 4 bytes by task 30997 on cpu 1: sk_set_txhash include/net/sock.h:1937 [inline] __ip4_datagram_connect+0x69e/0x710 net/ipv4/datagram.c:75 __ip6_datagram_connect+0x551/0x840 net/ipv6/datagram.c:189 ip6_datagram_connect+0x2a/0x40 net/ipv6/datagram.c:272 inet_dgram_connect+0xfd/0x180 net/ipv4/af_inet.c:580 __sys_connect_file net/socket.c:1837 [inline] __sys_connect+0x245/0x280 net/socket.c:1854 __do_sys_connect net/socket.c:1864 [inline] __se_sys_connect net/socket.c:1861 [inline] __x64_sys_connect+0x3d/0x50 net/socket.c:1861 do_syscall_64+0x4a/0x90 arch/x86/entry/common.c:47 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffff88813397920c of 4 bytes by task 31039 on cpu 0: skb_set_hash_from_sk include/net/sock.h:2211 [inline] skb_set_owner_w+0x118/0x220 net/core/sock.c:2101 sock_alloc_send_pskb+0x452/0x4e0 net/core/sock.c:2359 sock_alloc_send_skb+0x2d/0x40 net/core/sock.c:2373 __ip6_append_data+0x1743/0x21a0 net/ipv6/ip6_output.c:1621 ip6_make_skb+0x258/0x420 net/ipv6/ip6_output.c:1983 udpv6_sendmsg+0x160a/0x16b0 net/ipv6/udp.c:1527 inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:642 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] ____sys_sendmsg+0x360/0x4d0 net/socket.c:2350 ___sys_sendmsg net/socket.c:2404 [inline] __sys_sendmmsg+0x315/0x4b0 net/socket.c:2490 __do_sys_sendmmsg net/socket.c:2519 [inline] __se_sys_sendmmsg net/socket.c:2516 [inline] __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2516 do_syscall_64+0x4a/0x90 arch/x86/entry/common.c:47 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0xbca3c43d -> 0xfdb309e0 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 31039 Comm: syz-executor.2 Not tainted 5.13.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2021-06-30 08:47:21 -04:00
..
9p	net: 9p: drop duplicate word in comment	2020-07-15 20:34:11 -07:00
bluetooth	Bluetooth: verify AMP hci_chan before amp_destroy	2021-05-14 09:49:55 +02:00
caif	net: caif: add proper error handling	2021-06-10 13:39:24 +02:00
iucv	net/af_iucv: clean up function prototypes	2020-05-19 12:50:14 -07:00
netfilter	netfilter: flowtable: Remove redundant hw refresh bit	2021-06-03 09:00:37 +02:00
netns	net: xfrm: Localize sequence counter per network namespace	2021-04-14 08:42:05 +02:00
nfc	NFC: nci: fix memory leak in nci_allocate_device	2021-05-28 13:17:43 +02:00
phonet
sctp	net: sctp: Fix IPv6 ancestor_size calc in sctp_copy_descendant	2020-09-20 14:15:12 -07:00
tc_act	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-10-15 12:43:21 -07:00
6lowpan.h	6lowpan: Replace zero-length array with flexible-array member	2020-02-28 14:51:30 +01:00
act_api.h	net: sched: fix err handler in tcf_action_init()	2021-04-14 08:42:05 +02:00
addrconf.h	net: bridge: mcast: fix broken length + header check for MRDv6 Adv.	2021-05-14 09:50:44 +02:00
af_ieee802154.h
af_rxrpc.h	rxrpc: Make rxrpc_kernel_get_srtt() indicate validity	2020-08-20 18:21:28 +01:00
af_unix.h	unix: uses an atomic type for scm files accounting	2020-02-28 12:12:53 -08:00
af_vsock.h	vsock: add local transport support in the vsock core	2019-12-11 15:01:23 -08:00
ah.h
arp.h
atmclip.h
ax25.h
ax88796.h
bareudp.h	bareudp: Reverted support to enable & disable rx metadata collection	2020-07-21 18:30:47 -07:00
