From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f202.google.com (mail-pf1-f202.google.com [209.85.210.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9701837C908 for ; Fri, 5 Jun 2026 01:43:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.202 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780623824; cv=none; b=cRoAgMsYFsR5B0ZQwHMUxC1jhwpdbI+AiCxhRAbxLXjwcoHYMbRW0yhgbaIU5QI+o/A4Npqw8m/H+Iqfv28/fSUCnJLkvY6kQ6NCQfkOT4c5ymaxDEBosZ9G9j7BLTzEEANv55ufkQvc8tu+OqkPmfzOJhJe6STDpKsBvNumtwA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780623824; c=relaxed/simple; bh=POCX/luQ74bLFaAzEt7GsC53FXksW1Gp1JHWey+4Dnw=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=UbvTvgZ2rLo52wAAs7oxhe5s50V+6HhOkEOxZMwj7+1IC7dN2eV+v4nGyS/x5iim9IO6WpQfpJac1Kpj6swtI1cncrhXmS3H6IWzW9zvvapCyKUI9v4Lxn7v54xV/pPtOljMlb0+ki02V1uG2orT8GB/j9PbqfbjB0Ac0YbxEK4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--yuyanghuang.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=JmWnJ3wT; arc=none smtp.client-ip=209.85.210.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--yuyanghuang.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="JmWnJ3wT" Received: by mail-pf1-f202.google.com with SMTP id d2e1a72fcca58-8423770d72dso1753773b3a.3 for ; Thu, 04 Jun 2026 18:43:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1780623813; x=1781228613; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=e/x5HRip2Kp59j/zU6/XZTTx4Pvu5aw0vss9ccMmg6o=; b=JmWnJ3wTptHmb1wGS4YYFpbfMndqQTfLrchC2paMsTbn9MAyzFmX+E6NqjT2TY3iQy u6Tk1k4TFQS2WxOdux7JlESkOqymrVqI0j1TfVmtZUoi3AhVMHoaEAbhmCIGfHPBz/Cf TMBYqUdwRQ4TG3keHsyocDZVHuu8zzkcSZYgF0U591dDTllq+dzhf1cJ5AGbrUcAFR5B 5VbVwnj03o9Oty1KKkKXTis3jXbH8LYSF44YesDMxvMm3zCxEGL2JSOIyVHuxz22zX9d cZflwNfoRq3lNCug5RF/ALw1f+ZREmrav93/qoXad8qgNd76Bdl9m9PZwJHsBBAXBvWl FaPA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780623813; x=1781228613; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=e/x5HRip2Kp59j/zU6/XZTTx4Pvu5aw0vss9ccMmg6o=; b=Vst02zSSm4uQqbW1XhCDHwYofbsLRcbACUTC52k3KvBrFaRMHcEg8+EzT6CM8T1b4F R66ecRwj40c/qsJsddwlcVFb/MsEatY7UrvmUfsEGP9WADEx/II2VHAJ2CIvBmBswSfm bD8UFdBir4ReZ1o+3ommLmqVM3VxWsDLIAQQaK8BHBquSa3ebyv6z8YsFGHQYqXyHDXj OQc5ALFiciwDA/Sg2ZsO3rtLN/t20yaiEYDKWGZKuLBnKprgvzwk6b4i0Y0mFplwuTqg KIGNtagY8rMyIa0RjNM97kYWxZtfAzkejOAy7xyXNuKzp2lnzHRwtXGNKTjUWpkS1kTA t8IQ== X-Forwarded-Encrypted: i=1; AFNElJ+9WRwRM6GLAZjqvbyYSJ3hihXOuWNi51S6Qi0yR1DZF88cR7HLwLR7dZTHGa4JlXpEgAQr/kA7Mar7sd4=@vger.kernel.org X-Gm-Message-State: AOJu0Yx4udDLD7PDk8hDrCp+QiMxtm+aeHd+h6c02wYyqzkRGpoYUY1j XCfu0RTIh0CLyLExU2qOej5ZCNVwjaAawKWqb4b2Df483ijOIWu4wwwugDsGTivL7BHDSllL5an eAt9brTV5xFatRFWgbvwyQ/ZGZA== X-Received: from pfva8.prod.google.com ([2002:a05:6a00:c88:b0:842:5989:fb63]) (user=yuyanghuang job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a00:8d0:b0:842:77ab:35df with SMTP id d2e1a72fcca58-842b0e4c733mr1128059b3a.11.1780623812365; Thu, 04 Jun 2026 18:43:32 -0700 (PDT) Date: Fri, 5 Jun 2026 10:43:18 +0900 In-Reply-To: <20260605014318.3890804-1-yuyanghuang@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260605014318.3890804-1-yuyanghuang@google.com> X-Mailer: git-send-email 2.54.0.1032.g2f8565e1d1-goog Message-ID: <20260605014318.3890804-3-yuyanghuang@google.com> Subject: [PATCH net-next v2 2/2] ipv4: igmp: annotate