| Message ID | 20221118043843.3703186-1-edumazet@google.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 32634819ad37290b5d5a84bf8b71ef5e972c4a20 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net-next] net: fix __sock_gen_cookie() | expand |
Hello: This patch was applied to netdev/net-next.git (master) by Jakub Kicinski <kuba@kernel.org>: On Fri, 18 Nov 2022 04:38:43 +0000 you wrote: > I was mistaken how atomic64_try_cmpxchg(&sk_cookie, &res, new) > is working. > > I was assuming @res would contain the final sk_cookie value, > regardless of the success of our cmpxchg() > > We could do something like: > > [...] Here is the summary with links: - [net-next] net: fix __sock_gen_cookie() https://git.kernel.org/netdev/net-next/c/32634819ad37 You are awesome, thank you!
diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c index b11593cae5a09b15a10d6ba35bccc22263cb8fc8..b1e29e18d1d60cb5c87c884652f547c083ba81cd 100644 --- a/net/core/sock_diag.c +++ b/net/core/sock_diag.c @@ -30,7 +30,10 @@ u64 __sock_gen_cookie(struct sock *sk) if (!res) { u64 new = gen_cookie_next(&sock_cookie); - atomic64_try_cmpxchg(&sk->sk_cookie, &res, new); + atomic64_cmpxchg(&sk->sk_cookie, res, new); + + /* Another thread might have changed sk_cookie before us. */ + res = atomic64_read(&sk->sk_cookie); } return res; }
I was mistaken how atomic64_try_cmpxchg(&sk_cookie, &res, new) is working. I was assuming @res would contain the final sk_cookie value, regardless of the success of our cmpxchg() We could do something like: if (atomic64_try_cmpxchg(&sk_cookie, &res, new) res = new; But we can avoid a conditional and read sk_cookie again. atomic64_cmpxchg(&sk_cookie, res, new); res = atomic64_read(&sk_cookie); Reported-by: coverity-bot <keescook+coverity-bot@chromium.org> Addresses-Coverity-ID: 1527347 ("Error handling issues") Fixes: 4ebf802cf1c6 ("net: __sock_gen_cookie() cleanup") Signed-off-by: Eric Dumazet <edumazet@google.com> --- net/core/sock_diag.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)