From nobody Mon Jun 8 07:24:00 2026 Received: from mail-pg1-f201.google.com (mail-pg1-f201.google.com [209.85.215.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F08EF3E3D9E for ; Fri, 5 Jun 2026 01:43:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780623818; cv=none; b=ORZ9MeyBZJb3K4Q02M5R7DtqI3eg431yyRR5lB4BVk9f5tFDVkQITbw942dvF6fa0L0FrcuK3/1p+vSll3CnPBvBLIskTxQ9qRKsUGzlnnloEEl1b0AH7psdi6vaN5nZmiD3sosJUHfskDDstCk/WZv7tl/Ved80KZ6qaUdZTZo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780623818; c=relaxed/simple; bh=EDdO8sCFNSFFX5asKV9mS604oajtv91yhZtFBop5IP8=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=tI7W//OYknmz8ih/mhEUe1eGflxSX9lHGIj4a1sH25DnghSWHCdUFVpRPVPOCFiOX17RGlpQPUNt+udxRWlZ5Quvyrbw9GaKFOetgX8hm+YsTCsPp/t8yalpBBV+gnEVhTrfIJSEeZXr7Vsk1kyF9K4RIAz2R3PJLBnMcLaB4uY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--yuyanghuang.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=Inr+20uM; arc=none smtp.client-ip=209.85.215.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--yuyanghuang.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="Inr+20uM" Received: by mail-pg1-f201.google.com with SMTP id 41be03b00d2f7-c85d9f0ace9so1269047a12.1 for ; Thu, 04 Jun 2026 18:43:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1780623808; x=1781228608; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=iVAJucd+GVsBBf1FGgcJQ8cRedfncMhwEKsquMbLLdE=; b=Inr+20uMaAQbLN9lbx+DFFI+p8Zk3FYKooLRjyg6OE4Am/6RDsHF/o0BSUGsmG+Z/O dsZFJ59bm1jpBuFcTTtTdSQCGZDr0luWTBaG8GHyE2Q0P+RAgpKpjS+6adNsGkAYGdMq h0mcJABbaDZGfoAJ6iDVBtbMPxatAcEQyPgA+K0uu7YG34qma7DXBpU9dFa5HghG4O7F w83RbywJrTvPJFsQdAGt9GT4ztpxe/0FmJ9kWsGWCOEhGYaTwUfSFrkBAKubIr29VfbN yfBcIW30r6PlFIkFyOauX8jPy+6MD3N6xmR3BWkKXi8MyopaG9JcO3aXyPso9eEm1ppI gT2w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780623808; x=1781228608; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=iVAJucd+GVsBBf1FGgcJQ8cRedfncMhwEKsquMbLLdE=; b=P/d33ZxuwgGCAj3IpJPTEVtl42jDgwc6MZLVfVqN4TnXvkjjwswKpWJSqN6GJKJi2M rVwO+7hrgbV8xUefR+vxxBe0OmgxxQ5jWFlwpcdvjx+XxaOBZh/vxZ/Gog3ljiwAM6Wt 4L6+1I5kjyYmD19eQjpAzJauF/TBlCYiT6Qx6D6BhHDlAaxHIzJEltt0xEcfOcN9FDIQ cW8V6Bc1F4tN813QzigQJWxShf8Is2l+Illy9hOjWSF4QeptoXKrC5QNGFqxcv0yeWOf cPY2i2bRel8TPLb4CxZggyZ2JysLbVKlEz1WFhMA9yjmpN0MZQk4d+RE+ycprF7VhH/I jy9Q== X-Forwarded-Encrypted: i=1; AFNElJ97h46U7tX0rMtBAQ3Swpo3lnSp9h/cSiXKwmpmD1LFRT5LpOWqEpF0ZKSopUhdkb/Kz8p0dy+ReG6D1mw=@vger.kernel.org X-Gm-Message-State: AOJu0Yxq0pM4S/QSpMWBWp+zC99R1LXmbj3Dl0sisiYdnlufTm/Zy1Em vsfa1+zupk6DJm99jTpwlO/J+yecglkiMp2jo2ygZzsFo6YvXS4Z3yBOq87XiPuqwDHOmxi5abN MtEtZetjOqkJgD5397dKfSam1Sg== X-Received: from pghl22.prod.google.com ([2002:a63:f316:0:b0:c82:7df9:8c21]) (user=yuyanghuang job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a21:a8b:b0:3b4:8ec9:514e with SMTP id adf61e73a8af0-3b4ccd77529mr1868150637.4.1780623807839; Thu, 04 Jun 2026 18:43:27 -0700 (PDT) Date: Fri, 5 Jun 2026 10:43:17 +0900 In-Reply-To: <20260605014318.3890804-1-yuyanghuang@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260605014318.3890804-1-yuyanghuang@google.com> X-Mailer: git-send-email 2.54.0.1032.g2f8565e1d1-goog Message-ID: <20260605014318.3890804-2-yuyanghuang@google.com> Subject: [PATCH net-next v2 1/2] ipv4: igmp: annotate data-races around in_dev->mc_count From: Yuyang Huang To: Yuyang Huang Cc: "David S. Miller" , David Ahern , Eric Dumazet , Ido Schimmel , Jakub Kicinski , Paolo Abeni , Simon Horman , linux-kernel@vger.kernel.org, netdev@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" /proc/net/igmp walks the multicast list for IPv4 interfaces locklessly under RCU and prints state->in_dev->mc_count. Concurrently, device init/destruction and multicast join/leave paths update the count under the RTNL lock. Fix this intentional lockless snapshot by annotating the read with READ_ONCE() and the updates with WRITE_ONCE(). Signed-off-by: Yuyang Huang Reviewed-by: Ido Schimmel --- net/ipv4/igmp.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c index f2aca659b29c..fd0faf042fa6 100644 --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -1566,7 +1566,7 @@ static void ____ip_mc_inc_group(struct in_device *in_= dev, __be32 addr, #endif =20 im->next_rcu =3D in_dev->mc_list; - in_dev->mc_count++; + WRITE_ONCE(in_dev->mc_count, in_dev->mc_count + 1); rcu_assign_pointer(in_dev->mc_list, im); =20 ip_mc_hash_add(in_dev, im); @@ -1790,7 +1790,8 @@ void __ip_mc_dec_group(struct in_device *in_dev, __be= 32 addr, gfp_t gfp) if (new_users =3D=3D 0) { ip_mc_hash_remove(in_dev, i); *ip =3D i->next_rcu; - in_dev->mc_count--; + WRITE_ONCE(in_dev->mc_count, + in_dev->mc_count - 1); __igmp_group_dropped(i, gfp); inet_ifmcaddr_notify(in_dev->dev, i, RTM_DELMULTICAST); @@ -1922,7 +1923,7 @@ void ip_mc_destroy_dev(struct in_device *in_dev) =20 while ((i =3D rtnl_dereference(in_dev->mc_list)) !=3D NULL) { in_dev->mc_list =3D i->next_rcu; - in_dev->mc_count--; + WRITE_ONCE(in_dev->mc_count, in_dev->mc_count - 1); ip_mc_clear_src(i); ip_ma_put(i); } @@ -2974,7 +2975,9 @@ static int igmp_mc_seq_show(struct seq_file *seq, voi= d *v) =20 if (rcu_access_pointer(state->in_dev->mc_list) =3D=3D im) { seq_printf(seq, "%d\t%-10s: %5d %7s\n", - state->dev->ifindex, state->dev->name, state->in_dev->mc_count, que= rier); + state->dev->ifindex, state->dev->name, + READ_ONCE(state->in_dev->mc_count), + querier); } =20 delta =3D im->timer.expires - jiffies; --=20 2.54.0.1032.g2f8565e1d1-goog From nobody Mon Jun 8 07:24:00 2026 Received: from mail-pf1-f202.google.com (mail-pf1-f202.google.com [209.85.210.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9701837C908 for ; Fri, 5 Jun 2026 01:43:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.202 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780623824; cv=none; b=cRoAgMsYFsR5B0ZQwHMUxC1jhwpdbI+AiCxhRAbxLXjwcoHYMbRW0yhgbaIU5QI+o/A4Npqw8m/H+Iqfv28/fSUCnJLkvY6kQ6NCQfkOT4c5ymaxDEBosZ9G9j7BLTzEEANv55ufkQvc8tu+OqkPmfzOJhJe6STDpKsBvNumtwA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780623824; c=relaxed/simple; bh=POCX/luQ74bLFaAzEt7GsC53FXksW1Gp1JHWey+4Dnw=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=UbvTvgZ2rLo52wAAs7oxhe5s50V+6HhOkEOxZMwj7+1IC7dN2eV+v4nGyS/x5iim9IO6WpQfpJac1Kpj6swtI1cncrhXmS3H6IWzW9zvvapCyKUI9v4Lxn7v54xV/pPtOljMlb0+ki02V1uG2orT8GB/j9PbqfbjB0Ac0YbxEK4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--yuyanghuang.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=JmWnJ3wT; arc=none smtp.client-ip=209.85.210.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--yuyanghuang.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="JmWnJ3wT" Received: by mail-pf1-f202.google.com with SMTP id d2e1a72fcca58-8423770d72dso1753773b3a.3 for ; Thu, 04 Jun 2026 18:43:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1780623813; x=1781228613; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=e/x5HRip2Kp59j/zU6/XZTTx4Pvu5aw0vss9ccMmg6o=; b=JmWnJ3wTptHmb1wGS4YYFpbfMndqQTfLrchC2paMsTbn9MAyzFmX+E6NqjT2TY3iQy u6Tk1k4TFQS2WxOdux7JlESkOqymrVqI0j1TfVmtZUoi3AhVMHoaEAbhmCIGfHPBz/Cf TMBYqUdwRQ4TG3keHsyocDZVHuu8zzkcSZYgF0U591dDTllq+dzhf1cJ5AGbrUcAFR5B 5VbVwnj03o9Oty1KKkKXTis3jXbH8LYSF44YesDMxvMm3zCxEGL2JSOIyVHuxz22zX9d cZflwNfoRq3lNCug5RF/ALw1f+ZREmrav93/qoXad8qgNd76Bdl9m9PZwJHsBBAXBvWl FaPA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780623813; x=1781228613; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=e/x5HRip2Kp59j/zU6/XZTTx4Pvu5aw0vss9ccMmg6o=; b=Vst02zSSm4uQqbW1XhCDHwYofbsLRcbACUTC52k3KvBrFaRMHcEg8+EzT6CM8T1b4F R66ecRwj40c/qsJsddwlcVFb/MsEatY7UrvmUfsEGP9WADEx/II2VHAJ2CIvBmBswSfm bD8UFdBir4ReZ1o+3ommLmqVM3VxWsDLIAQQaK8BHBquSa3ebyv6z8YsFGHQYqXyHDXj OQc5ALFiciwDA/Sg2ZsO3rtLN/t20yaiEYDKWGZKuLBnKprgvzwk6b4i0Y0mFplwuTqg KIGNtagY8rMyIa0RjNM97kYWxZtfAzkejOAy7xyXNuKzp2lnzHRwtXGNKTjUWpkS1kTA t8IQ== X-Forwarded-Encrypted: i=1; AFNElJ+9WRwRM6GLAZjqvbyYSJ3hihXOuWNi51S6Qi0yR1DZF88cR7HLwLR7dZTHGa4JlXpEgAQr/kA7Mar7sd4=@vger.kernel.org X-Gm-Message-State: AOJu0Yx4udDLD7PDk8hDrCp+QiMxtm+aeHd+h6c02wYyqzkRGpoYUY1j XCfu0RTIh0CLyLExU2qOej5ZCNVwjaAawKWqb4b2Df483ijOIWu4wwwugDsGTivL7BHDSllL5an eAt9brTV5xFatRFWgbvwyQ/ZGZA== X-Received: from pfva8.prod.google.com ([2002:a05:6a00:c88:b0:842:5989:fb63]) (user=yuyanghuang job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a00:8d0:b0:842:77ab:35df with SMTP id d2e1a72fcca58-842b0e4c733mr1128059b3a.11.1780623812365; Thu, 04 Jun 2026 18:43:32 -0700 (PDT) Date: Fri, 5 Jun 2026 10:43:18 +0900 In-Reply-To: <20260605014318.3890804-1-yuyanghuang@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260605014318.3890804-1-yuyanghuang@google.com> X-Mailer: git-send-email 2.54.0.1032.g2f8565e1d1-goog Message-ID: <20260605014318.3890804-3-yuyanghuang@google.com> Subject: [PATCH net-next v2 2/2] ipv4: igmp: annotate data-races around timer-related fields From: Yuyang Huang To: Yuyang Huang Cc: "David S. Miller" , David Ahern , Eric Dumazet , Ido Schimmel , Jakub Kicinski , Paolo Abeni , Simon Horman , linux-kernel@vger.kernel.org, netdev@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" /proc/net/igmp walks the multicast list locklessly under RCU and reads timer-related