From nobody Mon Jun 8 08:53:09 2026 Received: from mail-pj1-f74.google.com (mail-pj1-f74.google.com [209.85.216.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 97D9C344036 for ; Sun, 31 May 2026 03:07:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.74 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780196834; cv=none; b=FjJF2UMNQW9R10GMiHunqbTySe3WbJ+FcesOPCSZ1+UzhDiF4M6oMt3PTWAqsNx48qMofGPOVAihw43DtuiocVPyFmfjClWtJ2EwWY1ifpP37rW3Hb0j4f8DVcprCQPKhxJt7UbC/D+iSDERfL5NaDile7lC+RUaWQ5Z3VlFxQ4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780196834; c=relaxed/simple; bh=jObXvUmJwSX2RcQ2/1IwXVgIYqTkbTQpMAcZONQ8hPk=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=Qz12Km/lkfv9TqB5v/4fhL7M6+Ef5gtCRiNNiFffD1rBO5AHAKMJRyKzv7EcJdfWsHalvDASreGy5qzVVzz27oZDfkdOUK/xxeiIcP8nrhLksWCH434VgQh00tvwZ1qVZr2G2Bxv/ZYAz6NNcqkMYEMTW835x0rMtg8EV3+AIP0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--yuyanghuang.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=HmJZIEk+; arc=none smtp.client-ip=209.85.216.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--yuyanghuang.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="HmJZIEk+" Received: by mail-pj1-f74.google.com with SMTP id 98e67ed59e1d1-36d6389bbf4so675364a91.3 for ; Sat, 30 May 2026 20:07:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1780196833; x=1780801633; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=eHS1zH76PK3GplZPAYQZxMnWYQ6i6DemI1XwEHjPHmI=; b=HmJZIEk+/d6xqrcdMfwGyYl0DKJbiBQQgNjqWY2peRdMikcMCS+yezpFz3x/FAJt17 elTOUpqHPtycyUWlsdWM3dum/41zFdIkF9aF7ZTswE9G2j4RvF4BCNM8KlDqlLsQJZdx J8Txq1uYe3iWCQCtBWbbUABvUbk/ctboNUi6IooFqjfraA/jraelMacmNc9fiEiXLDB2 bLkoBOmqEjlJyGV5w01G2fxaRIjNoOBwmzhFRIhDgC1F6E17slfUJ6VcqSIsgw0jjd2f jiDmfa0VI+M9zK325/u0ZDN0qKOli9g2bzsM2WZq0JJ/MimzHAtENCWBsyjqLGMgealC G0tg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780196833; x=1780801633; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=eHS1zH76PK3GplZPAYQZxMnWYQ6i6DemI1XwEHjPHmI=; b=Ht6txuU2q6h6F+cQhTvdsgxPP864qmI40NU6J3jcp4ivNh5t7nvC7Y+mtQttaqOgo2 ZLPThtLoA1ILXBOTRnvbfX/f+Po96ALsUGD3fLIZDllC+9l9FJr4C1lqX0bSZQhabQ1Q 3TZfqDGl5T2sIDsieHrdvgftJEtMmJhu9s76oLQZ8/7c6MEi+iRDkPU7jmiUXm4vvDXu pQonHBbAvvBxmCiY166bHYduo2r/LxRxHottjQIg/Hi3UtKUxFVYtzR6PDYckQ21vbUb Y4/tUm2VjvKKlfkxEVOLSAvTymMv49HBN574FAA39cJWue6MW4uaFydzKQyCtj/v47pp zTTQ== X-Forwarded-Encrypted: i=1; AFNElJ+l+MKMqHfz1Kx5vbBfjxbLWs3ZoEYgDzp1gKkhCtGVF0b5q0W+r0gic4Aa+jAuPBni/BJ/cxZIH7rltes=@vger.kernel.org X-Gm-Message-State: AOJu0YxzXeN1Oz9t4Afg2zVGepyYfLuKPjyms4gjTTOy+Xm0ljufVLcE Fn3JiV5+YihGDs2fa2aOO1F8CVmHzxl+tkmb1DiErl2aPz6whLXUAj+HOaaQ6hxKSBvJUNui1Vq 2ZKdjlvFeknxqtAxTmKP1sBm2Cg== X-Received: from pgab135.prod.google.com ([2002:a63:348d:0:b0:c85:9c9a:ab50]) (user=yuyanghuang job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:3d84:b0:369:7421:75cf with SMTP id 98e67ed59e1d1-36c501eb0a7mr5545510a91.16.1780196832575; Sat, 30 May 2026 20:07:12 -0700 (PDT) Date: Sun, 31 May 2026 11:07:03 +0800 In-Reply-To: <20260531030705.3754389-1-yuyanghuang@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260531030705.3754389-1-yuyanghuang@google.com> X-Mailer: