[PATCH net-next 0/2] annotate data-races around sysctl_tcp_wmem[0]

[PATCH net-next 0/2] annotate data-races around sysctl_tcp_wmem[0]

[Jason Xing]

From: Jason Xing <kernelxing@tencent.com>

Adding simple READ_ONCE() can avoid reading the sysctl knob meanwhile
someone is trying to change it.

Jason Xing (2):
  mptcp: annotate a data-race around sysctl_tcp_wmem[0]
  tcp: annotate a data-race around sysctl_tcp_wmem[0]

 net/ipv4/tcp.c       | 2 +-
 net/mptcp/protocol.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

-- 
2.37.3

[PATCH net-next 1/2] mptcp: annotate a data-race around sysctl_tcp_wmem[0]

[Jason Xing]

From: Jason Xing <kernelxing@tencent.com>

It's possible that writer and the reader can manipulate the same
sysctl knob concurrently. Using READ_ONCE() to prevent reading
an old value.

Signed-off-by: Jason Xing <kernelxing@tencent.com>
---
 net/mptcp/protocol.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index f16edef6026a..a10ebf3ee10a 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -850,7 +850,7 @@ static inline void __mptcp_sync_sndbuf(struct sock *sk)
 	if (sk->sk_userlocks & SOCK_SNDBUF_LOCK)
 		return;
 
-	new_sndbuf = sock_net(sk)->ipv4.sysctl_tcp_wmem[0];
+	new_sndbuf = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_wmem[0]);
 	mptcp_for_each_subflow(mptcp_sk(sk), subflow) {
 		ssk_sndbuf =  READ_ONCE(mptcp_subflow_tcp_sock(subflow)->sk_sndbuf);
 
-- 
2.37.3

Re: [PATCH net-next 1/2] mptcp: annotate a data-race around sysctl_tcp_wmem[0]

[Eric Dumazet]

On Fri, Mar 8, 2024 at 12:25 PM Jason Xing <kerneljasonxing@gmail.com> wrote:
>
> From: Jason Xing <kernelxing@tencent.com>
>
> It's possible that writer and the reader can manipulate the same
> sysctl knob concurrently. Using READ_ONCE() to prevent reading
> an old value.
>
> Signed-off-by: Jason Xing <kernelxing@tencent.com>

Reviewed-by: Eric Dumazet <edumazet@google.com>

Re: [PATCH net-next 1/2] mptcp: annotate a data-race around sysctl_tcp_wmem[0]

[Mat Martineau]

On Fri, 8 Mar 2024, Jason Xing wrote:

> From: Jason Xing <kernelxing@tencent.com>
>
> It's possible that writer and the reader can manipulate the same
> sysctl knob concurrently. Using READ_ONCE() to prevent reading
> an old value.
>
> Signed-off-by: Jason Xing <kernelxing@tencent.com>
> ---
> net/mptcp/protocol.h | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
> index f16edef6026a..a10ebf3ee10a 100644
> --- a/net/mptcp/protocol.h
> +++ b/net/mptcp/protocol.h
> @@ -850,7 +850,7 @@ static inline void __mptcp_sync_sndbuf(struct sock *sk)
> 	if (sk->sk_userlocks & SOCK_SNDBUF_LOCK)
> 		return;
>
> -	new_sndbuf = sock_net(sk)->ipv4.sysctl_tcp_wmem[0];
> +	new_sndbuf = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_wmem[0]);
> 	mptcp_for_each_subflow(mptcp_sk(sk), subflow) {
> 		ssk_sndbuf =  READ_ONCE(mptcp_subflow_tcp_sock(subflow)->sk_sndbuf);
>

Looks good to me, thanks Jason.

Reviewed-by: Mat Martineau <martineau@kernel.org>

[PATCH net-next 2/2] tcp: annotate a data-race around sysctl_tcp_wmem[0]

[Jason Xing]

From: Jason Xing <kernelxing@tencent.com>

When reading wmem[0], it could be changed concurrently without
READ_ONCE() protection. So add one annotation here.

Signed-off-by: Jason Xing <kernelxing@tencent.com>
---
 net/ipv4/tcp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index c5b83875411a..e3904c006e63 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -975,7 +975,7 @@ int tcp_wmem_schedule(struct sock *sk, int copy)
 	 * Use whatever is left in sk->sk_forward_alloc and tcp_wmem[0]
 	 * to guarantee some progress.
 	 */
-	left = sock_net(sk)->ipv4.sysctl_tcp_wmem[0] - sk->sk_wmem_queued;
+	left = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_wmem[0]) - sk->sk_wmem_queued;
 	if (left > 0)
 		sk_forced_mem_schedule(sk, min(left, copy));
 	return min(copy, sk->sk_forward_alloc);
-- 
2.37.3

Re: [PATCH net-next 2/2] tcp: annotate a data-race around sysctl_tcp_wmem[0]

[Eric Dumazet]

On Fri, Mar 8, 2024 at 12:25 PM Jason Xing <kerneljasonxing@gmail.com> wrote:
>
> From: Jason Xing <kernelxing@tencent.com>
>
> When reading wmem[0], it could be changed concurrently without
> READ_ONCE() protection. So add one annotation here.
>
> Signed-off-by: Jason Xing <kernelxing@tencent.com>
> ---
>  net/ipv4/tcp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
> index c5b83875411a..e3904c006e63 100644
> --- a/net/ipv4/tcp.c
> +++ b/net/ipv4/tcp.c
> @@ -975,7 +975,7 @@ int tcp_wmem_schedule(struct sock *sk, int copy)
>          * Use whatever is left in sk->sk_forward_alloc and tcp_wmem[0]
>          * to guarantee some progress.
>          */
> -       left = sock_net(sk)->ipv4.sysctl_tcp_wmem[0] - sk->sk_wmem_queued;
> +       left = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_wmem[0]) - sk->sk_wmem_queued;

SGTM, you could have split the long line...

Reviewed-by: Eric Dumazet <edumazet@google.com>

Re: [PATCH net-next 0/2] annotate data-races around sysctl_tcp_wmem[0]

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net-next.git (main)
by David S. Miller <davem@davemloft.net>:

On Fri,  8 Mar 2024 19:25:02 +0800 you wrote:
> From: Jason Xing <kernelxing@tencent.com>
> 
> Adding simple READ_ONCE() can avoid reading the sysctl knob meanwhile
> someone is trying to change it.
> 
> Jason Xing (2):
>   mptcp: annotate a data-race around sysctl_tcp_wmem[0]
>   tcp: annotate a data-race around sysctl_tcp_wmem[0]
> 
> [...]

Here is the summary with links:
  - [net-next,1/2] mptcp: annotate a data-race around sysctl_tcp_wmem[0]
    https://git.kernel.org/netdev/net-next/c/9eb430d40e44
  - [net-next,2/2] tcp: annotate a data-race around sysctl_tcp_wmem[0]
    https://git.kernel.org/netdev/net-next/c/683a67da9561

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html