Re: [PATCH net v2] tcp: fix data-race in tcp_recv_should_stop

The lockless writers are sock_error() from SO_ERROR and recvmmsg(),
so every plain read of sk_err on a TCP socket has the same race, not
only this helper:
     tcp_recvmsg_locked
     tcp_sendmsg_locked
     tcp_splice_read
     sk_stream_wait_memory
     tcp_bpf_sendmsg
     tcp_bpf_recvmsg_parser
     mptcp_splice_read
     mptcp_recvmsg

I'd drop the Fixes tag, target net-next and annotate all of them like
e13ec3da05d1, instead of pointing at a MPTCP commit.

Eric, Matthieu, does that sound OK?

Thanks Jiayuan, Matt.

Agreed that eb477fdd6803 only moved the existing load, so I will
drop the Fixes tag and retarget to net-next.

I will also annotate the remaining unmarked sk_err reads on the
TCP/MPTCP recv and splice paths (the other arm of the same loops
that Sashiko pointed out). I would keep this as KCSAN annotations
in the style of e13ec3da05d1, and leave the check-then-sock_error()
TOCTOU as a separate change.

sk_stream_wait_memory() already uses READ_ONCE(sk->sk_err). I will
double-check the sendmsg/bpf sites before expanding further.

Happy to wait if Eric prefers a different scope.

Quanye