From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f202.google.com (mail-pl1-f202.google.com [209.85.214.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BA43D361641 for ; Sun, 31 May 2026 03:07:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.202 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780196837; cv=none; b=ofB+IDqw4jqQFPwYr96FUM/YCo7bQKr9marSsankCbh4uQGi5ihRVnKCoE0F05+TK4CHleUWJsOvOuu08UYu7SCYZyScCvz1TdFpY+oMRT7L9OjQgc8QEBY01lr9hq+Z4XiXJnopluL1ZQ68KtUv+cJYY0GH/urEbBlnbIh5z2c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780196837; c=relaxed/simple; bh=r7jHWy3rqTxJY1sKvw/JEXrPrLy0VTqs8er4fh0Y210=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=GBricMkxnJyo0zDC7MecWEF/tqIMLLtWuBmIEaMceXZgyCu4I7MXl0zXL2F7tJl75aFCav97YSjC5U58Yqm5ud8sVoYgt6d4wzq3PtDZtz3eNXktGsbuy7N4p/GDg4rEk+wQhqKOfW0ZIsSjlnbwtlyA3bV1JEAwrZKNnYTFeog= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--yuyanghuang.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=lFxu6+Wj; arc=none smtp.client-ip=209.85.214.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--yuyanghuang.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="lFxu6+Wj" Received: by mail-pl1-f202.google.com with SMTP id d9443c01a7336-2c0b35fa876so5633005ad.1 for ; Sat, 30 May 2026 20:07:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1780196836; x=1780801636; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=+XGHTHkWccB92iEs3+aiLHcXw/qjbvnaI33XklcMc4g=; b=lFxu6+WjxTmqqQDMDLgtViXgpXCmWHviH/Ol9+WVi6Ai7c4aR+TwOo05WHYb154eSC H9hU4hr2foLa/21ORuM47T54qVu0AiQOmVNgnFyfEck5FJVgOkMWgVq64HqAr2aY8qqH cXd0e+gLFGGUt5oMUsx8aaMglG4y4z8s83UTt2FAqvsqeiG6NUIRwjRimxFHf9Av9R7a WlSOPwgJtdt5XI6e1SB/gnNqoy8J39lAdpk73XFIRlizn2PMQ5iDmnwtfMTrsyCbd0Oh Sgg5QUrlg+x4J0oT3sBBE+Fs1QLA+1awnt7N0S7htf7cp+L27Z5itkfDbnW38zipKtJA H7Wg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780196836; x=1780801636; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=+XGHTHkWccB92iEs3+aiLHcXw/qjbvnaI33XklcMc4g=; b=rbVhUwu9y6F55lmw8Jvcr2vovIPxbLcWtgHphLVGFRK24a4SoMUMnz+p19UhdwICVp noiNTRd85RVa8gvOyFfG2Ova5AwouNzabjch+UxRlTZ8FW/OTJdN5JiSd/8FRG8K1xad f00Sqq4LaKCwLGfCDSxMpDduBO6A8pO+vApd3oviP4d6BGexyNWkAy26jk/zoGzf28jY Bt6GPm9iKZF4l6QZEHEsOSFxxUgdtjTiBuhBG1rVpmfVhqMj4xe05Xko8IYGDnWszpBQ URxt3zlpkhzDc6hRyO/ySPNs6NnUUgkLhsQB/HsNbLN+Oc2QLiJaYiCX5mj2/WE0au6M NbuQ== X-Forwarded-Encrypted: i=1; AFNElJ+Cle0eMct4uT0Ef3FzZcuOgBStSe8n3A/8NH+I7W0AogOYdPhEH3K+yXcBBnLKgKjDssapA/Cxc7yNkvU=@vger.kernel.org X-Gm-Message-State: AOJu0YzwkjhJRw4vX4XlYMzyssqKFSTXJneTXm6Bxr9Ct74aZ1V0qt9i +rnr3X6QOt2SZmfjhuCeJBXmdPVm2h36TQKiXvZNLpz9G0iIr7OSDWB0jPgMg1YcgcpAx/Z8r4T vNBHaOAli0lJMrrIIH9Yi8i0wRA== X-Received: from plnz4.prod.google.com ([2002:a17:902:8344:b0:2bf:1748:aa9b]) (user=yuyanghuang job=prod-delivery.src-stubby-dispatcher) by 2002:a17:903:22c9:b0:2b0:5795:9ead with SMTP id d9443c01a7336-2bf36370f35mr67308815ad.0.1780196835789; Sat, 30 May 2026 20:07:15 -0700 (PDT) Date: Sun, 31 May 2026 11:07:04 +0800 In-Reply-To: <20260531030705.3754389-1-yuyanghuang@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260531030705.3754389-1-yuyanghuang@google.com> X-Mailer: git-send-email 2.54.0.823.g6e5bcc1fc9-goog Message-ID: <20260531030705.3754389-3-yuyanghuang@google.com> Subject: [PATCH 2/2] ipv4: igmp: annotate data-races around timer-related fields