netdev - Re: [PATCH net-next 1/6] tcp: set TCP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 4 Aug 2023 10:55:37 -0400
From: Soheil Hassas Yeganeh <soheil@...gle.com>
To: Eric Dumazet <edumazet@...gle.com>
Cc: "David S . Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, 
	Paolo Abeni <pabeni@...hat.com>, netdev@...r.kernel.org, eric.dumazet@...il.com
Subject: Re: [PATCH net-next 1/6] tcp: set TCP_SYNCNT locklessly

On Fri, Aug 4, 2023 at 10:46 AM Eric Dumazet <edumazet@...gle.com> wrote:
>
> icsk->icsk_syn_retries can safely be set without locking the socket.
>
> We have to add READ_ONCE() annotations in tcp_fastopen_synack_timer()
> and tcp_write_timeout().
>
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>

Acked by: Soheil Hassas Yeganeh <soheil@...gle.com>

> ---
>  net/ipv4/tcp.c       | 15 ++++++---------
>  net/ipv4/tcp_timer.c |  9 ++++++---
>  2 files changed, 12 insertions(+), 12 deletions(-)
>
> diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
> index aca5620cf3ba20be38d81b1b526c22623b145ff7..bcbb33a8c152abe2a060abd644689b54bcca1daa 100644
> --- a/net/ipv4/tcp.c
> +++ b/net/ipv4/tcp.c
> @@ -3291,9 +3291,7 @@ int tcp_sock_set_syncnt(struct sock *sk, int val)
>         if (val < 1 || val > MAX_TCP_SYNCNT)
>                 return -EINVAL;
>
> -       lock_sock(sk);
>         WRITE_ONCE(inet_csk(sk)->icsk_syn_retries, val);
> -       release_sock(sk);
>         return 0;
>  }
>  EXPORT_SYMBOL(tcp_sock_set_syncnt);
> @@ -3462,6 +3460,12 @@ int do_tcp_setsockopt(struct sock *sk, int level, int optname,
>         if (copy_from_sockptr(&val, optval, sizeof(val)))
>                 return -EFAULT;
>
> +       /* Handle options that can be set without locking the socket. */
> +       switch (optname) {
> +       case TCP_SYNCNT:
> +               return tcp_sock_set_syncnt(sk, val);
> +       }
> +
>         sockopt_lock_sock(sk);
>
>         switch (optname) {
> @@ -3569,13 +3573,6 @@ int do_tcp_setsockopt(struct sock *sk, int level, int optname,
>                 else
>                         WRITE_ONCE(tp->keepalive_probes, val);
>                 break;
> -       case TCP_SYNCNT:
> -               if (val < 1 || val > MAX_TCP_SYNCNT)
> -                       err = -EINVAL;
> -               else
> -                       WRITE_ONCE(icsk->icsk_syn_retries, val);
> -               break;
> -
>         case TCP_SAVE_SYN:
>                 /* 0: disable, 1: enable, 2: start from ether_header */
>                 if (val < 0 || val > 2)
> diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
> index 470f581eedd438b3bbd6ae4973c7a6f01ee1724f..66040ab457d46ffa2fac62f875b636f567157793 100644
> --- a/net/ipv4/tcp_timer.c
> +++ b/net/ipv4/tcp_timer.c
> @@ -239,7 +239,8 @@ static int tcp_write_timeout(struct sock *sk)
>         if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
>                 if (icsk->icsk_retransmits)
>                         __dst_negative_advice(sk);
> -               retry_until = icsk->icsk_syn_retries ? :
> +               /* Paired with WRITE_ONCE() in tcp_sock_set_syncnt() */
> +               retry_until = READ_ONCE(icsk->icsk_syn_retries) ? :
>                         READ_ONCE(net->ipv4.sysctl_tcp_syn_retries);
>
>                 max_retransmits = retry_until;
> @@ -421,8 +422,10 @@ static void tcp_fastopen_synack_timer(struct sock *sk, struct request_sock *req)
>
>         req->rsk_ops->syn_ack_timeout(req);
>
> -       /* add one more retry for fastopen */
> -       max_retries = icsk->icsk_syn_retries ? :
> +       /* Add one more retry for fastopen.
> +        * Paired with WRITE_ONCE() in tcp_sock_set_syncnt()
> +        */
> +       max_retries = READ_ONCE(icsk->icsk_syn_retries) ? :
>                 READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_synack_retries) + 1;
>
>         if (req->num_timeout >= max_retries) {
> --
> 2.41.0.640.ga95def55d0-goog
>