From nobody Sat Sep 26 11:01:51 2026 Received: from canpmsgout11.his.huawei.com (canpmsgout11.his.huawei.com [113.46.200.226]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 027C03E3C73; Wed, 2 Sep 2026 07:32:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.226 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788334373; cv=none; b=u0nZHfvwGz/55AErhGZW8xDyaAWWfgi62jmfYSZ0KW4Id11jATePbpoZ1cVw9V/ZxsY0jOG/ty6hiEvSJt/KkEG7jNWc0fXr9JS+l8L9VHKoae48v+PGuR3nCRxvePgXJFqiDIR2vMWaldITBVJWc8Ufj5U/UCCsxLAob1MWgHw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788334373; c=relaxed/simple; bh=FEXr74+mRZDY5P0+8AX8vb2OHgI+CdK3+b71vGoRlz8=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=soeZ27yq1Us1uv6aNAr09NmH4OO7laBs/WoackvXe5I+VfDbFyeiyVZ75nrflW2G93KTgToFwYo1Ns2dz+D2wkX5fc0ngFq09b1YdJmYi2TXOoqoxHmFoduWx0Nq/Dus8RuVnPBpYqJB8mEb8WdcZwhVMxT6oTBp/6yCVuE3j+c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=m6929SfT; arc=none smtp.client-ip=113.46.200.226 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="m6929SfT" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=TqoaAhRMVIzc4ysdOfxdXVObD5EzvCeXtJZE1w2pbag=; b=m6929SfTYgjwMKoPvxZhsQs6ohVfL/lfiH4TcTvOo9BEXsDD9vCPGdxf9c3hCzBJPzxDY20GR fPT6JnNSQqXCGKqhVl7qXYAUiAILvf4RfKh43k8g2UhoOj1y6Y3tx0/UDyU3wBUX8Iyf3m2fiOp a5ntZL+UgHiQWWXZCWum0hM= Received: from mail.maildlp.com (unknown [172.19.163.200]) by canpmsgout11.his.huawei.com (SkyGuard) with ESMTPS id 4hZZ0t4j5VzKm6S; Wed, 2 Sep 2026 15:21:50 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id 49E7F40563; Wed, 2 Sep 2026 15:32:44 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Wed, 2 Sep 2026 15:32:43 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , CC: Subject: [PATCH net-next v3 1/2] 8021q: Fix data race when publishing vlan net_device pointers Date: Wed, 2 Sep 2026 15:33:33 +0800 Message-ID: <20260902073334.397685-2-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260902073334.397685-1-ruanjinjie@huawei.com> References: <20260902073334.397685-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems200001.china.huawei.com (7.221.188.67) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" A plain C read and assignment of the net_device pointer in the vlan_devices_arrays leaf entries lack proper atomicity and ordering barriers. A concurrent lockless reader on the packet receive fast-path could observe a torn or partially initialized net_device pointer, leading to a potential out-of-bounds read or kernel panic. The data race occurs between the netlink/ioctl configuration paths (holding the per-netns rtnl_nets_lock or RTNL lock) and the softirq receive fast-path (holding rcu_read_lock()): CPU 0 (Writer, rtnl_nets_lock/RTNL) CPU 1 (Reader, rcu_read_lock()) ----------------------------------- ------------------------------- rtnetlink_rcv_msg() // RTM_NEWLINK handler with RTNL_FLAG_DOIT_PERNET rtnl_newlink() ops->newlink() =3D=3D vlan_newlink() OR vlan_ioctl_handler() [ADD_VLAN_CMD] -> register_vlan_device() register_vlan_dev() vlan_group_set_device() netif_receive_skb_core() vlan_do_receive() vlan_find_dev() __vlan_group_get_device() // Speculative / torn read [Loads bad net_device *] [Plain C store] array[vlan_id] =3D dev; // Dereferences bad point= er // during device status c= heck vlan_dev->flags (PANIC!) Fix this by using rcu_assign_pointer() in vlan_group_set_device() and