inet: annotate data-races around isk->inet_num

UDP/TCP lookups are using RCU, thus isk->inet_num accesses
should use READ_ONCE() and WRITE_ONCE() where needed.

Fixes: 3ab5aee7fe84 ("net: Convert TCP & DCCP hash tables to use RCU / hlist_nulls")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260225203545.1512417-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/include/net/inet6_hashtables.h b/include/net/inet6_hashtables.h
index 282e29237d9367f3e9a602a9e2964e291a3bf263..c16de5b7963fdb166b6f04420174a7a83a2e7973 100644 (file)
--- a/include/net/inet6_hashtables.h
+++ b/include/net/inet6_hashtables.h
@@ -175,7 +175,7 @@ static inline bool inet6_match(const struct net *net, const struct sock *sk,
 {
        if (!net_eq(sock_net(sk), net) ||
            sk->sk_family != AF_INET6 ||
-           sk->sk_portpair != ports ||
+           READ_ONCE(sk->sk_portpair) != ports ||
            !ipv6_addr_equal(&sk->sk_v6_daddr, saddr) ||
            !ipv6_addr_equal(&sk->sk_v6_rcv_saddr, daddr))
                return false;

diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h
index ac05a52d9e1382cd7ed88ff07eab67ec42a2ede0..5a979dcab5383907560eddd6249a9d77c4d95978 100644 (file)
--- a/include/net/inet_hashtables.h
+++ b/include/net/inet_hashtables.h
@@ -345,7 +345,7 @@ static inline bool inet_match(const struct net *net, const struct sock *sk,
                              int dif, int sdif)
 {
        if (!net_eq(sock_net(sk), net) ||
-           sk->sk_portpair != ports ||
+           READ_ONCE(sk->sk_portpair) != ports ||
            sk->sk_addrpair != cookie)
                return false;
 

diff --git a/include/net/ip.h b/include/net/ip.h
index 69d5cef460040558529e1fdd3e9336986e843362..7f9abd457e0181fc7d0b351916c75210331a31bd 100644 (file)
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -101,7 +101,7 @@ static inline void ipcm_init_sk(struct ipcm_cookie *ipcm,
 
        ipcm->oif = READ_ONCE(inet->sk.sk_bound_dev_if);
        ipcm->addr = inet->inet_saddr;
-       ipcm->protocol = inet->inet_num;
+       ipcm->protocol = READ_ONCE(inet->inet_num);
 }
 
 #define IPCB(skb) ((struct inet_skb_parm*)((skb)->cb))

diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index fca980772c81c785b086d5e8fa1dc44cd8c01591..9bfccc283fa629caa79aadfd312595b7963143b8 100644 (file)
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -200,7 +200,7 @@ static bool inet_bind2_bucket_addr_match(const struct inet_bind2_bucket *tb2,
 void inet_bind_hash(struct sock *sk, struct inet_bind_bucket *tb,
                    struct inet_bind2_bucket *tb2, unsigned short port)
 {
-       inet_sk(sk)->inet_num = port;
+       WRITE_ONCE(inet_sk(sk)->inet_num, port);
        inet_csk(sk)->icsk_bind_hash = tb;
        inet_csk(sk)->icsk_bind2_hash = tb2;
        sk_add_bind_node(sk, &tb2->owners);
@@ -224,7 +224,7 @@ static void __inet_put_port(struct sock *sk)
        spin_lock(&head->lock);
        tb = inet_csk(sk)->icsk_bind_hash;
        inet_csk(sk)->icsk_bind_hash = NULL;
-       inet_sk(sk)->inet_num = 0;
+       WRITE_ONCE(inet_sk(sk)->inet_num, 0);
        sk->sk_userlocks &= ~SOCK_CONNECT_BIND;
 
        spin_lock(&head2->lock);
@@ -352,7 +352,7 @@ static inline int compute_score(struct sock *sk, const struct net *net,
 {
        int score = -1;
 
-       if (net_eq(sock_net(sk), net) && sk->sk_num == hnum &&
+       if (net_eq(sock_net(sk), net) && READ_ONCE(sk->sk_num) == hnum &&
                        !ipv6_only_sock(sk)) {
                if (sk->sk_rcv_saddr != daddr)
                        return -1;
@@ -1206,7 +1206,7 @@ error:
 
                sk->sk_hash = 0;
                inet_sk(sk)->inet_sport = 0;
-               inet_sk(sk)->inet_num = 0;
+               WRITE_ONCE(inet_sk(sk)->inet_num, 0);
 
                if (tw)
                        inet_twsk_bind_unhash(tw, hinfo);

diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c
index d83efd91f461c8ad0157faeebae051b32cb07bf4..7935702e394b26d1ea2f2a990f645e0a681c6fbd 100644 (file)
--- a/net/ipv4/tcp_diag.c
+++ b/net/ipv4/tcp_diag.c
@@ -509,7 +509,7 @@ next_chunk:
                        if (r->sdiag_family != AF_UNSPEC &&
                            sk->sk_family != r->sdiag_family)
                                goto next_normal;
-                       if (r->id.idiag_sport != htons(sk->sk_num) &&
+                       if (r->id.idiag_sport != htons(READ_ONCE(sk->sk_num)) &&
                            r->id.idiag_sport)
                                goto next_normal;
                        if (r->id.idiag_dport != sk->sk_dport &&

diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 5e1da088d8e11977c2ae92401eb4124e4af3b734..182d38e6d6d8dac30ea06b90daf8a7f328866063 100644 (file)
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -95,7 +95,8 @@ static inline int compute_score(struct sock *sk, const struct net *net,
 {
        int score = -1;
 
-       if (net_eq(sock_net(sk), net) && inet_sk(sk)->inet_num == hnum &&
+       if (net_eq(sock_net(sk), net) &&
+           READ_ONCE(inet_sk(sk)->inet_num) == hnum &&
            sk->sk_family == PF_INET6) {
                if (!ipv6_addr_equal(&sk->sk_v6_rcv_saddr, daddr))
                        return -1;