[PATCH net-next v3 0/2] 8021q: publish vlan_devices_arrays entries with acquire/release

[PATCH net-next v3 0/2] 8021q: publish vlan_devices_arrays entries with acquire/release

[Jinjie Ruan]

Hi all,

This series fixes a speculative lockless data race in the 8021q
VLAN receive fast-path, and publish vlan_devices_arrays entries
with acquire/release for better performance.

Changes in v3:
- Fix C=1 sparse warning as Jakub pointed out.
- Split out from following patch set as Kuniyuki suggested.

Link: https://lore.kernel.org/all/20260901024234.135119-1-ruanjinjie@huawei.com/

Jinjie Ruan (2):
  8021q: Fix data race when publishing vlan net_device pointers
  8021q: publish vlan_devices_arrays entries with acquire/release

 net/8021q/vlan.c |  8 +++-----
 net/8021q/vlan.h | 20 +++++++++-----------
 2 files changed, 12 insertions(+), 16 deletions(-)

-- 
2.34.1

[PATCH net-next v3 1/2] 8021q: Fix data race when publishing vlan net_device pointers

[Jinjie Ruan]

A plain C read and assignment of the net_device pointer
in the vlan_devices_arrays leaf entries lack proper atomicity
and ordering barriers. A concurrent lockless reader on the packet
receive fast-path could observe a torn or partially initialized
net_device pointer, leading to a potential out-of-bounds read or kernel
panic.

The data race occurs between the netlink/ioctl configuration paths
(holding the per-netns rtnl_nets_lock or RTNL lock) and the softirq
receive fast-path (holding rcu_read_lock()):

  CPU 0 (Writer, rtnl_nets_lock/RTNL)      CPU 1 (Reader, rcu_read_lock())
  -----------------------------------      -------------------------------
   rtnetlink_rcv_msg()
     // RTM_NEWLINK handler with RTNL_FLAG_DOIT_PERNET
     rtnl_newlink()
       ops->newlink() == vlan_newlink()
   OR
   vlan_ioctl_handler()
     [ADD_VLAN_CMD] -> register_vlan_device()

     register_vlan_dev()
       vlan_group_set_device()
                                      netif_receive_skb_core()
                                          vlan_do_receive()
                                              vlan_find_dev()
                                                 __vlan_group_get_device()
                                                  // Speculative / torn read
                                                  [Loads bad net_device *]
           [Plain C store]
           array[vlan_id] = dev;
                                                  // Dereferences bad pointer
                                                  // during device status check
                                                  vlan_dev->flags (PANIC!)

Fix this by using rcu_assign_pointer() in vlan_group_set_device()
and rcu_dereference_raw() in __vlan_group_get_device() to enforce
proper ordering and memory atomicity for the leaf entry traversal.

Cc: stable@vger.kernel.org
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Simon Horman <horms@kernel.org>
Cc: Stanislav Fomichev <sdf@fomichev.me>
Cc: Kuniyuki Iwashima <kuniyu@google.com>
Cc: Nicolai Buchwitz <nb@tipi-net.de>
Cc: Dan Aloni <da-x@monatomic.org>
Cc: Jeff Garzik <jeff@garzik.org>
Fixes: 5c15bdec5c38 ("[VLAN]: Avoid a 4-order allocation.")
Link: https://sashiko.dev/#/patchset/20260825095422.3166067-1-ruanjinjie%40huawei.com
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
---
 net/8021q/vlan.c |  2 +-
 net/8021q/vlan.h | 12 ++++++------
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 2d2efb877975..6df80cad40a2 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -49,7 +49,7 @@ const char vlan_version[] = DRV_VERSION;
 static int vlan_group_prealloc_vid(struct vlan_group *vg,
 				   __be16 vlan_proto, u16 vlan_id)
 {
-	struct net_device **array;
+	struct net_device __rcu **array;
 	unsigned int vidx;
 	unsigned int size;
 	int pidx;
diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h
index c41caaf94095..3cb4c8294130 100644
--- a/net/8021q/vlan.h
+++ b/net/8021q/vlan.h
@@ -22,8 +22,8 @@ enum vlan_protos {
 struct vlan_group {
 	unsigned int		nr_vlan_devs;
 	struct hlist_node	hlist;	/* linked list */
-	struct net_device **vlan_devices_arrays[VLAN_PROTO_NUM]
-					       [VLAN_GROUP_ARRAY_SPLIT_PARTS];
+	struct net_device __rcu **vlan_devices_arrays[VLAN_PROTO_NUM]
+						     [VLAN_GROUP_ARRAY_SPLIT_PARTS];
 };
 
