sock_diag: annotate data-races around sock_diag_handlers[family]

[ Upstream commit efd402537673f9951992aea4ef0f5ff51d858f4b ]

__sock_diag_cmd() and sock_diag_bind() read sock_diag_handlers[family]
without a lock held.

Use READ_ONCE()/WRITE_ONCE() annotations to avoid potential issues.

Fixes: 8ef874bfc729 ("sock_diag: Move the sock_ code to net/core/")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Guillaume Nault <gnault@redhat.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
index c9c45b935f9900ddc05d3604e893c0b3c6386206..bce65b519ee80303b55f9bed3e22d1bc2ee5169b 100644 (file)
--- a/net/core/sock_diag.c
+++ b/net/core/sock_diag.c
@@ -189,7 +189,7 @@ int sock_diag_register(const struct sock_diag_handler *hndl)
        if (sock_diag_handlers[hndl->family])
                err = -EBUSY;
        else
-               sock_diag_handlers[hndl->family] = hndl;
+               WRITE_ONCE(sock_diag_handlers[hndl->family], hndl);
        mutex_unlock(&sock_diag_table_mutex);
 
        return err;
@@ -205,7 +205,7 @@ void sock_diag_unregister(const struct sock_diag_handler *hnld)
 
        mutex_lock(&sock_diag_table_mutex);
        BUG_ON(sock_diag_handlers[family] != hnld);
-       sock_diag_handlers[family] = NULL;
+       WRITE_ONCE(sock_diag_handlers[family], NULL);
        mutex_unlock(&sock_diag_table_mutex);
 }
 EXPORT_SYMBOL_GPL(sock_diag_unregister);
@@ -223,7 +223,7 @@ static int __sock_diag_cmd(struct sk_buff *skb, struct nlmsghdr *nlh)
                return -EINVAL;
        req->sdiag_family = array_index_nospec(req->sdiag_family, AF_MAX);
 
-       if (sock_diag_handlers[req->sdiag_family] == NULL)
+       if (READ_ONCE(sock_diag_handlers[req->sdiag_family]) == NULL)
                sock_load_diag_module(req->sdiag_family, 0);
 
        mutex_lock(&sock_diag_table_mutex);
@@ -282,12 +282,12 @@ static int sock_diag_bind(struct net *net, int group)
        switch (group) {
        case SKNLGRP_INET_TCP_DESTROY:
        case SKNLGRP_INET_UDP_DESTROY:
-               if (!sock_diag_handlers[AF_INET])
+               if (!READ_ONCE(sock_diag_handlers[AF_INET]))
                        sock_load_diag_module(AF_INET, 0);
                break;
        case SKNLGRP_INET6_TCP_DESTROY:
        case SKNLGRP_INET6_UDP_DESTROY:
-               if (!sock_diag_handlers[AF_INET6])
+               if (!READ_ONCE(sock_diag_handlers[AF_INET6]))
                        sock_load_diag_module(AF_INET6, 0);
                break;
        }