From: Eric Dumazet <edumazet@google.com>
Date: Mon, 7 Apr 2025 16:36:00 +0000 (+0000)
Subject: net: rps: annotate data-races around (struct sd_flow_limit)->count
X-Git-Tag: v6.16-rc1~132^2~358^2~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7b6f0a852da34379a304d7020d70049ba5d1f0f3;p=thirdparty%2Fkernel%2Fstable.git

net: rps: annotate data-races around (struct sd_flow_limit)->count

softnet_seq_show() can read fl->count while another cpu
updates this field from skb_flow_limit().

Make this field an 'unsigned int', as its only consumer
only deals with 32 bit.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20250407163602.170356-3-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---

diff --git a/net/core/dev.c b/net/core/dev.c
index f674236f34beb..969883173182b 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5049,7 +5049,8 @@ static bool skb_flow_limit(struct sk_buff *skb, unsigned int qlen)
 			fl->buckets[old_flow]--;
 
 		if (++fl->buckets[new_flow] > (FLOW_LIMIT_HISTORY >> 1)) {
-			fl->count++;
+			/* Pairs with READ_ONCE() in softnet_seq_show() */
+			WRITE_ONCE(fl->count, fl->count + 1);
 			rcu_read_unlock();
 			return true;
 		}
diff --git a/net/core/dev.h b/net/core/dev.h
index b1cd44b5f009b..e855e1cb43fd1 100644
--- a/net/core/dev.h
+++ b/net/core/dev.h
@@ -15,7 +15,7 @@ struct cpumask;
 /* Random bits of netdevice that don't need to be exposed */
 #define FLOW_LIMIT_HISTORY	(1 << 7)  /* must be ^2 and !overflow buckets */
 struct sd_flow_limit {
-	u64			count;
+	unsigned int		count;
 	u8			log_buckets;
 	unsigned int		history_head;
 	u16			history[FLOW_LIMIT_HISTORY];
diff --git a/net/core/net-procfs.c b/net/core/net-procfs.c
index 3e92bf0f9060b..69782d62fbe19 100644
--- a/net/core/net-procfs.c
+++ b/net/core/net-procfs.c
@@ -132,8 +132,9 @@ static int softnet_seq_show(struct seq_file *seq, void *v)
 
 	rcu_read_lock();
 	fl = rcu_dereference(sd->flow_limit);
+	/* Pairs with WRITE_ONCE() in skb_flow_limit() */
 	if (fl)
-		flow_limit_count = fl->count;
+		flow_limit_count = READ_ONCE(fl->count);
 	rcu_read_unlock();
 #endif