Skip to content

Commit 0273954

Browse files
q2vendavem330
q2ven
authored and
davem330
committed
net: Fix data-races around sysctl_[rw]mem(_offset)?.
While reading these sysctl variables, they can be changed concurrently. Thus, we need to add READ_ONCE() to their readers. - .sysctl_rmem - .sysctl_rwmem - .sysctl_rmem_offset - .sysctl_wmem_offset - sysctl_tcp_rmem[1, 2] - sysctl_tcp_wmem[1, 2] - sysctl_decnet_rmem[1] - sysctl_decnet_wmem[1] - sysctl_tipc_rmem[1] Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 59bf6c6 commit 0273954

File tree

7 files changed

+21
-20
lines changed

7 files changed

+21
-20
lines changed

‎include/net/sock.h

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2843,18 +2843,18 @@ static inline int sk_get_wmem0(const struct sock *sk, const struct proto *proto)
28432843
{
28442844
/* Does this proto have per netns sysctl_wmem ? */
28452845
if (proto->sysctl_wmem_offset)
2846-
return *(int *)((void *)sock_net(sk) + proto->sysctl_wmem_offset);
2846+
return READ_ONCE(*(int *)((void *)sock_net(sk) + proto->sysctl_wmem_offset));
28472847

2848-
return *proto->sysctl_wmem;
2848+
return READ_ONCE(*proto->sysctl_wmem);
28492849
}
28502850

28512851
static inline int sk_get_rmem0(const struct sock *sk, const struct proto *proto)
28522852
{
28532853
/* Does this proto have per netns sysctl_rmem ? */
28542854
if (proto->sysctl_rmem_offset)
2855-
return *(int *)((void *)sock_net(sk) + proto->sysctl_rmem_offset);
2855+
return READ_ONCE(*(int *)((void *)sock_net(sk) + proto->sysctl_rmem_offset));
28562856

2857-
return *proto->sysctl_rmem;
2857+
return READ_ONCE(*proto->sysctl_rmem);
28582858
}
28592859

28602860
/* Default TCP Small queue budget is ~1 ms of data (1sec >> 10)

‎net/decnet/af_decnet.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -480,8 +480,8 @@ static struct sock *dn_alloc_sock(struct net *net, struct socket *sock, gfp_t gf
480480
sk->sk_family = PF_DECnet;
481481
sk->sk_protocol = 0;
482482
sk->sk_allocation = gfp;
483-
sk->sk_sndbuf = sysctl_decnet_wmem[1];
484-
sk->sk_rcvbuf = sysctl_decnet_rmem[1];
483+
sk->sk_sndbuf = READ_ONCE(sysctl_decnet_wmem[1]);
484+
sk->sk_rcvbuf = READ_ONCE(sysctl_decnet_rmem[1]);
485485

486486
/* Initialization of DECnet Session Control Port */
487487
scp = DN_SK(sk);

‎net/ipv4/tcp.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -452,8 +452,8 @@ void tcp_init_sock(struct sock *sk)
452452

453453
icsk->icsk_sync_mss = tcp_sync_mss;
454454

455-
WRITE_ONCE(sk->sk_sndbuf, sock_net(sk)->ipv4.sysctl_tcp_wmem[1]);
456-
WRITE_ONCE(sk->sk_rcvbuf, sock_net(sk)->ipv4.sysctl_tcp_rmem[1]);
455+
WRITE_ONCE(sk->sk_sndbuf, READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_wmem[1]));
456+
WRITE_ONCE(sk->sk_rcvbuf, READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_rmem[1]));
457457

458458
sk_sockets_allocated_inc(sk);
459459
}
@@ -1724,7 +1724,7 @@ int tcp_set_rcvlowat(struct sock *sk, int val)
17241724
if (sk->sk_userlocks & SOCK_RCVBUF_LOCK)
17251725
cap = sk->sk_rcvbuf >> 1;
17261726
else
1727-
cap = sock_net(sk)->ipv4.sysctl_tcp_rmem[2] >> 1;
1727+
cap = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_rmem[2]) >> 1;
17281728
val = min(val, cap);
17291729
WRITE_ONCE(sk->sk_rcvlowat, val ? : 1);
17301730

‎net/ipv4/tcp_input.c

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -426,7 +426,7 @@ static void tcp_sndbuf_expand(struct sock *sk)
426426

427427
if (sk->sk_sndbuf < sndmem)
428428
WRITE_ONCE(sk->sk_sndbuf,
429-
min(sndmem, sock_net(sk)->ipv4.sysctl_tcp_wmem[2]));
429+
min(sndmem, READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_wmem[2])));
430430
}
431431