data-races around timer-related fields From: Yuyang Huang To: Yuyang Huang Cc: "David S. Miller" , David Ahern , Eric Dumazet , Ido Schimmel , Jakub Kicinski , Paolo Abeni , Simon Horman , linux-kernel@vger.kernel.org, netdev@vger.kernel.org Content-Type: text/plain; charset="UTF-8" /proc/net/igmp walks the multicast list locklessly under RCU and reads timer-related fields (im->tm_running, im->reporter, im->timer.expires) to print the timer state of multicast memberships. Concurrently, these fields are modified under im->lock spinlock in timer management paths (igmp_stop_timer(), igmp_start_timer(), and igmp_timer_expire()). Fix this intentional lockless snapshot by annotating the lockless reads with READ_ONCE() and the updates with WRITE_ONCE(). Signed-off-by: Yuyang Huang Reviewed-by: Ido Schimmel --- net/ipv4/igmp.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c index fd0faf042fa6..b6337a47c141 100644 --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -220,8 +220,8 @@ static void igmp_stop_timer(struct ip_mc_list *im) spin_lock_bh(&im->lock); if (timer_delete(&im->timer)) refcount_dec(&im->refcnt); - im->tm_running = 0; - im->reporter = 0; + WRITE_ONCE(im->tm_running, 0); + WRITE_ONCE(im->reporter, 0); im->unsolicit_count = 0; spin_unlock_bh(&im->lock); } @@ -231,7 +231,7 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay) { int tv = get_random_u32_below(max_delay); - im->tm_running = 1; + WRITE_ONCE(im->tm_running, 1); if (refcount_inc_not_zero(&im->refcnt)) { if (mod_timer(&im->timer, jiffies + tv + 2)) ip_ma_put(im); @@ -267,7 +267,7 @@ static void igmp_mod_timer(struct ip_mc_list *im, int max_delay) if (timer_delete(&im->timer)) { if ((long)(im->timer.expires-jiffies) < max_delay) { add_timer(&im->timer); - im->tm_running = 1; + WRITE_ONCE(im->tm_running, 1); spin_unlock_bh(&im->lock); return; } @@ -857,12 +857,12 @@ static void igmp_timer_expire(struct timer_list *t) struct in_device *in_dev = im->interface; spin_lock(&im->lock); - im->tm_running = 0; + WRITE_ONCE(im->tm_running, 0); if (im->unsolicit_count && --im->unsolicit_count) igmp_start_timer(im, unsolicited_report_interval(in_dev)); - im->reporter = 1; + WRITE_ONCE(im->reporter, 1); spin_unlock(&im->lock); if (IGMP_V1_SEEN(in_dev)) @@ -1325,7 +1325,7 @@ static void __igmp_group_dropped(struct ip_mc_list *im, gfp_t gfp) !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) return; - reporter = im->reporter; + reporter = READ_ONCE(im->reporter); igmp_stop_timer(im); if (!in_dev->dead) { @@ -2963,6 +2963,7 @@ static int igmp_mc_seq_show(struct seq_file *seq, void *v) struct ip_mc_list *im = v; struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq); char *querier; + int tm_running; long delta; #ifdef CONFIG_IP_MULTICAST @@ -2980,13 +2981,14 @@ static int igmp_mc_seq_show(struct seq_file *seq, void *v) querier); } - delta = im->timer.expires - jiffies; + tm_running = READ_ONCE(im->tm_running); + delta = READ_ONCE(im->timer.expires) - jiffies; seq_printf(seq, "\t\t\t\t%08X %5d %d:%08lX\t\t%d\n", im->multiaddr, READ_ONCE(im->users), - im->tm_running, - im->tm_running ? jiffies_delta_to_clock_t(delta) : 0, - im->reporter); + tm_running, + tm_running ? jiffies_delta_to_clock_t(delta) : 0, + READ_ONCE(im->reporter)); } return 0; } -- 2.54.0.1032.g2f8565e1d1-goog