From: Jakub Kicinski <kuba@kernel.org>
To: Jinjie Ruan <ruanjinjie@huawei.com>
Cc: <viro@zeniv.linux.org.uk>, <brauner@kernel.org>, <jack@suse.cz>,
<bcrl@kvack.org>, <tytso@mit.edu>, <adilger.kernel@dilger.ca>,
<libaokun@linux.alibaba.com>, <ojaswin@linux.ibm.com>,
<ritesh.list@gmail.com>, <yi.zhang@huawei.com>,
<sforshee@kernel.org>, <pmladek@suse.com>, <rostedt@goodmis.org>,
<andriy.shevchenko@linux.intel.com>, <linux@rasmusvillemoes.dk>,
<senozhatsky@chromium.org>, <akpm@linux-foundation.org>,
<davem@davemloft.net>, <edumazet@google.com>, <pabeni@redhat.com>,
<horms@kernel.org>, <kuniyu@google.com>, <willemb@google.com>,
<jhs@mojatatu.com>, <jiri@resnulli.us>, <kees@kernel.org>,
<cyphar@cyphar.com>, <tglx@kernel.org>, <sdf@fomichev.me>,
<nb@tipi-net.de>, <liuhangbin@gmail.com>, <da-x@monatomic.org>,
<jeff@garzik.org>, <linux-fsdevel@vger.kernel.org>,
<linux-aio@kvack.org>, <linux-kernel@vger.kernel.org>,
<linux-ext4@vger.kernel.org>, <netdev@vger.kernel.org>
Subject: Re: [PATCH v2 11/12] 8021q: Fix data race when publishing vlan net_device pointers
Date: Tue, 1 Sep 2026 07:58:33 -0700 [thread overview]
Message-ID: <20260901075833.1aa73cb3@kernel.org> (raw)
In-Reply-To: <20260901024234.135119-12-ruanjinjie@huawei.com>
On Tue, 1 Sep 2026 10:42:33 +0800 Jinjie Ruan wrote:
> A plain C read and assignment of the net_device pointer
> in the vlan_devices_arrays leaf entries lack proper atomicity
> and ordering barriers. A concurrent lockless reader on the packet
> receive fast-path could observe a torn or partially initialized
> net_device pointer, leading to a potential out-of-bounds read or kernel
> panic.
>
> The data race occurs between the netlink/ioctl configuration paths
> (holding the per-netns rtnl_nets_lock or RTNL lock) and the softirq
> receive fast-path (holding rcu_read_lock()):
>
> CPU 0 (Writer, rtnl_nets_lock/RTNL) CPU 1 (Reader, rcu_read_lock())
> ----------------------------------- -------------------------------
> rtnetlink_rcv_msg()
> // RTM_NEWLINK handler with RTNL_FLAG_DOIT_PERNET
> rtnl_newlink()
> ops->newlink() == vlan_newlink()
> OR
> vlan_ioctl_handler()
> [ADD_VLAN_CMD] -> register_vlan_device()
>
> register_vlan_dev()
> vlan_group_set_device()
> netif_receive_skb_core()
> vlan_do_receive()
> vlan_find_dev()
> __vlan_group_get_device()
> // Speculative / torn read
> [Loads bad net_device *]
> [Plain C store]
> array[vlan_id] = dev;
> // Dereferences bad pointer
> // during device status check
> vlan_dev->flags (PANIC!)
>
> Fix this by using rcu_assign_pointer() in vlan_group_set_device()
> and rcu_dereference_raw() in __vlan_group_get_device() to enforce
> proper ordering and memory atomicity for the leaf entry traversal.
>
> Cc: stable@vger.kernel.org
> Cc: "David S. Miller" <davem@davemloft.net>
> Cc: Eric Dumazet <edumazet@google.com>
> Cc: Jakub Kicinski <kuba@kernel.org>
> Cc: Paolo Abeni <pabeni@redhat.com>
> Cc: Simon Horman <horms@kernel.org>
> Cc: Stanislav Fomichev <sdf@fomichev.me>
> Cc: Kuniyuki Iwashima <kuniyu@google.com>
> Cc: Nicolai Buchwitz <nb@tipi-net.de>
> Cc: Dan Aloni <da-x@monatomic.org>
> Cc: Jeff Garzik <jeff@garzik.org>
> Fixes: 5c15bdec5c38 ("[VLAN]: Avoid a 4-order allocation.")
