veth: fix data race in veth_get_ethtool_stats

[ Upstream commit b47adaab8b3d443868096bac08fdbb3d403194ba ]

In veth_get_ethtool_stats(), some statistics protected by
u64_stats_sync, are read and accumulated in ignorance of possible
u64_stats_fetch_retry() events. These statistics, peer_tq_xdp_xmit and
peer_tq_xdp_xmit_err, are already accumulated by veth_xdp_xmit(). Fix
this by reading them into a temporary buffer first.

Fixes: 5fe6e56776ba ("veth: rely on peer veth_rq for ndo_xdp_xmit accounting")
Signed-off-by: David Yang <mmyangfl@gmail.com>
Link: https://patch.msgid.link/20260114122450.227982-1-mmyangfl@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 7767b6ff5a1559ce13c0498c118562aeea634890..2b3b0beb55c88bc52ade3d0b263cdbe81d279f6e 100644 (file)
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -226,16 +226,20 @@ static void veth_get_ethtool_stats(struct net_device *dev,
                const struct veth_rq_stats *rq_stats = &rcv_priv->rq[i].stats;
                const void *base = (void *)&rq_stats->vs;
                unsigned int start, tx_idx = idx;
+               u64 buf[VETH_TQ_STATS_LEN];
                size_t offset;
 
-               tx_idx += (i % dev->real_num_tx_queues) * VETH_TQ_STATS_LEN;
                do {
                        start = u64_stats_fetch_begin(&rq_stats->syncp);
                        for (j = 0; j < VETH_TQ_STATS_LEN; j++) {
                                offset = veth_tq_stats_desc[j].offset;
-                               data[tx_idx + j] += *(u64 *)(base + offset);
+                               buf[j] = *(u64 *)(base + offset);
                        }
                } while (u64_stats_fetch_retry(&rq_stats->syncp, start));
+
+               tx_idx += (i % dev->real_num_tx_queues) * VETH_TQ_STATS_LEN;
+               for (j = 0; j < VETH_TQ_STATS_LEN; j++)
+                       data[tx_idx + j] += buf[j];
        }
        pp_idx = idx + dev->real_num_tx_queues * VETH_TQ_STATS_LEN;