dualpi2_dump_stats() is called without holding qdisc lock.

Several statistics fields are concurrently updated from enqueue and
dequeue paths while being read locklessly from dualpi2_dump_stats().

Annotate these accesses with READ_ONCE().

Signed-off-by: Vineet Agarwal <agarwal.vineet2006@gmail.com>
---
 net/sched/sch_dualpi2.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/net/sched/sch_dualpi2.c b/net/sched/sch_dualpi2.c
index 241e6a46bd00..fd8d505b4688 100644
--- a/net/sched/sch_dualpi2.c
+++ b/net/sched/sch_dualpi2.c
@@ -1046,14 +1046,13 @@ static int dualpi2_dump_stats(struct Qdisc *sch, struct gnet_dump *d)
 	struct dualpi2_sched_data *q = qdisc_priv(sch);
 	struct tc_dualpi2_xstats st = {
 		.prob			= READ_ONCE(q->pi2_prob),
-		.packets_in_c		= q->packets_in_c,
-		.packets_in_l		= q->packets_in_l,
-		.maxq			= q->maxq,
-		.ecn_mark		= q->ecn_mark,
-		.credit			= q->c_protection_credit,
-		.step_marks		= q->step_marks,
-		.memory_used		= q->memory_used,
-		.max_memory_used	= q->max_memory_used,
+		.packets_in_c		= READ_ONCE(q->packets_in_c),
+		.packets_in_l		= READ_ONCE(q->packets_in_l),
+		.maxq			= READ_ONCE(q->maxq),
+		.ecn_mark		= READ_ONCE(q->ecn_mark),
+		.step_marks		= READ_ONCE(q->step_marks),
+		.memory_used		= READ_ONCE(q->memory_used),
+		.max_memory_used	= READ_ONCE(q->max_memory_used),
 		.memory_limit		= q->memory_limit,
 	};
 	u64 qc, ql;
-- 
2.54.0

On Thu, May 7, 2026 at 3:20 AM Vineet Agarwal
<agarwal.vineet2006@gmail.com> wrote:
>
> dualpi2_dump_stats() is called without holding qdisc lock.
>
> Several statistics fields are concurrently updated from enqueue and
> dequeue paths while being read locklessly from dualpi2_dump_stats().
>
> Annotate these accesses with READ_ONCE().
>
> Signed-off-by: Vineet Agarwal <agarwal.vineet2006@gmail.com>
> ---

Thanks for the patch. This was on my plate.

1) This is probably targeting net tree. You must select either net or net-next.

2) We need a Fixes: tag.

3) WRITE_ONCE() annotations are missing from your patch.

4) Please wait ~24 hours before sending a V2

More details in:  Documentation/process/maintainer-netdev.rst

pw-bot: cr