Commit 31d7d67b authored by Eric Dumazet's avatar Eric Dumazet Committed by Jakub Kicinski
Browse files

ipv6: annotate data-races around rt->fib6_nsiblings 



rt->fib6_nsiblings can be read locklessly, add corresponding
READ_ONCE() and WRITE_ONCE() annotations.

Fixes: 66f5d6ce ("ipv6: replace rwlock with rcu and spinlock in fib6_table")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250725140725.3626540-5-edumazet@google.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent f8d8ce1b

net/ipv6/ip6_fib.c

+13 −7
Original line number Diff line number Diff line
@@ -445,15 +445,17 @@ struct fib6_dump_arg { 
static int fib6_rt_dump(struct fib6_info *rt, struct fib6_dump_arg *arg)

{

	enum fib_event_type fib_event = FIB_EVENT_ENTRY_REPLACE;

	unsigned int nsiblings;

	int err;



	if (!rt || rt == arg->net->ipv6.fib6_null_entry)

		return 0;



	if (rt->fib6_nsiblings)

	nsiblings = READ_ONCE(rt->fib6_nsiblings);

	if (nsiblings)

		err = call_fib6_multipath_entry_notifier(arg->nb, fib_event,

							 rt,

							 rt->fib6_nsiblings,

							 nsiblings,

							 arg->extack);

	else

		err = call_fib6_entry_notifier(arg->nb, fib_event, rt,
@@ -1138,7 +1140,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt, 


			if (rt6_duplicate_nexthop(iter, rt)) {

				if (rt->fib6_nsiblings)

					rt->fib6_nsiblings = 0;

					WRITE_ONCE(rt->fib6_nsiblings, 0);

				if (!(iter->fib6_flags & RTF_EXPIRES))

					return -EEXIST;

				if (!(rt->fib6_flags & RTF_EXPIRES)) {
@@ -1167,7 +1169,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt, 
			 */

			if (rt_can_ecmp &&

			    rt6_qualify_for_ecmp(iter))

				rt->fib6_nsiblings++;

				WRITE_ONCE(rt->fib6_nsiblings,

					   rt->fib6_nsiblings + 1);

		}



		if (iter->fib6_metric > rt->fib6_metric)
@@ -1217,7 +1220,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt, 
		fib6_nsiblings = 0;

		list_for_each_entry_safe(sibling, temp_sibling,

					 &rt->fib6_siblings, fib6_siblings) {

			sibling->fib6_nsiblings++;

			WRITE_ONCE(sibling->fib6_nsiblings,

				   sibling->fib6_nsiblings + 1);

			BUG_ON(sibling->fib6_nsiblings != rt->fib6_nsiblings);

			fib6_nsiblings++;

		}
@@ -1264,7 +1268,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt, 
				list_for_each_entry_safe(sibling, next_sibling,

							 &rt->fib6_siblings,

							 fib6_siblings)

					sibling->fib6_nsiblings--;

					WRITE_ONCE(sibling->fib6_nsiblings,

						   sibling->fib6_nsiblings - 1);

				WRITE_ONCE(rt->fib6_nsiblings, 0);

				list_del_rcu(&rt->fib6_siblings);

				rcu_read_lock();
@@ -2014,7 +2019,8 @@ static void fib6_del_route(struct fib6_table *table, struct fib6_node *fn, 
			notify_del = true;

		list_for_each_entry_safe(sibling, next_sibling,

					 &rt->fib6_siblings, fib6_siblings)

			sibling->fib6_nsiblings--;

			WRITE_ONCE(sibling->fib6_nsiblings,

				   sibling->fib6_nsiblings - 1);

		WRITE_ONCE(rt->fib6_nsiblings, 0);

		list_del_rcu(&rt->fib6_siblings);

		rt6_multipath_rebalance(next_sibling);

net/ipv6/route.c

+3 −2
Original line number Diff line number Diff line
@@ -5346,7 +5346,8 @@ static void ip6_route_mpath_notify(struct fib6_info *rt, 
	 */

	rcu_read_lock();



	if ((nlflags & NLM_F_APPEND) && rt_last && rt_last->fib6_nsiblings) {

	if ((nlflags & NLM_F_APPEND) && rt_last &&

	    READ_ONCE(rt_last->fib6_nsiblings)) {

		rt = list_first_or_null_rcu(&rt_last->fib6_siblings,

					    struct fib6_info,

					    fib6_siblings);
@@ -5856,7 +5857,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb, 
		if (dst->lwtstate &&

		    lwtunnel_fill_encap(skb, dst->lwtstate, RTA_ENCAP, RTA_ENCAP_TYPE) < 0)

			goto nla_put_failure;

	} else if (rt->fib6_nsiblings) {

	} else if (READ_ONCE(rt->fib6_nsiblings)) {

		struct fib6_info *sibling;

		struct nlattr *mp;