diff options
| author | Yuyang Huang <sigefriedhyy@gmail.com> | 2026-05-24 11:24:56 +0900 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-05-27 17:01:56 -0700 |
| commit | 56ed77ff6022271e172f043b44193889226e42b0 (patch) | |
| tree | db0ece1078d55330138a8e84f8c92f0b090a8a80 /net | |
| parent | f289c0664f64578355d10a85a6e0108fd182043c (diff) | |
| download | linux-next-history-56ed77ff6022271e172f043b44193889226e42b0.tar.gz | |
ipv6: mcast: annotate data-races around mca_users
/proc/net/igmp6 walks IPv6 multicast memberships under RCU and prints
mca_users without holding idev->mc_lock, while multicast join and leave
paths update the field while holding idev->mc_lock. Annotate this
intentional lockless snapshot with READ_ONCE() and the matching writers
with WRITE_ONCE().
Signed-off-by: Yuyang Huang <sigefriedhyy@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260524022456.20689-1-sigefriedhyy@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv6/mcast.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index 6ddc18ac59b95..1297047fedb2b 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -876,7 +876,7 @@ static struct ifmcaddr6 *mca_alloc(struct inet6_dev *idev, mc->mca_addr = *addr; mc->idev = idev; /* reference taken by caller */ - mc->mca_users = 1; + WRITE_ONCE(mc->mca_users, 1); /* mca_stamp should be updated upon changes */ mc->mca_cstamp = mc->mca_tstamp = jiffies; refcount_set(&mc->mca_refcnt, 1); @@ -950,7 +950,7 @@ static int __ipv6_dev_mc_inc(struct net_device *dev, for_each_mc_mclock(idev, mc) { if (ipv6_addr_equal(&mc->mca_addr, addr)) { - mc->mca_users++; + WRITE_ONCE(mc->mca_users, mc->mca_users + 1); ip6_mc_add_src(idev, &mc->mca_addr, mode, 0, NULL, 0); mutex_unlock(&idev->mc_lock); in6_dev_put(idev); @@ -995,7 +995,10 @@ int __ipv6_dev_mc_dec(struct inet6_dev *idev, const struct in6_addr *addr) (ma = mc_dereference(*map, idev)); map = &ma->next) { if (ipv6_addr_equal(&ma->mca_addr, addr)) { - if (--ma->mca_users == 0) { + int new_users = ma->mca_users - 1; + + WRITE_ONCE(ma->mca_users, new_users); + if (new_users == 0) { *map = ma->next; igmp6_group_dropped(ma); @@ -2974,7 +2977,7 @@ static int igmp6_mc_seq_show(struct seq_file *seq, void *v) "%-4d %-15s %pi6 %5d %08X %ld\n", state->dev->ifindex, state->dev->name, &im->mca_addr, - im->mca_users, im->mca_flags, + READ_ONCE(im->mca_users), im->mca_flags, (im->mca_flags & MAF_TIMER_RUNNING) ? jiffies_to_clock_t(im->mca_work.timer.expires - jiffies) : 0); return 0; |