net/packet: annotate accesses to po->xmit

po->xmit can be set from setsockopt(PACKET_QDISC_BYPASS),
while read locklessly.

Use READ_ONCE()/WRITE_ONCE() to avoid potential load/store
tearing issues.

Fixes: d346a3fae3ff ("packet: introduce PACKET_QDISC_BYPASS socket option")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index d4e76e2..d25dd9f 100644 (file)
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -307,7 +307,8 @@ static void packet_cached_dev_reset(struct packet_sock *po)
 
 static bool packet_use_direct_xmit(const struct packet_sock *po)
 {
-       return po->xmit == packet_direct_xmit;
+       /* Paired with WRITE_ONCE() in packet_setsockopt() */
+       return READ_ONCE(po->xmit) == packet_direct_xmit;
 }
 
 static u16 packet_pick_tx_queue(struct sk_buff *skb)
@@ -2867,7 +2868,8 @@ tpacket_error:
                packet_inc_pending(&po->tx_ring);
 
                status = TP_STATUS_SEND_REQUEST;
-               err = po->xmit(skb);
+               /* Paired with WRITE_ONCE() in packet_setsockopt() */
+               err = READ_ONCE(po->xmit)(skb);
                if (unlikely(err != 0)) {
                        if (err > 0)
                                err = net_xmit_errno(err);
@@ -3070,7 +3072,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
                virtio_net_hdr_set_proto(skb, &vnet_hdr);
        }
 
-       err = po->xmit(skb);
+       /* Paired with WRITE_ONCE() in packet_setsockopt() */
+       err = READ_ONCE(po->xmit)(skb);
        if (unlikely(err != 0)) {
                if (err > 0)
                        err = net_xmit_errno(err);
@@ -4007,7 +4010,8 @@ packet_setsockopt(struct socket *sock, int level, int optname, sockptr_t optval,
                if (copy_from_sockptr(&val, optval, sizeof(val)))
                        return -EFAULT;
 
-               po->xmit = val ? packet_direct_xmit : dev_queue_xmit;
+               /* Paired with all lockless reads of po->xmit */
+               WRITE_ONCE(po->xmit, val ? packet_direct_xmit : dev_queue_xmit);
                return 0;
        }
        default: