[v1] raw: annotate data-races in raw_v4_match()

[PATCH net] raw: annotate data-races in raw_v4_match()

Posted by Runyu Xiao 6 days, 21 hours ago

raw_v4_match() is a lockless match helper under sk_for_each_rcu()
and still reads inet->inet_num, inet->inet_rcv_saddr and
sk->sk_bound_dev_if with plain loads.

Add READ_ONCE() annotations for these fields.

Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
 net/ipv4/raw.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 5aaf9c62c8e1..faa49f3d239a 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -120,11 +120,14 @@ bool raw_v4_match(struct net *net, const struct sock *sk, unsigned short num,
 		  __be32 raddr, __be32 laddr, int dif, int sdif)
 {
 	const struct inet_sock *inet = inet_sk(sk);
+	unsigned short match_num = READ_ONCE(inet->inet_num);
+	__be32 match_rcv_saddr = READ_ONCE(inet->inet_rcv_saddr);
+	int match_bound_dev_if = READ_ONCE(sk->sk_bound_dev_if);
 
-	if (net_eq(sock_net(sk), net) && inet->inet_num == num	&&
+	if (net_eq(sock_net(sk), net) && match_num == num &&
 	    !(inet->inet_daddr && inet->inet_daddr != raddr) 	&&
-	    !(inet->inet_rcv_saddr && inet->inet_rcv_saddr != laddr) &&
-	    raw_sk_bound_dev_eq(net, sk->sk_bound_dev_if, dif, sdif))
+	    !(match_rcv_saddr && match_rcv_saddr != laddr) &&
+	    raw_sk_bound_dev_eq(net, match_bound_dev_if, dif, sdif))
 		return true;
 	return false;
 }
-- 
2.34.1

Re: [PATCH net] raw: annotate data-races in raw_v4_match()

Posted by Eric Dumazet 6 days, 21 hours ago

On Mon, Jun 1, 2026 at 12:39 AM Runyu Xiao <runyu.xiao@seu.edu.cn> wrote:
>
> raw_v4_match() is a lockless match helper under sk_for_each_rcu()
> and still reads inet->inet_num, inet->inet_rcv_saddr and
> sk->sk_bound_dev_if with plain loads.
>

Are you sure these fields are updated with appropriate WRITE_ONCE()?

If so, please mention this in the changelog.

> Add READ_ONCE() annotations for these fields.
>
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
> ---
>  net/ipv4/raw.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
> index 5aaf9c62c8e1..faa49f3d239a 100644
> --- a/net/ipv4/raw.c
> +++ b/net/ipv4/raw.c
> @@ -120,11 +120,14 @@ bool raw_v4_match(struct net *net, const struct sock *sk, unsigned short num,
>                   __be32 raddr, __be32 laddr, int dif, int sdif)
>  {
>         const struct inet_sock *inet = inet_sk(sk);
> +       unsigned short match_num = READ_ONCE(inet->inet_num);
> +       __be32 match_rcv_saddr = READ_ONCE(inet->inet_rcv_saddr);
> +       int match_bound_dev_if = READ_ONCE(sk->sk_bound_dev_if);
>
> -       if (net_eq(sock_net(sk), net) && inet->inet_num == num  &&
> +       if (net_eq(sock_net(sk), net) && match_num == num &&
>             !(inet->inet_daddr && inet->inet_daddr != raddr)    &&
> -           !(inet->inet_rcv_saddr && inet->inet_rcv_saddr != laddr) &&
> -           raw_sk_bound_dev_eq(net, sk->sk_bound_dev_if, dif, sdif))
> +           !(match_rcv_saddr && match_rcv_saddr != laddr) &&
> +           raw_sk_bound_dev_eq(net, match_bound_dev_if, dif, sdif))
>                 return true;
>         return false;
>  }
> --
> 2.34.1