net: Fix data-races around sysctl_[rw]mem(_offset)?.

[ Upstream commit 02739545951ad4c1215160db7fbf9b7a918d3c0b ] While reading these sysctl variables, they can be changed concurrently. Thus, we need to add READ_ONCE() to their readers. - .sysctl_rmem - .sysctl_rwmem - .sysctl_rmem_offset - .sysctl_wmem_offset - sysctl_tcp_rmem[1, 2] - sysctl_tcp_wmem[1, 2] - sysctl_decnet_rmem[1] - sysctl_decnet_wmem[1] - sysctl_tipc_rmem[1] Fixes: 1da177e ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>

Author: q2ven

include/net/sock.h

@@ -2765,18 +2765,18 @@ static inline int sk_get_wmem0(const struct sock *sk, const struct proto *proto)
 {
 /* Does this proto have per netns sysctl_wmem ? */
 if (proto->sysctl_wmem_offset)
-return *(int *)((void *)sock_net(sk) + proto->sysctl_wmem_offset);
+return READ_ONCE(*(int *)((void *)sock_net(sk) + proto->sysctl_wmem_offset));
 
-return *proto->sysctl_wmem;
+return READ_ONCE(*proto->sysctl_wmem);
 }
 
 static inline int sk_get_rmem0(const struct sock *sk, const struct proto *proto)
 {
 /* Does this proto have per netns sysctl_rmem ? */
 if (proto->sysctl_rmem_offset)
-return *(int *)((void *)sock_net(sk) + proto->sysctl_rmem_offset);
+return READ_ONCE(*(int *)((void *)sock_net(sk) + proto->sysctl_rmem_offset));
 
-return *proto->sysctl_rmem;
+return READ_ONCE(*proto->sysctl_rmem);
 }
 
 /* Default TCP Small queue budget is ~1 ms of data (1sec >> 10)

net/decnet/af_decnet.c

@@ -480,8 +480,8 @@ static struct sock *dn_alloc_sock(struct net *net, struct socket *sock, gfp_t gf
 sk->sk_family = PF_DECnet;
 sk->sk_protocol = 0;
 sk->sk_allocation = gfp;
-sk->sk_sndbuf = sysctl_decnet_wmem[1];
-sk->sk_rcvbuf = sysctl_decnet_rmem[1];
+sk->sk_sndbuf = READ_ONCE(sysctl_decnet_wmem[1]);
+sk->sk_rcvbuf = READ_ONCE(sysctl_decnet_rmem[1]);
 
 /* Initialization of DECnet Session Control Port	*/
 scp = DN_SK(sk);

net/ipv4/tcp.c

@@ -458,8 +458,8 @@ void tcp_init_sock(struct sock *sk)
 
 icsk->icsk_sync_mss = tcp_sync_mss;
 
-WRITE_ONCE(sk->sk_sndbuf, sock_net(sk)->ipv4.sysctl_tcp_wmem[1]);
-WRITE_ONCE(sk->sk_rcvbuf, sock_net(sk)->ipv4.sysctl_tcp_rmem[1]);
+WRITE_ONCE(sk->sk_sndbuf, READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_wmem[1]));
+WRITE_ONCE(sk->sk_rcvbuf, READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_rmem[1]));
 
 sk_sockets_allocated_inc(sk);
 sk->sk_route_forced_caps = NETIF_F_GSO;
@@ -1722,7 +1722,7 @@ int tcp_set_rcvlowat(struct sock *sk, int val)
 if (sk->sk_userlocks & SOCK_RCVBUF_LOCK)
 cap = sk->sk_rcvbuf >> 1;
 else
-cap = sock_net(sk)->ipv4.sysctl_tcp_rmem[2] >> 1;
+cap = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_rmem[2]) >> 1;
 val = min(val, cap);
 WRITE_ONCE(sk->sk_rcvlowat, val ? : 1);
 

net/ipv4/tcp_input.c

@@ -426,7 +426,7 @@ static void tcp_sndbuf_expand(struct sock *sk)
 
 if (sk->sk_sndbuf < sndmem)
 WRITE_ONCE(sk->sk_sndbuf,
- min(sndmem, sock_net(sk)->ipv4.sysctl_tcp_wmem[2]));
+ min(sndmem, READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_wmem[2])));
 }
 
