Re: [PATCH v2] net: ipv4: fix ARM64 alignment fault in multipath hash seed

[Eric Dumazet]

On Mon, Mar 2, 2026 at 7:03 AM Yung Chih Su <yuuchihsu@xxxxxxxxx> wrote:
>
> `struct sysctl_fib_multipath_hash_seed` contains two u32 fields
> (user_seed and mp_seed), making it an 8-byte structure with a 4-byte
> alignment requirement.
>
> In `fib_multipath_hash_from_keys()`, the code evaluates the entire
> struct atomically via `READ_ONCE()`:
>
>     mp_seed = READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed).mp_seed;
>
> While this silently works on GCC by falling back to unaligned regular
> loads which the ARM64 kernel tolerates, it causes a fatal kernel panic
> when compiled with Clang and LTO enabled.
>
> Commit e35123d83ee3 ("arm64: lto: Strengthen READ_ONCE() to acquire
> when CONFIG_LTO=y") strengthens `READ_ONCE()` to use Load-Acquire
> instructions (`ldar` / `ldapr`) to prevent compiler reordering bugs
> under Clang LTO. Since the macro evaluates the full 8-byte struct,
> Clang emits a 64-bit `ldar` instruction. ARM64 architecture strictly
> requires `ldar` to be naturally aligned, thus executing it on a 4-byte
> aligned address triggers a strict Alignment Fault (FSC = 0x21).
>
> Fix the read side by moving the `READ_ONCE()` directly to the `u32`
> member, which emits a safe 32-bit `ldar Wn`.
>
> Furthermore, Eric Dumazet pointed out that `WRITE_ONCE()` on the entire
> struct in `proc_fib_multipath_hash_set_seed()` is also flawed. Analysis
> shows that Clang splits this 8-byte write into two separate 32-bit
> `str` instructions. While this avoids an alignment fault, it destroys
> atomicity and exposes a tear-write vulnerability. Fix this by
> explicitly splitting the write into two 32-bit `WRITE_ONCE()`
> operations.
>
> Finally, add the missing `READ_ONCE()` when reading `user_seed` in
> `proc_fib_multipath_hash_seed()` to ensure proper pairing and
> concurrency safety.
>
> Fixes: 4ee2a8cace3f ("net: ipv4: Add a sysctl to set multipath hash seed")
> Suggested-by: Eric Dumazet <edumazet@xxxxxxxxxx>

Nit: Use of Suggested-by: implies I made the original suggestion for
this patch (before the V1)
I simply gave a feedback on your V1. The idea of the patch came from you :)

So next time, do not add a "Suggested-by:", as the expected step is
that I add a Reviewed-by tag when I am happy with a new version,
if I see it in time before it is merged.

No need for a V3, this is simply a reminder for your next patches.

> Signed-off-by: Yung Chih Su <yuuchihsu@xxxxxxxxx>
> ---

Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>

Thanks !