[PATCH net v2] net: openvswitch: fix data race in ovs_vport_get_upcall_stats

[PATCH net v2] net: openvswitch: fix data race in ovs_vport_get_upcall_stats

[David Yang]

In ovs_vport_get_upcall_stats(), some statistics protected by
u64_stats_sync, are read and accumulated in ignorance of possible
u64_stats_fetch_retry() events. These statistics are already accumulated
by u64_stats_inc(). Fix this by reading them into temporary variables
first.

Fixes: 1933ea365aa7 ("net: openvswitch: Add support to count upcall packets")
Signed-off-by: David Yang <mmyangfl@gmail.com>
---
v1: https://lore.kernel.org/r/20260119181339.1847451-1-mmyangfl@gmail.com
  - use u64 instead of __u64
 net/openvswitch/vport.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c
index 6bbbc16ab778..f0ce8ce1dce0 100644
--- a/net/openvswitch/vport.c
+++ b/net/openvswitch/vport.c
@@ -310,22 +310,23 @@ void ovs_vport_get_stats(struct vport *vport, struct ovs_vport_stats *stats)
  */
 int ovs_vport_get_upcall_stats(struct vport *vport, struct sk_buff *skb)
 {
+	u64 tx_success = 0, tx_fail = 0;
 	struct nlattr *nla;
 	int i;
 
-	__u64 tx_success = 0;
-	__u64 tx_fail = 0;
-
 	for_each_possible_cpu(i) {
 		const struct vport_upcall_stats_percpu *stats;
+		u64 n_success, n_fail;
 		unsigned int start;
 
 		stats = per_cpu_ptr(vport->upcall_stats, i);
 		do {
 			start = u64_stats_fetch_begin(&stats->syncp);
-			tx_success += u64_stats_read(&stats->n_success);
-			tx_fail += u64_stats_read(&stats->n_fail);
+			n_success = u64_stats_read(&stats->n_success);
+			n_fail = u64_stats_read(&stats->n_fail);
 		} while (u64_stats_fetch_retry(&stats->syncp, start));
+		tx_success += n_success;
+		tx_fail += n_fail;
 	}
 
 	nla = nla_nest_start_noflag(skb, OVS_VPORT_ATTR_UPCALL_STATS);
-- 
2.51.0

Re: [PATCH net v2] net: openvswitch: fix data race in ovs_vport_get_upcall_stats

[Ilya Maximets]

On 1/21/26 8:29 AM, David Yang wrote:
> In ovs_vport_get_upcall_stats(), some statistics protected by
> u64_stats_sync, are read and accumulated in ignorance of possible
> u64_stats_fetch_retry() events. These statistics are already accumulated
> by u64_stats_inc(). Fix this by reading them into temporary variables
> first.
> 
> Fixes: 1933ea365aa7 ("net: openvswitch: Add support to count upcall packets")
> Signed-off-by: David Yang <mmyangfl@gmail.com>
> ---
> v1: https://lore.kernel.org/r/20260119181339.1847451-1-mmyangfl@gmail.com
>   - use u64 instead of __u64
>  net/openvswitch/vport.c | 11 ++++++-----
>  1 file changed, 6 insertions(+), 5 deletions(-)
> 
> diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c
> index 6bbbc16ab778..f0ce8ce1dce0 100644
> --- a/net/openvswitch/vport.c
> +++ b/net/openvswitch/vport.c
> @@ -310,22 +310,23 @@ void ovs_vport_get_stats(struct vport *vport, struct ovs_vport_stats *stats)
>   */
>  int ovs_vport_get_upcall_stats(struct vport *vport, struct sk_buff *skb)
>  {
> +	u64 tx_success = 0, tx_fail = 0;
>  	struct nlattr *nla;
>  	int i;
>  
> -	__u64 tx_success = 0;
> -	__u64 tx_fail = 0;
> -
>  	for_each_possible_cpu(i) {
>  		const struct vport_upcall_stats_percpu *stats;
> +		u64 n_success, n_fail;
>  		unsigned int start;
>  
>  		stats = per_cpu_ptr(vport->upcall_stats, i);
>  		do {
>  			start = u64_stats_fetch_begin(&stats->syncp);
> -			tx_success += u64_stats_read(&stats->n_success);
> -			tx_fail += u64_stats_read(&stats->n_fail);
> +			n_success = u64_stats_read(&stats->n_success);
> +			n_fail = u64_stats_read(&stats->n_fail);
>  		} while (u64_stats_fetch_retry(&stats->syncp, start));

