net: rmnet: annotate data-races around mux_id

Browse source

priv->mux_id is written under RTNL from rmnet_vnd_newlink() and
rmnet_changelink(), but rmnet_egress_handler() reads it from the
transmit path without any lock.

Likewise ep->mux_id is written under RTNL from rmnet_changelink(),
while rmnet_get_endpoint() reads it from the receive path under
RCU only.

Add the missing READ_ONCE()/WRITE_ONCE() annotations.

While at it, publish ep->mux_id before inserting the endpoint in
its new bucket in rmnet_changelink(). Otherwise a concurrent
rmnet_get_endpoint() walking the new bucket could find the
endpoint still carrying its old mux_id, and drop the packet.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Sean Tranchetti <sean.tranchetti@oss.qualcomm.com>
Reviewed-by: Subash Abhinov Kasiviswanathan <subash.a.kasiviswanathan@oss.qualcomm.com>
Link: https://patch.msgid.link/20260916132231.1780091-3-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

...

This commit is contained in:

Eric Dumazet 2026-09-16 13:22:30 +00:00 • committed by Jakub Kicinski

parent c863bf6a7d

commit 0067187dbe

3 changed files with 5 additions and 5 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

6

drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c

View file

2

drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c

View file

2

drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c

View file