[PATCH net-next 2/3] net: rmnet: annotate data-races around mux_id
From: Eric Dumazet <edumazet@google.com>
Date: 2026-09-16 13:22:37
Subsystem:
networking drivers, qualcomm rmnet driver, the rest · Maintainers:
Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Subash Abhinov Kasiviswanathan, Sean Tranchetti, Linus Torvalds
priv->mux_id is written under RTNL from rmnet_vnd_newlink() and rmnet_changelink(), but rmnet_egress_handler() reads it from the transmit path without any lock. Likewise ep->mux_id is written under RTNL from rmnet_changelink(), while rmnet_get_endpoint() reads it from the receive path under RCU only. Add the missing READ_ONCE()/WRITE_ONCE() annotations. While at it, publish ep->mux_id before inserting the endpoint in its new bucket in rmnet_changelink(). Otherwise a concurrent rmnet_get_endpoint() walking the new bucket could find the endpoint still carrying its old mux_id, and drop the packet. Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Subash Abhinov Kasiviswanathan <subash.a.kasiviswanathan@oss.qualcomm.com> Cc: Sean Tranchetti <sean.tranchetti@oss.qualcomm.com> --- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 6 +++--- drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c | 2 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index 59ef8b4ce5321ebbd1d416fd9da0a820e53ecf9e..248a9d822409b7cbf3739c085487644b7025dd37 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c@@ -331,11 +331,11 @@ static int rmnet_changelink(struct net_device *dev, struct nlattr *tb[], } hlist_del_init_rcu(&ep->hlnode); + WRITE_ONCE(ep->mux_id, mux_id); hlist_add_head_rcu(&ep->hlnode, &port->muxed_ep[mux_id]); - ep->mux_id = mux_id; - priv->mux_id = mux_id; + WRITE_ONCE(priv->mux_id, mux_id); } }
@@ -427,7 +427,7 @@ struct rmnet_endpoint *rmnet_get_endpoint(struct rmnet_port *port, u8 mux_id) hlist_for_each_entry_rcu(ep, &port->muxed_ep[mux_id], hlnode, lockdep_rtnl_is_held()) { - if (ep->mux_id == mux_id) + if (READ_ONCE(ep->mux_id) == mux_id) return ep; }
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
index d4fec2fff227cd93f14eb1802aff185e6d496786..aa5523f4618eb350ec3da20b7f085d955b3403a2 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c@@ -261,7 +261,7 @@ void rmnet_egress_handler(struct sk_buff *skb) orig_dev = skb->dev; priv = netdev_priv(orig_dev); skb->dev = priv->real_dev; - mux_id = priv->mux_id; + mux_id = READ_ONCE(priv->mux_id); port = rmnet_get_port_rcu(skb->dev); if (!port)
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
index 4f0ddcedfa9790dc5843fdea85b2da4bc8329775..9594c97c918565e93ac70ac73340f705b391bd18 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c@@ -332,7 +332,7 @@ int rmnet_vnd_newlink(u8 id, struct net_device *rmnet_dev, rmnet_dev->rtnl_link_ops = &rmnet_link_ops; - priv->mux_id = id; + WRITE_ONCE(priv->mux_id, id); netdev_dbg(rmnet_dev, "rmnet dev created\n"); }
--
2.55.0.1032.g73a4cd73de-goog