[PATCH net] net: gen_estimator: protect seqcount updates from hardirq readers

[PATCH net] net: gen_estimator: protect seqcount updates from hardirq readers

[Runyu Xiao]

est_timer updates the estimator seqcount with preemption disabled, which
does not exclude hardirq readers on non-PREEMPT_RT kernels.  A reader can
observe an odd sequence and spin while the timer is interrupted.

Disable interrupts around the seqcount write section.

The failure mode was reproduced with an x86_64 kernel under QEMU. A
test-only hardirq injection invokes gen_estimator_read() on the same CPU
while est_timer() is updating the sequence counter.

On the unfixed kernel, the hardirq reader reports the seqcount lockdep
warning and spins until QEMU times out. With this change, the reader is
deferred until the writer restores local IRQs, then returns and the guest
shuts down normally. The hardirq context is deliberately injected to
exercise this interleaving; ordinary userspace traffic does not guarantee
it.

Fixes: 1c0d32fde5bd ("net_sched: gen_estimator: complete rewrite of rate estimators")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
 net/core/gen_estimator.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index c34e58c6c..6aba5916d 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -79,6 +79,7 @@ static void est_timer(struct timer_list *t)
 	struct gnet_stats_basic_sync b;
 	u64 b_bytes, b_packets;
 	u64 rate, brate;
+	unsigned long flags;
 
 	est_fetch_counters(est, &b);
 	b_bytes = u64_stats_read(&b.bytes);
@@ -90,12 +91,12 @@ static void est_timer(struct timer_list *t)
 	rate = (b_packets - est->last_packets) << (10 - est->intvl_log);
 	rate = (rate >> est->ewma_log) - (est->avpps >> est->ewma_log);
 
-	preempt_disable_nested();
+	local_irq_save(flags);
 	write_seqcount_begin(&est->seq);
 	est->avbps += brate;
 	est->avpps += rate;
 	write_seqcount_end(&est->seq);
-	preempt_enable_nested();
+	local_irq_restore(flags);
 
 	est->last_bytes = b_bytes;
 	est->last_packets = b_packets;
-- 
2.34.1

Re: [PATCH net] net: gen_estimator: protect seqcount updates from hardirq readers

[Sebastian Andrzej Siewior]

On 2026-09-23 11:29:36 [+0800], Runyu Xiao wrote:
> est_timer updates the estimator seqcount with preemption disabled, which
> does not exclude hardirq readers on non-PREEMPT_RT kernels.  A reader can
> observe an odd sequence and spin while the timer is interrupted.

How do you inject a reader from hardirq? Isn't this meant for softirq
context only?

> Disable interrupts around the seqcount write section.
> 
> The failure mode was reproduced with an x86_64 kernel under QEMU. A
> test-only hardirq injection invokes gen_estimator_read() on the same CPU
> while est_timer() is updating the sequence counter.
> 
> On the unfixed kernel, the hardirq reader reports the seqcount lockdep
> warning and spins until QEMU times out. With this change, the reader is
> deferred until the writer restores local IRQs, then returns and the guest
> shuts down normally. The hardirq context is deliberately injected to
> exercise this interleaving; ordinary userspace traffic does not guarantee
> it.
> 
> Fixes: 1c0d32fde5bd ("net_sched: gen_estimator: complete rewrite of rate estimators")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>

Sebastian

Re: [PATCH net] net: gen_estimator: protect seqcount updates from hardirq readers

[Runyu Xiao]

Hi Sebastian,

Thanks for the detailed review.

You are right. I rechecked the in-tree callers and confirmed that
gen_estimator_read() has no hardirq caller. The hardirq call in my test
harness was an artificial caller that is not part of a reachable mainline
execution path, so it does not demonstrate a real bug.

The injected reader also overlooked that a hypothetical caller would first
hit est_fetch_counters() and stats_lock. In addition, replacing
preempt_disable_nested() with local_irq_save() would conflict with the
PREEMPT_RT rationale from 9f74c0ea9b26.

I will withdraw this patch and will not send a v2.

Regards,
Runyu

Re: [PATCH net] net: gen_estimator: protect seqcount updates from hardirq readers

[Eric Dumazet]

On Wed, Sep 23, 2026 at 5:29 AM Runyu Xiao <runyu.xiao@seu.edu.cn> wrote:
>
> est_timer updates the estimator seqcount with preemption disabled, which
> does not exclude hardirq readers on non-PREEMPT_RT kernels.  A reader can
> observe an odd sequence and spin while the timer is interrupted.
>

There is no hardirq reader of gen_estimator_read() in the tree.

The only callers are:
 - gnet_stats_copy_rate_est() from tc dump paths (process context)
 - tcf_police_act() (BH)
 - xt_rateest_mt() (process or BH)

est_timer() itself runs from TIMER_SOFTIRQ (or ktimers/N on RT), and
softirqs do not nest on a CPU, so no reader can interrupt the writer.

> Disable interrupts around the seqcount write section.
>
> The failure mode was reproduced with an x86_64 kernel under QEMU. A
> test-only hardirq injection invokes gen_estimator_read() on the same CPU
> while est_timer() is updating the sequence counter.

Injecting a call that does not exist is not a reproducer; with that
methodology essentially every seqcount_t writer in the kernel would need
local_irq_save(). Note that such a hardirq caller would already deadlock
on e->stats_lock in est_fetch_counters() anyway.

Also, the preempt_disable_nested() here is deliberate (9f74c0ea9b26
"net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y").
local_irq_save() is not remapped on PREEMPT_RT, so this patch would add
a real IRQ-off section in a context RT intentionally keeps preemptible,
and would lose the lockdep assertion on !RT.

Finally, the Fixes: tag and Cc: stable are not warranted: nothing
regressed in 1c0d32fde5bd, and there is no user-visible bug.

pw-bot: rejected