From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932422AbcEROuG (ORCPT ); Wed, 18 May 2016 10:50:06 -0400 Received: from mail-db3on0128.outbound.protection.outlook.com ([157.55.234.128]:44032 "EHLO emea01-db3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753137AbcEROuD (ORCPT ); Wed, 18 May 2016 10:50:03 -0400 Authentication-Results: davemloft.net; dkim=none (message not signed) header.d=none;davemloft.net; dmarc=none action=none header.from=virtuozzo.com; From: Andrey Ryabinin To: "David S. Miller" CC: Hannes Frederic Sowa , Rainer Weikusat , Eric Dumazet , , , Andrey Ryabinin Subject: [PATCH v3] net: sock: move ->sk_shutdown out of bitfields. Date: Wed, 18 May 2016 17:36:11 +0300 Message-ID: <1463582171-24083-1-git-send-email-aryabinin@virtuozzo.com> X-Mailer: git-send-email 2.7.3 In-Reply-To: <1463576621.18194.96.camel@edumazet-glaptop3.roam.corp.google.com> References: <1463576621.18194.96.camel@edumazet-glaptop3.roam.corp.google.com> MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [195.214.232.10] X-ClientProxiedBy: AM4PR02CA0002.eurprd02.prod.outlook.com (10.165.239.140) To VI1PR0801MB1310.eurprd08.prod.outlook.com (10.167.197.148) X-MS-Office365-Filtering-Correlation-Id: 7969859d-09a4-4a13-9d56-08d37f29ad8b X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB1310;2:1O3cYJoyuiiNjgGoLuoHpJf7hZDIU0THpn21u72vWJEa+OIUOlJ+LxKTugfYEeQ/qrAzy9dLMBaP5HGGZG+S3crRII8u7fouuUGqCAg4NEYLV49CSVbyRyHYpEdUvbDCzS4k5cWbJYOy4VzAj4N9gEgVb3lziMRO6uXRAcotUVXumBTTvuqPNRTv/49iX7Fc;3:wRLskDnqtuZgGDJvaqoxqp2hnwMs8HldGPJUZ+4yim352eNzQ5zGGiryK9rgt0qNReXV8VH9OiJ0cfKZ16I0MiUSmcxwYua3vdFu8aLNdsE2ICimS+R0cW9Ezc3oRo1u;25:oAhEIOWBzeBSZA+FuI0Q3ZVXR9pqQIDWoJ4CUDkdgvzcO5rPTJ23tbne45DwHVgG1RiXPMTAiJFJqvt8Klf9Hfz6AuKP3b3/dKbx7b7wYe7mjOXQ6MgUt1uFzPjKQaGGXZpWADpeTjDYh2AeXMlOugvbPG88wLX3J5//uRXvnom3MK78JKeAczKkpQhOmWylec5VxWEhhonBDXFTOxiLr5Hen6ZmtvgnMuWfXbRGSgEWbmX8HOK0TOJrw3lB0eU37ZwF4E20QqTb8Dxt/xlKDPm32BxX31y6l6LQaTxGvOEFADPmqmm5DyJ6Dun0YWwFBkSxH+QY5GqUxhRrB/EYmJWe9iUxiYdPY+E9nuZ8H9tlOfu248+3YBcHCIYGeA3BR4CDz+nHwXUIp1mQPdDIwTL7Pp9RT4jTrnn6PZiKupk= X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:VI1PR0801MB1310; X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040130)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6041072)(6043046);SRVR:VI1PR0801MB1310;BCL:0;PCL:0;RULEID:;SRVR:VI1PR0801MB1310; X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB1310;4:BLZz/36vmwjTUmpajExwdImVmoQPFmwlrsTZ/iE+VHwuLN3xpcu4PGBW5e65JQwB16mH+e6VxELRPNJZ4LaEtMyE6yzOjh5RQXJidaHZSaSzkuwvJahuErKPQ4Spef6A4VP6AGJ4LB24njDeRJRVwFPfnXuxV1rBJWvN7loUPDla+R2uNLQmmU8WxabiWSRtTEO3rJN2lJ/HyQdIsgRwe7odSLj6bX/dJl+eNjyZbNl7o5TOqfjFX/+M+k6wQiw1fqVADTAj2Sk0vHRIqJU3IZKdQLybLFR9BdGfbv9Oz5WoLacYlAnB35lwz12kcM9syL2cLFdPKRzSZGxgttNYvyvE2ADhG59LPxkYE+6SLZkTyVIgFmi1DIi8Ir9Cr/UYifCcpjZfTfktdOtvHBQdvNCu7D8b0H6RtO5tpTWRtiU= X-Forefront-PRVS: 0946DC87A1 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6069001)(6009001)(2906002)(50226002)(19580395003)(19580405001)(2950100001)(77096005)(6116002)(107886002)(5003940100001)(42186005)(76506005)(4001430100002)(53416004)(229853001)(86362001)(4326007)(66066001)(81166006)(33646002)(92566002)(189998001)(110136002)(47776003)(50986999)(76176999)(8676002)(36756003)(586003)(48376002)(5004730100002)(5008740100001)(50466002);DIR:OUT;SFP:1102;SCL:1;SRVR:VI1PR0801MB1310;H:localhost.sw.ru;FPR:;SPF:None;MLV:sfv;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;VI1PR0801MB1310;23:O+a5AjIP9HehR0OhCEL0LwXHcTJ5dgCWwkxAXIe?= =?us-ascii?Q?wJoueQqugRTd67xzpC1GYLmIxD7BMm73PaXtLXUXiHXoKxvX2m1ZmdxHksgD?= =?us-ascii?Q?i58zfmgSBZH7j41iHbAsAj/ooiNljyNyZ2N5InynaTXz49koKDQv6Rw0+pof?= =?us-ascii?Q?6Cy4e9Sh8yVdIxx2GRyMKYYO2jTyD9ESIN8NG9+HvU6hPHE0by5mbOfkApBD?= =?us-ascii?Q?yaD5ObiCCM9jbPONkrUtnVBT/ugSRMtA5pLnxAzppQaMxOTqi/GSRdQefris?= =?us-ascii?Q?nQ0CLxQ4tyGJ3mGvQoW5Afp//rxjErd6iHnu1RDbzik2BJR3EqNfG5ZTNfRB?= =?us-ascii?Q?yARVonY+UyncBE8w7ViOkOLwetlu4yaGKb5WIKPwJLfdfFh+i70gicXlKQXZ?= =?us-ascii?Q?gN0TLD1JvQNIuHA+x3YQkU/am+ZK/3ZiUD2pJQpPy7PvZIDmqBqh+Cn3rXOq?= =?us-ascii?Q?IIv3NyMFjuLwDuZ0u7SaXSTx/xzqhGT+S4bK+02uILiy+A0oiwrYzLNFdCwW?= =?us-ascii?Q?Th9kkRTIyGJoOjvBy/8zkPzR7dtOdVnk9GCxDckY9xkt2y04myBnHBTamJFD?= =?us-ascii?Q?t3+2u+Jk0W81nZ0lpmZhi6v7xD9aDsSCvwM3UdW5kIhnLzXgHVB38sDWoC3C?= =?us-ascii?Q?mAk5YP3cewcUfaQI26v2u54EtmXImdHZ+JNdHfC3rCcXhcXdQXt7O2779fkn?= =?us-ascii?Q?jvi12oJmnpMUjw2GG2FFrpD9vvyYEuxP0idB6HvP7UGpjmg+f2U2A6NThDBh?= =?us-ascii?Q?yeb59+fJyhTRDeBtyvYr4RiGGs088w86B61zo6nXKEDZnqSroBMkUD87O0Rt?= =?us-ascii?Q?Z2C4QXPRGCm2oLHjNOJQQQm5pcaZYKTQwy641kn/eUE/Amkt41MLEhsFsIYA?= =?us-ascii?Q?w2EhXFJrt6xncWnsRDkMRCeA5cKIj/g1AOP0D7gguS1DK9B759CnQx8Qry2C?