From nobody Sat Sep 26 13:48:14 2026 Received: from canpmsgout10.his.huawei.com (canpmsgout10.his.huawei.com [113.46.200.225]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B004330D419; Tue, 1 Sep 2026 02:42:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.225 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788230539; cv=none; b=IKPKRuB6fcrt/LecJLMnCpWNRv0Jh7FfbOnnHJ93p5saHLUPN0RlrU6iQkwCEV/SZq76fiFbkJPjCY24kzLgXTlWiI40AlfEq957do44tH7B9CryL7s0RGT8UHtRnMmGblqPmgl0VgVf/vsyAHX0ZhQCJ1jgdFKOV/M3IDHwNEI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788230539; c=relaxed/simple; bh=2ExYMYQOFQQPwIyWmmjRnsN6d7J+Qq6kfNRhJ1FSOCA=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=ZI2MkZdSfszEEw19x2P/aBUbePhYYRkZSkBp2IQS323YeB8c7DdiXZOk/Yxa0ItESEkT/58on3rjyNE1Ml98CwDF4/lVViWDPQl8F6CQ5IHJd+2gm4plRmEdDVoUdSm5lPLj/l/I5gpoxwN0eOGj4Vfwx7ljeVUn47vccb5zcSI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=QudGLxf2; arc=none smtp.client-ip=113.46.200.225 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="QudGLxf2" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=qoAjlya8M+d7R8ZbBFu376QlGU7wsKKm9VDsrz6PzLY=; b=QudGLxf2IG1POpNF4FFFGKzpzwPRL7qNIYEKL0+9CPKFxIxW33aq8Jn68fLZYj7bL/Md8ZiDc W5Xl4K1EEhYjoYTS9KPDYrZlYJWVFH6FO5HA2eWCMlIm6pD9G0keSgwEjFnxcb9Kjz6enEvDbDq 8hEA3ehvZox4Ef8AKLOz1pc= Received: from mail.maildlp.com (unknown [172.19.163.200]) by canpmsgout10.his.huawei.com (SkyGuard) with ESMTPS id 4hYqbw09KZz1K9D2; Tue, 1 Sep 2026 10:31:08 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id 6268E4055B; Tue, 1 Sep 2026 10:41:57 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Tue, 1 Sep 2026 10:41:55 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , Subject: [PATCH v2 01/12] user_namespace: Use acquire/release for nr_extents synchronization Date: Tue, 1 Sep 2026 10:42:23 +0800 Message-ID: <20260901024234.135119-2-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260901024234.135119-1-ruanjinjie@huawei.com> References: <20260901024234.135119-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems200001.china.huawei.com (7.221.188.67) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" Replace smp_wmb()/smp_rmb() with smp_store_release()/smp_load_acquire() when publishing and consuming `nr_extents`. This expresses the publish/subscribe pattern more clearly and allows architectures with native acquire/release instructions (e.g. arm64's STLR/LDAR) to avoid the cost of full one-way barriers (DMB ISHST/ISHLD). No functional change intended. Cc: Alexander Viro Cc: Christian Brauner Cc: Jan Kara Cc: Seth Forshee Cc: Kees Cook Cc: Aleksa Sarai Assisted-by: DeepSeek:DeepSeek-V3 Signed-off-by: Jinjie Ruan --- v2: - Add missing load replace in copy_mnt_idmap() --- fs/mnt_idmapping.c | 5 ++--- kernel/user_namespace.c | 24 +++++++++++++----------- 2 files changed, 15 insertions(+), 14 deletions(-) diff --git a/fs/mnt_idmapping.c b/fs/mnt_idmapping.c index cb61fbdb52e9..612b266ab3da 100644 --- a/fs/mnt_idmapping.c +++ b/fs/mnt_idmapping.c @@ -219,10 +219,9 @@ EXPORT_SYMBOL_GPL(vfsgid_in_group_p); static int copy_mnt_idmap(struct uid_gid_map *map_from, struct uid_gid_map *map_to) { + /* Pairs with smp_store_release() in map_write(). */ + u32 nr_extents =3D smp_load_acquire(&map_from->nr_extents); struct uid_gid_extent *forward, *reverse; - u32 nr_extents =3D READ_ONCE(map_from->nr_extents); - /* Pairs with smp_wmb() when writing the idmapping. */ - smp_rmb(); =20 /* * Don't blindly copy @map_to into @map_from if nr_extents is diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c index 0bed462e9b2a..576b667a8813 100644 --- a/kernel/user_namespace.c +++ b/kernel/user_namespace.c @@ -317,9 +317,9 @@ map_id_range_down_base(unsigned extents, struct uid_gid= _map *map, u32 id, u32 co =20 static u32 map_id_range_down(struct uid_gid_map *map, u32 id, u32 count) { + /* Pairs with smp_store_release() in map_write(). */ + unsigned int extents =3D smp_load_acquire(&map->nr_extents); struct uid_gid_extent *extent; - unsigned extents =3D map->nr_extents; - smp_rmb(); =20 if (extents <=3D UID_GID_MAP_MAX_BASE_EXTENTS) extent =3D map_id_range_down_base(extents, map, id, count); @@ -383,9 +383,9 @@ map_id_range_up_max(unsigned extents, struct uid_gid_ma= p *map, u32 id, u32 count =20 u32 map_id_range_up(struct uid_gid_map *map, u32 id, u32 count) { + /* Pairs with smp_store_release() in map_write(). */ + unsigned int extents =3D smp_load_acquire(&map->nr_extents); struct uid_gid_extent *extent; - unsigned extents =3D map->nr_extents; - smp_rmb(); =20 if (extents <=3D UID_GID_MAP_MAX_BASE_EXTENTS) extent =3D map_id_range_up_base(extents, map, id, count); @@ -676,9 +676,9 @@ static int projid_m_show(struct seq_file *seq, void *v) static void *m_start(struct seq_file *seq, loff_t *ppos, struct uid_gid_map *map) { + /* Pairs with smp_store_release() in map_write(). */ + unsigned int extents =3D smp_load_acquire(&map->nr_extents); loff_t pos =3D *ppos; - unsigned extents =3D map->nr_extents; - smp_rmb(); =20 if (pos >=3D extents) return NULL; @@ -967,9 +967,11 @@ static ssize_t map_write(struct file *file, const char= __user *buf, * desired behavior is to see the values of the extents that * were written before the count of the extents. * - * To achieve this smp_wmb() is used on guarantee the write - * order and smp_rmb() is guaranteed that we don't have crazy - * architectures returning stale data. + * The nr_extents field is the publish point for the extent + * data. Writers use smp_store_release() to ensure all extent + * data is visible before nr_extents is updated. Readers use + * smp_load_acquire() to ensure they see a consistent view of + * the extent data when reading nr_extents. */ mutex_lock(&userns_state_mutex); =20 @@ -1098,8 +1100,8 @@ static ssize_t map_write(struct file *file, const cha= r __user *buf, map->forward =3D new_map.forward; map->reverse =3D new_map.reverse; } - smp_wmb(); - map->nr_extents =3D new_map.nr_extents; + /* Pairs with smp_load_acquire() in map_id_range_{up,down}() and m_start(= ). */ + smp_store_release(&map->nr_extents, new_map.nr_extents); =20 *ppos =3D count; ret =3D count; --=20 2.34.1 From nobody Sat Sep 26 13:48:14 2026 Received: from canpmsgout04.his.huawei.com (canpmsgout04.his.huawei.com [113.46.200.219]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B12E542F70E; Tue, 1 Sep 2026 02:42:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.219 