rcu_dereference_raw() in __vlan_group_get_device() to enforce proper ordering and memory atomicity for the leaf entry traversal. Cc: stable@vger.kernel.org Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Cc: Stanislav Fomichev Cc: Kuniyuki Iwashima Cc: Nicolai Buchwitz Cc: Dan Aloni Cc: Jeff Garzik Fixes: 5c15bdec5c38 ("[VLAN]: Avoid a 4-order allocation.") Link: https://sashiko.dev/#/patchset/20260825095422.3166067-1-ruanjinjie%40= huawei.com Signed-off-by: Jinjie Ruan Reviewed-by: Kuniyuki Iwashima --- net/8021q/vlan.c | 2 +- net/8021q/vlan.h | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c index 2d2efb877975..6df80cad40a2 100644 --- a/net/8021q/vlan.c +++ b/net/8021q/vlan.c @@ -49,7 +49,7 @@ const char vlan_version[] =3D DRV_VERSION; static int vlan_group_prealloc_vid(struct vlan_group *vg, __be16 vlan_proto, u16 vlan_id) { - struct net_device **array; + struct net_device __rcu **array; unsigned int vidx; unsigned int size; int pidx; diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h index c41caaf94095..3cb4c8294130 100644 --- a/net/8021q/vlan.h +++ b/net/8021q/vlan.h @@ -22,8 +22,8 @@ enum vlan_protos { struct vlan_group { unsigned int nr_vlan_devs; struct hlist_node hlist; /* linked list */ - struct net_device **vlan_devices_arrays[VLAN_PROTO_NUM] - [VLAN_GROUP_ARRAY_SPLIT_PARTS]; + struct net_device __rcu **vlan_devices_arrays[VLAN_PROTO_NUM] + [VLAN_GROUP_ARRAY_SPLIT_PARTS]; }; =20 struct vlan_info { @@ -54,7 +54,7 @@ static inline struct net_device *__vlan_group_get_device(= struct vlan_group *vg, unsigned int pidx, u16 vlan_id) { - struct net_device **array; + struct net_device __rcu **array; =20 array =3D vg->vlan_devices_arrays[pidx] [vlan_id / VLAN_GROUP_ARRAY_PART_LEN]; @@ -62,7 +62,7 @@ static inline struct net_device *__vlan_group_get_device(= struct vlan_group *vg, /* paired with smp_wmb() in vlan_group_prealloc_vid() */ smp_rmb(); =20 - return array ? array[vlan_id % VLAN_GROUP_ARRAY_PART_LEN] : NULL; + return array ? rcu_dereference_raw(array[vlan_id % VLAN_GROUP_ARRAY_PART_= LEN]) : NULL; } =20 static inline struct net_device *vlan_group_get_device(struct vlan_group *= vg, @@ -82,13 +82,13 @@ static inline void vlan_group_set_device(struct vlan_gr= oup *vg, struct net_device *dev) { int pidx =3D vlan_proto_idx(vlan_proto); - struct net_device **array; + struct net_device __rcu **array; =20 if (!vg || pidx < 0) return; array =3D vg->vlan_devices_arrays[pidx] [vlan_id / VLAN_GROUP_ARRAY_PART_LEN]; - array[vlan_id % VLAN_GROUP_ARRAY_PART_LEN] =3D dev; + rcu_assign_pointer(array[vlan_id % VLAN_GROUP_ARRAY_PART_LEN], dev); } =20 /* Must be invoked with rcu_read_lock or with RTNL. */ --=20 2.34.1 From nobody Sat Sep 26 11:01:51 2026 Received: from canpmsgout12.his.huawei.com (canpmsgout12.his.huawei.com [113.46.200.227]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D88BE3E3C5F; Wed, 2 Sep 2026 07:32:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.227 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788334371; cv=none; b=kcTcJm3hQZw8TJc++oq0eARY7dMq9cjL2uG1G051hfQMTff7hekVDa0ERuqPDqreVFvC9mr77ZaeNL9LJRNHqgrb5kUrNa/qeR4jdC8oQTm/VsoCaoV+h1uxEmh49k1LrVFMlYJxJ2a/ropfNCSOOCs76/FVadg7iEAz5cz9myM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788334371; c=relaxed/simple; bh=lme/k/mvGWorJ17rEXy+N3WEx8UnBVqykX+blYDUzJc=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=k8YDCJisjiR+QtnBXedrhJYeLbWJ+XAP0O8YZGGqxTYOJ/hzjL/FpZg+w23LBTHOp+ULEXKyhjx4UGUxb/Ne6Ycg5FWom5LFrEE7xdNqT0mA3UTwZENj1lGt+ZxeK3niDvVUY1lOF1Jjo4Y43MUTUn9W5ZnD5kIec15WBPcizF0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=fN3lVLCo; arc=none