Commit f1c5fd34 authored by Eric Dumazet's avatar Eric Dumazet Committed by Jakub Kicinski
Browse files

net: dst: annotate data-races around dst->input 



dst_dev_put() can overwrite dst->input while other
cpus might read this field (for instance from dst_input())

Add READ_ONCE()/WRITE_ONCE() annotations to suppress
potential issues.

We will likely need full RCU protection later.

Fixes: 4a6ce2b6 ("net: introduce a new function dst_dev_put()")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reviewed-by: default avatarKuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20250630121934.3399505-5-edumazet@google.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 8f2b2282

include/net/dst.h

+1 −1
Original line number Diff line number Diff line
@@ -468,7 +468,7 @@ INDIRECT_CALLABLE_DECLARE(int ip_local_deliver(struct sk_buff *)); 
/* Input packet from network to transport.  */

static inline int dst_input(struct sk_buff *skb)

{

	return INDIRECT_CALL_INET(skb_dst(skb)->input,

	return INDIRECT_CALL_INET(READ_ONCE(skb_dst(skb)->input),

				  ip6_input, ip_local_deliver, skb);

}

include/net/lwtunnel.h

+2 −2
Original line number Diff line number Diff line
@@ -142,8 +142,8 @@ static inline void lwtunnel_set_redirect(struct dst_entry *dst) 
		dst->output = lwtunnel_output;

	}

	if (lwtunnel_input_redirect(dst->lwtstate)) {

		dst->lwtstate->orig_input = dst->input;

		dst->input = lwtunnel_input;

		dst->lwtstate->orig_input = READ_ONCE(dst->input);

		WRITE_ONCE(dst->input, lwtunnel_input);

	}

}

#else

net/core/dst.c

+1 −1
Original line number Diff line number Diff line
@@ -148,7 +148,7 @@ void dst_dev_put(struct dst_entry *dst) 
	WRITE_ONCE(dst->obsolete, DST_OBSOLETE_DEAD);

	if (dst->ops->ifdown)

		dst->ops->ifdown(dst, dev);

	dst->input = dst_discard;

	WRITE_ONCE(dst->input, dst_discard);

	dst->output = dst_discard_out;

	dst->dev = blackhole_netdev;

	netdev_ref_replace(dev, blackhole_netdev, &dst->dev_tracker,

net/ipv4/route.c

+1 −1
Original line number Diff line number Diff line
@@ -1687,7 +1687,7 @@ struct rtable *rt_dst_clone(struct net_device *dev, struct rtable *rt) 
		else if (rt->rt_gw_family == AF_INET6)

			new_rt->rt_gw6 = rt->rt_gw6;



		new_rt->dst.input = rt->dst.input;

		new_rt->dst.input = READ_ONCE(rt->dst.input);

		new_rt->dst.output = rt->dst.output;

		new_rt->dst.error = rt->dst.error;

		new_rt->dst.lastuse = jiffies;