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788230534; cv=none; b=mE7Mh7B6vwEhpaPazowYcW1gxY7z1pZFtq3OioXj5qJF9AuGLdnVD5TuntGN8onuND+yBI1AXNb/Koe8nMTYZruov4fCkHRInlXtyx6jPgGgu/6ZXCCu3ToSOm0a4fTRLfeQKoZbRk2WBEFRuDIM4z0trtQ5nREYS1CfZ7RysUI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788230534; c=relaxed/simple; bh=K7Gq5AUxlQXe5No7zoeHSsKZ3ssti34uiTOjY1Ps/no=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=bWPwj2D8x1vcWHtrstVgaKzVunX/DtIgTDaUVPAxleXmdJem5pi8wZguFT3pwvo+9qN0EVRG3kwFOA8v909FlNSE00o2DJLVyDt/f4cY52Lo2+BRMn4wL45JMlW7VrRZkDRi6MYwT6IayP0dmaX0FfpGGzmGLMJwlFa/JvIXGGs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=SFCgOczG; arc=none smtp.client-ip=113.46.200.219 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="SFCgOczG" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=4SvDeO5hIzQzXgGr/cxbQ0Jb8d2NsgcdDWNHmf6UJlg=; b=SFCgOczGkgW7ko/Y6AyBOmgW04Do1Yczgae9MVa2hBLlI//yx0q8SiRjeMI/zITTc1wQzJfyz Vr5GUCNXmb9RGJMAhn5/pBaxOBcUTwNFSsW7mBjeakFp9WQLLKIevVOcv4C56V+IqI5wZ3JjmZN 6QoPmCaiCKQ0LvFErUobgGM= Received: from mail.maildlp.com (unknown [172.19.162.140]) by canpmsgout04.his.huawei.com (SkyGuard) with ESMTPS id 4hYqbv6KdNz1prmR; Tue, 1 Sep 2026 10:31:07 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id D4544203C8; Tue, 1 Sep 2026 10:41:58 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Tue, 1 Sep 2026 10:41:57 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , Subject: [PATCH v2 02/12] lib/vsprintf: Use acquire/release for ptr_key publication Date: Tue, 1 Sep 2026 10:42:24 +0800 Message-ID: <20260901024234.135119-3-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260901024234.135119-1-ruanjinjie@huawei.com> References: <20260901024234.135119-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems200001.china.huawei.com (7.221.188.67) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" Replace the smp_wmb() + WRITE_ONCE() and READ_ONCE() + smp_rmb() barrier pair with smp_store_release()/smp_load_acquire() on filled_random_ptr_key. This expresses the publish/subscribe pattern more clearly and allows architectures with native acquire/release instructions (e.g. arm64's STLR/LDAR) to avoid the cost of full one-way barriers (DMB ISHST/ISHLD). No functional change intended. Cc: Petr Mladek Cc: Steven Rostedt Cc: Andy Shevchenko Cc: Rasmus Villemoes Cc: Sergey Senozhatsky Cc: Andrew Morton Assisted-by: DeepSeek:DeepSeek-V3 Signed-off-by: Jinjie Ruan --- lib/vsprintf.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/lib/vsprintf.c b/lib/vsprintf.c index 1d95ab9314bf..90d0a724eadd 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -762,9 +762,8 @@ static int fill_ptr_key(struct notifier_block *nb, unsi= gned long action, void *d { get_random_bytes(&ptr_key, sizeof(ptr_key)); =20 - /* Pairs with smp_rmb() before reading ptr_key. */ - smp_wmb(); - WRITE_ONCE(filled_random_ptr_key, true); + /* Pairs with smp_load_acquire() before reading ptr_key. */ + smp_store_release(&filled_random_ptr_key, true); return NOTIFY_DONE; } =20 @@ -781,12 +780,10 @@ static inline int __ptr_to_hashval(const void *ptr, u= nsigned long *hashval_out) { unsigned long hashval; =20 - if (!READ_ONCE(filled_random_ptr_key)) + /* Pairs with smp_store_release() after writing ptr_key. */ + if (!smp_load_acquire(&filled_random_ptr_key)) return -EBUSY; =20 - /* Pairs with smp_wmb() after writing ptr_key. */ - smp_rmb(); - #ifdef CONFIG_64BIT hashval =3D (unsigned long)siphash_1u64((u64)ptr, &ptr_key); /* --=20 2.34.1 From nobody Sat Sep 26 13:48:14 2026 Received: from canpmsgout05.his.huawei.com (canpmsgout05.his.huawei.com [113.46.200.220]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ADC98418344; Tue, 1 Sep 2026 02:42:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.220 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788230537; cv=none; b=Xz143lHm0yj3Gn947/JeyF/+tSaISNC0w3ggLc8yhPqgKSqq4PHAhTAb2zqqplDcM97tCNlY6NeZp57isHb9x/N/2AvkBLbFpcNZCq26Y5A4GGi8UHLU6RTzcZicG6hqu9Uh94uANPT7fO6UAE4HYIlB7RaG/2QzhuB+d0wlfbA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788230537; c=relaxed/simple; bh=5ktFPYfcS354H0E7w1/ipjmsCACpMiKd8AYObWDY1jA=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=T8FseHwatGDvOM+TfL+5i/N+EvVJb2ZB2i+e3IlWtjcMPDZm3T1OGj56A8AM1U54kTB19Ay2WwU4UnuxVUKKM5MVijWneM6q0zApI9ZVn+7OBHdOwcIovU4G8HEMEkYo3fx3uAvfScw0+sZhE7SEhTwrRvTo7/0xfSuHk3EUwik= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=rd6Hz3E3; arc=none smtp.client-ip=113.46.200.220 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="rd6Hz3E3" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=ao1UDWuDYQRsk9bPKBFmaIKKn4znhhepOdHzIjS7dcs=; b=rd6Hz3E3kFFODcc4/kGIU6WQ3O/MF2UNzG8fGv3DfTk1xxbkr5JYxWMHti/CESfAv3QlowOiF KpxM7VUaBOOrPoiBFse4b4RNYjhXKbaL61GTXDs/kAXRoMmBSTF1OOw+4B8ofiUSWzJ9cBthC5e jq57PsmyzIUaJsuBshV91U0= Received: from mail.maildlp.com (unknown [172.19.162.223]) by canpmsgout05.his.huawei.com (SkyGuard) with ESMTPS id 4hYqbR2P5Lz12LHk; Tue, 1 Sep 2026 10:30:43 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id 5359340561; Tue, 1 Sep 2026 10:42:00 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Tue, 1 Sep 2026 10:41:58 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , Subject: [PATCH v2 03/12] fs: aio: Use acquire/release for ring->tail publication Date: Tue, 1 Sep 2026 10:42:25 +0800 Message-ID: <20260901024234.135119-4-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260901024234.135119-1-ruanjinjie@huawei.com> References: <20260901024234.135119-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems200001.china.huawei.com (7.221.188.67) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" Replace the smp_wmb() + WRITE_ONCE(ring->tail) and READ_ONCE(ring->tail) + smp_rmb() barrier pair with smp_store_release()/smp_load_acquire() on `ring->tail`. This expresses the publish/subscribe pattern more clearly and allows architectures with native acquire/release instructions (e.g. arm64's STLR/LDAR) to avoid the cost of full one-way barriers (DMB ISHST/ISHLD). The release ensures event data written before updating ring->tail is visible to readers that observe the new tail value via acquire, which is exactly the ordering the barrier pair provided. No functional change intended. Cc: Alexander Viro Cc: Christian Brauner Cc: Jan Kara Cc: Benjamin LaHaise Reviewed-by: Jan Kara Assisted-by: DeepSeek:DeepSeek-V3 Signed-off-by: Jinjie Ruan --- fs/aio.