[PATCH] net: ipv4: fix alignment fault in sysctl_fib_multipath_hash_seed on ARM64 with Clang

[PATCH] net: ipv4: fix alignment fault in sysctl_fib_multipath_hash_seed on ARM64 with Clang

[Juno Choii]

From: Juno Choi <juno.choi@lge.com>

On ARM64, Clang may generate ldaxr (64-bit exclusive load) for
READ_ONCE() on 8-byte structs. ldaxr requires 8-byte natural
alignment, but sysctl_fib_multipath_hash_seed (two u32 members)
only has 4-byte natural alignment.

When this struct lands at a 4-byte-aligned but not 8-byte-aligned
offset within struct netns_ipv4, the ldaxr triggers an alignment
fault in rt6_multipath_hash(), causing a kernel panic in the IPv6
packet receive path (rtl8168_poll -> ipv6_list_rcv ->
rt6_multipath_hash).

Add __aligned(8) to the struct definition when building for ARM64
with Clang to ensure proper alignment for atomic 8-byte loads.

Signed-off-by: Juno Choi <juno.choi@lge.com>
---
 include/net/netns/ipv4.h | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 276f622f3516..4366ab26512d 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -41,11 +41,18 @@ struct inet_timewait_death_row {
 struct tcp_fastopen_context;
 
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
+#if defined(CONFIG_ARM64) && defined(CONFIG_CC_IS_CLANG)
+struct sysctl_fib_multipath_hash_seed {
+	u32 user_seed;
+	u32 mp_seed;
+} __aligned(8);
+#else
 struct sysctl_fib_multipath_hash_seed {
 	u32 user_seed;
 	u32 mp_seed;
 };
 #endif
+#endif
 
 struct netns_ipv4 {
 	/* Cacheline organization can be found documented in
-- 
2.43.0

Re: [PATCH] net: ipv4: fix alignment fault in sysctl_fib_multipath_hash_seed on ARM64 with Clang

[Eric Dumazet]

On Tue, Apr 14, 2026 at 10:13 PM Juno Choii <juno.choi@lge.com> wrote:
>
> From: Juno Choi <juno.choi@lge.com>
>
> On ARM64, Clang may generate ldaxr (64-bit exclusive load) for
> READ_ONCE() on 8-byte structs. ldaxr requires 8-byte natural
> alignment, but sysctl_fib_multipath_hash_seed (two u32 members)
> only has 4-byte natural alignment.
>
> When this struct lands at a 4-byte-aligned but not 8-byte-aligned
> offset within struct netns_ipv4, the ldaxr triggers an alignment
> fault in rt6_multipath_hash(), causing a kernel panic in the IPv6
> packet receive path (rtl8168_poll -> ipv6_list_rcv ->
> rt6_multipath_hash).
>
> Add __aligned(8) to the struct definition when building for ARM64
> with Clang to ensure proper alignment for atomic 8-byte loads.
>
> Signed-off-by: Juno Choi <juno.choi@lge.com>
> ---

It seems you missed

commit 4ee7fa6cf78ff26d783d39e2949d14c4c1cd5e7f
Author: Yung Chih Su <yuuchihsu@gmail.com>
Date:   Mon Mar 2 14:02:47 2026 +0800

    net: ipv4: fix ARM64 alignment fault in multipath hash seed

    `struct sysctl_fib_multipath_hash_seed` contains two u32 fields
    (user_seed and mp_seed), making it an 8-byte structure with a 4-byte
    alignment requirement.

    In `fib_multipath_hash_from_keys()`, the code evaluates the entire
    struct atomically via `READ_ONCE()`:

        mp_seed = READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed).mp_seed;

    While this silently works on GCC by falling back to unaligned regular
    loads which the ARM64 kernel tolerates, it causes a fatal kernel panic
    when compiled with Clang and LTO enabled.

    Commit e35123d83ee3 ("arm64: lto: Strengthen READ_ONCE() to acquire
    when CONFIG_LTO=y") strengthens `READ_ONCE()` to use Load-Acquire
    instructions (`ldar` / `ldapr`) to prevent compiler reordering bugs
    under Clang LTO. Since the macro evaluates the full 8-byte struct,
    Clang emits a 64-bit `ldar` instruction. ARM64 architecture strictly
    requires `ldar` to be naturally aligned, thus executing it on a 4-byte
    aligned address triggers a strict Alignment Fault (FSC = 0x21).

    Fix the read side by moving the `READ_ONCE()` directly to the `u32`
    member, which emits a safe 32-bit `ldar Wn`.

    Furthermore, Eric Dumazet pointed out that `WRITE_ONCE()` on the entire
    struct in `proc_fib_multipath_hash_set_seed()` is also flawed. Analysis
    shows that Clang splits this 8-byte write into two separate 32-bit
    `str` instructions. While this avoids an alignment fault, it destroys
    atomicity and exposes a tear-write vulnerability. Fix this by
    explicitly splitting the write into two 32-bit `WRITE_ONCE()`
    operations.

    Finally, add the missing `READ_ONCE()` when reading `user_seed` in
    `proc_fib_multipath_hash_seed()` to ensure proper pairing and
    concurrency safety.

    Fixes: 4ee2a8cace3f ("net: ipv4: Add a sysctl to set multipath hash seed")
    Signed-off-by: Yung Chih Su <yuuchihsu@gmail.com>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Link: https://patch.msgid.link/20260302060247.7066-1-yuuchihsu@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

So perhaps you only want this followup:

diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 7bd87d0547d8af40ca8736e97eac9e3d8a069052..5de5fd9465b8c5ea81d92dc74d7c6e50e3a94c73
100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -11404,7 +11404,7 @@ static int mlxsw_sp_mp_hash_init(struct
mlxsw_sp *mlxsw_sp)
        u32 seed;
        int err;

-       seed = READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed).user_seed;
+       seed = READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed.user_seed);
        if (!seed)
                seed = jhash(mlxsw_sp->base_mac, sizeof(mlxsw_sp->base_mac), 0);