ipv6: np->rxpmtu race annotation

[ Upstream commit 9fba1eb39e2f74d2002c5cbcf1d4435d37a4f752 ]

Add READ_ONCE() annotations because np->rxpmtu can be changed
while udpv6_recvmsg() and rawv6_recvmsg() read it.

Since this is a very rarely used feature, and that udpv6_recvmsg()
and rawv6_recvmsg() read np->rxopt anyway, change the test order
so that np->rxpmtu does not need to be in a hot cache line.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20250916160951.541279-4-edumazet@google.com
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 328419e05c8153cac3bc1157ee54c5ebb418ff58..d148f1b03c5d0951bcd88911deeb7fb3e04abc8f 100644 (file)
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -445,7 +445,7 @@ static int rawv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
        if (flags & MSG_ERRQUEUE)
                return ipv6_recv_error(sk, msg, len, addr_len);
 
-       if (np->rxpmtu && np->rxopt.bits.rxpmtu)
+       if (np->rxopt.bits.rxpmtu && READ_ONCE(np->rxpmtu))
                return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
 
        skb = skb_recv_datagram(sk, flags, &err);

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 57e38e5e4be926e11506bf8b891475d89a6fafa1..9b93df668025d154cb28818a1f108386c0026646 100644 (file)
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -394,7 +394,7 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
        if (flags & MSG_ERRQUEUE)
                return ipv6_recv_error(sk, msg, len, addr_len);
 
-       if (np->rxpmtu && np->rxopt.bits.rxpmtu)
+       if (np->rxopt.bits.rxpmtu && READ_ONCE(np->rxpmtu))
                return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
 
 try_again: