ipv6: np->rxpmtu race annotation

[ Upstream commit 9fba1eb39e2f74d2002c5cbcf1d4435d37a4f752 ]

Add READ_ONCE() annotations because np->rxpmtu can be changed
while udpv6_recvmsg() and rawv6_recvmsg() read it.

Since this is a very rarely used feature, and that udpv6_recvmsg()
and rawv6_recvmsg() read np->rxopt anyway, change the test order
so that np->rxpmtu does not need to be in a hot cache line.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20250916160951.541279-4-edumazet@google.com
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 731485b18de3175fb1012736b779515e0dd30fc0..90d828c98b7363f81a5eb7bc6f8d63b84e231aaf 100644 (file)
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -474,7 +474,7 @@ static int rawv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
        if (flags & MSG_ERRQUEUE)
                return ipv6_recv_error(sk, msg, len, addr_len);
 
-       if (np->rxpmtu && np->rxopt.bits.rxpmtu)
+       if (np->rxopt.bits.rxpmtu && READ_ONCE(np->rxpmtu))
                return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
 
        skb = skb_recv_datagram(sk, flags, noblock, &err);

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index db948e3a9bdc849bccf065cc321ed0ad9d9d734a..3ed835b308044a37894289e5931d757240951acc 100644 (file)
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -297,7 +297,7 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
        if (flags & MSG_ERRQUEUE)
                return ipv6_recv_error(sk, msg, len, addr_len);
 
-       if (np->rxpmtu && np->rxopt.bits.rxpmtu)
+       if (np->rxopt.bits.rxpmtu && READ_ONCE(np->rxpmtu))
                return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
 
 try_again: