Patch "af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg" has been added to the 4.19-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg

to the 4.19-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     af_unix-fix-data-races-in-unix_release_sock-unix_str.patch
and it can be found in the queue-4.19 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit d2aba116e6fd284f879ffaa655e62dccd63868c2
Author: Breno Leitao <leitao@xxxxxxxxxx>
Date:   Thu May 9 01:14:46 2024 -0700

    af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
    
    [ Upstream commit 540bf24fba16b88c1b3b9353927204b4f1074e25 ]
    
    A data-race condition has been identified in af_unix. In one data path,
    the write function unix_release_sock() atomically writes to
    sk->sk_shutdown using WRITE_ONCE. However, on the reader side,
    unix_stream_sendmsg() does not read it atomically. Consequently, this
    issue is causing the following KCSAN splat to occur:
    
            BUG: KCSAN: data-race in unix_release_sock / unix_stream_sendmsg
    
            write (marked) to 0xffff88867256ddbb of 1 bytes by task 7270 on cpu 28:
            unix_release_sock (net/unix/af_unix.c:640)
            unix_release (net/unix/af_unix.c:1050)
            sock_close (net/socket.c:659 net/socket.c:1421)
            __fput (fs/file_table.c:422)
            __fput_sync (fs/file_table.c:508)
            __se_sys_close (fs/open.c:1559 fs/open.c:1541)
            __x64_sys_close (fs/open.c:1541)
            x64_sys_call (arch/x86/entry/syscall_64.c:33)
            do_syscall_64 (arch/x86/entry/common.c:?)
            entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
    
            read to 0xffff88867256ddbb of 1 bytes by task 989 on cpu 14:
            unix_stream_sendmsg (net/unix/af_unix.c:2273)
            __sock_sendmsg (net/socket.c:730 net/socket.c:745)
            ____sys_sendmsg (net/socket.c:2584)
            __sys_sendmmsg (net/socket.c:2638 net/socket.c:2724)
            __x64_sys_sendmmsg (net/socket.c:2753 net/socket.c:2750 net/socket.c:2750)
            x64_sys_call (arch/x86/entry/syscall_64.c:33)
            do_syscall_64 (arch/x86/entry/common.c:?)
            entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
    
            value changed: 0x01 -> 0x03
    
    The line numbers are related to commit dd5a440a31fa ("Linux 6.9-rc7").
    
    Commit e1d09c2c2f57 ("af_unix: Fix data races around sk->sk_shutdown.")
    addressed a comparable issue in the past regarding sk->sk_shutdown.
    However, it overlooked resolving this particular data path.
    This patch only offending unix_stream_sendmsg() function, since the
    other reads seem to be protected by unix_state_lock() as discussed in
    Link: https://lore.kernel.org/all/20240508173324.53565-1-kuniyu@xxxxxxxxxx/
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Breno Leitao <leitao@xxxxxxxxxx>
    Reviewed-by: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240509081459.2807828-1-leitao@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 921b7e355b9b9..02100e62bf608 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1895,7 +1895,7 @@ static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg,
 			goto out_err;
 	}
 
-	if (sk->sk_shutdown & SEND_SHUTDOWN)
+	if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN)
 		goto pipe_err;
 
 	while (sent < len) {




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux