diff options
| author | Eric Dumazet | 2023-05-09 16:35:53 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman | 2023-05-24 17:32:32 +0100 |
| commit | bd0f360ee86494037fbffcac28dbb47c438b33df (patch) | |
| tree | 63f7508d458021e7ba7845814429a94717c1331a | |
| parent | a115dadf8995b1730c36c474401d97355705cb88 (diff) | |
net: annotate sk->sk_err write from do_recvmmsg()
[ Upstream commit e05a5f510f26607616fecdd4ac136310c8bea56b ]
do_recvmmsg() can write to sk->sk_err from multiple threads.
As said before, many other points reading or writing sk_err
need annotations.
Fixes: 34b88a68f26a ("net: Fix use after free in the recvmmsg exit path")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | net/socket.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/socket.c b/net/socket.c index 577079a8935f..c2e0a22f16d9 100644 --- a/net/socket.c +++ b/net/socket.c @@ -2890,7 +2890,7 @@ static int do_recvmmsg(int fd, struct mmsghdr __user *mmsg, * error to return on the next call or if the * app asks about it using getsockopt(SO_ERROR). */ - sock->sk->sk_err = -err; + WRITE_ONCE(sock->sk->sk_err, -err); } out_put: fput_light(sock->file, fput_needed); |