net: annotate a data-race in __dev_xmit_skb()

edumazet · opsiff · commit 0f5f222f13a7 · 2026-04-23T11:38:56.000+08:00
mainline inclusion from mainline-v6.19-rc1 category: bugfix q->limit is read locklessly, add a READ_ONCE(). Fixes: 100dfa7 ("net: dev_queue_xmit() llist adoption") Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20251121083256.674562-12-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> (cherry picked from commit 4792c3a) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
diff --git a/net/core/dev.c b/net/core/dev.c
@@ -4208,7 +4208,7 @@ static inline int __dev_xmit_skb(struct sk_buff *skb, struct Qdisc *q,
 	do {
 		if (first_n && !defer_count) {
 			defer_count = atomic_long_inc_return(&q->defer_count);
-			if (unlikely(defer_count > q->limit)) {
+			if (unlikely(defer_count > READ_ONCE(q->limit))) {
 				kfree_skb_reason(skb, SKB_DROP_REASON_QDISC_DROP);
 				return NET_XMIT_DROP;
 			}

Original file line number	Diff line number	Diff line change
`@@ -4208,7 +4208,7 @@ static inline int __dev_xmit_skb(struct sk_buff skb, struct Qdisc q,`
`4208`	`4208`	`do {`
`4209`	`4209`	`if (first_n && !defer_count) {`
`4210`	`4210`	`defer_count = atomic_long_inc_return(&q->defer_count);`
`4211`		`- if (unlikely(defer_count > q->limit)) {`
	`4211`	`+ if (unlikely(defer_count > READ_ONCE(q->limit))) {`
`4212`	`4212`	`kfree_skb_reason(skb, SKB_DROP_REASON_QDISC_DROP);`
`4213`	`4213`	`return NET_XMIT_DROP;`
`4214`	`4214`	`}`