[PATCH net-next 1/2] tls: annotate lockless access to sk->sk_err
flat view
COOLING12d
SUPERSEDED
From: Quanye Yang via B4 Relay <devnull+quanyeyang.proton.me@kernel.org>
Date: 2026-10-02 07:29:31
Also in:
b4-sent, bpf, lkml
Subsystem:
networking [general], networking [tls], the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, John Fastabend, Sabrina Dubroca, Linus Torvalds
Revision v1 of 2 in this series.
Revisions (2)
- v1 current
- v2 [diff vs current]
From: Quanye Yang <redacted> kTLS sits on the same struct sock as TCP. do_recvmmsg() and getsockopt(SO_ERROR) still call sock_error() without the socket lock and clear sk_err with xchg(). tls_rx_rec_wait() already peeks when data has been copied and consumes otherwise, but the outer if (sk_err) is an unmarked load. On the no-data path that check-then-sock_error() window can return 0 after another thread consumes the error. Call sock_error() once and only return when it is non-zero; keep READ_ONCE() on the peek path. tls_sw_sendmsg_locked(), tls_push_data() and bpf_exec_tx_verdict() read sk_err twice. Fold those unmarked loads into one READ_ONCE() and use that value as the returned errno. The field is still not consumed there. Link: https://lore.kernel.org/netdev/3d9d442f-f168-43da-87b0-010ad5a78365@redhat.com/ (local) Signed-off-by: Quanye Yang <redacted> --- net/tls/tls_device.c | 5 +++-- net/tls/tls_sw.c | 45 ++++++++++++++++++++++++++++++--------------- 2 files changed, 33 insertions(+), 17 deletions(-)
diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
index f11d0528fc43..03ce83a9d4e9 100644
--- a/net/tls/tls_device.c
+++ b/net/tls/tls_device.c@@ -444,8 +444,9 @@ static int tls_push_data(struct sock *sk, if ((flags & (MSG_MORE | MSG_EOR)) == (MSG_MORE | MSG_EOR)) return -EINVAL; - if (unlikely(sk->sk_err)) - return -sk->sk_err; + rc = -READ_ONCE(sk->sk_err); + if (unlikely(rc)) + return rc; flags |= MSG_SENDPAGE_DECRYPTED; tls_push_record_flags = flags | MSG_MORE;
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index d1ad31986cf2..12e4458b44bb 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c@@ -704,10 +704,14 @@ static int bpf_exec_tx_verdict(struct sk_msg *msg, struct sock *sk, int err; err = tls_push_record(sk, flags, record_type); - if (err && err != -EINPROGRESS && sk->sk_err == EBADMSG) { - *copied -= sk_msg_free(sk, msg); - tls_free_open_rec(sk); - err = -sk->sk_err; + if (err && err != -EINPROGRESS) { + int skerr = READ_ONCE(sk->sk_err); + + if (skerr == EBADMSG) { + *copied -= sk_msg_free(sk, msg); + tls_free_open_rec(sk); + err = -skerr; + } } return err; }
@@ -800,10 +804,9 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, } while (msg_data_left(msg)) { - if (sk->sk_err) { - ret = -sk->sk_err; + ret = -READ_ONCE(sk->sk_err); + if (ret) goto send_end; - } if (ctx->open_rec) rec = ctx->open_rec;
@@ -1107,10 +1110,16 @@ tls_rx_rec_wait(struct sock *sk, bool nonblock, bool released, bool has_copied) timeo = sock_rcvtimeo(sk, nonblock); while (!tls_strp_msg_ready(ctx)) { - if (sk->sk_err) { - if (has_copied) - return -READ_ONCE(sk->sk_err); - return sock_error(sk); + if (has_copied) { + int err = READ_ONCE(sk->sk_err); + + if (err) + return -err; + } else { + int err = sock_error(sk); + + if (err) + return err; } if (ret < 0)
@@ -1132,10 +1141,16 @@ tls_rx_rec_wait(struct sock *sk, bool nonblock, bool released, bool has_copied) * sk_err here so a connection abort surfaces as the * actual error rather than a clean EOF. */ - if (sk->sk_err) { - if (has_copied) - return -READ_ONCE(sk->sk_err); - return sock_error(sk); + if (has_copied) { + int err = READ_ONCE(sk->sk_err); + + if (err) + return -err; + } else { + int err = sock_error(sk); + + if (err) + return err; } if (sk->sk_shutdown & RCV_SHUTDOWN) return 0;
--
2.55.0