 struct vlan_info {
@@ -54,7 +54,7 @@ static inline struct net_device *__vlan_group_get_device(struct vlan_group *vg,
 							 unsigned int pidx,
 							 u16 vlan_id)
 {
-	struct net_device **array;
+	struct net_device __rcu **array;
 
 	array = vg->vlan_devices_arrays[pidx]
 				       [vlan_id / VLAN_GROUP_ARRAY_PART_LEN];
@@ -62,7 +62,7 @@ static inline struct net_device *__vlan_group_get_device(struct vlan_group *vg,
 	/* paired with smp_wmb() in vlan_group_prealloc_vid() */
 	smp_rmb();
 
-	return array ? array[vlan_id % VLAN_GROUP_ARRAY_PART_LEN] : NULL;
+	return array ? rcu_dereference_raw(array[vlan_id % VLAN_GROUP_ARRAY_PART_LEN]) : NULL;
 }
 
 static inline struct net_device *vlan_group_get_device(struct vlan_group *vg,
@@ -82,13 +82,13 @@ static inline void vlan_group_set_device(struct vlan_group *vg,
 					 struct net_device *dev)
 {
 	int pidx = vlan_proto_idx(vlan_proto);
-	struct net_device **array;
+	struct net_device __rcu **array;
 
 	if (!vg || pidx < 0)
 		return;
 	array = vg->vlan_devices_arrays[pidx]
 				       [vlan_id / VLAN_GROUP_ARRAY_PART_LEN];
-	array[vlan_id % VLAN_GROUP_ARRAY_PART_LEN] = dev;
+	rcu_assign_pointer(array[vlan_id % VLAN_GROUP_ARRAY_PART_LEN], dev);
 }
 
 /* Must be invoked with rcu_read_lock or with RTNL. */
-- 
2.34.1

Re: [PATCH net-next v3 1/2] 8021q: Fix data race when publishing vlan net_device pointers

[Kuniyuki Iwashima]

