Re: [PATCH net] soreuseport: annotate data-races around reuse->socks[] and num_socks

[Kuniyuki Iwashima <kuniyu@google.com>]

On Fri, 30 Oct 2026 13:09:56 +0100, Eric Dumazet wrote:
> From: Eric Dumazet <edumazet@google.com>
> 
> reuseport_select_sock() and reuseport_migrate_sock() read
> reuse->num_socks and reuse->socks[] locklessly under RCU, while
> writers holding reuseport_lock can change them.
> 
> Readers snapshot num_socks once, then index socks[] with it.
> Meanwhile, writers can perform several operations, storing into
> slots below the reader's stale count:
> 
> - __reuseport_detach_sock() moves the last socket into slot i.
> - __reuseport_add_sock() then writes the new socket at the
>   (now smaller) num_socks index.
> - reuseport_stop_listen_sock() calls __reuseport_detach_sock()
>   then __reuseport_add_closed_sock(), which writes slot
>   max_socks - num_closed_socks - 1. This can be the slot a reader
>   still considers part of the listener region when the array is full.
> - __reuseport_detach_closed_sock() can then rewrite that slot.
> 
> All pointers stored in socks[] remain valid for the RCU grace period,
> but without annotations the compiler is allowed to tear or reload
> these accesses. For instance, reuseport_select_sock_by_hash() could
> reload reuse->socks[i] between the sk_state/sk_incoming_cpu checks
> and the return, returning a socket that did not pass them.
> 
> Use WRITE_ONCE() for all socks[] stores done while the array is
> visible to readers, and for num_socks updates (readers already use
> READ_ONCE()). Use READ_ONCE() in the two lockless readers.
> 
> Fixes: ef456144da8e ("soreuseport: define reuseport groups")
> Link: https://lore.kernel.org/netdev/20260902071900.395567-1-ruanjinjie@huawei.com/
> Cc: Kuniyuki Iwashima <kuniyu@google.com>
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>