net: Fix data-races around sysctl_max_skb_frags.
authorKuniyuki Iwashima <kuniyu@amazon.com>
Tue, 23 Aug 2022 17:46:54 +0000 (10:46 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 31 Aug 2022 15:16:44 +0000 (17:16 +0200)
[ Upstream commit 657b991afb89d25fe6c4783b1b75a8ad4563670d ]

While reading sysctl_max_skb_frags, it can be changed concurrently.
Thus, we need to add READ_ONCE() to its readers.

Fixes: 5f74f82ea34c ("net:Add sysctl_max_skb_frags")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/ipv4/tcp.c
net/mptcp/protocol.c

index 52f5171..0ebef2a 100644 (file)
@@ -991,7 +991,7 @@ new_segment:
 
        i = skb_shinfo(skb)->nr_frags;
        can_coalesce = skb_can_coalesce(skb, i, page, offset);
-       if (!can_coalesce && i >= sysctl_max_skb_frags) {
+       if (!can_coalesce && i >= READ_ONCE(sysctl_max_skb_frags)) {
                tcp_mark_push(tp, skb);
                goto new_segment;
        }
@@ -1344,7 +1344,7 @@ new_segment:
 
                        if (!skb_can_coalesce(skb, i, pfrag->page,
                                              pfrag->offset)) {
-                               if (i >= sysctl_max_skb_frags) {
+                               if (i >= READ_ONCE(sysctl_max_skb_frags)) {
                                        tcp_mark_push(tp, skb);
                                        goto new_segment;
                                }
index a089791..5df60a4 100644 (file)
@@ -1317,7 +1317,7 @@ static int mptcp_sendmsg_frag(struct sock *sk, struct sock *ssk,
 
                i = skb_shinfo(skb)->nr_frags;
                can_coalesce = skb_can_coalesce(skb, i, dfrag->page, offset);
-               if (!can_coalesce && i >= sysctl_max_skb_frags) {
+               if (!can_coalesce && i >= READ_ONCE(sysctl_max_skb_frags)) {
                        tcp_mark_push(tcp_sk(ssk), skb);
                        goto alloc_skb;
                }