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/fs/aio.c b/fs/aio.c index d78acc69f487..a0279e059e97 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -1206,13 +1206,12 @@ static void aio_complete(struct aio_kiocb *iocb) /* after flagging the request as done, we * must never even look at it again */ - smp_wmb(); /* make event visible before updating tail */ - ctx->tail =3D tail; =20 ring =3D folio_address(ctx->ring_folios[0]); head =3D ring->head; - ring->tail =3D tail; + /* Make event visible before updating tail */ + smp_store_release(&ring->tail, tail); flush_dcache_folio(ctx->ring_folios[0]); =20 ctx->completed_events++; @@ -1288,13 +1287,12 @@ static long aio_read_events_ring(struct kioctx *ctx, /* Access to ->ring_folios here is protected by ctx->ring_lock. */ ring =3D folio_address(ctx->ring_folios[0]); head =3D ring->head; - tail =3D ring->tail; - /* * Ensure that once we've read the current tail pointer, that * we also see the events that were stored up to the tail. + * Pairs with smp_store_release() in aio_complete(). */ - smp_rmb(); + tail =3D smp_load_acquire(&ring->tail); =20 pr_debug("h%u t%u m%u\n", head, tail, ctx->nr_events); =20 --=20 2.34.1 From nobody Sat Sep 26 13:48:14 2026 Received: from canpmsgout05.his.huawei.com (canpmsgout05.his.huawei.com [113.46.200.220]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ACC7A3C65E0; Tue, 1 Sep 2026 02:42:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.220 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788230539; cv=none; b=S4enhHhKdmXvvcHi1srxfpQHiPghtUJzjxCEBYKhT/q/MKjnHGpddn0+DTLSzD2D6doyhbgENkjeFcm8bFWP8GI+rdPRg2NkyYy86R+zjHlqZoq8cFMUEMKnbo+RN2sIDN4P5CPu6TBBZWSFq0m2pLli80HTbWKFQCs7NpmkGA8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788230539; c=relaxed/simple; bh=o8FmgoYdsYjyVB+XJ0H6LCxj3FMwFt8UkvGX+Rj1CnA=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=mlvSsmV7HRL17v1Jpom5IQI6s3MWAIPkmgsCFCWdxVGPEnEVQwgn4zxuJCtoZ4QNh/+HraYq5QpNziZxBphdIt43njoOBsDtlh//J6RA0p2ImmQSW8uW8nC1TkPgwCjuHt3r0Z62ZhEi09DSnWU60EgXUdpiZW7DMlvTkhKftCc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=QPVIb2HG; arc=none smtp.client-ip=113.46.200.220 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="QPVIb2HG" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=wH2CfQ8NlJ9qjdgD8gOoz1HdGX4QF01Gpzjou8ScRYs=; b=QPVIb2HGkXjoGFUlheFPTaFl6nReY9Qp8svTUtzhUBF2/KR5IEjfDKNlMkgpqQw528JiX5MNH NseSbq5LHmz/b2fwSENyTgHpUwzro0zhrd/yXzJ37lLWPO6yAK43w8QDF0QRFnjTUarutjn9hxh z7R00Tr3pWkTXseMFYuRpEY= Received: from mail.maildlp.com (unknown [172.19.162.223]) by canpmsgout05.his.huawei.com (SkyGuard) with ESMTPS id 4hYqbS5RK2z12LHv; Tue, 1 Sep 2026 10:30:44 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id C5EB640561; Tue, 1 Sep 2026 10:42:01 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Tue, 1 Sep 2026 10:42:00 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , Subject: [PATCH v2 04/12] fs: Use acquire/release for fdtable resize synchronization Date: Tue, 1 Sep 2026 10:42:26 +0800 Message-ID: <20260901024234.135119-5-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260901024234.135119-1-ruanjinjie@huawei.com> References: <20260901024234.135119-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems200001.china.huawei.com (7.221.188.67) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" Replace the smp_wmb()/smp_rmb() barrier pair with smp_store_release()/smp_load_acquire() on `files->resize_in_progress`. The flag is the publish point for fdtable expansion: writers clear it via release after rcu_assign_pointer(), readers check it via acquire before rcu_dereference_sched(). Observing it clear guarantees the new fdt pointer is visible. This expresses the pattern more clearly and allows cheaper one-way barriers on weakly-ordered architectures (e.g. arm64 STLR/LDAR vs DMB ISHST/ISHLD). Cc: Alexander Viro Cc: Christian Brauner Cc: Jan Kara Reviewed-by: Jan Kara Assisted-by: DeepSeek:DeepSeek-V3 Signed-off-by: Jinjie Ruan --- fs/file.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/fs/file.c b/fs/file.c index 628ca07dc4b1..86c035d459f2 100644 --- a/fs/file.c +++ b/fs/file.c @@ -273,8 +273,6 @@ static int expand_fdtable(struct files_struct *files, u= nsigned int nr) rcu_assign_pointer(files->fdt, new_fdt); if (cur_fdt !=3D &files->fdtab) call_rcu(&cur_fdt->rcu, free_fdtable_rcu); - /* coupled with smp_rmb() in fd_install() */ - smp_wmb(); return 0; } =20 @@ -313,7 +311,8 @@ static int expand_files(struct files_struct *files, uns= igned int nr) /* All good, so we try */ files->resize_in_progress =3D true; error =3D expand_fdtable(files, nr); - files->resize_in_progress =3D false; + /* coupled with smp_load_acquire() in fd_install() */ + smp_store_release(&files->resize_in_progress, false); =20 wake_up_all(&files->resize_wait); return error; @@ -685,13 +684,12 @@ void fd_install(unsigned int fd, struct file *file) return; =20 rcu_read_lock_sched(); - if (unlikely(files->resize_in_progress)) { + /* coupled with smp_store_release() in expand_files() */ + if (unlikely(smp_load_acquire(&files->resize_in_progress))) { rcu_read_unlock_sched(); fd_install_slowpath(fd, file); return; } - /* coupled with smp_wmb() in expand_fdtable() */ - smp_rmb(); fdt =3D rcu_dereference_sched(files->fdt); VFS_BUG_ON(rcu_access_pointer(fdt->fd[fd]) !=3D NULL); rcu_assign_pointer(fdt->fd[fd], file); --=20 2.34.1 From nobody Sat Sep 26 13:48:14 2026 Received: from canpmsgout12.his.huawei.com (canpmsgout12.his.huawei.com [113.46.200.227]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 47CB231B833; Tue, 1 Sep 2026 02:42:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.227 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788230537; cv=none; b=iF1Ts3wisRnmonKKHE6DX/jOcsBZVHqb7whYbyRQnlbrPTkANKpvHCjVkI6JwxCNXBpKhjQ9I7UYoJWLLWu9f8CMV61I4eE0gSoKOLCux7jICNQqHgzUyvA+xWdmNrbhxOGAvTVLmAWk7XRoLwMjMgdjLZc2Z4OZt9H6ImmFfK4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788230537; c=relaxed/simple; bh=6PIg64GDnvklPC0UJj5Fh9eYgMI0rQUBw8ZYe1++kd8=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=nDMVsJ+YApbeEJN7j4OiKw77ImKQIapl27Ul6w36KvZsoyVDMpDpQt/sjqvXjUYMPUn3f5ycuu4xkBp1IC3HI9clxkXEZ0ORxJmaa5Uf2rYaEMj3p5QqMUSEFiWwnJHVOFSRsJTJdyIDhmVA339xz/Bj+/wUIgYJwjs3R5/p6lY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=c9mLb8sr; arc=none smtp.client-ip=113.46.200.227 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="c9mLb8sr" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=J4yJnyqxeHRcmq2Fv8EZ0jwzeTlaVGzNrqh5hfCP6Nw=; b=c9mLb8srEPPPQLn8yQD0c0BDviwcWNS55C5KXhKc4Lr6mNPUZ/QWJP9W/S2+92FK4d3gHgR/6 obYTqC6R8LtPGNDKBwX3FscPqdzkyNC5H6hczFGuWxwrAZrZMKArEzgEpCM04d+2arVNeGGvtZ7 9YQTydYIvXdK+e7T86kwZ34= Received: from mail.maildlp.com (unknown [172.19.163.200]) by canpmsgout12.his.huawei.com (SkyGuard) with ESMTPS id 4hYqbY22jCznTVx; Tue, 1 Sep 2026 10:30:49 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id 3CFF64055B; Tue, 1 Sep 2026 10:42:03 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Tue, 1 Sep 2026 10:42:01 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , Subject: [PATCH v2 05/12] pidfs: Use test_bit_acquire() for attr flag tests Date: Tue, 1 Sep 2026 10:42:27 +0800 Message-ID: <20260901024234.135119-6-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260901024234.135119-1-ruanjinjie@huawei.com> References: <20260901024234.135119-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems200001.china.huawei.com (7.221.188.67) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" Replace test_bit() + smp_rmb() with test_bit_acquire() for PIDFS_ATTR_BIT_EXIT and PIDFS_ATTR_BIT_COREDUMP tests in pidfd_info(). The acquire semantics ensure that if the flag is observed set, the associated attr fields written before smp_wmb() + set_bit() are also visible. Writers keep smp_wmb() + set_bit() since no release bitop exists. Cc: Alexander Viro Cc: Christian Brauner Cc: Jan Kara Assisted-by: DeepSeek:DeepSeek-V3 Signed-off-by: Jinjie Ruan --- fs/pidfs.