RE: [PATCH net-next 0/3] net: rmnet: lockless rmnet_fill_info()

-----Original Message-----
From: Eric Dumazet <edumazet@google.com>
Sent: Wednesday, September 16, 2026 7:22 AM
To: David S . Miller <davem@davemloft.net>; Jakub Kicinski
[off-list ref]; Paolo Abeni [off-list ref]
Cc: Simon Horman <horms@kernel.org>; Kuniyuki Iwashima
[off-list ref]; Andrew Lunn [off-list ref];
netdev@vger.kernel.org; eric.dumazet@gmail.com; Eric Dumazet
[off-list ref]; Subash Abhinov Kasiviswanathan
[off-list ref]; Sean Tranchetti
[off-list ref]
Subject: [PATCH net-next 0/3] net: rmnet: lockless rmnet_fill_info()

rmnet_fill_info() currently relies on RTNL being held, because it uses
rmnet_get_port_rtnl() to reach the rmnet_port attached to the underlying real
device.

While auditing the fields exposed there, it appears that both
priv->mux_id and port->data_format are written under RTNL but read
from the data path without any lock. Note that rmnet_newlink() can update
port->data_format of an already active port, and that
rmnet_changelink() can change both fields while traffic is flowing.

- Patch 1 annotates the data-races around port->data_format. It also
  samples the field only once per packet and passes the value down,
  so that both ends of a packet transformation agree on the format
  (TX used to size the MAP headroom and set MAP_NEXT_HEADER_FLAG
  from two separate reads), and prevents rmnet_changelink() from
  publishing an intermediate value to the data path.

- Patch 2 annotates the data-races around priv->mux_id and
  ep->mux_id. It also publishes ep->mux_id before the endpoint is
  inserted into its new bucket, so that a concurrent lookup walking
  that bucket can no longer miss it and drop the packet.

- Patch 3 converts rmnet_fill_info() to RCU. rmnet_get_port_rcu()
  was only called from the data path and thus used
  rcu_dereference_bh(); its lockdep condition is relaxed so that it
  can also be called from process context.

The lockless lookup is safe because rmnet_get_port_rcu() checks real_dev-

quoted

rx_handler before returning rx_handler_data, while

rmnet_unregister_real_device() clears rx_handler and waits for a grace period
(in netdev_rx_handler_unregister()) before freeing the port.

This is part of a larger effort to remove the RTNL dependency from
rtnl_link_ops->fill_info().

Assisted-by: LLM
Cc: Subash Abhinov Kasiviswanathan
[off-list ref]
Cc: Sean Tranchetti <sean.tranchetti@oss.qualcomm.com>

Eric Dumazet (3):
  net: rmnet: annotate data-races around port->data_format
  net: rmnet: annotate data-races around mux_id
  net: rmnet: no longer rely on RTNL in rmnet_fill_info()

 .../ethernet/qualcomm/rmnet/rmnet_config.c    | 54 +++++++++----------
 .../ethernet/qualcomm/rmnet/rmnet_config.h    |  2 +-
 .../ethernet/qualcomm/rmnet/rmnet_handlers.c  | 34 +++++++-----
 .../net/ethernet/qualcomm/rmnet/rmnet_map.h   |  9 ++--
 .../qualcomm/rmnet/rmnet_map_command.c        |  9 ++--
 .../ethernet/qualcomm/rmnet/rmnet_map_data.c  | 14 ++---
 .../net/ethernet/qualcomm/rmnet/rmnet_vnd.c   |  2 +-
 7 files changed, 65 insertions(+), 59 deletions(-)

--
2.55.0.1032.g73a4cd73de-goog

No concerns from our side. For the series - 

Reviewed-by: Subash Abhinov Kasiviswanathan <subash.a.kasiviswanathan@oss.qualcomm.com>