| Message ID | 20240524193630.2007563-5-edumazet@google.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | tcp: fix tcp_poll() races | expand |
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index 30ef0c8f5e92d301c31ea1a05f662c1fc4cf37af..09192c786d145ee97058b6bab61d96274a883aef 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -613,10 +613,7 @@ int tcp_v4_err(struct sk_buff *skb, u32 info) if (!sock_owned_by_user(sk)) { WRITE_ONCE(sk->sk_err, err); - - sk_error_report(sk); - - tcp_done(sk); + tcp_done_with_error(sk); } else { WRITE_ONCE(sk->sk_err_soft, err); } diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index 4c3605485b68e7c333a0144df3d685b3db9ff45d..41ddc7c768ce957ff64aac6de4a2a59227e7c7ff 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -492,9 +492,7 @@ static int tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, if (!sock_owned_by_user(sk)) { WRITE_ONCE(sk->sk_err, err); - sk_error_report(sk); /* Wake people up to see the error (see connect in sock.c) */ - - tcp_done(sk); + tcp_done_with_error(sk); } else { WRITE_ONCE(sk->sk_err_soft, err); }
These functions have races when they: 1) Write sk->sk_err [A] 2) call sk_error_report(sk) [B] 3) call tcp_done(sk) As described in prior patches in this series: [A] An smp_wmb() is missing. [B] We should call tcp_done() before sk_error_report(sk) to have consistent tcp_poll() results on SMP hosts. Use tcp_done_with_error() where we centralized the correct sequence. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet@google.com> --- net/ipv4/tcp_ipv4.c | 5 +---- net/ipv6/tcp_ipv6.c | 4 +--- 2 files changed, 2 insertions(+), 7 deletions(-)