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/fs/pidfs.c b/fs/pidfs.c index a6a643f15d08..2cd0fab73180 100644 --- a/fs/pidfs.c +++ b/fs/pidfs.c @@ -393,8 +393,7 @@ static long pidfd_info(struct file *file, unsigned int = cmd, unsigned long arg) =20 attr =3D READ_ONCE(pid->attr); if (mask & PIDFD_INFO_EXIT) { - if (test_bit(PIDFS_ATTR_BIT_EXIT, &attr->attr_mask)) { - smp_rmb(); + if (test_bit_acquire(PIDFS_ATTR_BIT_EXIT, &attr->attr_mask)) { kinfo.mask |=3D PIDFD_INFO_EXIT; #ifdef CONFIG_CGROUPS kinfo.cgroupid =3D attr->cgroupid; @@ -405,8 +404,7 @@ static long pidfd_info(struct file *file, unsigned int = cmd, unsigned long arg) } =20 if (mask & PIDFD_INFO_COREDUMP) { - if (test_bit(PIDFS_ATTR_BIT_COREDUMP, &attr->attr_mask)) { - smp_rmb(); + if (test_bit_acquire(PIDFS_ATTR_BIT_COREDUMP, &attr->attr_mask)) { kinfo.mask |=3D PIDFD_INFO_COREDUMP | PIDFD_INFO_COREDUMP_SIGNAL | PIDF= D_INFO_COREDUMP_CODE; kinfo.coredump_mask =3D attr->coredump_mask; kinfo.coredump_signal =3D attr->coredump_signal; --=20 2.34.1 From nobody Sat Sep 26 13:48:14 2026 Received: from canpmsgout10.his.huawei.com (canpmsgout10.his.huawei.com [113.46.200.225]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EBED52931C1; Tue, 1 Sep 2026 02:42:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.225 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788230543; cv=none; b=jYL4GChc8XqIMChzxSeu466n9YvWH6tts7zzrWp/ObA8/j9lwP6vnUlUGoaa2gJbYYgVxJwbCvsCrJ7ZPws4cLPpgNgTgoI/LVMvYtL5N+ViJgLs8BIiMzEVtwC32Cg+NBwVqMfkiRbGmc3H2vjYeRd52rxE9oglgB3DWvtlt9s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788230543; c=relaxed/simple; bh=rM/tXGbf1aCcjq5KxywPtk0vBUXFIx2mFpz196P6YbQ=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=hooyVEdO+3CAkBAGoIG/BIwAPQUka0KQyyo8omdlJej3iGAjUgn5ageiOQDvw20MfpKGSiQb7uv/RodH2bU85qc6BG+HFaPxxPXOvdYNDwcwyUrtv4BhfH1tkFSggbnRYotwKXTs6Aj1wun9RC83Zr68E8N1oqjEDTLL5xWL6aE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=NOgSQT1d; arc=none smtp.client-ip=113.46.200.225 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="NOgSQT1d" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=Xr9BLFJfOVdKkYTXuHA//41f3O6Yyk2q7ziikLqqqXw=; b=NOgSQT1dlqJaQi9vrvjYnOEf8vsKWa97ntxZrTZMRxiKx0d/nYt5xLqPcABA9lWZ31g/7l5Y1 +AfGvHDdfxbE8Fgiw6r/ppCN3i8sshYU034KTWamrxz3cwwcpKeTXatkjTKwHhVVwkOK/Im0sjX vRXMeKBUnArlIhi7y1g3vL8= Received: from mail.maildlp.com (unknown [172.19.163.127]) by canpmsgout10.his.huawei.com (SkyGuard) with ESMTPS id 4hYqc32Wnfz1K9cF; Tue, 1 Sep 2026 10:31:15 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id AE57940572; Tue, 1 Sep 2026 10:42:04 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Tue, 1 Sep 2026 10:42:03 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , Subject: [PATCH v2 06/12] super: Use acquire for SB_BORN check in super_cache_count() Date: Tue, 1 Sep 2026 10:42:28 +0800 Message-ID: <20260901024234.135119-7-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260901024234.135119-1-ruanjinjie@huawei.com> References: <20260901024234.135119-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems200001.china.huawei.com (7.221.188.67) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" The active SB_BORN check in super_cache_count() pairs with the smp_store_release() in super_wake() when publishing a newly initialized superblock. Replace the historical independent smp_rmb() barrier with an acquire load on sb->s_flags via super_flags(). This expresses the publish-subscribe pattern more clearly and allows weakly-ordered architectures like arm64 to utilize efficient native instructions (e.g., LDAR) instead of a full one-way barrier. Also remove the outdated memory barrier comment in super_cache_count(), as the underlying super_flags() implementation already self-documents the matched smp_store_release() in super_wake(). Cc: Alexander Viro Cc: Christian Brauner Cc: Jan Kara Assisted-by: Gemini:Gemini-3.1 Assisted-by: DeepSeek:DeepSeek-V3 Reviewed-by: Jan Kara Signed-off-by: Jinjie Ruan --- fs/super.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/fs/super.c b/fs/super.c index 05e443173038..caa6189e4057 100644 --- a/fs/super.c +++ b/fs/super.c @@ -267,12 +267,10 @@ static unsigned long super_cache_count(struct shrinke= r *shrink, * However, if we are currently mounting the superblock, the underlying * filesystem might be in a state of partial construction and hence it * is dangerous to access it. super_trylock_shared() uses a SB_BORN check - * to avoid this situation, so do the same here. The memory barrier is - * matched with the one in mount_fs() as we don't hold locks here. + * to avoid this situation, so do the same here. */ - if (!(sb->s_flags & SB_BORN)) + if (!super_flags(sb, SB_BORN)) return 0; - smp_rmb(); =20 if (sb->s_op && sb->s_op->nr_cached_objects && super_fs_objects_eligible(sc)) --=20 2.34.1 From nobody Sat Sep 26 13:48:14 2026 Received: from canpmsgout04.his.huawei.com (canpmsgout04.his.huawei.com [113.46.200.219]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 39CDE42E40F; Tue, 1 Sep 2026 02:42:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.219 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788230540; cv=none; b=fW8Eg1K9qDpN1m25x+8r6XpXa18Y75lhN1zcdhrLbUptfEX0oBE5y2I/5s4LqBzesDhErCUh4jkHnZJ5+lc9NlgmQf8A4QAcZolkEfbniaf29UNXegbsnFGcoKeu9t1eDc76m8yx8MX8cY2zkx7ULtSl62rCmHhzysfri21nBOQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788230540; c=relaxed/simple; bh=mRu+8oI+8yejYmM5U0IYS4f9ZssaZfdqnhX1pgozqEk=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=sP0To4ba8Npd4jwAGO4QQbm+Y9wB3akgp5RZhTTovl23O+X8S7ad1f0g+9oxcUJq3R278EjhLzbUERuApfgAD/PqLXYfjvSrA5lyHzewsdh1WT0h1euPW84AAxRg6k/84HjKd6dQdCsXxa6+F3RJ9NVfgCCeU4bnknLmaqerF/E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=W5vBb9vC; arc=none smtp.client-ip=113.46.200.219 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="W5vBb9vC" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=KKEbfOeCLbOOAhU6UgBfdVrcmR/XEEwU6rZUBbIzUo4=; b=W5vBb9vC2vK/dr1W84GGMw8wT2SAhPGYXZBM7i3KKuiyeIFwMYrTND+SAvYviuEUw6E5on1IP 9raRX2qScminjENq+dSm4Xp5jJbaGAiJeXHxX2/ZySZkJSYl/5qepR/CtSL2YWYSdB2EvhzQycD 