> Link: https://sashiko.dev/#/patchset/20260825095422.3166067-1-ruanjinjie%40huawei.com
> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
make C=1 says:
net/8021q/vlan.c: note: in included file:
net/8021q/vlan.h:91:9: error: incompatible types in comparison expression (different address spaces):
net/8021q/vlan.h:91:9: struct net_device [noderef] __rcu *
net/8021q/vlan.h:91:9: struct net_device *
net/8021q/vlan.h:91:9: error: incompatible types in comparison expression (different address spaces):
net/8021q/vlan.h:91:9: struct net_device [noderef] __rcu *
net/8021q/vlan.h:91:9: struct net_device *
next prev parent reply other threads:[~2026-09-01 14:58 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-01 2:42 [PATCH v2 00/12] Convert barrier pairs to acquire/release for better performance Jinjie Ruan
2026-09-01 2:42 ` [PATCH v2 01/12] user_namespace: Use acquire/release for nr_extents synchronization Jinjie Ruan
2026-09-01 2:42 ` [PATCH v2 02/12] lib/vsprintf: Use acquire/release for ptr_key publication Jinjie Ruan
2026-09-01 2:42 ` [PATCH v2 03/12] fs: aio: Use acquire/release for ring->tail publication Jinjie Ruan
2026-09-01 2:42 ` [PATCH v2 04/12] fs: Use acquire/release for fdtable resize synchronization Jinjie Ruan
2026-09-01 2:42 ` [PATCH v2 05/12] pidfs: Use test_bit_acquire() for attr flag tests Jinjie Ruan
2026-09-01 2:42 ` [PATCH v2 06/12] super: Use acquire for SB_BORN check in super_cache_count() Jinjie Ruan
2026-09-01 2:42 ` [PATCH v2 07/12] ext4: Fix out-of-bounds read in ext4_get_group_info() Jinjie Ruan
2026-09-01 6:44 ` Zhang Yi
2026-09-01 13:55 ` Jan Kara
2026-09-01 2:42 ` [PATCH v2 08/12] ext4: Convert group-count barrier protocol to acquire/release Jinjie Ruan
2026-09-01 2:42 ` [PATCH v2 09/12] soreuseport: publish num_socks with acquire/release Jinjie Ruan
2026-09-01 2:42 ` [PATCH v2 10/12] net: sched: act_gact: use acquire/release for tcfg_ptype Jinjie Ruan
2026-09-01 2:42 ` [PATCH v2 11/12] 8021q: Fix data race when publishing vlan net_device pointers Jinjie Ruan
2026-09-01 14:58 ` Jakub Kicinski [this message]
2026-09-01 2:42 ` [PATCH v2 12/12] 8021q: publish vlan_devices_arrays entries with acquire/release Jinjie Ruan
2026-09-01 3:06 ` [PATCH v2 00/12] Convert barrier pairs to acquire/release for better performance Kuniyuki Iwashima
2026-09-01 3:15 ` Jinjie Ruan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260901075833.1aa73cb3@kernel.org \
--to=kuba@kernel.org \
--cc=adilger.kernel@dilger.ca \
--cc=akpm@linux-foundation.org \
--cc=andriy.shevchenko@linux.intel.com \
--cc=bcrl@kvack.org \
--cc=brauner@kernel.org \
--cc=cyphar@cyphar.com \
--cc=da-x@monatomic.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=jack@suse.cz \
--cc=jeff@garzik.org \
--cc=jhs@mojatatu.com \
--cc=jiri@resnulli.us \
--cc=kees@kernel.org \
--cc=kuniyu@google.com \
--cc=libaokun@linux.alibaba.com \
--cc=linux-aio@kvack.org \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@rasmusvillemoes.dk \
--cc=liuhangbin@gmail.com \
--cc=nb@tipi-net.de \
--cc=netdev@vger.kernel.org \
--cc=ojaswin@linux.ibm.com \
--cc=pabeni@redhat.com \
--cc=pmladek@suse.com \
--cc=ritesh.list@gmail.com \
--cc=rostedt@goodmis.org \
--cc=ruanjinjie@huawei.com \
--cc=sdf@fomichev.me \
--cc=senozhatsky@chromium.org \
--cc=sforshee@kernel.org \
--cc=tglx@kernel.org \
--cc=tytso@mit.edu \
--cc=viro@zeniv.linux.org.uk \
--cc=willemb@google.com \
--cc=yi.zhang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox