Commit dd23c9f1e8d5 ("tcp: annotate data-races around tp->tsoffset")
updated do_tcp_getsockopt() to read tp->tsoffset with READ_ONCE()
for TCP_TIMESTAMP because another CPU may change it concurrently.

tcp_v6_connect() still stores tp->tsoffset with a plain write. That
store runs under lock_sock() via inet_stream_connect(), but the socket
lock does not serialize a concurrent getsockopt(TCP_TIMESTAMP) from
another task sharing the socket.

Use WRITE_ONCE() for the tcp_v6_connect() store so the connect-time
writer matches the lockless TCP_TIMESTAMP reader. This also makes the
IPv6 path consistent with tcp_v4_connect().

Signed-off-by: Wesley Atwell <atwellwea@gmail.com>
---
 net/ipv6/tcp_ipv6.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index bb09d5ccf599..ba7cd7d3d4da 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -325,7 +325,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr_unsized *uaddr,
 						 inet->inet_dport);
 		if (!tp->write_seq)
 			WRITE_ONCE(tp->write_seq, st.seq);
-		tp->tsoffset = st.ts_off;
+		WRITE_ONCE(tp->tsoffset, st.ts_off);
 	}
 
 	if (tcp_fastopen_defer_connect(sk, &err))
-- 
2.34.1

On Mon, Mar 09, 2026 at 07:26:04PM +0800, Wesley Atwell wrote:
> Commit dd23c9f1e8d5 ("tcp: annotate data-races around tp->tsoffset")
> updated do_tcp_getsockopt() to read tp->tsoffset with READ_ONCE()
> for TCP_TIMESTAMP because another CPU may change it concurrently.
> 
> tcp_v6_connect() still stores tp->tsoffset with a plain write. That
> store runs under lock_sock() via inet_stream_connect(), but the socket
> lock does not serialize a concurrent getsockopt(TCP_TIMESTAMP) from
> another task sharing the socket.
> 
> Use WRITE_ONCE() for the tcp_v6_connect() store so the connect-time
> writer matches the lockless TCP_TIMESTAMP reader. This also makes the
> IPv6 path consistent with tcp_v4_connect().
> 
> Signed-off-by: Wesley Atwell <atwellwea@gmail.com>

I think maintainer will apply it to net-next tree after noticing Eric's comment..

Reviewed-by: Jiayuan Chen <jiayuan.chen@shopee.com>

> ---
>  net/ipv6/tcp_ipv6.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
> index bb09d5ccf599..ba7cd7d3d4da 100644
> --- a/net/ipv6/tcp_ipv6.c
> +++ b/net/ipv6/tcp_ipv6.c
> @@ -325,7 +325,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr_unsized *uaddr,
>  						 inet->inet_dport);
>  		if (!tp->write_seq)
>  			WRITE_ONCE(tp->write_seq, st.seq);
> -		tp->tsoffset = st.ts_off;
> +		WRITE_ONCE(tp->tsoffset, st.ts_off);
>  	}
>  
>  	if (tcp_fastopen_defer_connect(sk, &err))

On Mon, Mar 09, 2026 at 07:26:04PM +0800, Wesley Atwell wrote:

You should use [PATCH net] instead of [PATCH] to indicate which tree 
this patch is intended for.

> Commit dd23c9f1e8d5 ("tcp: annotate data-races around tp->tsoffset")
> updated do_tcp_getsockopt() to read tp->tsoffset with READ_ONCE()
> for TCP_TIMESTAMP because another CPU may change it concurrently.
> 
> tcp_v6_connect() still stores tp->tsoffset with a plain write. That
> store runs under lock_sock() via inet_stream_connect(), but the socket
> lock does not serialize a concurrent getsockopt(TCP_TIMESTAMP) from
> another task sharing the socket.
> 
> Use WRITE_ONCE() for the tcp_v6_connect() store so the connect-time
> writer matches the lockless TCP_TIMESTAMP reader. This also makes the
> IPv6 path consistent with tcp_v4_connect().
> 
> Signed-off-by: Wesley Atwell <atwellwea@gmail.com>
> ---
>  net/ipv6/tcp_ipv6.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
> index bb09d5ccf599..ba7cd7d3d4da 100644
> --- a/net/ipv6/tcp_ipv6.c
> +++ b/net/ipv6/tcp_ipv6.c
> @@ -325,7 +325,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr_unsized *uaddr,
>  						 inet->inet_dport);
>  		if (!tp->write_seq)
>  			WRITE_ONCE(tp->write_seq, st.seq);
> -		tp->tsoffset = st.ts_off;
> +		WRITE_ONCE(tp->tsoffset, st.ts_off);
>  	}
>  
>  	if (tcp_fastopen_defer_connect(sk, &err))

On Tue, Mar 10, 2026 at 4:20 AM Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
>
> On Mon, Mar 09, 2026 at 07:26:04PM +0800, Wesley Atwell wrote:
>
> You should use [PATCH net] instead of [PATCH] to indicate which tree
> this patch is intended for.
>

I saw the discrepancy while cooking

commit 165573e41f2f66ef98940cf65f838b2cb575d9d1    tcp: secure_seq:
add back ports to TS offset

For this reason, it is better to use net-next tree and avoid merge conflicts.

Note that TCP_TIMESTAMP getsockopt() is probably not used while
another thread is doing a connect(),
it is mostly used for TCP_REPAIR. No need for stable backports.

Reviewed-by: Eric Dumazet <edumazet@google.com>