[PATCH net] tipc: Fix a data race on mon->peer_cnt in mon_timeout()

[PATCH net] tipc: Fix a data race on mon->peer_cnt in mon_timeout()

[Ginger Li]

mon_timeout() evaluates dom_size(mon->peer_cnt) before it takes mon->lock,
while mon->peer_cnt is updated under that lock by tipc_mon_add_peer() and
tipc_mon_remove_peer().  The value can therefore be stale, and the decision
whether the local domain has to be recomputed can be based on an outdated
member count.

Read mon->peer_cnt inside the write_lock_bh(&mon->lock) protected region.

Fixes: 35c55c9877f8 ("tipc: add neighbor monitoring framework")
Signed-off-by: Ginger Li <ginger.jzllee@gmail.com>
---
 net/tipc/monitor.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c
--- a/net/tipc/monitor.c
+++ b/net/tipc/monitor.c
@@ -632,9 +632,10 @@ static void mon_timeout(struct timer_list *t)
 {
 	struct tipc_monitor *mon = timer_container_of(mon, t, timer);
 	struct tipc_peer *self;
-	int best_member_cnt = dom_size(mon->peer_cnt) - 1;
+	int best_member_cnt;
 
 	write_lock_bh(&mon->lock);
+	best_member_cnt = dom_size(mon->peer_cnt) - 1;
 	self = mon->self;
 	if (self && (best_member_cnt != self->applied)) {
 		mon_update_local_domain(mon);
-- 
2.43.0

Re: [PATCH net] tipc: Fix a data race on mon->peer_cnt in mon_timeout()

[Tung Quang Nguyen]

> Subject: [PATCH net] tipc: Fix a data race on mon->peer_cnt in mon_timeout()

> mon_timeout() evaluates dom_size(mon->peer_cnt) before it takes mon->lock,
> while mon->peer_cnt is updated under that lock by tipc_mon_add_peer() and
> tipc_mon_remove_peer().  The value can therefore be stale, and the decision
> whether the local domain has to be recomputed can be based on an outdated
> member count.

> Read mon->peer_cnt inside the write_lock_bh(&mon->lock) protected region.

> Fixes: 35c55c9877f8 ("tipc: add neighbor monitoring framework")
> Signed-off-by: Ginger Li <ginger.jzllee@gmail.com>

Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>