inet_diag: annotate data-races around inet_diag_table[]

[ Upstream commit e50e10ae5d81ddb41547114bfdc5edc04422f082 ]

inet_diag_lock_handler() reads inet_diag_table[proto] locklessly.

Use READ_ONCE()/WRITE_ONCE() annotations to avoid potential issues.

Fixes: d523a328fb02 ("[INET]: Fix inet_diag dead-lock regression")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Guillaume Nault <gnault@redhat.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index fa9f1de58df460f2446856f59840e65bbfcc4205..27a5a7d66d184b0f2c8efed94ea520124ce47a64 100644 (file)
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -57,7 +57,7 @@ static const struct inet_diag_handler *inet_diag_lock_handler(int proto)
                return ERR_PTR(-ENOENT);
        }
 
-       if (!inet_diag_table[proto])
+       if (!READ_ONCE(inet_diag_table[proto]))
                sock_load_diag_module(AF_INET, proto);
 
        mutex_lock(&inet_diag_table_mutex);
@@ -1413,7 +1413,7 @@ int inet_diag_register(const struct inet_diag_handler *h)
        mutex_lock(&inet_diag_table_mutex);
        err = -EEXIST;
        if (!inet_diag_table[type]) {
-               inet_diag_table[type] = h;
+               WRITE_ONCE(inet_diag_table[type], h);
                err = 0;
        }
        mutex_unlock(&inet_diag_table_mutex);
@@ -1430,7 +1430,7 @@ void inet_diag_unregister(const struct inet_diag_handler *h)
                return;
 
        mutex_lock(&inet_diag_table_mutex);
-       inet_diag_table[type] = NULL;
+       WRITE_ONCE(inet_diag_table[type], NULL);
        mutex_unlock(&inet_diag_table_mutex);
 }
 EXPORT_SYMBOL_GPL(inet_diag_unregister);