From: Jiayuan Chen Date: Fri, 22 May 2026 01:16:20 +0000 (+0800) Subject: rds: annotate data-race around rs_seen_congestion X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=67636cab273ed0c0b0f2adab6c9369a471cb7966;p=thirdparty%2Fkernel%2Flinux.git rds: annotate data-race around rs_seen_congestion rs_seen_congestion is read in rds_poll() and written in rds_sendmsg() and rds_poll() without any lock. Use READ_ONCE()/WRITE_ONCE() to annotate these lockless accesses and silence KCSAN. Reported-by: syzbot+fbf3648ae7f5bdb05c59@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6a0f8d94.050a0220.6b33c.0000.GAE@google.com/ Signed-off-by: Jiayuan Chen Reviewed-by: Allison Henderson   Tested-by: Allison Henderson Link: https://patch.msgid.link/20260522011621.304470-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski --- diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c index 76f625986a7f2..93b2da63ed42e 100644 --- a/net/rds/af_rds.c +++ b/net/rds/af_rds.c @@ -219,7 +219,7 @@ static __poll_t rds_poll(struct file *file, struct socket *sock, poll_wait(file, sk_sleep(sk), wait); - if (rs->rs_seen_congestion) + if (READ_ONCE(rs->rs_seen_congestion)) poll_wait(file, &rds_poll_waitq, wait); read_lock_irqsave(&rs->rs_recv_lock, flags); @@ -247,7 +247,7 @@ static __poll_t rds_poll(struct file *file, struct socket *sock, /* clear state any time we wake a seen-congested socket */ if (mask) - rs->rs_seen_congestion = 0; + WRITE_ONCE(rs->rs_seen_congestion, 0); return mask; } diff --git a/net/rds/send.c b/net/rds/send.c index d8b14ff9d366b..e5d58c29aabea 100644 --- a/net/rds/send.c +++ b/net/rds/send.c @@ -1388,7 +1388,7 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len) ret = rds_cong_wait(conn->c_fcong, dport, nonblock, rs); if (ret) { - rs->rs_seen_congestion = 1; + WRITE_ONCE(rs->rs_seen_congestion, 1); goto out; } while (!rds_send_queue_rm(rs, conn, cpath, rm, rs->rs_bound_port,