Kuniyuki Iwashima
0bc36c0650
af_unix: Fix data-races around user->unix_inflight.
user->unix_inflight is changed under spin_lock(unix_gc_lock),
but too_many_unix_fds() reads it locklessly.
Let's annotate the write/read accesses to user->unix_inflight.
BUG: KCSAN: data-race in unix_attach_fds / unix_inflight
write to 0xffffffff8546f2d0 of 8 bytes by task 44798 on cpu 1:
unix_inflight+0x157/0x180 net/unix/scm.c:66
unix_attach_fds+0x147/0x1e0 net/unix/scm.c:123
unix_scm_to_skb net/unix/af_unix.c:1827 [inline]
unix_dgram_sendmsg+0x46a/0x14f0 net/unix/af_unix.c:1950
unix_seqpacket_sendmsg net/unix/af_unix.c:2308 [inline]
unix_seqpacket_sendmsg+0xba/0x130 net/unix/af_unix.c:2292
sock_sendmsg_nosec net/socket.c:725 [inline]
sock_sendmsg+0x148/0x160 net/socket.c:748
____sys_sendmsg+0x4e4/0x610 net/socket.c:2494
___sys_sendmsg+0xc6/0x140 net/socket.c:2548
__sys_sendmsg+0x94/0x140 net/socket.c:2577
__do_sys_sendmsg net/socket.c:2586 [inline]
__se_sys_sendmsg net/socket.c:2584 [inline]
__x64_sys_sendmsg+0x45/0x50 net/socket.c:2584
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
read to 0xffffffff8546f2d0 of 8 bytes by task 44814 on cpu 0:
too_many_unix_fds net/unix/scm.c:101 [inline]
unix_attach_fds+0x54/0x1e0 net/unix/scm.c:110
unix_scm_to_skb net/unix/af_unix.c:1827 [inline]
unix_dgram_sendmsg+0x46a/0x14f0 net/unix/af_unix.c:1950
unix_seqpacket_sendmsg net/unix/af_unix.c:2308 [inline]
unix_seqpacket_sendmsg+0xba/0x130 net/unix/af_unix.c:2292
sock_sendmsg_nosec net/socket.c:725 [inline]
sock_sendmsg+0x148/0x160 net/socket.c:748
____sys_sendmsg+0x4e4/0x610 net/socket.c:2494
___sys_sendmsg+0xc6/0x140 net/socket.c:2548
__sys_sendmsg+0x94/0x140 net/socket.c:2577
__do_sys_sendmsg net/socket.c:2586 [inline]
__se_sys_sendmsg net/socket.c:2584 [inline]
__x64_sys_sendmsg+0x45/0x50 net/socket.c:2584
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
value changed: 0x000000000000000c -> 0x000000000000000d
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 44814 Comm: systemd-coredum Not tainted 6.4.0-11989-g6843306689af #6
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
Fixes: 712f4aad40 ("unix: properly account for FDs passed over unix sockets")
Reported-by: syzkaller <syzkaller@googlegroups.com>
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Acked-by: Willy Tarreau <w@1wt.eu>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-09-04 11:06:16 +01:00
..
2023-03-29 08:22:52 +01:00
2023-08-09 15:32:43 -07:00
2023-08-18 12:44:56 -07:00
2023-06-24 15:50:13 -07:00
2023-06-24 15:50:13 -07:00
2023-06-24 15:50:13 -07:00
2023-08-24 10:51:39 -07:00
2023-08-24 12:23:46 -07:00
2023-08-30 08:36:17 +02:00
2023-05-31 13:06:57 +02:00
2023-08-22 15:13:20 +02:00
2023-06-24 15:50:13 -07:00
2023-09-01 07:27:33 +01:00
2023-08-02 09:07:34 +02:00
2023-09-04 06:49:31 +01:00
2023-08-01 21:07:46 -07:00
2023-08-29 07:44:56 +02:00
2023-08-28 08:02:24 -07:00
2023-08-09 13:08:09 -07:00
2023-08-15 15:01:03 -07:00
2023-09-01 07:25:14 +01:00
2023-07-31 20:11:47 -07:00
2023-08-15 15:00:45 -07:00
2023-09-01 08:11:51 +01:00
2023-09-04 07:07:30 +01:00
2023-03-16 17:34:40 -07:00
2023-06-24 15:50:13 -07:00
2023-08-18 12:44:56 -07:00
2023-08-16 11:09:16 +01:00
2023-08-09 15:34:28 -07:00
2023-08-25 18:35:09 -07:00
2023-06-24 15:41:46 -07:00
2023-06-24 15:50:13 -07:00
2023-06-10 00:11:41 -07:00
2023-09-01 07:27:33 +01:00
2023-08-15 14:54:44 -07:00
2023-08-31 01:29:28 +02:00
2023-08-02 12:28:22 -07:00
2023-08-15 15:01:03 -07:00
2023-08-28 06:58:46 +01:00
2023-08-15 15:00:45 -07:00
2023-06-10 00:11:41 -07:00
2023-08-18 12:44:56 -07:00
2023-08-10 14:10:53 -07:00
2023-06-24 15:50:13 -07:00
2023-07-17 09:02:30 +01:00
2023-08-13 12:25:42 +01:00
2023-04-06 20:36:27 +02:00
2023-06-24 15:50:13 -07:00
2023-06-28 16:43:10 -07:00
2023-08-31 11:21:52 +02:00
2023-08-31 11:56:59 +02:00
2023-08-21 07:41:57 +01:00
2023-08-29 11:33:01 -07:00
2023-07-21 08:54:03 +01:00
2023-08-15 15:00:45 -07:00
2023-08-27 17:17:42 -07:00
2023-09-04 11:06:16 +01:00
2023-07-31 14:41:08 -07:00
2023-08-22 21:40:40 +02:00
2023-06-24 15:50:13 -07:00
2023-08-31 13:21:11 +02:00
2023-08-18 12:44:56 -07:00
2023-04-14 11:09:27 +01:00
2023-07-19 10:07:27 -07:00
2023-04-19 18:48:48 -07:00
2023-09-01 07:27:33 +01:00