77jndysTvDI2xvAtaB0rTcc= Received: from mail.maildlp.com (unknown [172.19.162.140]) by canpmsgout04.his.huawei.com (SkyGuard) with ESMTPS id 4hYqc31LKfz1prl2; Tue, 1 Sep 2026 10:31:15 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id 2C76C202E6; Tue, 1 Sep 2026 10:42:06 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Tue, 1 Sep 2026 10:42:04 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , Subject: [PATCH v2 07/12] ext4: Fix out-of-bounds read in ext4_get_group_info() Date: Tue, 1 Sep 2026 10:42:29 +0800 Message-ID: <20260901024234.135119-8-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260901024234.135119-1-ruanjinjie@huawei.com> References: <20260901024234.135119-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems200001.china.huawei.com (7.221.188.67) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" A plain read of s_groups_count in ext4_get_group_info() allows CPU load-load reordering. On weak memory models, speculative prefetch of s_group_info prior to the boundary check could lead to an out-of-bounds read if a concurrent online resize expands the array and increments s_groups_count. The data race occurs between the ioctl configuration path (holding the resize lock via ext4_resize_begin) and the lockless metadata lookup path: CPU 0 (Writer, Resize Lock) CPU 1 (Reader, Lockless) --------------------------- ------------------------ ext4_ioctl() [EXT4_IOC_GROUP_ADD] ext4_ioctl_group_add() ext4_resize_begin() // Takes lock ext4_group_add() ext4_mb_alloc_groupinfo() // Publishes expanded array via RCU rcu_assign_pointer(s_group_info, ...) ext4_flex_group_add() ext4_update_super() ext4_get_group_info() // Speculative / out-of-ord= er read [Loads old/smaller s_group_= info pointer] [Plain C store / smp_wmb()] sbi->s_groups_count +=3D ...; // Reads new s_groups_count, // boundary check passes if (group >=3D s_groups_cou= nt) // Out-of-bounds array acce= ss! sbi_array_rcu_deref(..., s_= group_info) Fix this by using ext4_get_groups_count() to enforce acquire semantics. Cc: stable@vger.kernel.org Cc: "Theodore Ts'o" Cc: Andreas Dilger Cc: Baokun Li Cc: Jan Kara Cc: Ojaswin Mujoo Cc: "Ritesh Harjani (IBM)" Cc: Zhang Yi Fixes: 5354b2af3406 ("ext4: allow ext4_get_group_info() to fail") Link: https://sashiko.dev/#/patchset/20260825095422.3166067-1-ruanjinjie%40= huawei.com Signed-off-by: Jinjie Ruan Reviewed-by: Jan Kara Reviewed-by: Zhang Yi --- fs/ext4/balloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c index 52f4c5169f91..778fe8788f06 100644 --- a/fs/ext4/balloc.c +++ b/fs/ext4/balloc.c @@ -329,7 +329,7 @@ struct ext4_group_info *ext4_get_group_info(struct supe= r_block *sb, struct ext4_group_info **grp_info; long indexv, indexh; =20 - if (unlikely(group >=3D EXT4_SB(sb)->s_groups_count)) + if (unlikely(group >=3D ext4_get_groups_count(sb))) return NULL; if (unlikely(!EXT4_SB(sb)->s_group_info)) return NULL; --=20 2.34.1 From nobody Sat Sep 26 13:48:14 2026 Received: from canpmsgout03.his.huawei.com (canpmsgout03.his.huawei.com [113.46.200.218]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C98AB41D23D; Tue, 1 Sep 2026 02:42:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.218 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788230546; cv=none; b=h/+Bjmc8x/pL+a7POx3UNeUapt4a7vahNNegn4n9T1nWRN/bUrBtIlWyBvTOdvycn1r8o5QGdXo0YhUkFlb30r4Zn83i8Ls70RyF7TuSjHx8GYiSIozfBwNpfz3l+7KWo9F80U/ySvIxTUN0vUC3zPkvUEfjZ4XhQyugtD3NxtI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788230546; c=relaxed/simple; bh=pADLIDDDAa+lhGsyTlXoetDrztywb5yDxiTzspAGBzY=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=f04zqKVIYMWAS1fflPnl1QltXYyGEj3hvqDuCyQ/zqPOzpIbjVHVJjNrz0gG0INlj9JHYd/h3RZAlhH/loupaJNCRwaEQbIS1+WG/005mJcF8BmtOlJM28hPZlSmVSfkwN8xBGFKX7zXTkVC9oXXo8Yz2V6r6mc4cN1P3GhGbwA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=53B12CPQ; arc=none smtp.client-ip=113.46.200.218 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="53B12CPQ" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=iH00vTqUXFP44+YZhDZSDGKnnR3KFEyl0IM9Pe/tVLE=; b=53B12CPQYRWRKa5gqDtuoUGWsm1oHSiifC4JGWdfAVl4rFPT2lC1C0tVRMzhXLCkAVhJH2+wL 01JI5nBn1I2mufrWDunC94QgP8Zwwx1EfEbULJWhS5IHjrKwyDrZmfXytMBUaRH5oFHElaByvZn DfK1Pf8R89hd2mIFe1ETWuQ= Received: from mail.maildlp.com (unknown [172.19.162.140]) by canpmsgout03.his.huawei.com (SkyGuard) with ESMTPS id 4hYqbY0tdczpSvd; Tue, 1 Sep 2026 10:30:49 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id 9E0E3202E6; Tue, 1 Sep 2026 10:42:07 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Tue, 1 Sep 2026 10:42:06 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , Subject: [PATCH v2 08/12] ext4: Convert group-count barrier protocol to acquire/release Date: Tue, 1 Sep 2026 10:42:30 +0800 Message-ID: <20260901024234.135119-9-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260901024234.135119-1-ruanjinjie@huawei.com> References: <20260901024234.135119-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems200001.china.huawei.com (7.221.188.67) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" During an online resize, reading s_groups_count and s_blockfile_groups requires strict ordering against subsequent initialized block group metadata. Replace the historical smp_wmb()/smp_rmb() pairs with smp_store_release() and smp_load_acquire(). This formalizes the publish-subscribe pattern and allows weakly-ordered architectures (e.g., arm64) to utilize native STLR/LDAR instructions instead of full DMB fences. Update the documentation in resize.c and ext4.h accordingly. Cc: "Theodore Ts'o" Cc: Andreas Dilger Cc: Baokun Li Cc: Jan Kara Cc: Ojaswin Mujoo Cc: "Ritesh Harjani (IBM)" Cc: Zhang Yi Assisted-by: Gemini:Gemini-3.1 Assisted-by: DeepSeek:DeepSeek-V3 Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Signed-off-by: Jinjie Ruan --- fs/ext4/ext4.h | 10 +++------- fs/ext4/mballoc.c | 6 ++---- fs/ext4/resize.c | 19 +++++++++++-------- 3 files changed, 16 insertions(+), 19 deletions(-) diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h index 724a27e8be61..d70b9cb09155 100644 --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h @@ -3542,16 +3542,12 @@ static inline void ext4_isize_set(struct ext4_inode= *raw_inode, loff_t i_size) } =20 /* - * Reading s_groups_count requires using smp_rmb() afterwards. See - * the locking protocol documented in the comments of ext4_group_add() - * in resize.c + * Reading s_groups_count uses acquire semantics. */ static inline ext4_group_t ext4_get_groups_count(struct super_block *sb) { - ext4_group_t ngroups =3D EXT4_SB(sb)->s_groups_count; - - smp_rmb(); - return ngroups; + /* Pairs with smp_store_release() in ext4_update_super() */ + return smp_load_acquire(&EXT4_SB(sb)->s_groups_count); } =20 static inline ext4_group_t ext4_flex_group(struct ext4_sb_info *sbi, diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index 06171a11db12..a15285224cdf 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -899,10 +899,8 @@ static ext4_group_t ext4_get_allocation_groups_count( =20 /* non-extent files are limited to low blocks/groups */ if (!