Hi Eric,

I just sent out the v2 patch, which includes this missing READ_ONCE()
fix for the read side as you suggested.

I also wanted to share a quick update on the WRITE_ONCE() behavior we
discussed. I tested the sysctl write on my ARM64 device and dumped the
assembly. Surprisingly, the original code didn't crash.

Looking at the objdump, because the ARM64 kernel workaround for Clang
LTO (commit e35123d83ee3) only strengthens the read side to use `ldar`
(Load-Acquire), the WRITE_ONCE() here falls back to regular store
instructions. Clang actually splits the 8-byte struct write into two
separate 32-bit `str Wn` instructions:

    b905ae68      str     w8, [x19, #0x5ac]  // user_seed
    b905b268      str     w8, [x19, #0x5b0]  // mp_seed

This completely confirms your concern: the current WRITE_ONCE(struct)
quietly destroys atomicity and exposes a tear-write vulnerability
without crashing the hardware.

Splitting it explicitly into two 32-bit WRITE_ONCE() calls in the v2
patch was definitely the right move. I have tested all these changes
on my ARM64 board, and everything works perfectly.

Thanks again for the review and guidance!

Best regards,
Yung Chih.

Sam Su [off-list ref] 於 2026年2月27日週五 下午3:12寫道：

Jakub Kicinski [off-list ref] 於 2026年2月27日週五 上午9:14寫道：

quoted

On Thu, 26 Feb 2026 19:17:21 +0800 Yung Chih Su wrote:

quoted

Fixes: [4ee2a8cace3fb9a34aea6a56426f89d26dd514f3] ("net: ipv4: Add a sysctl to set multipath hash seed")

Please use the traditional abbreviated format of the Fixes tag

Hi Jakub,

Got it, my apologies for the formatting mistake.
I will format it strictly as 12-char abbreviated without brackets in
the upcoming v2 patch:
Fixes: 4ee2a8cace3f ("net: ipv4: Add a sysctl to set multipath hash seed")

I am currently preparing the v2 patch which will also include Eric
Dumazet's suggestion regarding the WRITE_ONCE() and READ_ONCE() on the
sysctl read/write side.
 I will send out the v2 after my local testing is done.

Thanks for the review!

Best regards,
Yung Chih