bond_3ad.h
bond_alb.h	bonding/alb: Add helper functions to get the xmit slave	2020-05-01 12:15:37 -07:00
bond_options.h
bonding.h	bonding: fix feature flag setting at init time	2020-12-08 11:26:08 -08:00
bpf_sk_storage.h	bpf: Change bpf_sk_storage_*() to accept ARG_PTR_TO_BTF_ID_SOCK_COMMON	2020-09-25 13:58:01 -07:00
busy_poll.h	net: Avoid overwriting valid skb->napi_id	2020-06-20 17:30:59 -07:00
calipso.h
cfg80211-wext.h
cfg80211.h	mac80211: properly handle A-MSDUs that start with an RFC 1042 header	2021-06-03 09:00:29 +02:00
cfg802154.h	cfg802154: Replace zero-length array with flexible-array member	2020-02-29 14:39:08 +01:00
checksum.h	saner calling conventions for csum_and_copy_..._user()	2020-08-20 15:45:15 -04:00
cipso_ipv4.h	cipso: Remove unused inline functions	2020-07-15 07:45:24 -07:00
cls_cgroup.h	bpf: Allow to retrieve cgroup v1 classid from v2 hooks	2020-03-27 19:40:38 -07:00
codel_impl.h
codel_qdisc.h
codel.h
compat.h	net: simplify cBPF setsockopt compat handling	2020-07-19 18:16:40 -07:00
datalink.h
dcbevent.h
dcbnl.h
devlink.h	devlink: Add enable_remote_dev_reset generic parameter	2020-10-09 12:06:53 -07:00
dn_dev.h
dn_fib.h	net: dn_fib: Replace zero-length array with flexible-array member	2020-02-29 21:52:20 -08:00
dn_neigh.h
dn_nsp.h
dn_route.h
dn.h
dsa.h	net: dsa: propagate switchdev vlan_filtering prepare phase to drivers	2020-10-05 05:56:48 -07:00
dsfield.h	ipv6: Annotate bitwise IPv6 dsfield pointer cast	2019-12-16 16:09:44 -08:00
dst_cache.h
dst_metadata.h
dst_ops.h	net/dst: use a smaller percpu_counter batch for dst entries accounting	2020-05-08 21:33:33 -07:00
dst.h	net: Consolidate common blackhole dst ops	2021-03-30 14:32:05 +02:00
erspan.h	erspan: Add type I version 0 support.	2020-05-05 13:23:29 -07:00
esp.h	ESP: Export esp_output_fill_trailer function	2020-02-19 13:52:32 +01:00
espintcp.h	xfrm: espintcp: save and call old ->sk_destruct	2020-04-20 07:34:16 +02:00
ethoc.h
failover.h
fib_notifier.h	ipv6: Remove old route notifications and convert listeners	2019-12-24 22:37:30 -08:00
fib_rules.h	fib: use indirect call wrappers in the most common fib_rules_ops	2020-07-28 17:42:31 -07:00
firewire.h
flow_dissector.h	net/flow_dissector: add packet hash dissection	2020-07-24 15:23:31 -07:00
flow_offload.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next	2020-08-05 20:13:21 -07:00
flow.h	ipv4: Initialize flowi4_multipath_hash in data path	2020-09-14 14:54:56 -07:00
fou.h
fq_impl.h	net/fq_impl: use skb_get_hash instead of skb_get_hash_perturb	2020-07-31 09:24:24 +02:00
fq.h	net/fq_impl: use skb_get_hash instead of skb_get_hash_perturb	2020-07-31 09:24:24 +02:00
garp.h	treewide: Use sizeof_field() macro	2019-12-09 10:36:44 -08:00
gen_stats.h
genetlink.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-10-05 18:40:01 -07:00
geneve.h
gre.h
gro_cells.h
gtp.h
gue.h	GUE: Fix a typo	2020-06-22 21:12:44 -07:00
hwbm.h
icmp.h	net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending	2021-03-04 11:38:46 +01:00
ieee80211_radiotap.h	mac80211: add radiotap flag to prevent sequence number overwrite	2020-07-31 09:27:00 +02:00
ieee802154_netdev.h
if_inet6.h	ipv6: Replace zero-length array with flexible-array	2020-05-11 13:18:54 -07:00
