Re: [PATCH net] net: gen_estimator: protect seqcount updates from hardirq readers

[Eric Dumazet]

On Wed, Sep 23, 2026 at 5:29 AM Runyu Xiao <runyu.xiao@xxxxxxxxxx> wrote:
>
> est_timer updates the estimator seqcount with preemption disabled, which
> does not exclude hardirq readers on non-PREEMPT_RT kernels.  A reader can
> observe an odd sequence and spin while the timer is interrupted.
>

There is no hardirq reader of gen_estimator_read() in the tree.

The only callers are:
 - gnet_stats_copy_rate_est() from tc dump paths (process context)
 - tcf_police_act() (BH)
 - xt_rateest_mt() (process or BH)

est_timer() itself runs from TIMER_SOFTIRQ (or ktimers/N on RT), and
softirqs do not nest on a CPU, so no reader can interrupt the writer.

> Disable interrupts around the seqcount write section.
>
> The failure mode was reproduced with an x86_64 kernel under QEMU. A
> test-only hardirq injection invokes gen_estimator_read() on the same CPU
> while est_timer() is updating the sequence counter.

Injecting a call that does not exist is not a reproducer; with that
methodology essentially every seqcount_t writer in the kernel would need
local_irq_save(). Note that such a hardirq caller would already deadlock
on e->stats_lock in est_fetch_counters() anyway.

Also, the preempt_disable_nested() here is deliberate (9f74c0ea9b26
"net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y").
local_irq_save() is not remapped on PREEMPT_RT, so this patch would add
a real IRQ-off section in a context RT intentionally keeps preemptible,
and would lose the lockdep assertion on !RT.

Finally, the Fixes: tag and Cc: stable are not warranted: nothing
regressed in 1c0d32fde5bd, and there is no user-visible bug.

pw-bot: rejected