ipv6: mcast: annotate data-races around mc->mca_sfcount[MCAST_EXCLUDE]

mc->mca_sfcount[MCAST_EXCLUDE] is read locklessly from
ipv6_chk_mcast_addr().

Add READ_ONCE() and WRITE_ONCE() annotations accordingly.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20241210183352.86530-3-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index afe707b6841d1ce84f11cc588200615b504a591d..09622142b0705bd81491f148dde4612c0f8fddb8 100644 (file)
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1039,9 +1039,9 @@ bool ipv6_chk_mcast_addr(struct net_device *dev, const struct in6_addr *group,
                if (psf)
                        rv = psf->sf_count[MCAST_INCLUDE] ||
                                psf->sf_count[MCAST_EXCLUDE] !=
-                               mc->mca_sfcount[MCAST_EXCLUDE];
+                               READ_ONCE(mc->mca_sfcount[MCAST_EXCLUDE]);
                else
-                       rv = mc->mca_sfcount[MCAST_EXCLUDE] != 0;
+                       rv = READ_ONCE(mc->mca_sfcount[MCAST_EXCLUDE]) != 0;
        } else {
                rv = true; /* don't filter unspecified source */
        }
@@ -2505,7 +2505,8 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
        sf_markstate(pmc);
        isexclude = pmc->mca_sfmode == MCAST_EXCLUDE;
        if (!delta)
-               pmc->mca_sfcount[sfmode]++;
+               WRITE_ONCE(pmc->mca_sfcount[sfmode],
+                          pmc->mca_sfcount[sfmode] + 1);
        err = 0;
        for (i = 0; i < sfcount; i++) {
                err = ip6_mc_add1_src(pmc, sfmode, &psfsrc[i]);
@@ -2516,7 +2517,8 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
                int j;
 
                if (!delta)
-                       pmc->mca_sfcount[sfmode]--;
+                       WRITE_ONCE(pmc->mca_sfcount[sfmode],
+                                  pmc->mca_sfcount[sfmode] - 1);
                for (j = 0; j < i; j++)
                        ip6_mc_del1_src(pmc, sfmode, &psfsrc[j]);
        } else if (isexclude != (pmc->mca_sfcount[MCAST_EXCLUDE] != 0)) {
@@ -2561,7 +2563,8 @@ static void ip6_mc_clear_src(struct ifmcaddr6 *pmc)
        RCU_INIT_POINTER(pmc->mca_sources, NULL);
        pmc->mca_sfmode = MCAST_EXCLUDE;
        pmc->mca_sfcount[MCAST_INCLUDE] = 0;
-       pmc->mca_sfcount[MCAST_EXCLUDE] = 1;
+       /* Paired with the READ_ONCE() from ipv6_chk_mcast_addr() */
+       WRITE_ONCE(pmc->mca_sfcount[MCAST_EXCLUDE], 1);
 }
 
 /* called with mc_lock */