diff options
| author | Eric Dumazet <edumazet@google.com> | 2026-09-13 12:32:24 +0000 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2026-09-15 14:56:06 +0200 |
| commit | e8c06b895281ad68b2818c3f0c99b0d7fb79539f (patch) | |
| tree | 035cc833ca7b7030fbfca11b3e0e9e4f388e8728 /net/ipv4/tcp.c | |
| parent | 7bbb398689fe56196c321f4106bf7f570bfa3eaa (diff) | |
| download | linux-next-e8c06b895281ad68b2818c3f0c99b0d7fb79539f.tar.gz linux-next-e8c06b895281ad68b2818c3f0c99b0d7fb79539f.zip | |
tcp: make smp_rmb() conditional in tcp_poll()
Commit a4d258036ed9 ("tcp: Fix race in tcp_poll") added smp_rmb() in
tcp_poll() and smp_wmb() in tcp_reset() (now tcp_done_with_error())
to ensure that if tcp_poll() observed socket closure, it would also
observe sk->sk_err.
Currently, tcp_poll() unconditionally executes smp_rmb() at the end
of every invocation, which on weakly-ordered architectures such as ARM64
emits a memory barrier instruction (dmb ishld) on the poll fast path,
even for healthy, active sockets.
However, tcp_poll() only needs this barrier if socket closure has been
observed, to ensure that the error code set by tcp_done_with_error()
before socket closure is visible before returning EPOLLERR.
Move smp_rmb() inside the conditional block handling socket closure
(shutdown == SHUTDOWN_MASK || state == TCP_CLOSE). For healthy
connected sockets in epoll, tcp_poll() avoids the barrier entirely.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260913123224.762935-1-edumazet@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Diffstat (limited to 'net/ipv4/tcp.c')
| -rw-r--r-- | net/ipv4/tcp.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 562752352afe..3ac485685279 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -578,8 +578,13 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait) * blocking on fresh not-connected or disconnected socket. --ANK */ shutdown = READ_ONCE(sk->sk_shutdown); - if (shutdown == SHUTDOWN_MASK || state == TCP_CLOSE) + if (shutdown == SHUTDOWN_MASK || state == TCP_CLOSE) { mask |= EPOLLHUP; + /* Coupled with smp_wmb() in tcp_done_with_error() to ensure + * sk->sk_err is visible if socket closure was observed. + */ + smp_rmb(); + } if (shutdown & RCV_SHUTDOWN) mask |= EPOLLIN | EPOLLRDNORM | EPOLLRDHUP; @@ -626,8 +631,6 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait) */ mask |= EPOLLOUT | EPOLLWRNORM; } - /* This barrier is coupled with smp_wmb() in tcp_done_with_error() */ - smp_rmb(); if (READ_ONCE(sk->sk_err) || !skb_queue_empty_lockless(&sk->sk_error_queue)) mask |= EPOLLERR; |