Re: [PATCH v2 11/12] 8021q: Fix data race when publishing vlan net_device pointers

[Jinjie Ruan <ruanjinjie@huawei.com>]

在 2026/9/1 22:58, Jakub Kicinski 写道:
> On Tue, 1 Sep 2026 10:42:33 +0800 Jinjie Ruan wrote:
>> A plain C read and assignment of the net_device pointer
>> in the vlan_devices_arrays leaf entries lack proper atomicity
>> and ordering barriers. A concurrent lockless reader on the packet
>> receive fast-path could observe a torn or partially initialized
>> net_device pointer, leading to a potential out-of-bounds read or kernel
>> panic.
>>
>> The data race occurs between the netlink/ioctl configuration paths
>> (holding the per-netns rtnl_nets_lock or RTNL lock) and the softirq
>> receive fast-path (holding rcu_read_lock()):
>>
>>   CPU 0 (Writer, rtnl_nets_lock/RTNL)      CPU 1 (Reader, rcu_read_lock())
>>   -----------------------------------      -------------------------------
>>    rtnetlink_rcv_msg()
>>      // RTM_NEWLINK handler with RTNL_FLAG_DOIT_PERNET
>>      rtnl_newlink()
>>        ops->newlink() == vlan_newlink()
>>    OR
>>    vlan_ioctl_handler()
>>      [ADD_VLAN_CMD] -> register_vlan_device()
>>
>>      register_vlan_dev()
>>        vlan_group_set_device()
>>                                       netif_receive_skb_core()
>>                                           vlan_do_receive()
>>                                               vlan_find_dev()
>>                                                  __vlan_group_get_device()
>>                                                   // Speculative / torn read
>>                                                   [Loads bad net_device *]
>>            [Plain C store]
>>            array[vlan_id] = dev;
>>                                                   // Dereferences bad pointer
>>                                                   // during device status check
>>                                                   vlan_dev->flags (PANIC!)
>>
>> Fix this by using rcu_assign_pointer() in vlan_group_set_device()
>> and rcu_dereference_raw() in __vlan_group_get_device() to enforce
>> proper ordering and memory atomicity for the leaf entry traversal.
>>
>> Cc: stable@vger.kernel.org
>> Cc: "David S. Miller" <davem@davemloft.net>
>> Cc: Eric Dumazet <edumazet@google.com>
>> Cc: Jakub Kicinski <kuba@kernel.org>
>> Cc: Paolo Abeni <pabeni@redhat.com>
>> Cc: Simon Horman <horms@kernel.org>
>> Cc: Stanislav Fomichev <sdf@fomichev.me>
>> Cc: Kuniyuki Iwashima <kuniyu@google.com>
>> Cc: Nicolai Buchwitz <nb@tipi-net.de>
>> Cc: Dan Aloni <da-x@monatomic.org>
>> Cc: Jeff Garzik <jeff@garzik.org>
>> Fixes: 5c15bdec5c38 ("[VLAN]: Avoid a 4-order allocation.")
>> Link: https://sashiko.dev/#/patchset/20260825095422.3166067-1-ruanjinjie%40huawei.com
>> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
> 
> make C=1 says:
> 
> net/8021q/vlan.c: note: in included file:
> net/8021q/vlan.h:91:9: error: incompatible types in comparison expression (different address spaces):
> net/8021q/vlan.h:91:9:    struct net_device [noderef] __rcu *

Good catch, let me fix it in next version.

> net/8021q/vlan.h:91:9:    struct net_device *
> net/8021q/vlan.h:91:9: error: incompatible types in comparison expression (different address spaces):
> net/8021q/vlan.h:91:9:    struct net_device [noderef] __rcu *
> net/8021q/vlan.h:91:9:    struct net_device *