= =?us-ascii?Q?LG4UeNcL8qgmCOQOckLuPdVSGz8a2kuIiE5ipFPE6QQ=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB1310;5:SsF8Nj0ZULrE0B9joasSJaaZWl0Kvw0sVM7H6doFjwFAOrrsthiFnkut49ZiFv7HHcbqNN7YMXMtcH+JzedHH2ofpS1Grqedt64HpC+3V1mJKqOB2r0ZcCwzDVgn1Qtg+V6U+cmQQR+txZwviUlWWw==;24:UKQZaQhoYohEDWRRUypF2aC3/gF/eXrD5nwuXmI7rtiL5jAwurbb5OrepmQzpl90tJhBn4pWyxDQ+3QNENJ0Gxp1arIuQvEmf3IZBalgkaM=;7:Oxc1i1WgEjorEaP0tUOBe5ZAoDOekTlm16hCWk6QmY1aOsdZISnj+tIxx22GYf/nSKXGfGNU8zMbIRqgBeI1PfiyunVYEYeSfScq2MiWX+373EXXSh/QcTiEpGp9cSIK+ZRB0ngQNlSP3JXkhvYqWZ5/TG9PoLlVtfuOOiIN0CUT9jW3BQWmB9pbzgzk24fu;20:4DU04x4bzvB8NoMoRr/VXZVvb+jKqqFC22IO/I99ttjne9Tzfx3c6uy+2sO4fzz/FlhrwhJv4yWDsa+rteXAUfDiMbdPvZDzUfM0MX1jMuWp3TOdZxqqIF/slJRmSCOvcxpyUxOioRa2o6QURKX8+HF/fLiz5eJD6fPmsd7NddA= SpamDiagnosticOutput: 1:23 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 May 2016 14:35:36.4179 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0801MB1310 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org ->sk_shutdown bits share one bitfield with some other bits in sock struct, such as ->sk_no_check_[r,t]x, ->sk_userlocks ... sock_setsockopt() may write to these bits, while holding the socket lock. In case of AF_UNIX sockets, we change ->sk_shutdown bits while holding only unix_state_lock(). So concurrent setsockopt() and shutdown() may lead to corrupting these bits. Fix this by moving ->sk_shutdown bits out of bitfield into a separate byte. This will not change the 'struct sock' size since ->sk_shutdown moved into previously unused 16-bit hole. Signed-off-by: Andrey Ryabinin Suggested-by: Hannes Frederic Sowa --- Changes since v1: - move sk_shutdown into a separate byte instead of locking AF_UNIX sockets. Changes since v2: - reorder bitfields, so that sk_type/sk_protocol still fit in separate 2-bytes/byte. include/net/sock.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/include/net/sock.h b/include/net/sock.h index c9c8b19..1c019d4 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -383,12 +383,11 @@ struct sock { int sk_sndbuf; struct sk_buff_head sk_write_queue; kmemcheck_bitfield_begin(flags); - unsigned int sk_shutdown : 2, + unsigned int sk_type : 16, + sk_protocol : 8, sk_no_check_tx : 1, sk_no_check_rx : 1, - sk_userlocks : 4, - sk_protocol : 8, - sk_type : 16; + sk_userlocks : 4; #define SK_PROTOCOL_MAX U8_MAX kmemcheck_bitfield_end(flags); int sk_wmem_queued; @@ -418,6 +417,7 @@ struct sock { struct timer_list sk_timer; ktime_t sk_stamp; u16 sk_tsflags; + u8 sk_shutdown; u32 sk_tskey; struct socket *sk_socket; void *sk_user_data; -- 2.7.3