Re: [PATCH 10/11] 8021q: publish vlan_devices_arrays entries with acquire/release

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing RCU synchronization when publishing and reading VLAN net_device pointers.
--

--- Patch [10]: [PATCH 10/11] 8021q: publish vlan_devices_arrays entries with acquire/release ---
commit f29c587f5f1e59d66c0cd64be52269fbafa24e47
Author: Jinjie Ruan <ruanjinjie@huawei.com>

8021q: publish vlan_devices_arrays entries with acquire/release

This patch replaces the smp_wmb() and smp_rmb() barrier pair with
smp_store_release() and smp_load_acquire() for publishing and reading the
VLAN device sub-arrays. This ensures the allocated array entries are properly
visible when acquired by __vlan_group_get_device().

[ ... ]

> diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h
> index c41caaf94095f..6db7172bdaacc 100644
> --- a/net/8021q/vlan.h
> +++ b/net/8021q/vlan.h
> @@ -56,11 +56,9 @@ static inline struct net_device *__vlan_group_get_device(struct vlan_group *vg,
>  {
>  	struct net_device **array;
>  
> -	array = vg->vlan_devices_arrays[pidx]
> -				       [vlan_id / VLAN_GROUP_ARRAY_PART_LEN];
> -
> -	/* paired with smp_wmb() in vlan_group_prealloc_vid() */
> -	smp_rmb();
> +	/* Pairs with smp_store_release() in vlan_group_prealloc_vid() */
> +	array = smp_load_acquire(&vg->vlan_devices_arrays[pidx]
> +				 [vlan_id / VLAN_GROUP_ARRAY_PART_LEN]);
>  
>  	return array ? array[vlan_id % VLAN_GROUP_ARRAY_PART_LEN] : NULL;

[Severity: High]
This is a pre-existing issue, but does this array read lack RCU protection?

While the patch correctly handles publishing the array itself, the individual
net_device pointer in the array is accessed via a plain C read here. It is
also written via a plain assignment in vlan_group_set_device():

    array[vlan_id % VLAN_GROUP_ARRAY_PART_LEN] = dev;

Could this allow lockless RCU readers in the receive fast-path, such as
vlan_do_receive(), to read a partially initialized net_device pointer due to
compiler load tearing or missing data dependency barriers?

Should these accesses use rcu_dereference() and rcu_assign_pointer() to
ensure safe RCU traversal and prevent potential memory corruption?

>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260825095422.3166067-1-ruanjinjie@huawei.com?part=10