af_unix: Annodate data-races around sk->sk_state for writers.

sk->sk_state is changed under unix_state_lock(), but it's read locklessly
in many places.

This patch adds WRITE_ONCE() on the writer side.

We will add READ_ONCE() to the lockless readers in the following patches.

Fixes: 83301b5367a9 ("af_unix: Set TCP_ESTABLISHED for datagram sockets too")
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index b162164b7a420576a0c7c018a48a0893596adccb..424d021a4d7d76e811b9ac4068f4bd15751d53fa 100644 (file)
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -616,7 +616,7 @@ static void unix_release_sock(struct sock *sk, int embrion)
        u->path.dentry = NULL;
        u->path.mnt = NULL;
        state = sk->sk_state;
-       sk->sk_state = TCP_CLOSE;
+       WRITE_ONCE(sk->sk_state, TCP_CLOSE);
 
        skpair = unix_peer(sk);
        unix_peer(sk) = NULL;
@@ -738,7 +738,8 @@ static int unix_listen(struct socket *sock, int backlog)
        if (backlog > sk->sk_max_ack_backlog)
                wake_up_interruptible_all(&u->peer_wait);
        sk->sk_max_ack_backlog  = backlog;
-       sk->sk_state            = TCP_LISTEN;
+       WRITE_ONCE(sk->sk_state, TCP_LISTEN);
+
        /* set credentials so connect can copy them */
        init_peercred(sk);
        err = 0;
@@ -1401,7 +1402,8 @@ restart:
                if (err)
                        goto out_unlock;
 
-               sk->sk_state = other->sk_state = TCP_ESTABLISHED;
+               WRITE_ONCE(sk->sk_state, TCP_ESTABLISHED);
+               WRITE_ONCE(other->sk_state, TCP_ESTABLISHED);
        } else {
                /*
                 *      1003.1g breaking connected state with AF_UNSPEC
@@ -1418,7 +1420,7 @@ restart:
 
                unix_peer(sk) = other;
                if (!other)
-                       sk->sk_state = TCP_CLOSE;
+                       WRITE_ONCE(sk->sk_state, TCP_CLOSE);
                unix_dgram_peer_wake_disconnect_wakeup(sk, old_peer);
 
                unix_state_double_unlock(sk, other);
@@ -1639,7 +1641,7 @@ restart:
        copy_peercred(sk, other);
 
        sock->state     = SS_CONNECTED;
-       sk->sk_state    = TCP_ESTABLISHED;
+       WRITE_ONCE(sk->sk_state, TCP_ESTABLISHED);
        sock_hold(newsk);
 
        smp_mb__after_atomic(); /* sock_hold() does an atomic_inc() */
@@ -2050,7 +2052,7 @@ restart_locked:
                        unix_peer(sk) = NULL;
                        unix_dgram_peer_wake_disconnect_wakeup(sk, other);
 
-                       sk->sk_state = TCP_CLOSE;
+                       WRITE_ONCE(sk->sk_state, TCP_CLOSE);
                        unix_state_unlock(sk);
 
                        unix_dgram_disconnected(sk, other);