Re: [PATCH] ipv4: fib: annotate data-race around nh->nh_saddr

[Kuniyuki Iwashima]

On Fri, Sep 11, 2026 at 12:38 AM Linkui Xiao <xiaolinkui@xxxxxxx> wrote:
>
> From: Linkui Xiao <xiaolinkui@xxxxxxxxxx>
>
> fib_select_multipath() compares nexthop_nh->nh_saddr against the flow
> source address with no lock held, while fib_info_update_nhc_saddr()
> stores a new value from another CPU as soon as the preferred source
> address of the egress device changes.
>
> Commit 195374d89368 ("ipv4: fib: annotate races around nh->nh_saddr_genid
> and nh->nh_saddr") added WRITE_ONCE() on the store side and READ_ONCE()
> in fib_result_prefsrc() after syzbot reported
>
>         BUG: KCSAN: data-race in fib_select_path / fib_select_path
>
> but it only covered that reader. fib_select_multipath(), reached from
> fib_select_path(), is a second lockless reader of nh->nh_saddr and was
> left bare.

32607a332cfe added the reader after 195374d89368.


> Annotate it as well so that the value cannot be torn or
> reloaded while the per-nexthop scores are being computed.
>
> Fixes: 195374d89368 ("ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr")
> Signed-off-by: Linkui Xiao <xiaolinkui@xxxxxxxxxx>
> ---
>  net/ipv4/fib_semantics.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
> index 7a362f2e2c2b..885c6fae5232 100644
> --- a/net/ipv4/fib_semantics.c
> +++ b/net/ipv4/fib_semantics.c
> @@ -2204,7 +2204,7 @@ void fib_select_multipath(struct fib_result *res, int hash,
>                     (use_neigh && !fib_good_nh(nexthop_nh)))
>                         continue;
>
> -               if (saddr && nexthop_nh->nh_saddr == saddr)
> +               if (saddr && READ_ONCE(nexthop_nh->nh_saddr) == saddr)
>                         nh_score += 2;
>                 if (hash <= nh_upper_bound)
>                         nh_score++;
> --
> 2.25.1
>