qiurui/Centos-kernel-stream-10
1
0
Fork 0
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10.git synced 2026-09-09 00:07:04 +08:00
Code Issues Packages Projects Releases Wiki Activity

net: ipv4: fix ARM64 alignment fault in multipath hash seed

Browse Source 
JIRA: https://redhat.atlassian.net/browse/RHEL-152711
Upstream Status: linux.git

commit 4ee7fa6cf78ff26d783d39e2949d14c4c1cd5e7f
Author: Yung Chih Su <yuuchihsu@gmail.com>
Date:   Mon Mar 2 14:02:47 2026 +0800

    net: ipv4: fix ARM64 alignment fault in multipath hash seed

    `struct sysctl_fib_multipath_hash_seed` contains two u32 fields
    (user_seed and mp_seed), making it an 8-byte structure with a 4-byte
    alignment requirement.

    In `fib_multipath_hash_from_keys()`, the code evaluates the entire
    struct atomically via `READ_ONCE()`:

        mp_seed = READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed).mp_seed;

    While this silently works on GCC by falling back to unaligned regular
    loads which the ARM64 kernel tolerates, it causes a fatal kernel panic
    when compiled with Clang and LTO enabled.

    Commit e35123d83e ("arm64: lto: Strengthen READ_ONCE() to acquire
    when CONFIG_LTO=y") strengthens `READ_ONCE()` to use Load-Acquire
    instructions (`ldar` / `ldapr`) to prevent compiler reordering bugs
    under Clang LTO. Since the macro evaluates the full 8-byte struct,
    Clang emits a 64-bit `ldar` instruction. ARM64 architecture strictly
    requires `ldar` to be naturally aligned, thus executing it on a 4-byte
    aligned address triggers a strict Alignment Fault (FSC = 0x21).

    Fix the read side by moving the `READ_ONCE()` directly to the `u32`
    member, which emits a safe 32-bit `ldar Wn`.

    Furthermore, Eric Dumazet pointed out that `WRITE_ONCE()` on the entire
    struct in `proc_fib_multipath_hash_set_seed()` is also flawed. Analysis
    shows that Clang splits this 8-byte write into two separate 32-bit
    `str` instructions. While this avoids an alignment fault, it destroys
    atomicity and exposes a tear-write vulnerability. Fix this by
    explicitly splitting the write into two 32-bit `WRITE_ONCE()`
    operations.

    Finally, add the missing `READ_ONCE()` when reading `user_seed` in
    `proc_fib_multipath_hash_seed()` to ensure proper pairing and
    concurrency safety.

    Fixes: 4ee2a8cace ("net: ipv4: Add a sysctl to set multipath hash seed")
    Signed-off-by: Yung Chih Su <yuuchihsu@gmail.com>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Link: https://patch.msgid.link/20260302060247.7066-1-yuuchihsu@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Guillaume Nault <gnault@redhat.com>
This commit is contained in:
Guillaume Nault
2026-05-07 15:16:02 +02:00
parent 6a89a8ace5
commit bfe5189b7f
2 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/net/ip_fib.h
+1 -1
View File
@@ -559,7 +559,7 @@ static inline u32 fib_multipath_hash_from_keys(const struct net *net,
siphash_aligned_key_t hash_key;
u32 mp_seed;
mp_seed = READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed).mp_seed;
mp_seed = READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed.mp_seed);
fib_multipath_hash_construct_key(&hash_key, mp_seed);
return flow_hash_from_keys_seed(keys, &hash_key);
net/ipv4/sysctl_net_ipv4.c
+3 -2
View File
@@ -482,7 +482,8 @@ static void proc_fib_multipath_hash_set_seed(struct net *net, u32 user_seed)
proc_fib_multipath_hash_rand_seed),
};
WRITE_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed, new);
WRITE_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed.user_seed, new.user_seed);
WRITE_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed.mp_seed, new.mp_seed);
}
static int proc_fib_multipath_hash_seed(const struct ctl_table *table, int write,
@@ -496,7 +497,7 @@ static int proc_fib_multipath_hash_seed(const struct ctl_table *table, int write
int ret;
mphs = &net->ipv4.sysctl_fib_multipath_hash_seed;
user_seed = mphs->user_seed;
user_seed = READ_ONCE(mphs->user_seed);
tmp = *table;
tmp.data = &user_seed;