From: Wesley Atwell Date: Tue, 10 Mar 2026 01:26:04 +0000 (-0600) Subject: tcp: use WRITE_ONCE() for tsoffset in tcp_v6_connect() X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=dc9902bbd480aae510b885b67cd30cd04cfce3a8;p=thirdparty%2Fkernel%2Flinux.git tcp: use WRITE_ONCE() for tsoffset in tcp_v6_connect() Commit dd23c9f1e8d5 ("tcp: annotate data-races around tp->tsoffset") updated do_tcp_getsockopt() to read tp->tsoffset with READ_ONCE() for TCP_TIMESTAMP because another CPU may change it concurrently. tcp_v6_connect() still stores tp->tsoffset with a plain write. That store runs under lock_sock() via inet_stream_connect(), but the socket lock does not serialize a concurrent getsockopt(TCP_TIMESTAMP) from another task sharing the socket. Use WRITE_ONCE() for the tcp_v6_connect() store so the connect-time writer matches the lockless TCP_TIMESTAMP reader. This also makes the IPv6 path consistent with tcp_v4_connect(). Signed-off-by: Wesley Atwell Reviewed-by: Eric Dumazet Reviewed-by: Jiayuan Chen Link: https://patch.msgid.link/20260310012604.145661-1-atwellwea@gmail.com Signed-off-by: Jakub Kicinski --- diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index 074b83c9a551f..8dc3874e8b925 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -325,7 +325,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr_unsized *uaddr, inet->inet_dport); if (!tp->write_seq) WRITE_ONCE(tp->write_seq, st.seq); - tp->tsoffset = st.ts_off; + WRITE_ONCE(tp->tsoffset, st.ts_off); } if (tcp_fastopen_defer_connect(sk, &err))