[PATCH net] net: gen_estimator: protect seqcount updates from hardirq readers

[Runyu Xiao]

est_timer updates the estimator seqcount with preemption disabled, which
does not exclude hardirq readers on non-PREEMPT_RT kernels.  A reader can
observe an odd sequence and spin while the timer is interrupted.

Disable interrupts around the seqcount write section.

The failure mode was reproduced with an x86_64 kernel under QEMU. A
test-only hardirq injection invokes gen_estimator_read() on the same CPU
while est_timer() is updating the sequence counter.

On the unfixed kernel, the hardirq reader reports the seqcount lockdep
warning and spins until QEMU times out. With this change, the reader is
deferred until the writer restores local IRQs, then returns and the guest
shuts down normally. The hardirq context is deliberately injected to
exercise this interleaving; ordinary userspace traffic does not guarantee
it.

Fixes: 1c0d32fde5bd ("net_sched: gen_estimator: complete rewrite of rate estimators")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@xxxxxxxxxx>
---
 net/core/gen_estimator.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index c34e58c6c..6aba5916d 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -79,6 +79,7 @@ static void est_timer(struct timer_list *t)
 	struct gnet_stats_basic_sync b;
 	u64 b_bytes, b_packets;
 	u64 rate, brate;
+	unsigned long flags;
 
 	est_fetch_counters(est, &b);
 	b_bytes = u64_stats_read(&b.bytes);
@@ -90,12 +91,12 @@ static void est_timer(struct timer_list *t)
 	rate = (b_packets - est->last_packets) << (10 - est->intvl_log);
 	rate = (rate >> est->ewma_log) - (est->avpps >> est->ewma_log);
 
-	preempt_disable_nested();
+	local_irq_save(flags);
 	write_seqcount_begin(&est->seq);
 	est->avbps += brate;
 	est->avpps += rate;
 	write_seqcount_end(&est->seq);
-	preempt_enable_nested();
+	local_irq_restore(flags);
 
 	est->last_bytes = b_bytes;
 	est->last_packets = b_packets;
-- 
2.34.1