From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: Eric Dumazet <edumazet@google.com>,
Kuniyuki Iwashima <kuniyu@google.com>,
Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.15.y 3/6] net: dst: annotate data-races around dst->output
Date: Thu, 23 Jul 2026 07:36:59 -0400 [thread overview]
Message-ID: <20260723113702.3035088-3-sashal@kernel.org> (raw)
In-Reply-To: <20260723113702.3035088-1-sashal@kernel.org>
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 2dce8c52a98995c4719def6f88629ab1581c0b82 ]
dst_dev_put() can overwrite dst->output while other
cpus might read this field (for instance from dst_output())
Add READ_ONCE()/WRITE_ONCE() annotations to suppress
potential issues.
We will likely need RCU protection in the future.
Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20250630121934.3399505-6-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: c9c9b37f8c55 ("netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/dst.h | 2 +-
include/net/lwtunnel.h | 4 ++--
net/core/dst.c | 2 +-
net/ipv4/route.c | 2 +-
4 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/include/net/dst.h b/include/net/dst.h
index efbea74d03d915..27494911d6a100 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -449,7 +449,7 @@ INDIRECT_CALLABLE_DECLARE(int ip_output(struct net *, struct sock *,
/* Output packet to network from transport. */
static inline int dst_output(struct net *net, struct sock *sk, struct sk_buff *skb)
{
- return INDIRECT_CALL_INET(skb_dst(skb)->output,
+ return INDIRECT_CALL_INET(READ_ONCE(skb_dst(skb)->output),
ip6_output, ip_output,
net, sk, skb);
}
diff --git a/include/net/lwtunnel.h b/include/net/lwtunnel.h
index a4632a64daae32..09791f5d9b6ec8 100644
--- a/include/net/lwtunnel.h
+++ b/include/net/lwtunnel.h
@@ -138,8 +138,8 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len,
static inline void lwtunnel_set_redirect(struct dst_entry *dst)
{
if (lwtunnel_output_redirect(dst->lwtstate)) {
- dst->lwtstate->orig_output = dst->output;
- dst->output = lwtunnel_output;
+ dst->lwtstate->orig_output = READ_ONCE(dst->output);
+ WRITE_ONCE(dst->output, lwtunnel_output);
}
if (lwtunnel_input_redirect(dst->lwtstate)) {
dst->lwtstate->orig_input = READ_ONCE(dst->input);
diff --git a/net/core/dst.c b/net/core/dst.c
index 12ab51f87da452..42d7c04d409bd3 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -150,7 +150,7 @@ void dst_dev_put(struct dst_entry *dst)
if (dst->ops->ifdown)
dst->ops->ifdown(dst, dev, true);
WRITE_ONCE(dst->input, dst_discard);
- dst->output = dst_discard_out;
+ WRITE_ONCE(dst->output, dst_discard_out);
dst->dev = blackhole_netdev;
dev_hold(dst->dev);
dev_put(dev);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index e5a1006daeefcf..186e05a5a9c447 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1704,7 +1704,7 @@ struct rtable *rt_dst_clone(struct net_device *dev, struct rtable *rt)
INIT_LIST_HEAD(&new_rt->rt_uncached);
new_rt->dst.input = READ_ONCE(rt->dst.input);
- new_rt->dst.output = rt->dst.output;
+ new_rt->dst.output = READ_ONCE(rt->dst.output);
new_rt->dst.error = rt->dst.error;
new_rt->dst.lastuse = jiffies;
new_rt->dst.lwtstate = lwtstate_get(rt->dst.lwtstate);
--
2.53.0
next prev parent reply other threads:[~2026-07-23 11:37 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-20 12:33 FAILED: patch "[PATCH] netfilter: nf_queue: pin bridge device while NFQUEUE holds" failed to apply to 5.15-stable tree gregkh
2026-07-23 11:36 ` [PATCH 5.15.y 1/6] tcp: convert to dev_net_rcu() Sasha Levin
2026-07-23 11:36 ` [PATCH 5.15.y 2/6] net: dst: annotate data-races around dst->input Sasha Levin
2026-07-23 11:36 ` Sasha Levin [this message]
2026-07-23 11:37 ` [PATCH 5.15.y 4/6] net: dst: add four helpers to annotate data-races around dst->dev Sasha Levin
2026-07-23 11:37 ` [PATCH 5.15.y 5/6] ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] Sasha Levin
2026-07-23 11:37 ` [PATCH 5.15.y 6/6] netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260723113702.3035088-3-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=kuniyu@google.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox