linux/net
Eric Dumazet 21ef2d065a net: prevent torn reads in netdev_tc_txq
netdev_set_tc_queue() (and related helpers/drivers such as
netdev_bind_sb_channel_queue(), netdev_reset_tc(), and
netdev_unbind_sb_channel()) perform separate 16-bit writes to
dev->tc_to_txq[tc].count and dev->tc_to_txq[tc].offset.

Furthermore, memset() in netdev_reset_tc() and
netdev_unbind_sb_channel() provides no guarantee of performing
full 32-bit word stores.

Concurrent lockless readers (e.g. skb_tx_hash(), netdev_txq_to_tc(),
ixgbe_select_queue(), taprio, mqprio, FPE drivers) can observe torn
values where offset and count belong to inconsistent configurations.

Redefine struct netdev_tc_txq to embed count and offset inside a union
with a u32 combined field, allowing atomic manipulation via
READ_ONCE() and WRITE_ONCE().

Update all lockless readers and writers across the kernel to use
READ_ONCE() and WRITE_ONCE() on the combined field.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260812085440.3917924-2-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-17 10:27:48 -07:00
..
6lowpan net: Use helpers to get/set UDP len tree-wide 2026-07-22 13:47:02 +02:00
9p 9p: Add missing read barrier in virtio zero-copy path 2026-06-21 05:22:57 +00:00
802 appletalk: move the protocol out of tree 2026-06-16 14:37:06 -07:00
8021q vlan: defer real device state propagation to netdev_work 2026-06-25 10:18:40 -07:00
atm Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-08-06 11:53:47 -07:00
batman-adv batman-adv: remove negative returns for batadv_send_skb_unicast 2026-08-05 10:00:16 +02:00
bluetooth Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept 2026-08-07 15:40:28 -04:00
bpf bpf: Fix partial copy of non-linear test_run output 2026-06-21 17:55:06 -07:00
bridge Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-08-13 11:00:14 -07:00
can can: isotp: check register_netdevice_notifier() error in module init 2026-07-29 11:26:41 +02:00
ceph libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE 2026-07-23 20:29:42 +02:00
core net: prevent torn reads in netdev_tc_txq 2026-08-17 10:27:48 -07:00
dcb Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
devlink devlink: add generic device max_sfs parameter 2026-08-11 18:06:30 -07:00
dns_resolver keys, dns: Drop unused NUL terminator from upayload->data 2026-08-10 16:20:42 -07:00
dsa net: dsa: drop explicit NULL comparisons 2026-08-14 13:57:27 -07:00
ethernet bonding: prevent potential infinite loop in bond_header_parse() 2026-03-16 19:29:45 -07:00
ethtool ethtool: tsconfig: reject zero-valued tx_type and rx_filter bitsets 2026-08-13 17:44:54 -07:00
handshake handshake: Require admin permission for DONE command 2026-06-12 15:45:44 -07:00
hsr net: hsr: allow PRP RedBox (interlink) creation 2026-07-27 17:46:41 -07:00
ieee802154 ieee802154: convert dgram getsockopt to sockopt_t 2026-08-03 16:55:23 -07:00
ife net: ife: require ETH_HLEN to be pullable in ife_decode() 2026-06-13 17:34:39 -07:00
ipv4 gre: fix ERSPAN o_flags race/corruption in xmit and fill_info 2026-08-14 12:57:44 -07:00
ipv6 gre: fix ERSPAN o_flags race/corruption in xmit and fill_info 2026-08-14 12:57:44 -07:00
iucv net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() 2026-07-21 13:36:35 -07:00
kcm Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-06-16 14:59:58 -07:00
key ipsec-2026-06-22 2026-06-23 16:22:24 -07:00
l2tp l2tp: send netlink notifications in the tunnel's net namespace 2026-08-13 17:33:31 -07:00
l3mdev
lapb treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
llc llc: fix SAP refcount leak when creating incoming sockets 2026-07-17 13:17:46 +02:00
mac80211 Quite a bunch more work, of note: 2026-08-06 12:39:11 -07:00
mac802154 mac802154: fix netdev use-after-free in beacon worker 2026-08-05 17:12:50 -07:00
mctp mctp: check register_netdevice_notifier() error in mctp_device_init() 2026-07-23 09:17:36 -07:00
mpls net: mpls: initialize rtm_tos in mpls_getroute() 2026-07-28 11:06:06 +02:00
mptcp mptcp: implemented OoO queue pruning 2026-08-11 18:35:38 -07:00
ncsi net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length 2026-08-05 17:24:57 -07:00
netfilter netfilter pull request 26-08-10 2026-08-14 12:23:12 -07:00
netlabel Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-06-11 14:33:35 -07:00
netlink netlink: drop unneeded semicolon 2026-08-05 17:32:34 -07:00
nfc nfc: nci: uart: Constify struct tty_ldisc_ops 2026-06-11 20:21:32 +02:00
nsh
openvswitch netfilter pull request 26-08-10 2026-08-14 12:23:12 -07:00
packet af_packet: Don't send zero-byte data in tpacket_snd(). 2026-08-11 17:32:53 -07:00
phonet phonet: pep: convert getsockopt to sockopt_t 2026-08-03 16:55:23 -07:00
psample net: psample: fix info leak in PSAMPLE_ATTR_DATA 2026-06-17 16:35:50 -07:00
psp Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-07-30 12:53:19 -07:00
qrtr net: qrtr: ns: Raise lookup limit to 128 2026-08-06 08:10:44 -07:00
rds net/rds: clear i_rx_lat_trace in rds_inc_path_init() 2026-08-13 12:53:14 +02:00
rfkill Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
rxrpc rxrpc: fix io_thread race in rxrpc_wake_up_io_thread() 2026-07-21 11:52:29 +02:00
sched net: prevent torn reads in netdev_tc_txq 2026-08-17 10:27:48 -07:00
sctp Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-08-13 11:00:14 -07:00
shaper net: shaper: add a note that we expect cap dumps to be tiny 2026-06-11 12:55:23 +02:00
smc net: Const qualify network templated ctl_tables Arrays 2026-08-13 13:12:24 +02:00
strparser net: strparser: fix skb_head leak in strp_abort_strp() 2026-04-14 12:37:00 +02:00
sunrpc SUNRPC: pin upper rpc_clnt across the TLS connect_worker 2026-07-08 14:07:19 -04:00
switchdev bridge: No DEV_PATH_BR_VLAN_UNTAG_HW for dsa foreign 2026-03-19 13:14:00 +01:00
tipc tipc: read le->link under the node lock in tipc_node_link_down() 2026-08-11 15:50:22 +02:00
tls Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-08-13 11:00:14 -07:00
unix Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-08-13 11:00:14 -07:00
vmw_vsock net: Const qualify network templated ctl_tables Arrays 2026-08-13 13:12:24 +02:00
wireless Quite a bunch more work, of note: 2026-08-06 12:39:11 -07:00
x25 net/x25: fix use-after-free of the socket by its timers 2026-07-30 18:46:45 -07:00
xdp Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-08-06 11:53:47 -07:00
xfrm net: Const qualify ctl_tables that kmemdup unconditionally 2026-08-13 13:12:24 +02:00
compat.c net: Remove support for AIO on sockets 2026-05-29 14:05:30 +08:00
devres.c
Kconfig appletalk: move the protocol out of tree 2026-06-16 14:37:06 -07:00
Kconfig.debug
Makefile appletalk: move the protocol out of tree 2026-06-16 14:37:06 -07:00
socket.c Networking changes for 7.2. 2026-06-17 08:17:00 +01:00
sysctl_net.c net: enforce net sysctl registration 2026-08-13 13:12:21 +02:00