Patch "tcp: fix race in tcp_write_err()" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    tcp: fix race in tcp_write_err()

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     tcp-fix-race-in-tcp_write_err.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 4b63d16e634179e97287f9a4713194efbd92ad76
Author: Eric Dumazet <edumazet@xxxxxxxxxx>
Date:   Tue May 28 12:52:51 2024 +0000

    tcp: fix race in tcp_write_err()
    
    [ Upstream commit 853c3bd7b7917670224c9fe5245bd045cac411dd ]
    
    I noticed flakes in a packetdrill test, expecting an epoll_wait()
    to return EPOLLERR | EPOLLHUP on a failed connect() attempt,
    after multiple SYN retransmits. It sometimes return EPOLLERR only.
    
    The issue is that tcp_write_err():
     1) writes an error in sk->sk_err,
     2) calls sk_error_report(),
     3) then calls tcp_done().
    
    tcp_done() is writing SHUTDOWN_MASK into sk->sk_shutdown,
    among other things.
    
    Problem is that the awaken user thread (from 2) sk_error_report())
    might call tcp_poll() before tcp_done() has written sk->sk_shutdown.
    
    tcp_poll() only sees a non zero sk->sk_err and returns EPOLLERR.
    
    This patch fixes the issue by making sure to call sk_error_report()
    after tcp_done().
    
    tcp_write_err() also lacks an smp_wmb().
    
    We can reuse tcp_done_with_error() to factor out the details,
    as Neal suggested.
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx>
    Acked-by: Neal Cardwell <ncardwell@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240528125253.1966136-3-edumazet@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index ed01b775b8947..1a3a84992b9be 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -67,11 +67,7 @@ u32 tcp_clamp_probe0_to_user_timeout(const struct sock *sk, u32 when)
 
 static void tcp_write_err(struct sock *sk)
 {
-	WRITE_ONCE(sk->sk_err, READ_ONCE(sk->sk_err_soft) ? : ETIMEDOUT);
-	sk_error_report(sk);
-
-	tcp_write_queue_purge(sk);
-	tcp_done(sk);
+	tcp_done_with_error(sk, READ_ONCE(sk->sk_err_soft) ? : ETIMEDOUT);
 	__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTONTIMEOUT);
 }