(ext4_test_inode_flag(ac->ac_inode, EXT4_INODE_EXTENTS))) - ngroups =3D EXT4_SB(ac->ac_sb)->s_blockfile_groups; - - /* Pairs with smp_wmb() in ext4_update_super() */ - smp_rmb(); + /* Pairs with smp_store_release() in ext4_update_super() */ + ngroups =3D smp_load_acquire(&EXT4_SB(ac->ac_sb)->s_blockfile_groups); =20 return ngroups; } diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c index 2c5b851c552a..5e3ad8393cf8 100644 --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -1462,11 +1462,11 @@ static void ext4_update_super(struct super_block *s= b, * * The precise rules we use are: * - * * Writers must perform a smp_wmb() after updating all - * dependent data and before modifying the groups count + * * Writers must use a release store when updating the groups count + * after all dependent data has been updated * - * * Readers must perform an smp_rmb() after reading the groups - * count and before reading any dependent data. + * * Readers must use an acquire load when reading the groups + * count before reading any dependent data. * * NB. These rules can be relaxed when checking the group count * while freeing data, as we can only allocate from a block @@ -1474,12 +1474,15 @@ static void ext4_update_super(struct super_block *s= b, * only then free after serialising in turn against that * allocation. */ - smp_wmb(); =20 /* Update the global fs size fields */ - sbi->s_groups_count +=3D flex_gd->count; - sbi->s_blockfile_groups =3D min(sbi->s_groups_count, - (EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb))); + /* Pairs with smp_load_acquire() in ext4_get_groups_count() */ + smp_store_release(&sbi->s_groups_count, + sbi->s_groups_count + flex_gd->count); + /* Pairs with smp_load_acquire() in ext4_get_allocation_groups_count() */ + smp_store_release(&sbi->s_blockfile_groups, + min(sbi->s_groups_count, + (EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb)))); =20 /* Update the reserved block counts only once the new group is * active. */ --=20 2.34.1 From nobody Sat Sep 26 13:48:14 2026 Received: from canpmsgout03.his.huawei.com (canpmsgout03.his.huawei.com [113.46.200.218]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 094523D647A; Tue, 1 Sep 2026 02:42:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.218 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788230553; cv=none; b=ueqedY18rlECJrdKXOvualhl7ZijXwIX1JuvAayYHj8igAqezwH7WEyIFWwpZPEy6l/gcjG2rbzKuym16zsGNI+xhaUC1Q0fj6xjl4/yc0TA8daz5AsIObMtXqFvFUJKQkRiFFCJuEsuAFTe2bCvoUDhdSzfpV667B9OYvWVEBI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788230553; c=relaxed/simple; bh=f8cUvQr4SN6kSkXKV2fOi8juRid33vv6DwaKQMI0W4k=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=ZbAjVIP6WeY+ffhO6/SuAiObZXc6l4inq03w21mWNW8Zm2wxN0oUUHQQeSpyvTgYCys4j/mjIjus5MnvOxlzEhJXD6+LBncIwLKC98uwUbVhsbqIkjrr/+UH6V+BUtkxfG4JbDWnN5Z4BEeuzVdRyl8NnU5e0jv/jMP045Pi6RU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=A0Fh0pQm; arc=none smtp.client-ip=113.46.200.218 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="A0Fh0pQm" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=LL0W8CeNgEMKMcIbN4r+qUTUQsLcK7A36KE0FRo5UcI=; b=A0Fh0pQmI7C2hPcC0amBJ1qYBkK7obbqDvixwwZLL6MV3N1/I2ZQBvHNODG9p4SQ2OPKyzd0y 7rnauNdYlsUX7M+JhQ2bfSPyBFesEnhhjSeXnJsrYdqi4dDKAHoz61SnTSAEFHmcwdfm12ol+G6 8dX2IQna8yN4elhbt5q0wDg= Received: from mail.maildlp.com (unknown [172.19.162.197]) by canpmsgout03.his.huawei.com (SkyGuard) with ESMTPS id 4hYqbZ4DDSzpTJ4; Tue, 1 Sep 2026 10:30:50 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id 1D1CB4057D; Tue, 1 Sep 2026 10:42:09 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Tue, 1 Sep 2026 10:42:07 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , Subject: [PATCH v2 09/12] soreuseport: publish num_socks with acquire/release Date: Tue, 1 Sep 2026 10:42:31 +0800 Message-ID: <20260901024234.135119-10-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260901024234.135119-1-ruanjinjie@huawei.com> References: <20260901024234.135119-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems200001.china.huawei.com (7.221.188.67) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" Replace the smp_wmb()/smp_rmb() barrier pair with smp_store_release()/smp_load_acquire() on reuse->num_socks. Writers publish socks[] updates via release before incrementing or decrementing the count; readers acquire the count before accessing socks[], ensuring they observe a consistent view. The detach path gains proper ordering between the socks[] write and the decrement, which was previously unordered. No functional change intended. Cc: Eric Dumazet Cc: Kuniyuki Iwashima Cc: Paolo Abeni Cc: Willem de Bruijn Cc: "David S. Miller" Cc: Jakub Kicinski Cc: Simon Horman Assisted-by: DeepSeek:DeepSeek-V3 Signed-off-by: Jinjie Ruan --- net/core/sock_reuseport.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/net/core/sock_reuseport.c b/net/core/sock_reuseport.c index 29948cb44b7d..6d3c511d1def 100644 --- a/net/core/sock_reuseport.c +++ b/net/core/sock_reuseport.c @@ -125,9 +125,8 @@ static void __reuseport_add_sock(struct sock *sk, struct sock_reuseport *reuse) { reuse->socks[reuse->num_socks] =3D sk; - /* paired with smp_rmb() in reuseport_(select|migrate)_sock() */ - smp_wmb(); - reuse->num_socks++; + /* paired with smp_load_acquire() in reuseport_(select|migrate)_sock() */ + smp_store_release(&reuse->num_socks, reuse->num_socks + 1); reuseport_get_incoming_cpu(sk, reuse); } =20 @@ -140,7 +139,8 @@ static bool __reuseport_detach_sock(struct sock *sk, return false; =20 reuse->socks[i] =3D reuse->socks[reuse->num_socks - 1]; - reuse->num_socks--; + /* paired with smp_load_acquire() in reuseport_(select|migrate)_sock() */ + smp_store_release(&reuse->num_socks, reuse->num_socks - 1); reuseport_put_incoming_cpu(sk, reuse); =20 return true; @@ -583,11 +583,9 @@ struct sock *reuseport_select_sock(struct sock *sk, goto out; =20 prog =3D rcu_dereference(reuse->prog); - socks =3D READ_ONCE(reuse->num_socks); + /* paired with smp_store_release() in __reuseport_add_sock() */ + socks =3D smp_load_acquire(&reuse->num_socks); if (likely(socks)) { - /* paired with smp_wmb() in __reuseport_add_sock() */ - smp_rmb(); - if (!prog || !skb) goto select_by_hash; =20 @@ -634,13 +632,11 @@ struct sock *reuseport_migrate_sock(struct sock *sk, if (!reuse) goto out; =20 - socks =3D READ_ONCE(reuse->num_socks); + /* paired with smp_store_release() in __reuseport_add_sock() */ + socks =3D smp_load_acquire(&reuse->num_socks); if (unlikely(!socks)) goto failure; =20 - /* paired with smp_wmb() in __reuseport_add_sock() */ - smp_rmb(); - hash =3D migrating_sk->sk_hash; prog =3D rcu_dereference(reuse->prog); if (!prog || prog->expected_attach_type !