From nobody Fri Jun 12 21:42:29 2026 Received: from mail-m49198.qiye.163.com (mail-m49198.qiye.163.com [45.254.49.198]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5AAB1360EEA; Tue, 12 May 2026 13:40:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.254.49.198 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778593208; cv=none; b=O5BEsZSe+zHcFlZDmKh67gr91sGQZog1oye2aNnhmXCtqT0yFMSanm1lkybMzIIK6MG9q3kUnJCB7MNe4kVeSwup2V5u1DYRLFiDUnZF+xH3h3wyFeCXehkIQbIy1AXEfJV3MHhqJA9fPhXFrY+KHAlwLU+By0mlY1DWYLKz1sM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778593208; c=relaxed/simple; bh=cnnH4doB7vsmFrQZvpAxakD7wtyCXrlLBQD9l46Jf1E=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=lPRVsVM2OZJ5nM4mK2Q75CTzHtuz5hONMaWHJGHx1N/inoBWHTEN8ELlogb5KOH+fEBf9crbz9etIuTcxhJ3S+wDbubf0P1h5sS8Ehm+rn7Y62fNtWXHR2Tf96E7ywPT4LLal7Hrb8ULFHkk44nE9uwtzKqXPaSpCT3F740pIfo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn; spf=pass smtp.mailfrom=seu.edu.cn; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b=kvtjSyeX; arc=none smtp.client-ip=45.254.49.198 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b="kvtjSyeX" Received: from DESKTOP-4LEIBBM.localdomain (unknown [58.241.16.34]) by smtp.qiye.163.com (Hmail) with ESMTP id 3e1de6cb0; Tue, 12 May 2026 21:39:54 +0800 (GMT+08:00) From: Runyu Xiao To: Oliver Hartkopp , Marc Kleine-Budde Cc: Vincent Mailhol , linux-can@vger.kernel.org, linux-kernel@vger.kernel.org, jianhao.xu@seu.edu.cn, Runyu Xiao , stable@vger.kernel.org Subject: [PATCH net] can: proc: reset pkg_stats atomics individually Date: Tue, 12 May 2026 21:39:37 +0800 Message-Id: <20260512133937.21957-1-runyu.xiao@seu.edu.cn> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-HM-Tid: 0a9e1c6a610203a1kunm69b17e24be53 X-HM-MType: 10 X-HM-Spam-Status: e1kfGhgUHx5ZQUpXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFITzdXWRgWCB1ZQUpXWS1ZQUlXWQ8JGhUIEh9ZQVkZGUkYVhkYSUJDTk9CTxofSVYeHw 5VEwETFhoSFyQUDg9ZV1kYEgtZQVlOQ1VJT0pVSk1VSE9ZV1kWGg8SFR0UWUFZT0tIVUpLSUhOQ0 NVSktLVUtZBg++ DKIM-Signature: a=rsa-sha256; b=kvtjSyeXMZaSHkmjDOzLo5TpBNaiHD6jXpkqmups3HYk6y5cAmrMwZE5hgw0aUdf4vgt0sVaZgHEu4vZ6TQ4kboeDDF0LhpPOophoZ2W6paK+GFEW0A7gpf7A65cyWW6C3oyxADeyTRNIVo0jG5F9wU6LKQ94PFUEVUsy6jWpvY=; c=relaxed/relaxed; s=default; d=seu.edu.cn; v=1; bh=uPet2mht12Bnl3ICSeLirj73fFCJoOzI8zHCWah7FE8=; h=date:mime-version:subject:message-id:from; Content-Type: text/plain; charset="utf-8" Commit 80b5f90158d1 ("can: statistics: use atomic access in hot path") converted several members of struct can_pkg_stats to atomic_long_t and updated the hot TX/RX and procfs read paths to use atomic_long_*() helpers. However, can_init_stats() still clears the whole struct with memset(). can_init_stats() is reached from can_stat_update() in timer context and also from the procfs reset path. Those paths can run while the TX/RX hot paths are concurrently updating rx_frames, tx_frames, matches and their *_delta counters. Hitting the whole-struct memset() in that window performs plain writes to fields that otherwise follow an atomic_long_t access contract, which can lose or mix live statistics updates. This issue was found by source-level API-misuse analysis looking for whole-object resets left behind after atomic_long_t conversions, then manually audited on Linux v6.18.21. Replace the whole-struct memset() with a helper that resets the atomic_long_t counters via atomic_long_set() and clears the derived scalar statistics explicitly. This preserves the existing reset semantics for scalar fields while restoring atomic access discipline for the live counters. Build-tested by compiling net/can/proc.o on x86_64 netdev/main. Runtime-tested with a QEMU + vcan setup on Linux v6.18.21 by driving concurrent traffic and reset_stats reads, which reproduced inconsistent exported statistics before the fix. Fixes: 80b5f90158d1 ("can: statistics: use atomic access in hot path") Cc: stable@vger.kernel.org Signed-off-by: Runyu Xiao Acked-by: Oliver Hartkopp --- net/can/proc.c | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/net/can/proc.c b/net/can/proc.c index de4d05ae3459..64b3bdc2fa7e 100644 --- a/net/can/proc.c +++ b/net/can/proc.c @@ -76,16 +76,39 @@ static const char rx_list_name[][8] =3D { * af_can statistics stuff */ =20 +static void can_reset_pkg_stats(struct can_pkg_stats *pkg_stats) +{ + atomic_long_set(&pkg_stats->rx_frames, 0); + atomic_long_set(&pkg_stats->tx_frames, 0); + atomic_long_set(&pkg_stats->matches, 0); + + pkg_stats->total_rx_rate =3D 0; + pkg_stats->total_tx_rate =3D 0; + pkg_stats->total_rx_match_ratio =3D 0; + + pkg_stats->current_rx_rate =3D 0; + pkg_stats->current_tx_rate =3D 0; + pkg_stats->current_rx_match_ratio =3D 0; + + pkg_stats->max_rx_rate =3D 0; + pkg_stats->max_tx_rate =3D 0; + pkg_stats->max_rx_match_ratio =3D 0; + + atomic_long_set(&pkg_stats->rx_frames_delta, 0); + atomic_long_set(&pkg_stats->tx_frames_delta, 0); + atomic_long_set(&pkg_stats->matches_delta, 0); +} + static void can_init_stats(struct net *net) { struct can_pkg_stats *pkg_stats =3D net->can.pkg_stats; struct can_rcv_lists_stats *rcv_lists_stats =3D net->can.rcv_lists_stats; /* - * This memset function is called from a timer context (when + * This stats reset is called from a timer context (when * can_stattimer is active which is the default) OR in a process * context (reading the proc_fs when can_stattimer is disabled). */ - memset(pkg_stats, 0, sizeof(struct can_pkg_stats)); + can_reset_pkg_stats(pkg_stats); pkg_stats->jiffies_init =3D jiffies; =20 rcv_lists_stats->stats_reset++; --=20 2.34.1