ipv6: annotate data-races around rt->fib6_nsiblings

rt->fib6_nsiblings can be read locklessly, add corresponding
READ_ONCE() and WRITE_ONCE() annotations.

Fixes: 66f5d6ce53e6 ("ipv6: replace rwlock with rcu and spinlock in fib6_table")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250725140725.3626540-5-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index af7db69d9eac97033fde46c5ee57e0cfb53a36db..4d68bd853dbae92a48a15eeee091bfdde3b5c77d 100644 (file)
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -445,15 +445,17 @@ struct fib6_dump_arg {
 static int fib6_rt_dump(struct fib6_info *rt, struct fib6_dump_arg *arg)
 {
        enum fib_event_type fib_event = FIB_EVENT_ENTRY_REPLACE;
+       unsigned int nsiblings;
        int err;
 
        if (!rt || rt == arg->net->ipv6.fib6_null_entry)
                return 0;
 
-       if (rt->fib6_nsiblings)
+       nsiblings = READ_ONCE(rt->fib6_nsiblings);
+       if (nsiblings)
                err = call_fib6_multipath_entry_notifier(arg->nb, fib_event,
                                                         rt,
-                                                        rt->fib6_nsiblings,
+                                                        nsiblings,
                                                         arg->extack);
        else
                err = call_fib6_entry_notifier(arg->nb, fib_event, rt,
@@ -1138,7 +1140,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
 
                        if (rt6_duplicate_nexthop(iter, rt)) {
                                if (rt->fib6_nsiblings)
-                                       rt->fib6_nsiblings = 0;
+                                       WRITE_ONCE(rt->fib6_nsiblings, 0);
                                if (!(iter->fib6_flags & RTF_EXPIRES))
                                        return -EEXIST;
                                if (!(rt->fib6_flags & RTF_EXPIRES)) {
@@ -1167,7 +1169,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
                         */
                        if (rt_can_ecmp &&
                            rt6_qualify_for_ecmp(iter))
-                               rt->fib6_nsiblings++;
+                               WRITE_ONCE(rt->fib6_nsiblings,
+                                          rt->fib6_nsiblings + 1);
                }
 
                if (iter->fib6_metric > rt->fib6_metric)
@@ -1217,7 +1220,8 @@ next_iter:
                fib6_nsiblings = 0;
                list_for_each_entry_safe(sibling, temp_sibling,
                                         &rt->fib6_siblings, fib6_siblings) {
-                       sibling->fib6_nsiblings++;
+                       WRITE_ONCE(sibling->fib6_nsiblings,
+                                  sibling->fib6_nsiblings + 1);
                        BUG_ON(sibling->fib6_nsiblings != rt->fib6_nsiblings);
                        fib6_nsiblings++;
                }
@@ -1264,7 +1268,8 @@ add:
                                list_for_each_entry_safe(sibling, next_sibling,
                                                         &rt->fib6_siblings,
                                                         fib6_siblings)
-                                       sibling->fib6_nsiblings--;
+                                       WRITE_ONCE(sibling->fib6_nsiblings,
+                                                  sibling->fib6_nsiblings - 1);
                                WRITE_ONCE(rt->fib6_nsiblings, 0);
                                list_del_rcu(&rt->fib6_siblings);
                                rcu_read_lock();
@@ -2014,7 +2019,8 @@ static void fib6_del_route(struct fib6_table *table, struct fib6_node *fn,
                        notify_del = true;
                list_for_each_entry_safe(sibling, next_sibling,
                                         &rt->fib6_siblings, fib6_siblings)
-                       sibling->fib6_nsiblings--;
+                       WRITE_ONCE(sibling->fib6_nsiblings,
+                                  sibling->fib6_nsiblings - 1);
                WRITE_ONCE(rt->fib6_nsiblings, 0);
                list_del_rcu(&rt->fib6_siblings);
                rt6_multipath_rebalance(next_sibling);

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 04f2b860ca6156776e0cedd18d96877effd287a4..aaedc08607c01c409276032b3ac213bb1876c726 100644 (file)
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -5346,7 +5346,8 @@ static void ip6_route_mpath_notify(struct fib6_info *rt,
         */
        rcu_read_lock();
 
-       if ((nlflags & NLM_F_APPEND) && rt_last && rt_last->fib6_nsiblings) {
+       if ((nlflags & NLM_F_APPEND) && rt_last &&
+           READ_ONCE(rt_last->fib6_nsiblings)) {
                rt = list_first_or_null_rcu(&rt_last->fib6_siblings,
                                            struct fib6_info,
                                            fib6_siblings);
@@ -5856,7 +5857,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
                if (dst->lwtstate &&
                    lwtunnel_fill_encap(skb, dst->lwtstate, RTA_ENCAP, RTA_ENCAP_TYPE) < 0)
                        goto nla_put_failure;
-       } else if (rt->fib6_nsiblings) {
+       } else if (READ_ONCE(rt->fib6_nsiblings)) {
                struct fib6_info *sibling;
                struct nlattr *mp;