Re: [PATCH net v2] tcp: fix data-race in tcp_recv_should_stop

[quanyeyang]

> The lockless writers are sock_error() from SO_ERROR and recvmmsg(),
> so every plain read of sk_err on a TCP socket has the same race, not
> only this helper:
>      tcp_recvmsg_locked
>      tcp_sendmsg_locked
>      tcp_splice_read
>      sk_stream_wait_memory
>      tcp_bpf_sendmsg
>      tcp_bpf_recvmsg_parser
>      mptcp_splice_read
>      mptcp_recvmsg
> 
> I'd drop the Fixes tag, target net-next and annotate all of them like
> e13ec3da05d1, instead of pointing at a MPTCP commit.
> 
> Eric, Matthieu, does that sound OK?
> 
Thanks Jiayuan, Matt.

Agreed that eb477fdd6803 only moved the existing load, so I will
drop the Fixes tag and retarget to net-next.

I will also annotate the remaining unmarked sk_err reads on the
TCP/MPTCP recv and splice paths (the other arm of the same loops
that Sashiko pointed out). I would keep this as KCSAN annotations
in the style of e13ec3da05d1, and leave the check-then-sock_error()
TOCTOU as a separate change.

sk_stream_wait_memory() already uses READ_ONCE(sk->sk_err). I will
double-check the sendmsg/bpf sites before expanding further.

Happy to wait if Eric prefers a different scope.

Quanye