On Wed, Sep 2, 2026 at 12:32 AM Jinjie Ruan <ruanjinjie@huawei.com> wrote:
>
> A plain C read and assignment of the net_device pointer
> in the vlan_devices_arrays leaf entries lack proper atomicity
> and ordering barriers. A concurrent lockless reader on the packet
> receive fast-path could observe a torn or partially initialized
> net_device pointer, leading to a potential out-of-bounds read or kernel
> panic.
>
> The data race occurs between the netlink/ioctl configuration paths
> (holding the per-netns rtnl_nets_lock or RTNL lock) and the softirq
> receive fast-path (holding rcu_read_lock()):
>
>   CPU 0 (Writer, rtnl_nets_lock/RTNL)      CPU 1 (Reader, rcu_read_lock())
>   -----------------------------------      -------------------------------
>    rtnetlink_rcv_msg()
>      // RTM_NEWLINK handler with RTNL_FLAG_DOIT_PERNET
>      rtnl_newlink()
>        ops->newlink() == vlan_newlink()
>    OR
>    vlan_ioctl_handler()
>      [ADD_VLAN_CMD] -> register_vlan_device()
>
>      register_vlan_dev()
>        vlan_group_set_device()
>                                       netif_receive_skb_core()
>                                           vlan_do_receive()
>                                               vlan_find_dev()
>                                                  __vlan_group_get_device()
>                                                   // Speculative / torn read
>                                                   [Loads bad net_device *]
>            [Plain C store]
>            array[vlan_id] = dev;
>                                                   // Dereferences bad pointer
>                                                   // during device status check
>                                                   vlan_dev->flags (PANIC!)
>
> Fix this by using rcu_assign_pointer() in vlan_group_set_device()
> and rcu_dereference_raw() in __vlan_group_get_device() to enforce
> proper ordering and memory atomicity for the leaf entry traversal.
>
> Cc: stable@vger.kernel.org
> Cc: "David S. Miller" <davem@davemloft.net>
> Cc: Eric Dumazet <edumazet@google.com>
> Cc: Jakub Kicinski <kuba@kernel.org>
> Cc: Paolo Abeni <pabeni@redhat.com>
> Cc: Simon Horman <horms@kernel.org>
> Cc: Stanislav Fomichev <sdf@fomichev.me>
> Cc: Kuniyuki Iwashima <kuniyu@google.com>
> Cc: Nicolai Buchwitz <nb@tipi-net.de>
> Cc: Dan Aloni <da-x@monatomic.org>
> Cc: Jeff Garzik <jeff@garzik.org>
> Fixes: 5c15bdec5c38 ("[VLAN]: Avoid a 4-order allocation.")
> Link: https://sashiko.dev/#/patchset/20260825095422.3166067-1-ruanjinjie%40huawei.com
> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>

[PATCH net-next v3 2/2] 8021q: publish vlan_devices_arrays entries with acquire/release

[Jinjie Ruan]

Replace the smp_wmb()/smp_rmb() barrier pair with
smp_store_release()/smp_load_acquire() on
vg->vlan_devices_arrays[pidx][vidx].

vlan_group_prealloc_vid() publishes the array pointer via release;
__vlan_group_get_device() acquires it before accessing the array,
ensuring the allocated entries are visible.

No functional change intended.

Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Simon Horman <horms@kernel.org>
Cc: Nicolai Buchwitz <nb@tipi-net.de>
Cc: Stanislav Fomichev <sdf@fomichev.me>
Cc: Hangbin Liu <liuhangbin@gmail.com>
Cc: Kuniyuki Iwashima <kuniyu@google.com>
Assisted-by: DeepSeek:DeepSeek-V3
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
---
 net/8021q/vlan.c | 6 ++----
 net/8021q/vlan.h | 8 +++-----
 2 files changed, 5 insertions(+), 9 deletions(-)

diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 6df80cad40a2..ec9a7cc8afc7 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -70,10 +70,8 @@ static int vlan_group_prealloc_vid(struct vlan_group *vg,
 	if (array == NULL)
 		return -ENOBUFS;
 
-	/* paired with smp_rmb() in __vlan_group_get_device() */
-	smp_wmb();
-
-	vg->vlan_devices_arrays[pidx][vidx] = array;
+	/* paired with smp_load_acquire() in __vlan_group_get_device() */
+	smp_store_release(&vg->vlan_devices_arrays[pidx][vidx], array);
 	return 0;
 }
 
diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h
index 3cb4c8294130..d874ab323d32 100644
--- a/net/8021q/vlan.h
+++ b/net/8021q/vlan.h
@@ -56,11 +56,9 @@ static inline struct net_device *__vlan_group_get_device(struct vlan_group *vg,
 {
 	struct net_device __rcu **array;
 
-	array = vg->vlan_devices_arrays[pidx]
-				       [vlan_id / VLAN_GROUP_ARRAY_PART_LEN];
-
-	/* paired with smp_wmb() in vlan_group_prealloc_vid() */
-	smp_rmb();
+	/* Pairs with smp_store_release() in vlan_group_prealloc_vid() */
+	array = smp_load_acquire(&vg->vlan_devices_arrays[pidx]
+				 [vlan_id / VLAN_GROUP_ARRAY_PART_LEN]);
 
 	return array ? rcu_dereference_raw(array[vlan_id % VLAN_GROUP_ARRAY_PART_LEN]) : NULL;
 }
-- 
2.34.1