From: Yuyang Huang To: Yuyang Huang Cc: "David S. Miller" , David Ahern , Eric Dumazet , Ido Schimmel , Jakub Kicinski , Paolo Abeni , Simon Horman , linux-kernel@vger.kernel.org, netdev@vger.kernel.org Content-Type: text/plain; charset="UTF-8" /proc/net/igmp walks the multicast list locklessly under RCU and reads timer-related fields (im->tm_running, im->reporter, im->timer.expires) to print the timer state of multicast memberships. Concurrently, these fields are modified under im->lock spinlock in timer management paths (igmp_stop_timer(), igmp_start_timer(), and igmp_timer_expire()). Fix this intentional lockless snapshot by annotating the lockless reads with READ_ONCE() and the updates with WRITE_ONCE(). Fixes: 1d7138de878d ("igmp: RCU conversion of in_dev->mc_list") Signed-off-by: Yuyang Huang --- net/ipv4/igmp.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c index fd0faf042fa6..1e958027068b 100644 --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -220,8 +220,8 @@ static void igmp_stop_timer(struct ip_mc_list *im) spin_lock_bh(&im->lock); if (timer_delete(&im->timer)) refcount_dec(&im->refcnt); - im->tm_running = 0; - im->reporter = 0; + WRITE_ONCE(im->tm_running, 0); + WRITE_ONCE(im->reporter, 0); im->unsolicit_count = 0; spin_unlock_bh(&im->lock); } @@ -231,7 +231,7 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay) { int tv = get_random_u32_below(max_delay); - im->tm_running = 1; + WRITE_ONCE(im->tm_running, 1); if (refcount_inc_not_zero(&im->refcnt)) { if (mod_timer(&im->timer, jiffies + tv + 2)) ip_ma_put(im); @@ -267,7 +267,7 @@ static void igmp_mod_timer(struct ip_mc_list *im, int max_delay) if (timer_delete(&im->timer)) { if ((long)(im->timer.expires-jiffies) < max_delay) { add_timer(&im->timer); - im->tm_running = 1; + WRITE_ONCE(im->tm_running, 1); spin_unlock_bh(&im->lock); return; } @@ -857,12 +857,12 @@ static void igmp_timer_expire(struct timer_list *t) struct in_device *in_dev = im->interface; spin_lock(&im->lock); - im->tm_running = 0; + WRITE_ONCE(im->tm_running, 0); if (im->unsolicit_count && --im->unsolicit_count) igmp_start_timer(im, unsolicited_report_interval(in_dev)); - im->reporter = 1; + WRITE_ONCE(im->reporter, 1); spin_unlock(&im->lock); if (IGMP_V1_SEEN(in_dev)) @@ -1325,7 +1325,7 @@ static void __igmp_group_dropped(struct ip_mc_list *im, gfp_t gfp) !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) return; - reporter = im->reporter; + reporter = READ_ONCE(im->reporter); igmp_stop_timer(im); if (!in_dev->dead) { @@ -2964,6 +2964,7 @@ static int igmp_mc_seq_show(struct seq_file *seq, void *v) struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq); char *querier; long delta; + int tm_running; #ifdef CONFIG_IP_MULTICAST querier = IGMP_V1_SEEN(state->in_dev) ? "V1" : @@ -2980,13 +2981,14 @@ static int igmp_mc_seq_show(struct seq_file *seq, void *v) querier); } - delta = im->timer.expires - jiffies; + tm_running = READ_ONCE(im->tm_running); + delta = READ_ONCE(im->timer.expires) - jiffies; seq_printf(seq, "\t\t\t\t%08X %5d %d:%08lX\t\t%d\n", im->multiaddr, READ_ONCE(im->users), - im->tm_running, - im->tm_running ? jiffies_delta_to_clock_t(delta) : 0, - im->reporter); + tm_running, + tm_running ? jiffies_delta_to_clock_t(delta) : 0, + READ_ONCE(im->reporter)); } return 0; } -- 2.54.0.823.g6e5bcc1fc9-goog