fields (im->tm_running, im->reporter, im->timer.expires) to print the timer state of multicast memberships. Concurrently, these fields are modified under im->lock spinlock in timer management paths (igmp_stop_timer(), igmp_start_timer(), and igmp_timer_expire()). Fix this intentional lockless snapshot by annotating the lockless reads with READ_ONCE() and the updates with WRITE_ONCE(). Signed-off-by: Yuyang Huang Reviewed-by: Ido Schimmel --- net/ipv4/igmp.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c index fd0faf042fa6..b6337a47c141 100644 --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -220,8 +220,8 @@ static void igmp_stop_timer(struct ip_mc_list *im) spin_lock_bh(&im->lock); if (timer_delete(&im->timer)) refcount_dec(&im->refcnt); - im->tm_running =3D 0; - im->reporter =3D 0; + WRITE_ONCE(im->tm_running, 0); + WRITE_ONCE(im->reporter, 0); im->unsolicit_count =3D 0; spin_unlock_bh(&im->lock); } @@ -231,7 +231,7 @@ static void igmp_start_timer(struct ip_mc_list *im, int= max_delay) { int tv =3D get_random_u32_below(max_delay); =20 - im->tm_running =3D 1; + WRITE_ONCE(im->tm_running, 1); if (refcount_inc_not_zero(&im->refcnt)) { if (mod_timer(&im->timer, jiffies + tv + 2)) ip_ma_put(im); @@ -267,7 +267,7 @@ static void igmp_mod_timer(struct ip_mc_list *im, int m= ax_delay) if (timer_delete(&im->timer)) { if ((long)(im->timer.expires-jiffies) < max_delay) { add_timer(&im->timer); - im->tm_running =3D 1; + WRITE_ONCE(im->tm_running, 1); spin_unlock_bh(&im->lock); return; } @@ -857,12 +857,12 @@ static void igmp_timer_expire(struct timer_list *t) struct in_device *in_dev =3D im->interface; =20 spin_lock(&im->lock); - im->tm_running =3D 0; + WRITE_ONCE(im->tm_running, 0); =20 if (im->unsolicit_count && --im->unsolicit_count) igmp_start_timer(im, unsolicited_report_interval(in_dev)); =20 - im->reporter =3D 1; + WRITE_ONCE(im->reporter, 1); spin_unlock(&im->lock); =20 if (IGMP_V1_SEEN(in_dev)) @@ -1325,7 +1325,7 @@ static void __igmp_group_dropped(struct ip_mc_list *i= m, gfp_t gfp) !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) return; =20 - reporter =3D im->reporter; + reporter =3D READ_ONCE(im->reporter); igmp_stop_timer(im); =20 if (!in_dev->dead) { @@ -2963,6 +2963,7 @@ static int igmp_mc_seq_show(struct seq_file *seq, voi= d *v) struct ip_mc_list *im =3D v; struct igmp_mc_iter_state *state =3D igmp_mc_seq_private(seq); char *querier; + int tm_running; long delta; =20 #ifdef CONFIG_IP_MULTICAST @@ -2980,13 +2981,14 @@ static int igmp_mc_seq_show(struct seq_file *seq, v= oid *v) querier); } =20 - delta =3D im->timer.expires - jiffies; + tm_running =3D READ_ONCE(im->tm_running); + delta =3D READ_ONCE(im->timer.expires) - jiffies; seq_printf(seq, "\t\t\t\t%08X %5d %d:%08lX\t\t%d\n", im->multiaddr, READ_ONCE(im->users), - im->tm_running, - im->tm_running ? jiffies_delta_to_clock_t(delta) : 0, - im->reporter); + tm_running, + tm_running ? jiffies_delta_to_clock_t(delta) : 0, + READ_ONCE(im->reporter)); } return 0; } --=20 2.54.0.1032.g2f8565e1d1-goog