[PATCH net] raw: annotate data-races in raw_v4_match()

From: Runyu Xiao

Date: Mon Jun 01 2026 - 03:46:17 EST


raw_v4_match() is a lockless match helper under sk_for_each_rcu()
and still reads inet->inet_num, inet->inet_rcv_saddr and
sk->sk_bound_dev_if with plain loads.

Add READ_ONCE() annotations for these fields.

Signed-off-by: Runyu Xiao <runyu.xiao@xxxxxxxxxx>
---
net/ipv4/raw.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 5aaf9c62c8e1..faa49f3d239a 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -120,11 +120,14 @@ bool raw_v4_match(struct net *net, const struct sock *sk, unsigned short num,
__be32 raddr, __be32 laddr, int dif, int sdif)
{
const struct inet_sock *inet = inet_sk(sk);
+ unsigned short match_num = READ_ONCE(inet->inet_num);
+ __be32 match_rcv_saddr = READ_ONCE(inet->inet_rcv_saddr);
+ int match_bound_dev_if = READ_ONCE(sk->sk_bound_dev_if);

- if (net_eq(sock_net(sk), net) && inet->inet_num == num &&
+ if (net_eq(sock_net(sk), net) && match_num == num &&
!(inet->inet_daddr && inet->inet_daddr != raddr) &&
- !(inet->inet_rcv_saddr && inet->inet_rcv_saddr != laddr) &&
- raw_sk_bound_dev_eq(net, sk->sk_bound_dev_if, dif, sdif))
+ !(match_rcv_saddr && match_rcv_saddr != laddr) &&
+ raw_sk_bound_dev_eq(net, match_bound_dev_if, dif, sdif))
return true;
return false;
}
--
2.34.1