mptcp: Safely read sequence number when lock isn't held

mjmartineau · davem330 · commit c75293925f24 · 2020-07-28T17:02:42.000-07:00
The MPTCP socket's write_seq member should be read with READ_ONCE() when
the msk lock is not held.

Signed-off-by: Mat Martineau &lt;mathew.j.martineau@linux.intel.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
@@ -1269,7 +1269,7 @@ static void mptcp_retransmit_handler(struct sock *sk)
 {
 	struct mptcp_sock *msk = mptcp_sk(sk);
 
-	if (atomic64_read(&msk->snd_una) == msk->write_seq) {
+	if (atomic64_read(&msk->snd_una) == READ_ONCE(msk->write_seq)) {
 		mptcp_stop_timer(sk);
 	} else {
 		set_bit(MPTCP_WORK_RTX, &msk->flags);

Original file line number	Diff line number	Diff line change
`@@ -1269,7 +1269,7 @@ static void mptcp_retransmit_handler(struct sock *sk)`
`1269`	`1269`	`{`
`1270`	`1270`	`struct mptcp_sock *msk = mptcp_sk(sk);`
`1271`	`1271`
`1272`		`- if (atomic64_read(&msk->snd_una) == msk->write_seq) {`
	`1272`	`+ if (atomic64_read(&msk->snd_una) == READ_ONCE(msk->write_seq)) {`
`1273`	`1273`	`mptcp_stop_timer(sk);`
`1274`	`1274`	`} else {`
`1275`	`1275`	`set_bit(MPTCP_WORK_RTX, &msk->flags);`