From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9D0E8356A12; Tue, 21 Jul 2026 19:32:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784662371; cv=none; b=fyn1JeyukKrQYKbrTZtB6KrSaDSPulLeefJJJsPjaOWqm4MqwpS8qJGpXWLArWRy7DHxgi1QXQ3RxikrU3j434+u0PIgE2mn0XrOTQH5GghP21+H/rMvTUh9LM6sDStXzSNyYeSj70GXoCAZCTAffhVSFrd6C7s2SLB5wbSQQcU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784662371; c=relaxed/simple; bh=HGv64MDL+qwib93r0h9h/DvjIm1leildIk5ybLW8R2w=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qBc8FZE5ozhbcBVoOVntTTp7Q5gKX4FviSh+ZIJAv4YKwKrXO/VWZTNjyJFfZ78fS4CtPQqPbEQ5rGj5ZjEVgKHTyeY3VcO5hd6FGA2EkM/xG/hf5j9Jrh6ZbPpTw5gK/E7qZemzRo+CkTB+wJ9d1XrkOCBRPNK8edSMfr7r6CU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JEHWmUUh; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="JEHWmUUh" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0E77E1F000E9; Tue, 21 Jul 2026 19:32:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784662370; bh=dKiT6SyKNggCYNRTavx8LI80Y08q+mH2kJi6L4W3YbA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=JEHWmUUh1D1PDldOsBb41Lgg2D1rY0tLZRqNQfybLSYORY0oGf1FE7JQV8Vo3qh+u zO5B0PVcVoLrAJfJEPqA1LzkeCrS7dN3sMih/+EtMUeFqM+wwyUs0jftOeEl+84o46 oXDk/Rv0SlsNi3B9NHg8MUXnnuk1doyQ1NZQ4UwU= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Runyu Xiao , Paolo Abeni , Sasha Levin Subject: [PATCH 6.12 0375/1276] kcm: use WRITE_ONCE() when changing lower socket callbacks Date: Tue, 21 Jul 2026 17:13:38 +0200 Message-ID: <20260721152454.497711297@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721152446.065700225@linuxfoundation.org> References: <20260721152446.065700225@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Runyu Xiao [ Upstream commit 47186409c092cd7dd70350999186c700233e854d ] kcm_attach() replaces a live lower TCP socket's sk_data_ready and sk_write_space callbacks with KCM handlers, and kcm_unattach() restores them later. Those callback-pointer updates are still plain stores even though the same fields can be read and invoked concurrently on other CPUs. If another CPU observes an older callback snapshot after the live field has already been restored, callback execution can run with a mismatched target and sk_user_data state, leading to stale or misdirected wakeups. Use WRITE_ONCE() for the callback replacement and restore operations so these shared callback fields follow the same visibility contract already established by the earlier 4022 fixes. Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module") Signed-off-by: Runyu Xiao Link: https://patch.msgid.link/20260611053543.2429462-1-runyu.xiao@seu.edu.cn Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin --- net/kcm/kcmsock.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c index 4e34311b27b187..5736f06d814323 100644 --- a/net/kcm/kcmsock.c +++ b/net/kcm/kcmsock.c @@ -1299,8 +1299,8 @@ static int kcm_attach(struct socket *sock, struct socket *csock, psock->save_write_space = csk->sk_write_space; psock->save_state_change = csk->sk_state_change; csk->sk_user_data = psock; - csk->sk_data_ready = psock_data_ready; - csk->sk_write_space = psock_write_space; + WRITE_ONCE(csk->sk_data_ready, psock_data_ready); + WRITE_ONCE(csk->sk_write_space, psock_write_space); csk->sk_state_change = psock_state_change; write_unlock_bh(&csk->sk_callback_lock); @@ -1376,8 +1376,8 @@ static void kcm_unattach(struct kcm_psock *psock) */ write_lock_bh(&csk->sk_callback_lock); csk->sk_user_data = NULL; - csk->sk_data_ready = psock->save_data_ready; - csk->sk_write_space = psock->save_write_space; + WRITE_ONCE(csk->sk_data_ready, psock->save_data_ready); + WRITE_ONCE(csk->sk_write_space, psock->save_write_space); csk->sk_state_change = psock->save_state_change; strp_stop(&psock->strp); -- 2.53.0