tcp: Fix a data-race around sysctl_tcp_mtu_probe_floor.

[ Upstream commit b70658949c4594187a2d20ed69de6ba172caa7c2 ]

While reading sysctl_tcp_mtu_probe_floor, it can be changed concurrently.
Thus, we need to add READ_ONCE() to its reader.

Fixes: ed01edd8d50e ("tcp: add new tcp_mtu_probe_floor sysctl")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 0460c5deee3f1b10a82d681f67917c173f7da488..c48aeaef3ec7916a9e598cc5f9a9106414b2a078 100644 (file)
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -172,7 +172,7 @@ static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk)
        } else {
                mss = tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_low) >> 1;
                mss = min(READ_ONCE(net->ipv4.sysctl_tcp_base_mss), mss);
-               mss = max(mss, net->ipv4.sysctl_tcp_mtu_probe_floor);
+               mss = max(mss, READ_ONCE(net->ipv4.sysctl_tcp_mtu_probe_floor));
                mss = max(mss, READ_ONCE(net->ipv4.sysctl_tcp_min_snd_mss));
                icsk->icsk_mtup.search_low = tcp_mss_to_mtu(sk, mss);
        }