ife.h
ila.h
inet_common.h	bpf: Allow any port in bpf_bind helper	2020-05-09 00:48:20 +02:00
inet_connection_sock.h	tcp: relookup sock for RST+ACK packets handled by obsolete req sock	2021-03-30 14:31:59 +02:00
inet_ecn.h	inet_ecn: Fix endianness of checksum update when setting ECT(1)	2020-12-01 17:16:54 -08:00
inet_frag.h
inet_hashtables.h	tcp: fix race condition when creating child sockets from syncookies	2020-11-23 16:32:33 -08:00
inet_sock.h	inet: remove inet_sk_copy_descendant()	2020-08-26 07:33:19 -07:00
inet_timewait_sock.h
inet6_connection_sock.h
inet6_hashtables.h	net: Track socket refcounts in skb_steal_sock()	2020-03-30 13:45:04 -07:00
inetpeer.h
ip_fib.h	ipv4: nexthop version of fib_info_nh_uses_dev	2020-05-26 16:06:07 -07:00
ip_tunnels.h	ip_tunnels: Set tunnel option flag when tunnel metadata is present	2020-11-13 16:58:10 -08:00
ip_vs.h	ipvs: remove dependency on ip6_tables	2020-08-31 23:06:51 +02:00
ip.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-10-05 18:40:01 -07:00
ip6_checksum.h	tcp: remove indirect calls for icsk->icsk_af_ops->send_check	2020-06-20 17:47:53 -07:00
ip6_fib.h	net: ip6_fib.h: drop duplicate word in comment	2020-07-15 20:34:11 -07:00
ip6_route.h	ipv6: lift copy_from_user out of ipv6_route_ioctl	2020-05-18 17:35:02 -07:00
ip6_tunnel.h
ipcomp.h
ipconfig.h
ipv6_frag.h	ipv6: Remove dependency of ipv6_frag_thdr_truncated on ipv6 module	2020-11-19 10:49:50 -08:00
ipv6_stubs.h	ipv6: add ipv6_fragment hook in ipv6_stub	2020-08-31 12:26:39 -07:00
ipv6.h	ipv6: Remove dependency of ipv6_frag_thdr_truncated on ipv6 module	2020-11-19 10:49:50 -08:00
ipx.h	bonding/alb: properly access headers in bond_alb_xmit()	2020-02-05 14:28:09 +01:00
iw_handler.h
kcm.h
l3mdev.h	l3mdev: add infrastructure for table to VRF mapping	2020-06-20 17:22:22 -07:00
lag.h
lapb.h
lib80211.h
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h
llc_if.h
llc_pdu.h
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h
llc.h
lwtunnel.h	net: add net available in build_state	2020-03-29 22:30:57 -07:00
mac80211.h	mac80211: Fix NULL ptr deref for injected rate info	2021-06-23 14:42:52 +02:00
mac802154.h
macsec.h	net: macsec: add support for getting offloaded stats	2020-03-26 20:17:36 -07:00
mip6.h	net: mip6: Replace zero-length array with flexible-array member	2020-03-02 11:16:27 -08:00
mld.h	net: ipv6: mld: Replace zero-length array with flexible-array member	2020-02-29 21:52:20 -08:00
mpls_iptunnel.h	net: mpls: Replace zero-length array with flexible-array member	2020-02-28 12:08:37 -08:00
mpls.h	net: Make mpls_entry_encode() available for generic users	2020-05-29 21:20:20 -07:00
mptcp.h	net: tcp: drop unused function argument from mptcp_incoming_options	2020-09-24 20:17:01 -07:00
mrp.h	treewide: Use sizeof_field() macro	2019-12-09 10:36:44 -08:00
ncsi.h
ndisc.h	ipv6: ndisc: adjust ndisc_ifinfo_sysctl_change prototype	2020-08-24 06:40:07 -07:00
neighbour.h	net: Exempt multicast addresses from five-second neighbor lifetime	2020-11-13 14:24:39 -08:00
net_failover.h
net_namespace.h	net: make get_net_ns return error if NET_NS is disabled	2021-06-23 14:42:44 +02:00
net_ratelimit.h
netevent.h
netlabel.h
