From c67b104fd7982162885c5e43057ca761006748e2 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Tue, 19 May 2026 09:46:17 +0000 Subject: [PATCH 1/2] net/sched: sch_drr: annotate data-races around cl->deficit drr_dump_class_stats() runs without qdisc spinlock held. Add missing READ_ONCE()/WRITE_ONCE() annotations around cl->deficit. Fixes: edb09eb17ed8 ("net: sched: do not acquire qdisc spinlock in qdisc/class stats dump") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260519094618.2632073-2-edumazet@google.com Signed-off-by: Jakub Kicinski --- net/sched/sch_drr.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c index 3f6687fa9666..7da8c7c8421b 100644 --- a/net/sched/sch_drr.c +++ b/net/sched/sch_drr.c @@ -270,7 +270,7 @@ static int drr_dump_class_stats(struct Qdisc *sch, unsigned long arg, memset(&xstats, 0, sizeof(xstats)); if (qlen) - xstats.deficit = cl->deficit; + xstats.deficit = READ_ONCE(cl->deficit); if (gnet_stats_copy_basic(d, NULL, &cl->bstats, true) < 0 || gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 || @@ -362,7 +362,7 @@ static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch, if (!cl_is_active(cl)) { list_add_tail(&cl->alist, &q->active); - cl->deficit = cl->quantum; + WRITE_ONCE(cl->deficit, cl->quantum); } qstats_backlog_add(sch, len); @@ -389,7 +389,7 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch) len = qdisc_pkt_len(skb); if (len <= cl->deficit) { - cl->deficit -= len; + WRITE_ONCE(cl->deficit, cl->deficit - len); skb = qdisc_dequeue_peeked(cl->qdisc); if (unlikely(skb == NULL)) goto out; @@ -403,7 +403,7 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch) return skb; } - cl->deficit += cl->quantum; + WRITE_ONCE(cl->deficit, cl->deficit + cl->quantum); list_move_tail(&cl->alist, &q->active); } out: From a4d880b85089e12a5f2e8e2fee386310cec5b99a Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Tue, 19 May 2026 09:46:18 +0000 Subject: [PATCH 2/2] net/sched: sch_drr: make cl->quantum lockless cl->quantum does not need to be protected by RTNL or qdisc spinlock. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260519094618.2632073-3-edumazet@google.com Signed-off-by: Jakub Kicinski --- net/sched/sch_drr.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c index 7da8c7c8421b..020657f959b5 100644 --- a/net/sched/sch_drr.c +++ b/net/sched/sch_drr.c @@ -97,10 +97,8 @@ static int drr_change_class(struct Qdisc *sch, u32 classid, u32 parentid, } } - sch_tree_lock(sch); if (tb[TCA_DRR_QUANTUM]) - cl->quantum = quantum; - sch_tree_unlock(sch); + WRITE_ONCE(cl->quantum, quantum); return 0; } @@ -251,7 +249,7 @@ static int drr_dump_class(struct Qdisc *sch, unsigned long arg, nest = nla_nest_start_noflag(skb, TCA_OPTIONS); if (nest == NULL) goto nla_put_failure; - if (nla_put_u32(skb, TCA_DRR_QUANTUM, cl->quantum)) + if (nla_put_u32(skb, TCA_DRR_QUANTUM, READ_ONCE(cl->quantum))) goto nla_put_failure; return nla_nest_end(skb, nest); @@ -362,7 +360,7 @@ static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch, if (!cl_is_active(cl)) { list_add_tail(&cl->alist, &q->active); - WRITE_ONCE(cl->deficit, cl->quantum); + WRITE_ONCE(cl->deficit, READ_ONCE(cl->quantum)); } qstats_backlog_add(sch, len); @@ -403,7 +401,7 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch) return skb; } - WRITE_ONCE(cl->deficit, cl->deficit + cl->quantum); + WRITE_ONCE(cl->deficit, cl->deficit + READ_ONCE(cl->quantum)); list_move_tail(&cl->alist, &q->active); } out: