sock_diag: annotate data-races around sock_diag_handlers[family]

__sock_diag_cmd() and sock_diag_bind() read sock_diag_handlers[family]
without a lock held.

Use READ_ONCE()/WRITE_ONCE() annotations to avoid potential issues.

Fixes: 8ef874bfc729 ("sock_diag: Move the sock_ code to net/core/")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Guillaume Nault <gnault@redhat.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
index b1e29e18d1d60cb5c87c884652f547c083ba81cd..c53b731f2d6728d113b90732f4df5b011a438038 100644 (file)
--- a/net/core/sock_diag.c
+++ b/net/core/sock_diag.c
@@ -193,7 +193,7 @@ int sock_diag_register(const struct sock_diag_handler *hndl)
        if (sock_diag_handlers[hndl->family])
                err = -EBUSY;
        else
-               sock_diag_handlers[hndl->family] = hndl;
+               WRITE_ONCE(sock_diag_handlers[hndl->family], hndl);
        mutex_unlock(&sock_diag_table_mutex);
 
        return err;
@@ -209,7 +209,7 @@ void sock_diag_unregister(const struct sock_diag_handler *hnld)
 
        mutex_lock(&sock_diag_table_mutex);
        BUG_ON(sock_diag_handlers[family] != hnld);
-       sock_diag_handlers[family] = NULL;
+       WRITE_ONCE(sock_diag_handlers[family], NULL);
        mutex_unlock(&sock_diag_table_mutex);
 }
 EXPORT_SYMBOL_GPL(sock_diag_unregister);
@@ -227,7 +227,7 @@ static int __sock_diag_cmd(struct sk_buff *skb, struct nlmsghdr *nlh)
                return -EINVAL;
        req->sdiag_family = array_index_nospec(req->sdiag_family, AF_MAX);
 
-       if (sock_diag_handlers[req->sdiag_family] == NULL)
+       if (READ_ONCE(sock_diag_handlers[req->sdiag_family]) == NULL)
                sock_load_diag_module(req->sdiag_family, 0);
 
        mutex_lock(&sock_diag_table_mutex);
@@ -286,12 +286,12 @@ static int sock_diag_bind(struct net *net, int group)
        switch (group) {
        case SKNLGRP_INET_TCP_DESTROY:
        case SKNLGRP_INET_UDP_DESTROY:
-               if (!sock_diag_handlers[AF_INET])
+               if (!READ_ONCE(sock_diag_handlers[AF_INET]))
                        sock_load_diag_module(AF_INET, 0);
                break;
        case SKNLGRP_INET6_TCP_DESTROY:
        case SKNLGRP_INET6_UDP_DESTROY:
-               if (!sock_diag_handlers[AF_INET6])
+               if (!READ_ONCE(sock_diag_handlers[AF_INET6]))
                        sock_load_diag_module(AF_INET6, 0);
                break;
        }