 /* 2. Tuning advertised window (window_clamp, rcv_ssthresh)
@@ -461,7 +461,7 @@ static int __tcp_grow_window(const struct sock *sk, const struct sk_buff *skb,
 struct tcp_sock *tp = tcp_sk(sk);
 /* Optimize this! */
 int truesize = tcp_win_from_space(sk, skbtruesize) >> 1;
-int window = tcp_win_from_space(sk, sock_net(sk)->ipv4.sysctl_tcp_rmem[2]) >> 1;
+int window = tcp_win_from_space(sk, READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_rmem[2])) >> 1;
 
 while (tp->rcv_ssthresh <= window) {
 if (truesize <= skb->len)
@@ -566,16 +566,17 @@ static void tcp_clamp_window(struct sock *sk)
 struct tcp_sock *tp = tcp_sk(sk);
 struct inet_connection_sock *icsk = inet_csk(sk);
 struct net *net = sock_net(sk);
+int rmem2;
 
 icsk->icsk_ack.quick = 0;
+rmem2 = READ_ONCE(net->ipv4.sysctl_tcp_rmem[2]);
 
-if (sk->sk_rcvbuf < net->ipv4.sysctl_tcp_rmem[2] &&
+if (sk->sk_rcvbuf < rmem2 &&
  !(sk->sk_userlocks & SOCK_RCVBUF_LOCK) &&
  !tcp_under_memory_pressure(sk) &&
  sk_memory_allocated(sk) < sk_prot_mem_limits(sk, 0)) {
 WRITE_ONCE(sk->sk_rcvbuf,
- min(atomic_read(&sk->sk_rmem_alloc),
- net->ipv4.sysctl_tcp_rmem[2]));
+ min(atomic_read(&sk->sk_rmem_alloc), rmem2));
 }
 if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf)
 tp->rcv_ssthresh = min(tp->window_clamp, 2U * tp->advmss);
@@ -737,7 +738,7 @@ void tcp_rcv_space_adjust(struct sock *sk)
 
 do_div(rcvwin, tp->advmss);
 rcvbuf = min_t(u64, rcvwin * rcvmem,
- sock_net(sk)->ipv4.sysctl_tcp_rmem[2]);
+ READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_rmem[2]));
 if (rcvbuf > sk->sk_rcvbuf) {
 WRITE_ONCE(sk->sk_rcvbuf, rcvbuf);
 

net/ipv4/tcp_output.c

@@ -238,7 +238,7 @@ void tcp_select_initial_window(const struct sock *sk, int __space, __u32 mss,
 *rcv_wscale = 0;
 if (wscale_ok) {
 /* Set window scaling on max possible window */
-space = max_t(u32, space, sock_net(sk)->ipv4.sysctl_tcp_rmem[2]);
+space = max_t(u32, space, READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_rmem[2]));
 space = max_t(u32, space, sysctl_rmem_max);
 space = min_t(u32, space, *window_clamp);
 *rcv_wscale = clamp_t(int, ilog2(space) - 15,

net/mptcp/protocol.c

@@ -1899,7 +1899,7 @@ static void mptcp_rcv_space_adjust(struct mptcp_sock *msk, int copied)
 
 do_div(rcvwin, advmss);
 rcvbuf = min_t(u64, rcvwin * rcvmem,
- sock_net(sk)->ipv4.sysctl_tcp_rmem[2]);
+ READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_rmem[2]));
 
 if (rcvbuf > sk->sk_rcvbuf) {
 u32 window_clamp;
@@ -2532,8 +2532,8 @@ static int mptcp_init_sock(struct sock *sk)
 icsk->icsk_ca_ops = NULL;
 
 sk_sockets_allocated_inc(sk);
-sk->sk_rcvbuf = sock_net(sk)->ipv4.sysctl_tcp_rmem[1];
-sk->sk_sndbuf = sock_net(sk)->ipv4.sysctl_tcp_wmem[1];
+sk->sk_rcvbuf = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_rmem[1]);
+sk->sk_sndbuf = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_wmem[1]);
 
 return 0;
 }

net/tipc/socket.c

@@ -517,7 +517,7 @@ static int tipc_sk_create(struct net *net, struct socket *sock,
 timer_setup(&sk->sk_timer, tipc_sk_timeout, 0);
 sk->sk_shutdown = 0;
 sk->sk_backlog_rcv = tipc_sk_backlog_rcv;
-sk->sk_rcvbuf = sysctl_tipc_rmem[1];
+sk->sk_rcvbuf = READ_ONCE(sysctl_tipc_rmem[1]);
 sk->sk_data_ready = tipc_data_ready;
 sk->sk_write_space = tipc_write_space;
 sk->sk_destruct = tipc_sock_destruct;