git-send-email 2.54.0.823.g6e5bcc1fc9-goog Message-ID: <20260531030705.3754389-2-yuyanghuang@google.com> Subject: [PATCH 1/2] ipv4: igmp: annotate data-races around in_dev->mc_count From: Yuyang Huang To: Yuyang Huang Cc: "David S. Miller" , David Ahern , Eric Dumazet , Ido Schimmel , Jakub Kicinski , Paolo Abeni , Simon Horman , linux-kernel@vger.kernel.org, netdev@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" /proc/net/igmp walks the multicast list for IPv4 interfaces locklessly under RCU and prints state->in_dev->mc_count. Concurrently, device init/destruction and multicast join/leave paths update the count under the RTNL lock. Fix this intentional lockless snapshot by annotating the read with READ_ONCE() and the updates with WRITE_ONCE(). Fixes: 1d7138de878d ("igmp: RCU conversion of in_dev->mc_list") Signed-off-by: Yuyang Huang Reviewed-by: Ido Schimmel --- net/ipv4/igmp.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c index f2aca659b29c..fd0faf042fa6 100644 --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -1566,7 +1566,7 @@ static void ____ip_mc_inc_group(struct in_device *in_= dev, __be32 addr, #endif =20 im->next_rcu =3D in_dev->mc_list; - in_dev->mc_count++; + WRITE_ONCE(in_dev->mc_count, in_dev->mc_count + 1); rcu_assign_pointer(in_dev->mc_list, im); =20 ip_mc_hash_add(in_dev, im); @@ -1790,7 +1790,8 @@ void __ip_mc_dec_group(struct in_device *in_dev, __be= 32 addr, gfp_t gfp) if (new_users =3D=3D 0) { ip_mc_hash_remove(in_dev, i); *ip =3D i->next_rcu; - in_dev->mc_count--; + WRITE_ONCE(in_dev->mc_count, + in_dev->mc_count - 1); __igmp_group_dropped(i, gfp); inet_ifmcaddr_notify(in_dev->dev, i, RTM_DELMULTICAST); @@ -1922,7 +1923,7 @@ void ip_mc_destroy_dev(struct in_device *in_dev) =20 while ((i =3D rtnl_dereference(in_dev->mc_list)) !=3D NULL) { in_dev->mc_list =3D i->next_rcu; - in_dev->mc_count--; + WRITE_ONCE(in_dev->mc_count, in_dev->mc_count - 1); ip_mc_clear_src(i); ip_ma_put(i); } @@ -2974,7 +2975,9 @@ static int igmp_mc_seq_show(struct seq_file *seq, voi= d *v) =20 if (rcu_access_pointer(state->in_dev->mc_list) =3D=3D im) { seq_printf(seq, "%d\t%-10s: %5d %7s\n", - state->dev->ifindex, state->dev->name, state->in_dev->mc_count, que= rier); + state->dev->ifindex, state->dev->name, + READ_ONCE(state->in_dev->mc_count), + querier); } =20 delta =3D im->timer.expires - jiffies; --=20 2.54.0.823.g6e5bcc1fc9-goog From nobody Mon Jun 8 08:53:09 2026 Received: from mail-pl1-f202.google.com (mail-pl1-f202.google.com [209.85.214.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BA43D361641 for ; Sun, 31 May 2026 03:07:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.202 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780196837; cv=none; b=ofB+IDqw4jqQFPwYr96FUM/YCo7bQKr9marSsankCbh4uQGi5ihRVnKCoE0F05+TK4CHleUWJsOvOuu08UYu7SCYZyScCvz1TdFpY+oMRT7L9OjQgc8QEBY01lr9hq+Z4XiXJnopluL1ZQ68KtUv+cJYY0GH/urEbBlnbIh5z2c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780196837; c=relaxed/simple; bh=r7jHWy3rqTxJY1sKvw/JEXrPrLy0VTqs8er4fh0Y210=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=GBricMkxnJyo0zDC7MecWEF/tqIMLLtWuBmIEaMceXZgyCu4I7MXl0zXL2F7tJl75aFCav97YSjC5U58Yqm5ud8sVoYgt6d4wzq3PtDZtz3eNXktGsbuy7N4p/GDg4rEk+wQhqKOfW0ZIsSjlnbwtlyA3bV1JEAwrZKNnYTFeog= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--yuyanghuang.