est_timer updates the estimator seqcount with preemption disabled, which
does not exclude hardirq readers on non-PREEMPT_RT kernels.  A reader can
observe an odd sequence and spin while the timer is interrupted.

Disable interrupts around the seqcount write section.

The failure mode was reproduced with an x86_64 kernel under QEMU. A
test-only hardirq injection invokes gen_estimator_read() on the same CPU
while est_timer() is updating the sequence counter.

On the unfixed kernel, the hardirq reader reports the seqcount lockdep
warning and spins until QEMU times out. With this change, the reader is
deferred until the writer restores local IRQs, then returns and the guest
shuts down normally. The hardirq context is deliberately injected to
exercise this interleaving; ordinary userspace traffic does not guarantee
it.

Fixes: 1c0d32fde5bd ("net_sched: gen_estimator: complete rewrite of rate estimators")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
 net/core/gen_estimator.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index c34e58c6c..6aba5916d 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -79,6 +79,7 @@ static void est_timer(struct timer_list *t)
 	struct gnet_stats_basic_sync b;
 	u64 b_bytes, b_packets;
 	u64 rate, brate;
+	unsigned long flags;
 
 	est_fetch_counters(est, &b);
 	b_bytes = u64_stats_read(&b.bytes);
@@ -90,12 +91,12 @@ static void est_timer(struct timer_list *t)
 	rate = (b_packets - est->last_packets) << (10 - est->intvl_log);
 	rate = (rate >> est->ewma_log) - (est->avpps >> est->ewma_log);
 
-	preempt_disable_nested();
+	local_irq_save(flags);
 	write_seqcount_begin(&est->seq);
 	est->avbps += brate;
 	est->avpps += rate;
 	write_seqcount_end(&est->seq);
-	preempt_enable_nested();
+	local_irq_restore(flags);
 
 	est->last_bytes = b_bytes;
 	est->last_packets = b_packets;
-- 
2.34.1

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] net: gen_estimator: unnecessary irq disable for non-existent hardirq reader
--

commit 9722f5db0aef7c6cb33fd991daa5c91e6188c2bb
Author: Runyu Xiao <runyu.xiao@seu.edu.cn>

net: gen_estimator: protect seqcount updates from hardirq readers

This commit modifies est_timer() to disable local interrupts instead of
just disabling preemption when updating the estimator sequence counter.
The commit message notes this is to prevent a spinning hardirq reader,
reproducing a lockdep warning via a test-only hardirq injection.

> diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
> index c34e58c6c3e66..6aba5916d7959 100644
> --- a/net/core/gen_estimator.c
> +++ b/net/core/gen_estimator.c

[ ... ]

> @@ -90,12 +91,12 @@ static void est_timer(struct timer_list *t)
>  	rate = (b_packets - est->last_packets) << (10 - est->intvl_log);
>  	rate = (rate >> est->ewma_log) - (est->avpps >> est->ewma_log);
>  
> -	preempt_disable_nested();
> +	local_irq_save(flags);

[Severity: Medium]
Does this unnecessarily increase hardirq latency and CPU overhead by replacing
a zero-overhead preemption disable (on non-RT) with an expensive hardware
interrupt disable?

The commit message explicitly states this was triggered by a test-only hardirq
injection. In a production environment, gen_estimator_read() is only called
from softirq or process contexts (such as netfilter hooks, TC actions, or
stats dumping), and never from hardirq context.

Since est_timer() executes unconditionally, this change appears to add
overhead to the fast path to protect against a state that is structurally
impossible in actual usage.

>  	write_seqcount_begin(&est->seq);
>  	est->avbps += brate;
>  	est->avpps += rate;
>  	write_seqcount_end(&est->seq);
> -	preempt_enable_nested();
> +	local_irq_restore(flags);
>  
>  	est->last_bytes = b_bytes;
>  	est->last_packets = b_packets;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260923032936.2020902-1-runyu.xiao@seu.edu.cn?part=1

On Wed, Sep 23, 2026 at 5:29 AM Runyu Xiao <runyu.xiao@seu.edu.cn> wrote:
>
> est_timer updates the estimator seqcount with preemption disabled, which
> does not exclude hardirq readers on non-PREEMPT_RT kernels.  A reader can
> observe an odd sequence and spin while the timer is interrupted.
>

There is no hardirq reader of gen_estimator_read() in the tree.

The only callers are:
 - gnet_stats_copy_rate_est() from tc dump paths (process context)
 - tcf_police_act() (BH)
 - xt_rateest_mt() (process or BH)

est_timer() itself runs from TIMER_SOFTIRQ (or ktimers/N on RT), and
softirqs do not nest on a CPU, so no reader can interrupt the writer.

> Disable interrupts around the seqcount write section.
>
> The failure mode was reproduced with an x86_64 kernel under QEMU. A
> test-only hardirq injection invokes gen_estimator_read() on the same CPU
> while est_timer() is updating the sequence counter.

Injecting a call that does not exist is not a reproducer; with that
methodology essentially every seqcount_t writer in the kernel would need
local_irq_save(). Note that such a hardirq caller would already deadlock
on e->stats_lock in est_fetch_counters() anyway.

Also, the preempt_disable_nested() here is deliberate (9f74c0ea9b26
"net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y").
local_irq_save() is not remapped on PREEMPT_RT, so this patch would add
a real IRQ-off section in a context RT intentionally keeps preemptible,
and would lose the lockdep assertion on !RT.

Finally, the Fixes: tag and Cc: stable are not warranted: nothing
regressed in 1c0d32fde5bd, and there is no user-visible bug.

pw-bot: rejected

On 2026-09-23 11:29:36 [+0800], Runyu Xiao wrote:
> est_timer updates the estimator seqcount with preemption disabled, which
> does not exclude hardirq readers on non-PREEMPT_RT kernels.  A reader can
> observe an odd sequence and spin while the timer is interrupted.

How do you inject a reader from hardirq? Isn't this meant for softirq
context only?

> Disable interrupts around the seqcount write section.
> 
> The failure mode was reproduced with an x86_64 kernel under QEMU. A
> test-only hardirq injection invokes gen_estimator_read() on the same CPU
> while est_timer() is updating the sequence counter.
> 
> On the unfixed kernel, the hardirq reader reports the seqcount lockdep
> warning and spins until QEMU times out. With this change, the reader is
> deferred until the writer restores local IRQs, then returns and the guest
> shuts down normally. The hardirq context is deliberately injected to
> exercise this interleaving; ordinary userspace traffic does not guarantee
> it.
> 
> Fixes: 1c0d32fde5bd ("net_sched: gen_estimator: complete rewrite of rate estimators")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>

Sebastian

Hi Sebastian,

Thanks for the detailed review.

You are right. I rechecked the in-tree callers and confirmed that
gen_estimator_read() has no hardirq caller. The hardirq call in my test
harness was an artificial caller that is not part of a reachable mainline
execution path, so it does not demonstrate a real bug.

The injected reader also overlooked that a hypothetical caller would first
hit est_fetch_counters() and stats_lock. In addition, replacing
preempt_disable_nested() with local_irq_save() would conflict with the
PREEMPT_RT rationale from 9f74c0ea9b26.

I will withdraw this patch and will not send a v2.

Regards,
Runyu