Re: [PATCH net v2] pppoe: wait for RCU readers before reusing a socket

[Eric Dumazet]

Le lun. 26 oct. 2026 à 07:13, Qingfang Deng <qingfang.deng@xxxxxxxxx> a écrit :
>
> When pppoe_connect() disconnects or reuses a socket, it removes the old
> session from the hash table and resets the socket's fields. An RCU
> reader that reached the entry before it was unlinked can still be using
> its address, ifindex or next pointer.
>
> If sockets A and B share a hash bucket with A preceding B, a concurrent
> __get_item() looking for B can be traversing A when it is removed.
> Clearing A->next then makes the lookup miss B and drop the packet.
> Reinserting A can similarly redirect the reader into another hash chain.
>
> Call synchronize_net() after unlinking the old session and before
> clearing its fields. This allows existing receive-path and
> /proc/net/pppoe readers to finish before the socket is cleared or reused.
>
> This was found by Sashiko's static analysis, and reproduced on a VM
> stress test with KCSAN.
>
>  BUG: KCSAN: data-race in hash_item+0x1c/0x60
>
>  race at unknown origin, with read to 0xffff888000a1c566 of 2 bytes by task 147 on cpu 2:
>   hash_item+0x1c/0x60
>   pppoe_seq_next+0x112/0x1b0
>   seq_read_iter+0x595/0x700
>   seq_read+0xb0/0xe0
>   proc_reg_read+0xd0/0xf0
>   vfs_read+0xbd/0x220
>   ksys_read+0xa9/0x100
>   __x64_sys_read+0x47/0x60
>   x64_sys_call+0x98/0x1fd0
>   do_syscall_64+0x5b/0x260
>   entry_SYSCALL_64_after_hwframe+0x4b/0x53

Please next time include symbols. (scripts/decode_stacktrace.sh)

>
>  value changed: 0x0002 -> 0x0000
>
> Fixes: 72cdc67e7fa7 ("pppoe: remove rwlock usage")
> Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
> Closes: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261020092118.47416-1-qingfang.deng@xxxxxxxxx
> Signed-off-by: Qingfang Deng <qingfang.deng@xxxxxxxxx>
> ---

Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>