ipv4: Fix data-races around sysctl_fib_notify_on_flag_change.

[ Upstream commit 96b9bd8c6d125490f9adfb57d387ef81a55a103e ] While reading sysctl_fib_notify_on_flag_change, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 680aea0 ("net: ipv4: Emit notification when fib hardware flags are changed") Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>

Author: q2ven

net/ipv4/fib_trie.c

@@ -1037,6 +1037,7 @@ fib_find_matching_alias(struct net *net, const struct fib_rt_info *fri)
 
 void fib_alias_hw_flags_set(struct net *net, const struct fib_rt_info *fri)
 {
+u8 fib_notify_on_flag_change;
 struct fib_alias *fa_match;
 struct sk_buff *skb;
 int err;
@@ -1058,14 +1059,16 @@ void fib_alias_hw_flags_set(struct net *net, const struct fib_rt_info *fri)
 WRITE_ONCE(fa_match->offload, fri->offload);
 WRITE_ONCE(fa_match->trap, fri->trap);
 
+fib_notify_on_flag_change = READ_ONCE(net->ipv4.sysctl_fib_notify_on_flag_change);
+
 /* 2 means send notifications only if offload_failed was changed. */
-if (net->ipv4.sysctl_fib_notify_on_flag_change == 2 &&
+if (fib_notify_on_flag_change == 2 &&
  READ_ONCE(fa_match->offload_failed) == fri->offload_failed)
 goto out;
 
 WRITE_ONCE(fa_match->offload_failed, fri->offload_failed);
 
-if (!net->ipv4.sysctl_fib_notify_on_flag_change)
+if (!fib_notify_on_flag_change)
 goto out;
 
 skb = nlmsg_new(fib_nlmsg_size(fa_match->fa_info), GFP_ATOMIC);