[PATCH net-next 0/3] net: rmnet: lockless rmnet_fill_info()

[Eric Dumazet <edumazet@google.com>]

rmnet_fill_info() currently relies on RTNL being held, because it
uses rmnet_get_port_rtnl() to reach the rmnet_port attached to the
underlying real device.

While auditing the fields exposed there, it appears that both
priv->mux_id and port->data_format are written under RTNL but read
from the data path without any lock. Note that rmnet_newlink() can
update port->data_format of an already active port, and that
rmnet_changelink() can change both fields while traffic is flowing.

- Patch 1 annotates the data-races around port->data_format. It also
  samples the field only once per packet and passes the value down,
  so that both ends of a packet transformation agree on the format
  (TX used to size the MAP headroom and set MAP_NEXT_HEADER_FLAG
  from two separate reads), and prevents rmnet_changelink() from
  publishing an intermediate value to the data path.

- Patch 2 annotates the data-races around priv->mux_id and
  ep->mux_id. It also publishes ep->mux_id before the endpoint is
  inserted into its new bucket, so that a concurrent lookup walking
  that bucket can no longer miss it and drop the packet.

- Patch 3 converts rmnet_fill_info() to RCU. rmnet_get_port_rcu()
  was only called from the data path and thus used
  rcu_dereference_bh(); its lockdep condition is relaxed so that it
  can also be called from process context.

The lockless lookup is safe because rmnet_get_port_rcu() checks
real_dev->rx_handler before returning rx_handler_data, while
rmnet_unregister_real_device() clears rx_handler and waits for a
grace period (in netdev_rx_handler_unregister()) before freeing the
port.

This is part of a larger effort to remove the RTNL dependency from
rtnl_link_ops->fill_info().

Assisted-by: LLM
Cc: Subash Abhinov Kasiviswanathan <subash.a.kasiviswanathan@oss.qualcomm.com>
Cc: Sean Tranchetti <sean.tranchetti@oss.qualcomm.com>

Eric Dumazet (3):
  net: rmnet: annotate data-races around port->data_format
  net: rmnet: annotate data-races around mux_id
  net: rmnet: no longer rely on RTNL in rmnet_fill_info()

 .../ethernet/qualcomm/rmnet/rmnet_config.c    | 54 +++++++++----------
 .../ethernet/qualcomm/rmnet/rmnet_config.h    |  2 +-
 .../ethernet/qualcomm/rmnet/rmnet_handlers.c  | 34 +++++++-----
 .../net/ethernet/qualcomm/rmnet/rmnet_map.h   |  9 ++--
 .../qualcomm/rmnet/rmnet_map_command.c        |  9 ++--
 .../ethernet/qualcomm/rmnet/rmnet_map_data.c  | 14 ++---
 .../net/ethernet/qualcomm/rmnet/rmnet_vnd.c   |  2 +-
 7 files changed, 65 insertions(+), 59 deletions(-)

-- 
2.55.0.1032.g73a4cd73de-goog