]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
net: devmem: use READ_ONCE/WRITE_ONCE on binding->dev
authorBobby Eshleman <bobbyeshleman@meta.com>
Tue, 3 Mar 2026 00:32:56 +0000 (16:32 -0800)
committerSasha Levin <sashal@kernel.org>
Thu, 12 Mar 2026 11:09:56 +0000 (07:09 -0400)
commit1511db790a8869ec83b29348666bf9ea3d4749d1
tree32d7a09103320f38d7a5ef4f62e90bf26ac8c8f8
parentb86ec45b38daa4ee831dda54903a2084889cfa80
net: devmem: use READ_ONCE/WRITE_ONCE on binding->dev

[ Upstream commit 40bf00ec2ee271df5ba67593991760adf8b5d0ed ]

binding->dev is protected on the write-side in
mp_dmabuf_devmem_uninstall() against concurrent writes, but due to the
concurrent bare reads in net_devmem_get_binding() and
validate_xmit_unreadable_skb() it should be wrapped in a
READ_ONCE/WRITE_ONCE pair to make sure no compiler optimizations play
with the underlying register in unforeseen ways.

Doesn't present a critical bug because the known compiler optimizations
don't result in bad behavior. There is no tearing on u64, and load
omissions/invented loads would only break if additional binding->dev
references were inlined together (they aren't right now).

This just more strictly follows the linux memory model (i.e.,
"Lock-Protected Writes With Lockless Reads" in
tools/memory-model/Documentation/access-marking.txt).

Fixes: bd61848900bf ("net: devmem: Implement TX path")
Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com>
Link: https://patch.msgid.link/20260302-devmem-membar-fix-v2-1-5b33c9cbc28b@meta.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/core/dev.c
net/core/devmem.c