From: Jiayuan Chen Date: Wed, 4 Mar 2026 06:42:52 +0000 (+0800) Subject: net: annotate data races around sk->sk_prot X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ad4c9559603e1897e3a978c966b04424be68f4dc;p=thirdparty%2Flinux.git net: annotate data races around sk->sk_prot inet_sendmsg() and inet_recvmsg() access sk->sk_prot without lock_sock() or any other synchronization. sock_replace_proto() (used by sockmap), TLS and MPTCP can change sk->sk_prot under us, so these functions need READ_ONCE() to avoid load tearing. Signed-off-by: Jiayuan Chen Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260304064253.16955-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski --- diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index babcd75a08e27..e95ffa070568b 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -852,11 +852,13 @@ EXPORT_SYMBOL_GPL(inet_send_prepare); int inet_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) { struct sock *sk = sock->sk; + const struct proto *prot; if (unlikely(inet_send_prepare(sk))) return -EAGAIN; - return INDIRECT_CALL_2(sk->sk_prot->sendmsg, tcp_sendmsg, udp_sendmsg, + prot = READ_ONCE(sk->sk_prot); + return INDIRECT_CALL_2(prot->sendmsg, tcp_sendmsg, udp_sendmsg, sk, msg, size); } EXPORT_SYMBOL(inet_sendmsg); @@ -882,11 +884,13 @@ int inet_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, int flags) { struct sock *sk = sock->sk; + const struct proto *prot; if (likely(!(flags & MSG_ERRQUEUE))) sock_rps_record_flow(sk); - return INDIRECT_CALL_2(sk->sk_prot->recvmsg, tcp_recvmsg, udp_recvmsg, + prot = READ_ONCE(sk->sk_prot); + return INDIRECT_CALL_2(prot->recvmsg, tcp_recvmsg, udp_recvmsg, sk, msg, size, flags); } EXPORT_SYMBOL(inet_recvmsg);