Re: [PATCH 4.19 29/58] bonding: fix data-races around agg_select_timer

Pavel Machek
2022-02-22T15:36:02Z

[-- Attachment #1: Type: text/plain, Size: 1019 bytes --]

Hi!

> syzbot reported that two threads might write over agg_select_timer
> at the same time. Make agg_select_timer atomic to fix the races.

Ok, but:

> --- a/drivers/net/bonding/bond_3ad.c
> +++ b/drivers/net/bonding/bond_3ad.c
> @@ -249,7 +249,7 @@ static inline int __check_agg_selection_
> if (bond == NULL)
> return 0;
>
> - return BOND_AD_INFO(bond).agg_select_timer ? 1 : 0;
> + return atomic_read(&BOND_AD_INFO(bond).agg_select_timer) ? 1 : 0;
> }

This could probably use !!.

> +static bool bond_agg_timer_advance(struct bonding *bond)
> +{
> + int val, nval;
> +
> + while (1) {
> + val = atomic_read(&BOND_AD_INFO(bond).agg_select_timer);
> + if (!val)
> + return false;
> + nval = val - 1;
> + if (atomic_cmpxchg(&BOND_AD_INFO(bond).agg_select_timer,
> + val, nval) == val)
> + break;
> + }
> + return nval == 0;
> +}

This should really be atomic_dec_if_positive, no?

Best regards,
Pavel
--
http://www.livejournal.com/~pavelmachek

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]