=3D BPF_SK_REUSEPORT_SELECT_OR_M= IGRATE) { --=20 2.34.1 From nobody Sat Sep 26 13:48:14 2026 Received: from canpmsgout05.his.huawei.com (canpmsgout05.his.huawei.com [113.46.200.220]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 36ECC426EB7; Tue, 1 Sep 2026 02:42:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.220 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788230551; cv=none; b=YcXLtDvX1ngRWhSJXoh3FQrzgWYPjXaK0q8ecZ+pMQvlSvPE+hmyiO1uf0vd0q0/2AM20Wjg0ypBrQBh+d1QkWQkkhMFwKfJed0x8jH+yKnynrVexU6PCE7F9AWGHpeO+kADa52ifFWOVukDGBgDxu8k/+J6RgAAyzJbWlu0i+c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788230551; c=relaxed/simple; bh=Q4IHSqNTta6ZY/efVhCtaRjHjKcMWUomiKRMpYUCKlw=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=JByEnaDUReboLHNdNXca9QxVoIb0ribKpHjZcjtfhE+xQ7Q2YgmkmbyVN9SIBNCHHngkof0gdwbWdGs7nMdWjjtZoc1JpwhqIO/uzy3C8cxOtURvbhavT7jDb1Fi6QHgGAGkKi4kjfxl2K2F7rzpOuDAjGMfB1RfsHhIoaeasgo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=3MN1y82A; arc=none smtp.client-ip=113.46.200.220 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="3MN1y82A" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=HpnC7rLdz/iDoVhcUnqYIGvEK4UiEp8j2qFTrzFFI14=; b=3MN1y82AyUB+uSVGkpsEtn46gwJl3yuhLHq+APy7OksLo3azZvR0HlLyg/DfR5RZ8YBYprGfD IfPDFzpbKdgaKYr4CjKFT7GcHHN6kXtOvwv+26okjTS7wgzucRQEAXul44jF7TxYxkACO6gDi6m 2HM8XEE4+uMal1dtnRg0FhE= Received: from mail.maildlp.com (unknown [172.19.162.223]) by canpmsgout05.his.huawei.com (SkyGuard) with ESMTPS id 4hYqbd3nwvz12LHt; Tue, 1 Sep 2026 10:30:53 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id 8DF7B40561; Tue, 1 Sep 2026 10:42:10 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Tue, 1 Sep 2026 10:42:09 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , Subject: [PATCH v2 10/12] net: sched: act_gact: use acquire/release for tcfg_ptype Date: Tue, 1 Sep 2026 10:42:32 +0800 Message-ID: <20260901024234.135119-11-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260901024234.135119-1-ruanjinjie@huawei.com> References: <20260901024234.135119-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems200001.china.huawei.com (7.221.188.67) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" Replace the smp_wmb()/smp_rmb() barrier pair with smp_store_release()/smp_load_acquire() on gact->tcfg_ptype. tcf_gact_init() publishes tcfg_ptype via release after writing tcfg_pval/tcfg_paction; tcf_gact_act() acquires it before dispatching to gact_net_rand()/gact_determ(), ensuring the probability parameters are visible. No functional change intended. Cc: Jamal Hadi Salim Cc: Jiri Pirko Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Assisted-by: DeepSeek:DeepSeek-V3 Signed-off-by: Jinjie Ruan --- net/sched/act_gact.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c index 565860cccba6..d4f39f98e2cf 100644 --- a/net/sched/act_gact.c +++ b/net/sched/act_gact.c @@ -25,7 +25,6 @@ static struct tc_action_ops act_gact_ops; #ifdef CONFIG_GACT_PROB static int gact_net_rand(struct tcf_gact *gact) { - smp_rmb(); /* coupled with smp_wmb() in tcf_gact_init() */ if (get_random_u32_below(gact->tcfg_pval)) return gact->tcf_action; return gact->tcfg_paction; @@ -35,7 +34,6 @@ static int gact_determ(struct tcf_gact *gact) { u32 pack =3D atomic_inc_return(&gact->packets); =20 - smp_rmb(); /* coupled with smp_wmb() in tcf_gact_init() */ if (pack % gact->tcfg_pval) return gact->tcf_action; return gact->tcfg_paction; @@ -133,11 +131,8 @@ static int tcf_gact_init(struct net *net, struct nlatt= r *nla, if (p_parm) { gact->tcfg_paction =3D p_parm->paction; gact->tcfg_pval =3D max_t(u16, 1, p_parm->pval); - /* Make sure tcfg_pval is written before tcfg_ptype - * coupled with smp_rmb() in gact_net_rand() & gact_determ() - */ - smp_wmb(); - gact->tcfg_ptype =3D p_parm->ptype; + /* Pairs with smp_load_acquire() in tcf_gact_act(). */ + smp_store_release(&gact->tcfg_ptype, p_parm->ptype); } #endif spin_unlock_bh(&gact->tcf_lock); @@ -160,7 +155,8 @@ TC_INDIRECT_SCOPE int tcf_gact_act(struct sk_buff *skb, =20 #ifdef CONFIG_GACT_PROB { - u32 ptype =3D READ_ONCE(gact->tcfg_ptype); + /* Pairs with smp_store_release() in tcf_gact_init() */ + u32 ptype =3D smp_load_acquire(&gact->tcfg_ptype); =20 if (ptype) action =3D gact_rand[ptype](gact); --=20 2.34.1 From nobody Sat Sep 26 13:48:14 2026 Received: from canpmsgout09.his.huawei.com (canpmsgout09.his.huawei.com [113.46.200.224]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E7305436BF4; Tue, 1 Sep 2026 02:42:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.224 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788230575; cv=none; b=nyyKU1Ewd36sgAjbedCHpJRFear0TnBcaKSzCvdJKiCebQNI5jSjOc/nhAl3lFqsxOFUuKaUzmHTVUcn2GGaacTRuvmQYlnr6aO+xY4PElogYpXMGyyZdoysY2AU8bn3+k7T5Lsli/yjob0TMU58wshK5BtGujuAJFzkDLbmoUs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788230575; c=relaxed/simple; bh=qTOa/SXotA6a3UX1CtQJnoWqsy2a0tld+krDqavWCrU=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=QqDpkIknx560xRaYgkXVojLMmHYVUDJGoccBzK1YI9UwQok17ufL1DFOtwiNqRjgkrS6S4ftToIuLMu4qxwOMzUJhxbqcrKSRnqAnV0f6bBRwf6en52E8Mdrqm623Jpjl0Df6WSOCzFzyyo09066yk2dlj21Z1KHcEHo4ZouVrY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=FxCl1y1c; arc=none smtp.client-ip=113.46.200.224 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="FxCl1y1c" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=B4nkOSyrKXpYTqmMmhRGx9fcZpl8Ig3qwoqs/6YnVlI=; b=FxCl1y1c/qQJ+0Tb1ZFYoM/2vqeeozEIe48eoyUhQz2YNxplZ4JVrma92Up0t0/bcJJKqNmXz adFsXQLrfS5iQtE8NTYRkFGNfWj59kSXfwW1xaM5J/2OsbROIRtSYZNtGWCpDn4cUCkRGnNNH/D LQxJ3jNZlXNQHb49u+GbXlU= Received: from mail.maildlp.com (unknown [172.19.163.214]) by canpmsgout09.his.huawei.com (SkyGuard) with ESMTPS id 4hYqcC3frsz1cyVL; Tue, 1 Sep 2026 10:31:23 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id 1011C4057C; Tue, 1 Sep 2026 10:42:12 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Tue, 1 Sep 2026 10:42:10 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , Subject: [PATCH v2 11/12] 8021q: Fix data race when publishing vlan net_device pointers Date: Tue, 1 Sep 2026 10:42:33 +0800 Message-ID: <20260901024234.135119-12-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260901024234.135119-1-ruanjinjie@huawei.com> References: <20260901024234.135119-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems200001.china.huawei.com (7.221.188.67) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" A plain C read and assignment of the net_device pointer in the vlan_devices_arrays leaf entries lack proper atomicity and ordering barriers. A concurrent lockless reader on the packet receive fast-path could observe a torn or partially initialized net_device pointer, leading to a potential out-of-bounds read or kernel panic. The data race occurs between the netlink/ioctl configuration paths (holding the per-netns rtnl_nets_lock or RTNL lock) and the softirq receive fast-path (holding rcu_read_lock()): CPU 0 (Writer, rtnl_nets_lock/RTNL) CPU 1 (Reader, rcu_read_lock()) ----------------------------------- ------------------------------- rtnetlink_rcv_msg() // RTM_NEWLINK handler with RTNL_FLAG_DOIT_PERNET rtnl_newlink() ops->newlink() =3D=3D vlan_newlink() OR vlan_ioctl_handler() [ADD_VLAN_CMD] -> register_vlan_device() register_vlan_dev() vlan_group_set_device() netif_receive_skb_core() vlan_do_receive() vlan_find_dev() __vlan_group_get_device() // Speculative / torn read [Loads bad net_device *] [Plain C store] array[vlan_id] =3D dev; // Dereferences bad point= er // during device status c= heck vlan_dev->flags (PANIC!) Fix this by using rcu_assign_pointer() in vlan_group_set_device() and rcu_dereference_raw() in __vlan_group_get_device() to enforce proper ordering and memory atomicity for the leaf entry traversal. Cc: stable@vger.kernel.org Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Cc: Stanislav Fomichev Cc: Kuniyuki Iwashima Cc: Nicolai Buchwitz Cc: Dan Aloni Cc: Jeff Garzik Fixes: 5c15bdec5c38 ("[VLAN]: Avoid a 4-order allocation.") Link: https://sashiko.dev/#/patchset/20260825095422.3166067-1-ruanjinjie%40= huawei.com Signed-off-by: Jinjie Ruan --- net/8021q/vlan.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h index c41caaf94095..8030d616cb16 100644 --- a/net/8021q/vlan.h +++ b/net/8021q/vlan.h @@ -62,7 +62,7 @@ static inline struct net_device *__vlan_group_get_device(= struct vlan_group *vg, /* paired with smp_wmb() in vlan_group_prealloc_vid() */ smp_rmb(); =20 - return array ? array[vlan_id % VLAN_GROUP_ARRAY_PART_LEN] : NULL; + return array ? rcu_dereference_raw(array[vlan_id % VLAN_GROUP_ARRAY_PART_= LEN]) : NULL; } =20 static inline struct net_device *vlan_group_get_device(struct vlan_group *= vg, @@ -88,7 +88,7 @@ static inline void vlan_group_set_device(struct vlan_grou= p *vg, return; array =3D vg->vlan_devices_arrays[pidx] [vlan_id / VLAN_GROUP_ARRAY_PART_LEN]; - array[vlan_id % VLAN_GROUP_ARRAY_PART_LEN] =3D dev; + rcu_assign_pointer(array[vlan_id % VLAN_GROUP_ARRAY_PART_LEN], dev); } =20 /* Must be invoked with rcu_read_lock or with RTNL. */ --=20 2.34.1 From nobody Sat Sep 26 13:48:14 2026 Received: from canpmsgout10.his.huawei.com (canpmsgout10.his.huawei.com [113.46.200.225]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CC02F3955F9; Tue, 1 Sep 2026 02:42:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.225 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788230551; cv=none; b=Owc0Xegzcod6rRTIrfepPLBEXLAUStrDwM4kt1a7TPOW8gBdVifCgQWp6n7rXqdb/7fsUIHlHGJ2ztsCWNi7LrsVj6ybb6XyA1vvL+SxCbG+IIpMPBkTLKUvKJXIcENiUYPx4gvEd1fW1bB3H8ofeM5MjpgwpSZH/9wOpP4w/Gw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788230551; c=relaxed/simple; bh=psredXZcBYyF6yHuuo0kUdTbAiaE3bXWhgJqN8LR8dc=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=gCkpGMkmTC6Z6V4m6u7cWG6GlIbuE8ltx7+j/PjHsD3wPuL8wscDCQjHcR5rfTUKFpBTAiR2zi+K0dyCykIVEb4XAgYdI9RqM7FmRG8qXlbVAWvBCLYhZUoysQQHh1ONpsx1bccimkH+JSg0W+LU3JOBRAdytzSUeE+bOa0GmoM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=Tm0QWdRu; arc=none smtp.client-ip=113.46.200.225 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="Tm0QWdRu" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=FeUz9/Jb9zKBq4O6jTmfAdLRs6iUhQP0Ga4scxDxqrg=; b=Tm0QWdRumd9vaVubufGNdVaCfqEmd4AXKW9cihyB2xeJLR9Ulp6l09CFiRb1vZTF5i3+QcWxU tombpLLUdc5HpuTbdarLIaK38/vXyRuouGcJ51a7JKCw1xTjl8mOPp6McLFmAjvPXXwWjrJIxA3 mnM0gTlkzt1y5vv56lRb4w0= Received: from mail.maildlp.com (unknown [172.19.163.214]) by canpmsgout10.his.huawei.com (SkyGuard) with ESMTPS id 4hYqcD1DK2z1K9XH; Tue, 1 Sep 2026 10:31:24 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id 84DC24057C; Tue, 1 Sep 2026 10:42:13 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Tue, 1 Sep 2026 10:42:11 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , Subject: [PATCH v2 12/12] 8021q: publish vlan_devices_arrays entries with acquire/release Date: Tue, 1 Sep 2026 10:42:34 +0800 Message-ID: <20260901024234.135119-13-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260901024234.135119-1-ruanjinjie@huawei.com> References: <20260901024234.135119-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems200001.china.huawei.com (7.221.188.67) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" Replace the smp_wmb()/smp_rmb() barrier pair with smp_store_release()/smp_load_acquire() on vg->vlan_devices_arrays[pidx][vidx]. vlan_group_prealloc_vid() publishes the array pointer via release; __vlan_group_get_device() acquires it before accessing the array, ensuring the allocated entries are visible. No functional change intended. Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Cc: Nicolai Buchwitz Cc: Stanislav Fomichev Cc: Hangbin Liu Cc: Kuniyuki Iwashima Assisted-by: DeepSeek:DeepSeek-V3 Signed-off-by: Jinjie Ruan --- net/8021q/vlan.c | 6 ++---- net/8021q/vlan.h | 8 +++----- 2 files changed, 5 insertions(+), 9 deletions(-) diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c index 2d2efb877975..e34ada0cceac 100644 --- a/net/8021q/vlan.c +++ b/net/8021q/vlan.c @@ -70,10 +70,8 @@ static int vlan_group_prealloc_vid(struct vlan_group *vg, if (array =3D=3D NULL) return -ENOBUFS; =20 - /* paired with smp_rmb() in __vlan_group_get_device() */ - smp_wmb(); - - vg->vlan_devices_arrays[pidx][vidx] =3D array; + /* paired with smp_load_acquire() in __vlan_group_get_device() */ + smp_store_release(&vg->vlan_devices_arrays[pidx][vidx], array); return 0; } =20 diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h index 8030d616cb16..ee22637aa7ba 100644 --- a/net/8021q/vlan.h +++ b/net/8021q/vlan.h @@ -56,11 +56,9 @@ static inline struct net_device *__vlan_group_get_device= (struct vlan_group *vg, { struct net_device **array; =20 - array =3D vg->vlan_devices_arrays[pidx] - [vlan_id / VLAN_GROUP_ARRAY_PART_LEN]; - - /* paired with smp_wmb() in vlan_group_prealloc_vid() */ - smp_rmb(); + /* Pairs with smp_store_release() in vlan_group_prealloc_vid() */ + array =3D smp_load_acquire(&vg->vlan_devices_arrays[pidx] + [vlan_id / VLAN_GROUP_ARRAY_PART_LEN]); =20 return array ? rcu_dereference_raw(array[vlan_id % VLAN_GROUP_ARRAY_PART_= LEN]) : NULL; } --=20 2.34.1