bonding: annotate data-races arcound churn variables

These fields are updated asynchronously by the bonding state machine
in ad_churn_machine() while holding bond->mode_lock.

bond_info_show_slave() and bond_fill_slave_info() read them without
bond->mode_lock being held, we need to add READ_ONCE() and
WRITE_ONCE() annotations.

Note that AD_CHURN_MONITOR, AD_CHURN, and AD_NO_CHURN are defined
exclusively in (kernel private) include/net/bond_3ad.h header.

They should be moved to include/uapi/linux/if_bonding.h or userspace
tools will have to hardcode their values.

Fixes: 4916f2e2f3fc ("bonding: print churn state via netlink")
Fixes: 14c9551a32eb ("bonding: Implement port churn-machine (AD standard 43.4.17).")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260603123514.388226-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index f0aa7d2f21717a7084d78a8016643fa9f7e9e91e..985ef66dc3331e89458c9951a222d140c2275fb9 100644 (file)
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -1386,8 +1386,8 @@ static void ad_churn_machine(struct port *port)
 {
        if (port->sm_vars & AD_PORT_CHURNED) {
                port->sm_vars &= ~AD_PORT_CHURNED;
-               port->sm_churn_actor_state = AD_CHURN_MONITOR;
-               port->sm_churn_partner_state = AD_CHURN_MONITOR;
+               WRITE_ONCE(port->sm_churn_actor_state, AD_CHURN_MONITOR);
+               WRITE_ONCE(port->sm_churn_partner_state, AD_CHURN_MONITOR);
                port->sm_churn_actor_timer_counter =
                        __ad_timer_to_ticks(AD_ACTOR_CHURN_TIMER, 0);
                port->sm_churn_partner_timer_counter =
@@ -1398,20 +1398,22 @@ static void ad_churn_machine(struct port *port)
            !(--port->sm_churn_actor_timer_counter) &&
            port->sm_churn_actor_state == AD_CHURN_MONITOR) {
                if (port->actor_oper_port_state & LACP_STATE_SYNCHRONIZATION) {
-                       port->sm_churn_actor_state = AD_NO_CHURN;
+                       WRITE_ONCE(port->sm_churn_actor_state, AD_NO_CHURN);
                } else {
-                       port->churn_actor_count++;
-                       port->sm_churn_actor_state = AD_CHURN;
+                       WRITE_ONCE(port->churn_actor_count,
+                                  port->churn_actor_count + 1);
+                       WRITE_ONCE(port->sm_churn_actor_state, AD_CHURN);
                }
        }
        if (port->sm_churn_partner_timer_counter &&
            !(--port->sm_churn_partner_timer_counter) &&
            port->sm_churn_partner_state == AD_CHURN_MONITOR) {
                if (port->partner_oper.port_state & LACP_STATE_SYNCHRONIZATION) {
-                       port->sm_churn_partner_state = AD_NO_CHURN;
+                       WRITE_ONCE(port->sm_churn_partner_state, AD_NO_CHURN);
                } else {
-                       port->churn_partner_count++;
-                       port->sm_churn_partner_state = AD_CHURN;
+                       WRITE_ONCE(port->churn_partner_count,
+                                  port->churn_partner_count + 1);
+                       WRITE_ONCE(port->sm_churn_partner_state, AD_CHURN);
                }
        }
 }

diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
index c7d3e0602c831dcac74d2bed16b5026cddda4839..90365d3f7ebff7f762b4cb10303a3dd3fdd49cc6 100644 (file)
--- a/drivers/net/bonding/bond_netlink.c
+++ b/drivers/net/bonding/bond_netlink.c
@@ -82,10 +82,10 @@ static int bond_fill_slave_info(struct sk_buff *skb,
                                goto nla_put_failure_rcu;
 
                        if (nla_put_u8(skb, IFLA_BOND_SLAVE_AD_CHURN_ACTOR_STATE,
-                                      ad_port->sm_churn_actor_state))
+                                      READ_ONCE(ad_port->sm_churn_actor_state)))
                                goto nla_put_failure_rcu;
                        if (nla_put_u8(skb, IFLA_BOND_SLAVE_AD_CHURN_PARTNER_STATE,
-                                      ad_port->sm_churn_partner_state))
+                                      READ_ONCE(ad_port->sm_churn_partner_state)))
                                goto nla_put_failure_rcu;
                }
                rcu_read_unlock();

diff --git a/drivers/net/bonding/bond_procfs.c b/drivers/net/bonding/bond_procfs.c
index 3714aab1a3d9c54cb41de06e074ff483f2ac0b94..3607b62f9b63f65d01bfa4f1e85a34b4f1af803c 100644 (file)
--- a/drivers/net/bonding/bond_procfs.c
+++ b/drivers/net/bonding/bond_procfs.c
@@ -221,13 +221,13 @@ static void bond_info_show_slave(struct seq_file *seq,
                        seq_printf(seq, "Aggregator ID: %d\n",
                                   agg->aggregator_identifier);
                        seq_printf(seq, "Actor Churn State: %s\n",
-                                  bond_3ad_churn_desc(port->sm_churn_actor_state));
+                                  bond_3ad_churn_desc(READ_ONCE(port->sm_churn_actor_state)));
                        seq_printf(seq, "Partner Churn State: %s\n",
-                                  bond_3ad_churn_desc(port->sm_churn_partner_state));
+                                  bond_3ad_churn_desc(READ_ONCE(port->sm_churn_partner_state)));
                        seq_printf(seq, "Actor Churned Count: %d\n",
-                                  port->churn_actor_count);
+                                  READ_ONCE(port->churn_actor_count));
                        seq_printf(seq, "Partner Churned Count: %d\n",
-                                  port->churn_partner_count);
+                                  READ_ONCE(port->churn_partner_count));
 
                        if (capable(CAP_NET_ADMIN)) {
                                seq_puts(seq, "details actor lacp pdu:\n");