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=lFxu6+Wj; arc=none smtp.client-ip=209.85.214.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--yuyanghuang.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="lFxu6+Wj" Received: by mail-pl1-f202.google.com with SMTP id d9443c01a7336-2c0b35fa876so5633005ad.1 for ; Sat, 30 May 2026 20:07:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1780196836; x=1780801636; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=+XGHTHkWccB92iEs3+aiLHcXw/qjbvnaI33XklcMc4g=; b=lFxu6+WjxTmqqQDMDLgtViXgpXCmWHviH/Ol9+WVi6Ai7c4aR+TwOo05WHYb154eSC H9hU4hr2foLa/21ORuM47T54qVu0AiQOmVNgnFyfEck5FJVgOkMWgVq64HqAr2aY8qqH cXd0e+gLFGGUt5oMUsx8aaMglG4y4z8s83UTt2FAqvsqeiG6NUIRwjRimxFHf9Av9R7a WlSOPwgJtdt5XI6e1SB/gnNqoy8J39lAdpk73XFIRlizn2PMQ5iDmnwtfMTrsyCbd0Oh Sgg5QUrlg+x4J0oT3sBBE+Fs1QLA+1awnt7N0S7htf7cp+L27Z5itkfDbnW38zipKtJA H7Wg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780196836; x=1780801636; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=+XGHTHkWccB92iEs3+aiLHcXw/qjbvnaI33XklcMc4g=; b=rbVhUwu9y6F55lmw8Jvcr2vovIPxbLcWtgHphLVGFRK24a4SoMUMnz+p19UhdwICVp noiNTRd85RVa8gvOyFfG2Ova5AwouNzabjch+UxRlTZ8FW/OTJdN5JiSd/8FRG8K1xad f00Sqq4LaKCwLGfCDSxMpDduBO6A8pO+vApd3oviP4d6BGexyNWkAy26jk/zoGzf28jY Bt6GPm9iKZF4l6QZEHEsOSFxxUgdtjTiBuhBG1rVpmfVhqMj4xe05Xko8IYGDnWszpBQ URxt3zlpkhzDc6hRyO/ySPNs6NnUUgkLhsQB/HsNbLN+Oc2QLiJaYiCX5mj2/WE0au6M NbuQ== X-Forwarded-Encrypted: i=1; AFNElJ+Cle0eMct4uT0Ef3FzZcuOgBStSe8n3A/8NH+I7W0AogOYdPhEH3K+yXcBBnLKgKjDssapA/Cxc7yNkvU=@vger.kernel.org X-Gm-Message-State: AOJu0YzwkjhJRw4vX4XlYMzyssqKFSTXJneTXm6Bxr9Ct74aZ1V0qt9i +rnr3X6QOt2SZmfjhuCeJBXmdPVm2h36TQKiXvZNLpz9G0iIr7OSDWB0jPgMg1YcgcpAx/Z8r4T vNBHaOAli0lJMrrIIH9Yi8i0wRA== X-Received: from plnz4.prod.google.com ([2002:a17:902:8344:b0:2bf:1748:aa9b]) (user=yuyanghuang job=prod-delivery.src-stubby-dispatcher) by 2002:a17:903:22c9:b0:2b0:5795:9ead with SMTP id d9443c01a7336-2bf36370f35mr67308815ad.0.1780196835789; Sat, 30 May 2026 20:07:15 -0700 (PDT) Date: Sun, 31 May 2026 11:07:04 +0800 In-Reply-To: <20260531030705.3754389-1-yuyanghuang@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260531030705.3754389-1-yuyanghuang@google.com> X-Mailer: git-send-email 2.54.0.823.g6e5bcc1fc9-goog Message-ID: <20260531030705.3754389-3-yuyanghuang@google.com> Subject: [PATCH 2/2] ipv4: igmp: annotate data-races around timer-related fields From: Yuyang Huang To: Yuyang Huang Cc: "David S. Miller" , David Ahern , Eric Dumazet , Ido Schimmel , Jakub Kicinski , Paolo Abeni , Simon Horman , linux-kernel@vger.kernel.org, netdev@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" /proc/net/igmp walks the multicast list locklessly under RCU and reads timer-related fields (im->tm_running, im->reporter, im->timer.expires) to print the timer state of multicast memberships. Concurrently, these fields are modified under im->lock spinlock in timer management paths (igmp_stop_timer(), igmp_start_timer(), and igmp_timer_expire()). Fix this intentional lockless snapshot by annotating the lockless reads with READ_ONCE() and the updates with WRITE_ONCE(). Fixes: 1d7138de878d ("igmp: RCU conversion of in_dev->mc_list") Signed-off-by: Yuyang Huang Reviewed-by: Ido Schimmel --- net/ipv4/igmp.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c index fd0faf042fa6..1e958027068b 100644 --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -220,8 +220,8 @@ static void igmp_stop_timer(struct ip_mc_list *im) spin_lock_bh(&im->lock); if (timer_delete(&im->timer)) refcount_dec(&im->refcnt); - im->tm_running =3D 0; - im->reporter =3D 0; + WRITE_ONCE(im->tm_running, 0); + WRITE_ONCE(im->reporter, 0); im->unsolicit_count =3D 0; spin_unlock_bh(&im->lock); } @@ -231,7 +231,7 @@ static void igmp_start_timer(struct ip_mc_list *im, int= max_delay) { int tv =3D get_random_u32_below(max_delay); =20 - im->tm_running =3D 1; + WRITE_ONCE(im->tm_running, 1); if (refcount_inc_not_zero(&im->refcnt)) { if (mod_timer(&im->timer, jiffies + tv + 2)) ip_ma_put(im); @@ -267,7 +267,7 @@ static void igmp_mod_timer(struct ip_mc_list *im, int m= ax_delay) if (timer_delete(&im->timer)) { if ((long)(im->timer.expires-jiffies) < max_delay) { add_timer(&im->timer); - im->tm_running =3D 1; + WRITE_ONCE(im->tm_running, 1); spin_unlock_bh(&im->lock); return; } @@ -857,12 +857,12 @@ static void igmp_timer_expire(struct timer_list *t) struct in_device *in_dev =3D im->interface; =20 spin_lock(&im->lock); - im->tm_running =3D 0; + WRITE_ONCE(im->tm_running, 0); =20 if (im->unsolicit_count && --im->unsolicit_count) igmp_start_timer(im, unsolicited_report_interval(in_dev)); =20 - im->reporter =3D 1; + WRITE_ONCE(im->reporter, 1); spin_unlock(&im->lock); =20 if (IGMP_V1_SEEN(in_dev)) @@ -1325,7 +1325,7 @@ static void __igmp_group_dropped(struct ip_mc_list *i= m, gfp_t gfp) !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) return; =20 - reporter =3D im->reporter; + reporter =3D READ_ONCE(im->reporter); igmp_stop_timer(im); =20 if (!in_dev->dead) { @@ -2964,6 +2964,7 @@ static int igmp_mc_seq_show(struct seq_file *seq, voi= d *v) struct igmp_mc_iter_state *state =3D igmp_mc_seq_private(seq); char *querier; long delta; + int tm_running; =20 #ifdef CONFIG_IP_MULTICAST querier =3D IGMP_V1_SEEN(state->in_dev) ? "V1" : @@ -2980,13 +2981,14 @@ static int igmp_mc_seq_show(struct seq_file *seq, v= oid *v) querier); } =20 - delta =3D im->timer.expires - jiffies; + tm_running =3D READ_ONCE(im->tm_running); + delta =3D READ_ONCE(im->timer.expires) - jiffies; seq_printf(seq, "\t\t\t\t%08X %5d %d:%08lX\t\t%d\n", im->multiaddr, READ_ONCE(im->users), - im->tm_running, - im->tm_running ? jiffies_delta_to_clock_t(delta) : 0, - im->reporter); + tm_running, + tm_running ? jiffies_delta_to_clock_t(delta) : 0, + READ_ONCE(im->reporter)); } return 0; } --=20 2.54.0.823.g6e5bcc1fc9-goog