inet_diag: annotate data-races around inet_diag_table[]

inet_diag_lock_handler() reads inet_diag_table[proto] locklessly.

Use READ_ONCE()/WRITE_ONCE() annotations to avoid potential issues.

Fixes: d523a328fb02 ("[INET]: Fix inet_diag dead-lock regression")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Guillaume Nault <gnault@redhat.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 8e6b6aa0579e1c94def819a1f9eab8b946771ba7..9804e9608a5a0294b3ffabc4b5bb87ac1b96b09e 100644 (file)
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -57,7 +57,7 @@ static const struct inet_diag_handler *inet_diag_lock_handler(int proto)
                return ERR_PTR(-ENOENT);
        }
 
-       if (!inet_diag_table[proto])
+       if (!READ_ONCE(inet_diag_table[proto]))
                sock_load_diag_module(AF_INET, proto);
 
        mutex_lock(&inet_diag_table_mutex);
@@ -1503,7 +1503,7 @@ int inet_diag_register(const struct inet_diag_handler *h)
        mutex_lock(&inet_diag_table_mutex);
        err = -EEXIST;
        if (!inet_diag_table[type]) {
-               inet_diag_table[type] = h;
+               WRITE_ONCE(inet_diag_table[type], h);
                err = 0;
        }
        mutex_unlock(&inet_diag_table_mutex);
@@ -1520,7 +1520,7 @@ void inet_diag_unregister(const struct inet_diag_handler *h)
                return;
 
        mutex_lock(&inet_diag_table_mutex);
-       inet_diag_table[type] = NULL;
+       WRITE_ONCE(inet_diag_table[type], NULL);
        mutex_unlock(&inet_diag_table_mutex);
 }
 EXPORT_SYMBOL_GPL(inet_diag_unregister);