netlink.h	netlink: export policy in extended ACK	2020-10-09 20:22:32 -07:00
netprio_cgroup.h
netrom.h
nexthop.h	ipv6: fix suspecious RCU usage warning	2021-03-30 14:31:57 +02:00
nl802154.h
nsh.h
p8022.h
page_pool.h	mm: fix struct page layout on 32-bit systems	2021-05-19 10:13:17 +02:00
pie.h	pie: realign comment	2020-03-04 13:25:55 -08:00
ping.h
pkt_cls.h	net: zero-initialize tc skb extension on allocation	2021-06-03 09:00:51 +02:00
pkt_sched.h	net: sched: fix tx action rescheduling issue during deactivation	2021-06-03 09:00:47 +02:00
pptp.h
protocol.h
psample.h
psnap.h
raw.h
rawv6.h
red.h	sch_red: fix off-by-one checks in red_check_params()	2021-04-14 08:42:07 +02:00
regulatory.h	net/wireless: regulatory.h: drop duplicate word in comment	2020-07-31 09:24:23 +02:00
request_sock.h	tcp: bpf: Optionally store mac header in TCP_SAVE_SYN	2020-08-24 14:35:00 -07:00
rose.h
route.h	Remove DST_HOST	2020-03-23 21:57:44 -07:00
rpl.h	net: ipv6: Use struct_size() helper and kcalloc()	2020-06-23 20:27:09 -07:00
rsi_91x.h
rtnetlink.h	can: dev: Move device back to init netns on owning netns delete	2021-03-30 14:32:08 +02:00
rtnh.h
sch_generic.h	net: sched: fix packet stuck problem for lockless qdisc	2021-06-03 09:00:47 +02:00
scm.h	fs: Move __scm_install_fd() to __receive_fd()	2020-07-13 11:03:44 -07:00
secure_seq.h
seg6_hmac.h
seg6_local.h
seg6.h	seg6: fix seg6_validate_srh() to avoid slab-out-of-bounds	2020-06-04 15:39:32 -07:00
slhc_vj.h
smc.h	net/smc: introduce CHID callback for ISM devices	2020-09-28 15:19:03 -07:00
snmp.h
sock_reuseport.h	net: sock_reuseport: Replace zero-length array with flexible-array member	2020-02-29 21:52:19 -08:00
sock.h	inet: annotate date races around sk->sk_txhash	2021-06-30 08:47:21 -04:00
Space.h
stp.h
strparser.h
switchdev.h	switchdev: mrp: Remove SWITCHDEV_ATTR_ID_MRP_PORT_STAT	2021-02-17 11:02:29 +01:00
tcp_states.h
tcp.h	tcp: fix SO_RCVLOWAT related hangs under mem pressure	2021-03-04 11:37:33 +01:00
timewait_sock.h
tipc.h
tls_toe.h
tls.h	net/tls: Fix use-after-free after the TLS device goes down and up	2021-06-10 13:39:18 +02:00
transp_v6.h	tcp: move ipv4_specific to tcp include file	2020-06-23 20:10:15 -07:00
tso.h	net: tso: cache transport header length	2020-06-18 20:46:23 -07:00
tun_proto.h
udp_tunnel.h	udp_tunnel: add the ability to share port tables	2020-09-28 12:50:12 -07:00
udp.h	udp: ipv4: manipulate network header of NATed UDP GRO fraglist	2021-02-10 09:29:23 +01:00
udplite.h
vsock_addr.h
vxlan.h	net: sched: only keep the available bits when setting vxlan md->gbp	2020-09-14 16:49:39 -07:00
wext.h
wimax.h	net: wimax: fix duplicate words in comments	2020-07-15 20:34:02 -07:00
x25.h	net/x25: add new state X25_STATE_5	2019-12-09 10:28:43 -08:00
x25device.h
xdp_priv.h
xdp_sock_drv.h	xsk: i40e: ice: ixgbe: mlx5: Test for dma_need_sync earlier for better performance	2020-08-31 21:15:04 +02:00
xdp_sock.h	xsk: Fix race in SKB mode transmit with shared cq	2021-01-17 14:17:05 +01:00
xdp.h	xdp: Remove the xdp_attachment_flags_ok() callback	2020-12-09 16:27:42 +01:00
xfrm.h	xfrm: Fix NULL pointer dereference on policy lookup	2021-04-14 08:42:06 +02:00
xsk_buff_pool.h	xsk: Fix race in SKB mode transmit with shared cq	2021-01-17 14:17:05 +01:00