Re: [PATCH] ipv4: fib: annotate data-race around nh->nh_saddr
flat view
From: Kuniyuki Iwashima <kuniyu@google.com>
Date: 2026-09-14 19:51:05
Also in:
lkml
On Fri, Sep 11, 2026 at 12:38 AM Linkui Xiao [off-list ref] wrote:
From: Linkui Xiao <redacted>
fib_select_multipath() compares nexthop_nh->nh_saddr against the flow
source address with no lock held, while fib_info_update_nhc_saddr()
stores a new value from another CPU as soon as the preferred source
address of the egress device changes.
Commit 195374d89368 ("ipv4: fib: annotate races around nh->nh_saddr_genid
and nh->nh_saddr") added WRITE_ONCE() on the store side and READ_ONCE()
in fib_result_prefsrc() after syzbot reported
BUG: KCSAN: data-race in fib_select_path / fib_select_path
but it only covered that reader. fib_select_multipath(), reached from
fib_select_path(), is a second lockless reader of nh->nh_saddr and was
left bare.32607a332cfe added the reader after 195374d89368.
quoted hunk ↗ jump to hunk
Annotate it as well so that the value cannot be torn or reloaded while the per-nexthop scores are being computed. Fixes: 195374d89368 ("ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr") Signed-off-by: Linkui Xiao <redacted> --- net/ipv4/fib_semantics.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c index 7a362f2e2c2b..885c6fae5232 100644 --- a/net/ipv4/fib_semantics.c +++ b/net/ipv4/fib_semantics.c@@ -2204,7 +2204,7 @@ void fib_select_multipath(struct fib_result *res, int hash, (use_neigh && !fib_good_nh(nexthop_nh))) continue; - if (saddr && nexthop_nh->nh_saddr == saddr) + if (saddr && READ_ONCE(nexthop_nh->nh_saddr) == saddr) nh_score += 2; if (hash <= nh_upper_bound) nh_score++; --2.25.1