[PATCH net v2] pppoe: wait for RCU readers before reusing a socket

[PATCH net v2] pppoe: wait for RCU readers before reusing a socket

[Qingfang Deng]

When pppoe_connect() disconnects or reuses a socket, it removes the old
session from the hash table and resets the socket's fields. An RCU
reader that reached the entry before it was unlinked can still be using
its address, ifindex or next pointer.

If sockets A and B share a hash bucket with A preceding B, a concurrent
__get_item() looking for B can be traversing A when it is removed.
Clearing A->next then makes the lookup miss B and drop the packet.
Reinserting A can similarly redirect the reader into another hash chain.

Call synchronize_net() after unlinking the old session and before
clearing its fields. This allows existing receive-path and
/proc/net/pppoe readers to finish before the socket is cleared or reused.

This was found by Sashiko's static analysis, and reproduced on a VM
stress test with KCSAN.

 BUG: KCSAN: data-race in hash_item+0x1c/0x60

 race at unknown origin, with read to 0xffff888000a1c566 of 2 bytes by task 147 on cpu 2:
  hash_item+0x1c/0x60
  pppoe_seq_next+0x112/0x1b0
  seq_read_iter+0x595/0x700
  seq_read+0xb0/0xe0
  proc_reg_read+0xd0/0xf0
  vfs_read+0xbd/0x220
  ksys_read+0xa9/0x100
  __x64_sys_read+0x47/0x60
  x64_sys_call+0x98/0x1fd0
  do_syscall_64+0x5b/0x260
  entry_SYSCALL_64_after_hwframe+0x4b/0x53

 value changed: 0x0002 -> 0x0000

Fixes: 72cdc67e7fa7 ("pppoe: remove rwlock usage")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261020092118.47416-1-qingfang.deng@linux.dev
Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev>
---
v2: call synchronize_net right after delete_item

v1: https://lore.kernel.org/netdev/20261023043729.219660-1-qingfang.deng@linux.dev/
---
 drivers/net/ppp/pppoe.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index ee0e318d6a2a..021b6c767294 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -618,6 +618,10 @@ static int pppoe_connect(struct socket *sock, struct sockaddr_unsized *uservaddr
 		pppox_unbind_sock(sk);
 		pn = pppoe_pernet(sock_net(sk));
 		delete_item(pn, po);
+
+		/* wait for concurrent readers before clearing the fields */
+		synchronize_net();
+
 		if (po->pppoe_dev) {
 			dev_put(po->pppoe_dev);
 			po->pppoe_dev = NULL;
-- 
2.43.0

Re: [PATCH net v2] pppoe: wait for RCU readers before reusing a socket

[Eric Dumazet]

Le lun. 26 oct. 2026 à 07:13, Qingfang Deng <qingfang.deng@linux.dev> a écrit :
>
> When pppoe_connect() disconnects or reuses a socket, it removes the old
> session from the hash table and resets the socket's fields. An RCU
> reader that reached the entry before it was unlinked can still be using
> its address, ifindex or next pointer.
>
> If sockets A and B share a hash bucket with A preceding B, a concurrent
> __get_item() looking for B can be traversing A when it is removed.
> Clearing A->next then makes the lookup miss B and drop the packet.
> Reinserting A can similarly redirect the reader into another hash chain.
>
> Call synchronize_net() after unlinking the old session and before
> clearing its fields. This allows existing receive-path and
> /proc/net/pppoe readers to finish before the socket is cleared or reused.
>
> This was found by Sashiko's static analysis, and reproduced on a VM
> stress test with KCSAN.
>
>  BUG: KCSAN: data-race in hash_item+0x1c/0x60
>
>  race at unknown origin, with read to 0xffff888000a1c566 of 2 bytes by task 147 on cpu 2:
>   hash_item+0x1c/0x60
>   pppoe_seq_next+0x112/0x1b0
>   seq_read_iter+0x595/0x700
>   seq_read+0xb0/0xe0
>   proc_reg_read+0xd0/0xf0
>   vfs_read+0xbd/0x220
>   ksys_read+0xa9/0x100
>   __x64_sys_read+0x47/0x60
>   x64_sys_call+0x98/0x1fd0
>   do_syscall_64+0x5b/0x260
>   entry_SYSCALL_64_after_hwframe+0x4b/0x53

Please next time include symbols. (scripts/decode_stacktrace.sh)

>
>  value changed: 0x0002 -> 0x0000
>
> Fixes: 72cdc67e7fa7 ("pppoe: remove rwlock usage")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261020092118.47416-1-qingfang.deng@linux.dev
> Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev>
> ---

Reviewed-by: Eric Dumazet <edumazet@kernel.org>

Re: [PATCH net v2] pppoe: wait for RCU readers before reusing a socket

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Mon, 26 Oct 2026 14:12:58 +0800 you wrote:
> When pppoe_connect() disconnects or reuses a socket, it removes the old
> session from the hash table and resets the socket's fields. An RCU
> reader that reached the entry before it was unlinked can still be using
> its address, ifindex or next pointer.
> 
> If sockets A and B share a hash bucket with A preceding B, a concurrent
> __get_item() looking for B can be traversing A when it is removed.
> Clearing A->next then makes the lookup miss B and drop the packet.
> Reinserting A can similarly redirect the reader into another hash chain.
> 
> [...]

Here is the summary with links:
  - [net,v2] pppoe: wait for RCU readers before reusing a socket
    https://git.kernel.org/netdev/net/c/e7b01bc0202a

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html