Re: [PATCH net-next v3 2/2] 8021q: publish vlan_devices_arrays entries with acquire/release

[Kuniyuki Iwashima]

On Wed, Sep 2, 2026 at 12:32 AM Jinjie Ruan <ruanjinjie@huawei.com> wrote:
>
> Replace the smp_wmb()/smp_rmb() barrier pair with
> smp_store_release()/smp_load_acquire() on
> vg->vlan_devices_arrays[pidx][vidx].
>
> vlan_group_prealloc_vid() publishes the array pointer via release;
> __vlan_group_get_device() acquires it before accessing the array,
> ensuring the allocated entries are visible.
>
> No functional change intended.
>
> Cc: "David S. Miller" <davem@davemloft.net>
> Cc: Eric Dumazet <edumazet@google.com>
> Cc: Jakub Kicinski <kuba@kernel.org>
> Cc: Paolo Abeni <pabeni@redhat.com>
> Cc: Simon Horman <horms@kernel.org>
> Cc: Nicolai Buchwitz <nb@tipi-net.de>
> Cc: Stanislav Fomichev <sdf@fomichev.me>
> Cc: Hangbin Liu <liuhangbin@gmail.com>
> Cc: Kuniyuki Iwashima <kuniyu@google.com>
> Assisted-by: DeepSeek:DeepSeek-V3
> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>

Re: [PATCH net-next v3 2/2] 8021q: publish vlan_devices_arrays entries with acquire/release

[Jakub Kicinski]

Some nits for the future..

On Wed, 2 Sep 2026 15:33:34 +0800 Jinjie Ruan wrote:
> Replace the smp_wmb()/smp_rmb() barrier pair with
> smp_store_release()/smp_load_acquire() on
> vg->vlan_devices_arrays[pidx][vidx].
> 
> vlan_group_prealloc_vid() publishes the array pointer via release;
> __vlan_group_get_device() acquires it before accessing the array,
> ensuring the allocated entries are visible.
> 
> No functional change intended.

This phrase is usually reserved for patches which are pure refactor.
You are changing the barriers.

> Cc: "David S. Miller" <davem@davemloft.net>
> Cc: Eric Dumazet <edumazet@google.com>
> Cc: Jakub Kicinski <kuba@kernel.org>
> Cc: Paolo Abeni <pabeni@redhat.com>
> Cc: Simon Horman <horms@kernel.org>
> Cc: Nicolai Buchwitz <nb@tipi-net.de>
> Cc: Stanislav Fomichev <sdf@fomichev.me>
> Cc: Hangbin Liu <liuhangbin@gmail.com>
> Cc: Kuniyuki Iwashima <kuniyu@google.com>

Please put the CCs under the --- marker.

> Assisted-by: DeepSeek:DeepSeek-V3
> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>

Re: [PATCH net-next v3 0/2] 8021q: publish vlan_devices_arrays entries with acquire/release

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 2 Sep 2026 15:33:32 +0800 you wrote:
> Hi all,
> 
> This series fixes a speculative lockless data race in the 8021q
> VLAN receive fast-path, and publish vlan_devices_arrays entries
> with acquire/release for better performance.
> 
> Changes in v3:
> - Fix C=1 sparse warning as Jakub pointed out.
> - Split out from following patch set as Kuniyuki suggested.
> 
> [...]

Here is the summary with links:
  - [net-next,v3,1/2] 8021q: Fix data race when publishing vlan net_device pointers
    https://git.kernel.org/netdev/net-next/c/2e9ff7bb668b
  - [net-next,v3,2/2] 8021q: publish vlan_devices_arrays entries with acquire/release
    https://git.kernel.org/netdev/net-next/c/d199b0d0bb01

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html