net: add __rcu annotations to sk_wq and wq

Add proper RCU annotations/verbs to sk_wq and wq members

Fix __sctp_write_space() sk_sleep() abuse (and sock->wq access)

Fix sunrpc sk_sleep() abuse too

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 4 insertions, 3 deletions

diff --git a/include/net/sock.h b/include/net/sock.h
index e3893a2b5d25..da0534d3401c 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -281,7 +281,7 @@ struct sock {
         int                     sk_rcvbuf;
 
         struct sk_filter __rcu  *sk_filter;
-        struct socket_wq        *sk_wq;
+        struct socket_wq __rcu  *sk_wq;
 
 #ifdef CONFIG_NET_DMA
         struct sk_buff_head     sk_async_wait_queue;
@@ -1266,7 +1266,8 @@ static inline void sk_set_socket(struct sock *sk, struct socket *sock)
 
 static inline wait_queue_head_t *sk_sleep(struct sock *sk)
 {
-        return &sk->sk_wq->wait;
+        BUILD_BUG_ON(offsetof(struct socket_wq, wait) != 0);
+        return &rcu_dereference_raw(sk->sk_wq)->wait;
 }
 /* Detach socket from process context.
  * Announce socket dead, detach it from wait queue and inode.
@@ -1287,7 +1288,7 @@ static inline void sock_orphan(struct sock *sk)
 static inline void sock_graft(struct sock *sk, struct socket *parent)
 {
         write_lock_bh(&sk->sk_callback_lock);
-        rcu_assign_pointer(sk->sk_wq, parent->wq);
+        sk->sk_wq = parent->wq;
         parent->sk = sk;
         sk_set_socket(sk, parent);
         security_sock_graft(sk, parent);