432432
/* 2. Tuning advertised window (window_clamp, rcv_ssthresh)
@@ -461,7 +461,7 @@ static int __tcp_grow_window(const struct sock *sk, const struct sk_buff *skb,
461461
struct tcp_sock *tp = tcp_sk(sk);
462462
/* Optimize this! */
463463
int truesize = tcp_win_from_space(sk, skbtruesize) >> 1;
464-
int window = tcp_win_from_space(sk, sock_net(sk)->ipv4.sysctl_tcp_rmem[2]) >> 1;
464+
int window = tcp_win_from_space(sk, READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_rmem[2])) >> 1;
465465

466466
while (tp->rcv_ssthresh <= window) {
467467
if (truesize <= skb->len)
@@ -574,16 +574,17 @@ static void tcp_clamp_window(struct sock *sk)
574574
struct tcp_sock *tp = tcp_sk(sk);
575575
struct inet_connection_sock *icsk = inet_csk(sk);
576576
struct net *net = sock_net(sk);
577+
int rmem2;
577578

578579
icsk->icsk_ack.quick = 0;
580+
rmem2 = READ_ONCE(net->ipv4.sysctl_tcp_rmem[2]);
579581

580-
if (sk->sk_rcvbuf < net->ipv4.sysctl_tcp_rmem[2] &&
582+
if (sk->sk_rcvbuf < rmem2 &&
581583
!(sk->sk_userlocks & SOCK_RCVBUF_LOCK) &&
582584
!tcp_under_memory_pressure(sk) &&
583585
sk_memory_allocated(sk) < sk_prot_mem_limits(sk, 0)) {
584586
WRITE_ONCE(sk->sk_rcvbuf,
585-
min(atomic_read(&sk->sk_rmem_alloc),
586-
net->ipv4.sysctl_tcp_rmem[2]));
587+
min(atomic_read(&sk->sk_rmem_alloc), rmem2));
587588
}
588589
if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf)
589590
tp->rcv_ssthresh = min(tp->window_clamp, 2U * tp->advmss);
@@ -745,7 +746,7 @@ void tcp_rcv_space_adjust(struct sock *sk)
745746

746747
do_div(rcvwin, tp->advmss);
747748
rcvbuf = min_t(u64, rcvwin * rcvmem,
748-
sock_net(sk)->ipv4.sysctl_tcp_rmem[2]);
749+
READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_rmem[2]));
749750
if (rcvbuf > sk->sk_rcvbuf) {
750751
WRITE_ONCE(sk->sk_rcvbuf, rcvbuf);
751752

‎net/ipv4/tcp_output.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -238,7 +238,7 @@ void tcp_select_initial_window(const struct sock *sk, int __space, __u32 mss,
238238
*rcv_wscale = 0;
239239
if (wscale_ok) {
240240
/* Set window scaling on max possible window */
241-
space = max_t(u32, space, sock_net(sk)->ipv4.sysctl_tcp_rmem[2]);
241+
space = max_t(u32, space, READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_rmem[2]));
242242
space = max_t(u32, space, sysctl_rmem_max);
243243
space = min_t(u32, space, *window_clamp);
244244
*rcv_wscale = clamp_t(int, ilog2(space) - 15,

‎net/mptcp/protocol.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1926,7 +1926,7 @@ static void mptcp_rcv_space_adjust(struct mptcp_sock *msk, int copied)
19261926

19271927
do_div(rcvwin, advmss);
19281928
rcvbuf = min_t(u64, rcvwin * rcvmem,
1929-
sock_net(sk)->ipv4.sysctl_tcp_rmem[2]);
1929+
READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_rmem[2]));
19301930

19311931
if (rcvbuf > sk->sk_rcvbuf) {
19321932
u32 window_clamp;
@@ -2669,8 +2669,8 @@ static int mptcp_init_sock(struct sock *sk)
26692669
mptcp_ca_reset(sk);
26702670

26712671
sk_sockets_allocated_inc(sk);
2672-
sk->sk_rcvbuf = sock_net(sk)->ipv4.sysctl_tcp_rmem[1];
2673-
sk->sk_sndbuf = sock_net(sk)->ipv4.sysctl_tcp_wmem[1];
2672+
sk->sk_rcvbuf = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_rmem[1]);
2673+
sk->sk_sndbuf = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_wmem[1]);
26742674

26752675
return 0;
26762676
}

‎net/tipc/socket.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -517,7 +517,7 @@ static int tipc_sk_create(struct net *net, struct socket *sock,
517517
timer_setup(&sk->sk_timer, tipc_sk_timeout, 0);
518518
sk->sk_shutdown = 0;
519519
sk->sk_backlog_rcv = tipc_sk_backlog_rcv;
520-
sk->sk_rcvbuf = sysctl_tipc_rmem[1];
520+
sk->sk_rcvbuf = READ_ONCE(sysctl_tipc_rmem[1]);
521521
sk->sk_data_ready = tipc_data_ready;
522522
sk->sk_write_space = tipc_write_space;
523523
sk->sk_destruct = tipc_sock_destruct;

0 commit comments

Comments
 (0)