RE: [PATCH net-next 0/3] net: rmnet: lockless rmnet_fill_info()

[<subash.a.kasiviswanathan@oss.qualcomm.com>]

> -----Original Message-----
> From: Eric Dumazet <edumazet@google.com>
> Sent: Wednesday, September 16, 2026 7:22 AM
> To: David S . Miller <davem@davemloft.net>; Jakub Kicinski
> <kuba@kernel.org>; Paolo Abeni <pabeni@redhat.com>
> Cc: Simon Horman <horms@kernel.org>; Kuniyuki Iwashima
> <kuniyu@google.com>; Andrew Lunn <andrew+netdev@lunn.ch>;
> netdev@vger.kernel.org; eric.dumazet@gmail.com; Eric Dumazet
> <edumazet@google.com>; Subash Abhinov Kasiviswanathan
> <subash.a.kasiviswanathan@oss.qualcomm.com>; Sean Tranchetti
> <sean.tranchetti@oss.qualcomm.com>
> Subject: [PATCH net-next 0/3] net: rmnet: lockless rmnet_fill_info()
> 
> rmnet_fill_info() currently relies on RTNL being held, because it uses
> rmnet_get_port_rtnl() to reach the rmnet_port attached to the underlying real
> device.
> 
> While auditing the fields exposed there, it appears that both
> priv->mux_id and port->data_format are written under RTNL but read
> from the data path without any lock. Note that rmnet_newlink() can update
> port->data_format of an already active port, and that
> rmnet_changelink() can change both fields while traffic is flowing.
> 
> - Patch 1 annotates the data-races around port->data_format. It also
>   samples the field only once per packet and passes the value down,
>   so that both ends of a packet transformation agree on the format
>   (TX used to size the MAP headroom and set MAP_NEXT_HEADER_FLAG
>   from two separate reads), and prevents rmnet_changelink() from
>   publishing an intermediate value to the data path.
> 
> - Patch 2 annotates the data-races around priv->mux_id and
>   ep->mux_id. It also publishes ep->mux_id before the endpoint is
>   inserted into its new bucket, so that a concurrent lookup walking
>   that bucket can no longer miss it and drop the packet.
> 
> - Patch 3 converts rmnet_fill_info() to RCU. rmnet_get_port_rcu()
>   was only called from the data path and thus used
>   rcu_dereference_bh(); its lockdep condition is relaxed so that it
>   can also be called from process context.
> 
> The lockless lookup is safe because rmnet_get_port_rcu() checks real_dev-
> >rx_handler before returning rx_handler_data, while
> rmnet_unregister_real_device() clears rx_handler and waits for a grace period
> (in netdev_rx_handler_unregister()) before freeing the port.
> 
> This is part of a larger effort to remove the RTNL dependency from
> rtnl_link_ops->fill_info().
> 
> Assisted-by: LLM
> Cc: Subash Abhinov Kasiviswanathan
> <subash.a.kasiviswanathan@oss.qualcomm.com>
> Cc: Sean Tranchetti <sean.tranchetti@oss.qualcomm.com>
> 
> Eric Dumazet (3):
>   net: rmnet: annotate data-races around port->data_format
>   net: rmnet: annotate data-races around mux_id
>   net: rmnet: no longer rely on RTNL in rmnet_fill_info()
> 
>  .../ethernet/qualcomm/rmnet/rmnet_config.c    | 54 +++++++++----------
>  .../ethernet/qualcomm/rmnet/rmnet_config.h    |  2 +-
>  .../ethernet/qualcomm/rmnet/rmnet_handlers.c  | 34 +++++++-----
>  .../net/ethernet/qualcomm/rmnet/rmnet_map.h   |  9 ++--
>  .../qualcomm/rmnet/rmnet_map_command.c        |  9 ++--
>  .../ethernet/qualcomm/rmnet/rmnet_map_data.c  | 14 ++---
>  .../net/ethernet/qualcomm/rmnet/rmnet_vnd.c   |  2 +-
>  7 files changed, 65 insertions(+), 59 deletions(-)
> 
> --
> 2.55.0.1032.g73a4cd73de-goog

No concerns from our side. For the series - 

Reviewed-by: Subash Abhinov Kasiviswanathan <subash.a.kasiviswanathan@oss.qualcomm.com>