Re: [PATCH net-next 01/14] ipv4: annotate data-races around ip_rt_* sysctls

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] ipv4: double READ_ONCE() of ip_rt_min_pmtu in
  __ip_rt_update_pmtu()
--

commit d59c48746ce88d155c2f7dae0505f71dcceee996
Author: Jiayuan Chen <jiayuan.chen@linux.dev>

ipv4: annotate data-races around ip_rt_* sysctls

This commit wraps lockless reads of the ip_rt_* routing sysctls in
READ_ONCE() to avoid data races with concurrent sysctl writes.

> diff --git a/net/ipv4/route.c b/net/ipv4/route.c
> index d0a5f6d77094c..83f49b2d4c36a 100644
> --- a/net/ipv4/route.c
> +++ b/net/ipv4/route.c

[ ... ]

> @@ -1063,14 +1066,14 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
>  
>  	rcu_read_lock();
>  	net = dst_dev_net_rcu(dst);
> -	if (mtu < net->ipv4.ip_rt_min_pmtu) {
> +	if (mtu < READ_ONCE(net->ipv4.ip_rt_min_pmtu)) {
>  		lock = true;
> -		mtu = min(old_mtu, net->ipv4.ip_rt_min_pmtu);
> +		mtu = min(old_mtu, READ_ONCE(net->ipv4.ip_rt_min_pmtu));
>  	}

[Severity: Low]
Should READ_ONCE(net->ipv4.ip_rt_min_pmtu) be cached in a local variable
here, as done in ip_error()?  If net.ipv4.route.min_pmtu is lowered
between the two reads, the first load can observe the old higher limit
while the second observes the new lower value, clamping and locking mtu
below the incoming packet's reported PMTU.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109025425.328445-1-jiayuan.chen@linux.dev?part=1