smtp.client-ip=113.46.200.227 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="fN3lVLCo" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=atKlvKjiBr25ZmGwIkFEd53L8yH86qCl0s2fZCUjdM8=; b=fN3lVLCoJLGmnk6kc3FoBDusLqhOYmsTP4K7tpr9s1xID73mlueIasn7P/RQzdDtHXI2Cpgql qVaqPahA0eR9cOtVU8tB7/gIsfpL01c9ZEtWzO4gWgJkeOgyQHRgotibNmYkWRt9BPv6szdPRQW w8wqc5ewajiM/rAHubX0d6E= Received: from mail.maildlp.com (unknown [172.19.163.163]) by canpmsgout12.his.huawei.com (SkyGuard) with ESMTPS id 4hZZ0W6kS5znV05; Wed, 2 Sep 2026 15:21:31 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id 3334D4057A; Wed, 2 Sep 2026 15:32:45 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Wed, 2 Sep 2026 15:32:44 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , CC: Subject: [PATCH net-next v3 2/2] 8021q: publish vlan_devices_arrays entries with acquire/release Date: Wed, 2 Sep 2026 15:33:34 +0800 Message-ID: <20260902073334.397685-3-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260902073334.397685-1-ruanjinjie@huawei.com> References: <20260902073334.397685-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems200001.china.huawei.com (7.221.188.67) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" Replace the smp_wmb()/smp_rmb() barrier pair with smp_store_release()/smp_load_acquire() on vg->vlan_devices_arrays[pidx][vidx]. vlan_group_prealloc_vid() publishes the array pointer via release; __vlan_group_get_device() acquires it before accessing the array, ensuring the allocated entries are visible. No functional change intended. Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Cc: Nicolai Buchwitz Cc: Stanislav Fomichev Cc: Hangbin Liu Cc: Kuniyuki Iwashima Assisted-by: DeepSeek:DeepSeek-V3 Signed-off-by: Jinjie Ruan Reviewed-by: Kuniyuki Iwashima --- net/8021q/vlan.c | 6 ++---- net/8021q/vlan.h | 8 +++----- 2 files changed, 5 insertions(+), 9 deletions(-) diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c index 6df80cad40a2..ec9a7cc8afc7 100644 --- a/net/8021q/vlan.c +++ b/net/8021q/vlan.c @@ -70,10 +70,8 @@ static int vlan_group_prealloc_vid(struct vlan_group *vg, if (array =3D=3D NULL) return -ENOBUFS; =20 - /* paired with smp_rmb() in __vlan_group_get_device() */ - smp_wmb(); - - vg->vlan_devices_arrays[pidx][vidx] =3D array; + /* paired with smp_load_acquire() in __vlan_group_get_device() */ + smp_store_release(&vg->vlan_devices_arrays[pidx][vidx], array); return 0; } =20 diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h index 3cb4c8294130..d874ab323d32 100644 --- a/net/8021q/vlan.h +++ b/net/8021q/vlan.h @@ -56,11 +56,9 @@ static inline struct net_device *__vlan_group_get_device= (struct vlan_group *vg, { struct net_device __rcu **array; =20 - array =3D vg->vlan_devices_arrays[pidx] - [vlan_id / VLAN_GROUP_ARRAY_PART_LEN]; - - /* paired with smp_wmb() in vlan_group_prealloc_vid() */ - smp_rmb(); + /* Pairs with smp_store_release() in vlan_group_prealloc_vid() */ + array =3D smp_load_acquire(&vg->vlan_devices_arrays[pidx] + [vlan_id / VLAN_GROUP_ARRAY_PART_LEN]); =20 return array ? rcu_dereference_raw(array[vlan_id % VLAN_GROUP_ARRAY_PART_= LEN]) : NULL; } --=20 2.34.1