Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e0d694d6 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

tcp: annotate tp->snd_nxt lockless reads 



There are few places where we fetch tp->snd_nxt while
this field can change from IRQ or other cpu.

We need to add READ_ONCE() annotations, and also make
sure write sides use corresponding WRITE_ONCE() to avoid
store-tearing.

Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 0f317464

include/net/tcp.h

+2 −1
Original line number Diff line number Diff line
@@ -1917,7 +1917,8 @@ static inline u32 tcp_notsent_lowat(const struct tcp_sock *tp) 
static inline bool tcp_stream_memory_free(const struct sock *sk, int wake)

{

	const struct tcp_sock *tp = tcp_sk(sk);

	u32 notsent_bytes = READ_ONCE(tp->write_seq) - tp->snd_nxt;

	u32 notsent_bytes = READ_ONCE(tp->write_seq) -

			    READ_ONCE(tp->snd_nxt);



	return (notsent_bytes << wake) < tcp_notsent_lowat(tp);

}

net/ipv4/tcp.c

+2 −1
Original line number Diff line number Diff line
@@ -625,7 +625,8 @@ int tcp_ioctl(struct sock *sk, int cmd, unsigned long arg) 
		if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV))

			answ = 0;

		else

			answ = READ_ONCE(tp->write_seq) - tp->snd_nxt;

			answ = READ_ONCE(tp->write_seq) -

			       READ_ONCE(tp->snd_nxt);

		break;

	default:

		return -ENOIOCTLCMD;

net/ipv4/tcp_minisocks.c

+4 −2
Original line number Diff line number Diff line
@@ -482,8 +482,10 @@ struct sock *tcp_create_openreq_child(const struct sock *sk, 
	WRITE_ONCE(newtp->rcv_nxt, seq);

	newtp->segs_in = 1;



	newtp->snd_sml = newtp->snd_una =

	newtp->snd_nxt = newtp->snd_up = treq->snt_isn + 1;

	seq = treq->snt_isn + 1;

	newtp->snd_sml = newtp->snd_una = seq;

	WRITE_ONCE(newtp->snd_nxt, seq);

	newtp->snd_up = seq;



	INIT_LIST_HEAD(&newtp->tsq_node);

	INIT_LIST_HEAD(&newtp->tsorted_sent_queue);

net/ipv4/tcp_output.c

+5 −5
Original line number Diff line number Diff line
@@ -67,7 +67,7 @@ static void tcp_event_new_data_sent(struct sock *sk, struct sk_buff *skb) 
	struct tcp_sock *tp = tcp_sk(sk);

	unsigned int prior_packets = tp->packets_out;



	tp->snd_nxt = TCP_SKB_CB(skb)->end_seq;

	WRITE_ONCE(tp->snd_nxt, TCP_SKB_CB(skb)->end_seq);



	__skb_unlink(skb, &sk->sk_write_queue);

	tcp_rbtree_insert(&sk->tcp_rtx_queue, skb);
@@ -3142,7 +3142,7 @@ void tcp_send_fin(struct sock *sk) 
			 * if FIN had been sent. This is because retransmit path

			 * does not change tp->snd_nxt.

			 */

			tp->snd_nxt++;

			WRITE_ONCE(tp->snd_nxt, tp->snd_nxt + 1);

			return;

		}

	} else {
@@ -3426,7 +3426,7 @@ static void tcp_connect_init(struct sock *sk) 
	tp->snd_una = tp->write_seq;

	tp->snd_sml = tp->write_seq;

	tp->snd_up = tp->write_seq;

	tp->snd_nxt = tp->write_seq;

	WRITE_ONCE(tp->snd_nxt, tp->write_seq);



	if (likely(!tp->repair))

		tp->rcv_nxt = 0;
@@ -3586,11 +3586,11 @@ int tcp_connect(struct sock *sk) 
	/* We change tp->snd_nxt after the tcp_transmit_skb() call

	 * in order to make this packet get counted in tcpOutSegs.

	 */

	tp->snd_nxt = tp->write_seq;

	WRITE_ONCE(tp->snd_nxt, tp->write_seq);

	tp->pushed_seq = tp->write_seq;

	buff = tcp_send_head(sk);

	if (unlikely(buff)) {

		tp->snd_nxt	= TCP_SKB_CB(buff)->seq;

		WRITE_ONCE(tp->snd_nxt, TCP_SKB_CB(buff)->seq);

		tp->pushed_seq	= TCP_SKB_CB(buff)->seq;

	}

	TCP_INC_STATS(sock_net(sk), TCP_MIB_ACTIVEOPENS);