tcp: annotate data-races in tcp_req_diag_fill()

req->num_retrans and rsk_timer.expires are read locklessly,
and can be changed from tcp_rtx_synack().

Add READ_ONCE()/WRITE_ONCE() annotations.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20250828102738.2065992-3-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c
index 2f3a779ce7a2da7d59c6a471c155c3e6d1563acd..4ed6b93527f4ad00f34cc732639c0c82d0feff08 100644 (file)
--- a/net/ipv4/tcp_diag.c
+++ b/net/ipv4/tcp_diag.c
@@ -248,12 +248,12 @@ static int tcp_req_diag_fill(struct sock *sk, struct sk_buff *skb,
        inet_diag_msg_common_fill(r, sk);
        r->idiag_state = TCP_SYN_RECV;
        r->idiag_timer = 1;
-       r->idiag_retrans = reqsk->num_retrans;
+       r->idiag_retrans = READ_ONCE(reqsk->num_retrans);
 
        BUILD_BUG_ON(offsetof(struct inet_request_sock, ir_cookie) !=
                     offsetof(struct sock, sk_cookie));
 
-       tmo = inet_reqsk(sk)->rsk_timer.expires - jiffies;
+       tmo = READ_ONCE(inet_reqsk(sk)->rsk_timer.expires) - jiffies;
        r->idiag_expires = jiffies_delta_to_msecs(tmo);
        r->idiag_rqueue = 0;
        r->idiag_wqueue = 0;

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 06b26a6efd628e85f97bdb7253c344565b0ed56d..e180364b8ddad4baa9978418ffd9c8b871342cb9 100644 (file)
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -4438,7 +4438,7 @@ int tcp_rtx_synack(const struct sock *sk, struct request_sock *req)
                        tcp_sk_rw(sk)->total_retrans++;
                }
                trace_tcp_retransmit_synack(sk, req);
-               req->num_retrans++;
+               WRITE_ONCE(req->num_retrans, req->num_retrans + 1);
        }
        return res;
 }