[PATCH net-next v4 0/2] tcp: annotate lockless access to sk->sk_err

[Quanye Yang via B4 Relay]

do_recvmmsg() and getsockopt(SO_ERROR) call sock_error() without the
socket lock and clear sk_err with xchg(). Annotate the matching
lockless peeks with READ_ONCE().

Patch 1 covers TCP. Patch 2 covers MPTCP, including the remaining
unmarked subflow peeks.

This does not consume sk_err. The check-then-sock_error() TOCTOU on
the no-data paths is a separate issue.

---
Changes in v4:
- split the annotation change, one points to tcp and another points to
  mptcp.
- annotate the remaining unmarked MPTCP sk_err peeks on the
  subflow error-report path.
- Link to v3: https://patch.msgid.link/20260912-mptcp-sk-err-net-v3-1-c41383878bde@xxxxxxxxx

Changes in v3:
- drop the Fixes tag and retarget to net-next
- annotate the remaining unmarked sk_err peeks on the TCP/MPTCP
  send, recv and splice paths
- Link to v2: https://patch.msgid.link/20260909-mptcp-sk-err-net-v2-1-5044abecac90@xxxxxxxxx

Changes in v2:
- add Reported-by and Closes for the MPTCP syzkaller report
- Link to v1: https://patch.msgid.link/20260908-mptcp-sk-err-net-v1-1-da71aaec9afd@xxxxxxxxx

---
Quanye Yang (2):
      tcp: annotate lockless access to sk->sk_err
      mptcp: annotate lockless access to sk->sk_err

 include/net/tcp.h    | 3 ++-
 net/core/stream.c    | 2 +-
 net/ipv4/tcp.c       | 6 +++---
 net/ipv4/tcp_bpf.c   | 7 +++----
 net/mptcp/protocol.c | 8 ++++----
 net/mptcp/subflow.c  | 4 ++--
 6 files changed, 15 insertions(+), 15 deletions(-)
---
base-commit: 211f2a875f6f447745d80d5762d6d614503ac84a
change-id: 20260908-mptcp-sk-err-net-7ff88ef05044

Best regards,
--  
Quanye Yang <quanyeyang@xxxxxxxxx>