linux-kernel - Re: [Intel-wired-lan] [PATCH net] idpf: Fix data race in idpf_net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAAXyoMPxG5DbfMoLztWL3W78Xf3TMMVvkKJFD8L3Dup2-hMyyA@mail.gmail.com>
Date: Wed, 21 Jan 2026 03:09:47 +0800
From: Yangfl <mmyangfl@...il.com>
To: Paul Menzel <pmenzel@...gen.mpg.de>
Cc: netdev@...r.kernel.org, Tony Nguyen <anthony.l.nguyen@...el.com>, 
	Przemek Kitszel <przemyslaw.kitszel@...el.com>, Andrew Lunn <andrew+netdev@...n.ch>, 
	"David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, 
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, 
	Phani Burra <phani.r.burra@...el.com>, Willem de Bruijn <willemb@...gle.com>, 
	Sridhar Samudrala <sridhar.samudrala@...el.com>, Joshua Hay <joshua.a.hay@...el.com>, 
	intel-wired-lan@...ts.osuosl.org, linux-kernel@...r.kernel.org
Subject: Re: [Intel-wired-lan] [PATCH net] idpf: Fix data race in idpf_net_dim

On Wed, Jan 21, 2026 at 12:50 AM Paul Menzel <pmenzel@...gen.mpg.de> wrote:
>
> Dear David,
>
>
> Thank you for your patch.
>
> Am 19.01.26 um 17:27 schrieb David Yang:
> > In idpf_net_dim(), some statistics protected by u64_stats_sync, are read
> > and accumulated in ignorance of possible u64_stats_fetch_retry() events.
> > The correct way to copy statistics is already illustrated by
> > idpf_add_queue_stats(). Fix this by reading them into temporary variables
> > first.
>
> It’d be great if you also documented a test case.
>

Sorry, I didn't get what "documente a test case" means. Triggering the
bug would require precise timing between the writer and reader. If
u64_stats_fetch_retry() returns true you already know the previous
critical section was invalid, which is documented in u64_stats_sync.h.

> > Fixes: c2d548cad150 ("idpf: add TX splitq napi poll support")
> > Fixes: 3a8845af66ed ("idpf: add RX splitq napi poll support")
> > Signed-off-by: David Yang <mmyangfl@...il.com>
> > ---
> >   drivers/net/ethernet/intel/idpf/idpf_txrx.c | 16 +++++++++++-----
> >   1 file changed, 11 insertions(+), 5 deletions(-)
> >
> > diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> > index 97a5fe766b6b..66ba645e8b90 100644
> > --- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> > +++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> > @@ -3956,7 +3956,7 @@ static void idpf_update_dim_sample(struct idpf_q_vector *q_vector,
> >   static void idpf_net_dim(struct idpf_q_vector *q_vector)
> >   {
> >       struct dim_sample dim_sample = { };
> > -     u64 packets, bytes;
> > +     u64 packets, bytes, pkts, bts;
>
> The new variable names are ambiguous. Would _tmp or so be better?
>
> >       u32 i;
> >
> >       if (!IDPF_ITR_IS_DYNAMIC(q_vector->tx_intr_mode))
> > @@ -3968,9 +3968,12 @@ static void idpf_net_dim(struct idpf_q_vector *q_vector)
> >
> >               do {
> >                       start = u64_stats_fetch_begin(&txq->stats_sync);
> > -                     packets += u64_stats_read(&txq->q_stats.packets);
> > -                     bytes += u64_stats_read(&txq->q_stats.bytes);
> > +                     pkts = u64_stats_read(&txq->q_stats.packets);
> > +                     bts = u64_stats_read(&txq->q_stats.bytes);
> >               } while (u64_stats_fetch_retry(&txq->stats_sync, start));
> > +
> > +             packets += pkts;
> > +             bytes += bts;
> >       }
> >
> >       idpf_update_dim_sample(q_vector, &dim_sample, &q_vector->tx_dim,
> > @@ -3987,9 +3990,12 @@ static void idpf_net_dim(struct idpf_q_vector *q_vector)
> >
> >               do {
> >                       start = u64_stats_fetch_begin(&rxq->stats_sync);
> > -                     packets += u64_stats_read(&rxq->q_stats.packets);
> > -                     bytes += u64_stats_read(&rxq->q_stats.bytes);
> > +                     pkts = u64_stats_read(&rxq->q_stats.packets);
> > +                     bts = u64_stats_read(&rxq->q_stats.bytes);
> >               } while (u64_stats_fetch_retry(&rxq->stats_sync, start));
> > +
> > +             packets += pkts;
> > +             bytes += bts;
> >       }
> >
> >       idpf_update_dim_sample(q_vector, &dim_sample, &q_vector->rx_dim,
>
>
> Kind regards,
>
> Paul