Would be good to have an empty line here for readability, but a new version
just for this seems a bit excessive.

Either way:

Acked-by: Ilya Maximets <i.maximets@ovn.org>

> +		tx_success += n_success;
> +		tx_fail += n_fail;
>  	}
>  
>  	nla = nla_nest_start_noflag(skb, OVS_VPORT_ATTR_UPCALL_STATS);

Re: [PATCH net v2] net: openvswitch: fix data race in ovs_vport_get_upcall_stats

[Eric Dumazet]

On Wed, Jan 21, 2026 at 8:32 AM David Yang <mmyangfl@gmail.com> wrote:
>
> In ovs_vport_get_upcall_stats(), some statistics protected by
> u64_stats_sync, are read and accumulated in ignorance of possible
> u64_stats_fetch_retry() events. These statistics are already accumulated
> by u64_stats_inc(). Fix this by reading them into temporary variables
> first.
>
> Fixes: 1933ea365aa7 ("net: openvswitch: Add support to count upcall packets")
> Signed-off-by: David Yang <mmyangfl@gmail.com>

Reviewed-by: Eric Dumazet <edumazet@google.com>

Re: [PATCH net v2] net: openvswitch: fix data race in ovs_vport_get_upcall_stats

[Aaron Conole]

David Yang <mmyangfl@gmail.com> writes:

> In ovs_vport_get_upcall_stats(), some statistics protected by
> u64_stats_sync, are read and accumulated in ignorance of possible
> u64_stats_fetch_retry() events. These statistics are already accumulated
> by u64_stats_inc(). Fix this by reading them into temporary variables
> first.
>
> Fixes: 1933ea365aa7 ("net: openvswitch: Add support to count upcall packets")
> Signed-off-by: David Yang <mmyangfl@gmail.com>
> ---
> v1: https://lore.kernel.org/r/20260119181339.1847451-1-mmyangfl@gmail.com
>   - use u64 instead of __u64
>  net/openvswitch/vport.c | 11 ++++++-----
>  1 file changed, 6 insertions(+), 5 deletions(-)

Thanks for the patch - I did a spot-check of the rest of the module with
the following:

  ~/git/linux/net/openvswitch$ grep -nr 'while\(.*fetch.*\)'

and didn't find any other places that seemed to duplicate this
mistaken read pattern (at least in the OVS kernel module).

Reviewed-by: Aaron Conole <aconole@redhat.com>

Re: [PATCH net v2] net: openvswitch: fix data race in ovs_vport_get_upcall_stats

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Wed, 21 Jan 2026 15:29:26 +0800 you wrote:
> In ovs_vport_get_upcall_stats(), some statistics protected by
> u64_stats_sync, are read and accumulated in ignorance of possible
> u64_stats_fetch_retry() events. These statistics are already accumulated
> by u64_stats_inc(). Fix this by reading them into temporary variables
> first.
> 
> Fixes: 1933ea365aa7 ("net: openvswitch: Add support to count upcall packets")
> Signed-off-by: David Yang <mmyangfl@gmail.com>
> 
> [...]

Here is the summary with links:
  - [net,v2] net: openvswitch: fix data race in ovs_vport_get_upcall_stats
    https://git.kernel.org/netdev/net/c/cc4816bdb086

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html