From: Linkui Xiao <xiaolinkui@126.com>
To: dsahern@kernel.org, idosch@nvidia.com, davem@davemloft.net,
edumazet@google.com, kuba@kernel.org, pabeni@redhat.com,
horms@kernel.org
Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
Linkui Xiao <xiaolinkui@kylinos.cn>
Subject: [PATCH net] ipmr, ip6mr: annotate data-races in vif_seq_show()
Date: Thu, 10 Sep 2026 17:34:52 +0800 [thread overview]
Message-ID: <20260910093452.2070079-1-xiaolinkui@126.com> (raw)
From: Linkui Xiao <xiaolinkui@kylinos.cn>
ipmr_vif_seq_show() and ip6mr_vif_seq_show() read vif->bytes_in,
vif->pkt_in, vif->bytes_out and vif->pkt_out with only rcu_read_lock()
held: since commit b96ef16d2f83 ("ipmr: convert /proc handlers to
rcu_read_lock()") both seq_start helpers are annotated __acquires(RCU)
and no longer take mrt_lock.
Those counters are updated from softirq context and the writers already
use WRITE_ONCE(): ipmr_prepare_xmit() and ip_mr_forward() on the IPv4
side, ip6mr_prepare_xmit() and ip6_mr_forward() on the IPv6 side. The
other lockless readers use READ_ONCE() as well - ipmr_ioctl(),
ipmr_compat_ioctl(), ipmr_fill_vif(), ip6mr_ioctl() and
ip6mr_compat_ioctl().
The two vif_seq_show() helpers are the only remaining bare readers, so
KCSAN flags them and the compiler is free to tear or reload the values
while the /proc/net/ip_mr_vif and /proc/net/ip6_mr_vif lines are being
formatted. Annotate them like the other readers; these are plain
statistics, no locking is needed.
Fixes: b96ef16d2f83 ("ipmr: convert /proc handlers to rcu_read_lock()")
Assisted-by: Qwen:Qwen3.8-max
Signed-off-by: Linkui Xiao <xiaolinkui@kylinos.cn>
---
net/ipv4/ipmr.c | 5 +++--
net/ipv6/ip6mr.c | 5 +++--
2 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index e5f2b1c6150d..36d1b0410a08 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -3178,8 +3178,9 @@ static int ipmr_vif_seq_show(struct seq_file *seq, void *v)
seq_printf(seq,
"%2td %-10s %8ld %7ld %8ld %7ld %05X %08X %08X\n",
vif - mrt->vif_table,
- name, vif->bytes_in, vif->pkt_in,
- vif->bytes_out, vif->pkt_out,
+ name,
+ READ_ONCE(vif->bytes_in), READ_ONCE(vif->pkt_in),
+ READ_ONCE(vif->bytes_out), READ_ONCE(vif->pkt_out),
vif->flags, vif->local, vif->remote);
}
return 0;
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 3f2ed9b77deb..7a3c795ec68b 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -485,8 +485,9 @@ static int ip6mr_vif_seq_show(struct seq_file *seq, void *v)
seq_printf(seq,
"%2td %-10s %8ld %7ld %8ld %7ld %05X\n",
vif - mrt->vif_table,
- name, vif->bytes_in, vif->pkt_in,
- vif->bytes_out, vif->pkt_out,
+ name,
+ READ_ONCE(vif->bytes_in), READ_ONCE(vif->pkt_in),
+ READ_ONCE(vif->bytes_out), READ_ONCE(vif->pkt_out),
vif->flags);
}
return 0;
--
2.25.1
reply other threads:[~2026-09-10 9:35 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260910093452.2070079-1-xiaolinkui@126.com \
--to=xiaolinkui@126.com \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=idosch@nvidia.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=xiaolinkui@kylinos.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox