Patch "net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-smc-check-sndbuf_space-again-after-nospace-flag-.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 5d04092d4c4cb2c67af9b63ce97ff13c6832e206
Author: Guangguan Wang <guangguan.wang@xxxxxxxxxxxxxxxxx>
Date:   Wed Dec 11 17:21:17 2024 +0800

    net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll
    
    [ Upstream commit 679e9ddcf90dbdf98aaaa71a492454654b627bcb ]
    
    When application sending data more than sndbuf_space, there have chances
    application will sleep in epoll_wait, and will never be wakeup again. This
    is caused by a race between smc_poll and smc_cdc_tx_handler.
    
    application                                      tasklet
    smc_tx_sendmsg(len > sndbuf_space)   |
    epoll_wait for EPOLL_OUT,timeout=0   |
      smc_poll                           |
        if (!smc->conn.sndbuf_space)     |
                                         |  smc_cdc_tx_handler
                                         |    atomic_add sndbuf_space
                                         |    smc_tx_sndbuf_nonfull
                                         |      if (!test_bit SOCK_NOSPACE)
                                         |        do not sk_write_space;
          set_bit SOCK_NOSPACE;          |
        return mask=0;                   |
    
    Application will sleep in epoll_wait as smc_poll returns 0. And
    smc_cdc_tx_handler will not call sk_write_space because the SOCK_NOSPACE
    has not be set. If there is no inflight cdc msg, sk_write_space will not be
    called any more, and application will sleep in epoll_wait forever.
    So check sndbuf_space again after NOSPACE flag is set to break the race.
    
    Fixes: 8dce2786a290 ("net/smc: smc_poll improvements")
    Signed-off-by: Guangguan Wang <guangguan.wang@xxxxxxxxxxxxxxxxx>
    Suggested-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 664ddf5641de..3a4ae589671a 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -2110,6 +2110,13 @@ static __poll_t smc_poll(struct file *file, struct socket *sock,
 			} else {
 				sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk);
 				set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
+
+				if (sk->sk_state != SMC_INIT) {
+					/* Race breaker the same way as tcp_poll(). */
+					smp_mb__after_atomic();
+					if (atomic_read(&smc->conn.sndbuf_space))
+						mask |= EPOLLOUT | EPOLLWRNORM;
+				}
 			}
 			if (atomic_read(&smc->conn.bytes_to_rcv))
 				mask |= EPOLLIN | EPOLLRDNORM;