Files
linux/include/net
Yung Chih Su 4ee7fa6cf7 net: ipv4: fix ARM64 alignment fault in multipath hash seed
`struct sysctl_fib_multipath_hash_seed` contains two u32 fields
(user_seed and mp_seed), making it an 8-byte structure with a 4-byte
alignment requirement.

In `fib_multipath_hash_from_keys()`, the code evaluates the entire
struct atomically via `READ_ONCE()`:

    mp_seed = READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed).mp_seed;

While this silently works on GCC by falling back to unaligned regular
loads which the ARM64 kernel tolerates, it causes a fatal kernel panic
when compiled with Clang and LTO enabled.

Commit e35123d83e ("arm64: lto: Strengthen READ_ONCE() to acquire
when CONFIG_LTO=y") strengthens `READ_ONCE()` to use Load-Acquire
instructions (`ldar` / `ldapr`) to prevent compiler reordering bugs
under Clang LTO. Since the macro evaluates the full 8-byte struct,
Clang emits a 64-bit `ldar` instruction. ARM64 architecture strictly
requires `ldar` to be naturally aligned, thus executing it on a 4-byte
aligned address triggers a strict Alignment Fault (FSC = 0x21).

Fix the read side by moving the `READ_ONCE()` directly to the `u32`
member, which emits a safe 32-bit `ldar Wn`.

Furthermore, Eric Dumazet pointed out that `WRITE_ONCE()` on the entire
struct in `proc_fib_multipath_hash_set_seed()` is also flawed. Analysis
shows that Clang splits this 8-byte write into two separate 32-bit
`str` instructions. While this avoids an alignment fault, it destroys
atomicity and exposes a tear-write vulnerability. Fix this by
explicitly splitting the write into two 32-bit `WRITE_ONCE()`
operations.

Finally, add the missing `READ_ONCE()` when reading `user_seed` in
`proc_fib_multipath_hash_seed()` to ensure proper pairing and
concurrency safety.

Fixes: 4ee2a8cace ("net: ipv4: Add a sysctl to set multipath hash seed")
Signed-off-by: Yung Chih Su <yuuchihsu@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260302060247.7066-1-yuuchihsu@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-03 17:20:37 -08:00
..
2025-11-03 16:49:53 +09:00
2024-10-08 15:33:49 -07:00
2025-04-24 17:03:45 -07:00
2025-07-08 18:05:25 -07:00
2022-08-09 22:14:02 -07:00
2024-05-08 10:35:09 +01:00
2024-08-26 09:37:23 -07:00
2024-11-13 18:49:50 -08:00
2024-08-26 09:37:23 -07:00
2025-08-26 17:34:31 -07:00
2025-09-03 15:16:49 -07:00
2026-01-21 19:28:32 -08:00
2024-05-07 01:35:55 +02:00
2026-01-13 10:12:11 +01:00
2024-08-26 09:37:23 -07:00
2024-12-06 17:43:08 -08:00
2021-10-13 09:40:46 -07:00
2024-08-26 09:37:23 -07:00
2025-04-15 08:21:46 -07:00
2023-07-14 20:39:30 -07:00
2025-09-18 12:32:06 +02:00
2024-08-26 09:37:23 -07:00
2024-08-26 09:37:23 -07:00
2025-09-03 15:08:20 -07:00
2025-04-11 18:58:10 -07:00
2025-07-04 09:32:35 +02:00
2025-04-11 18:58:10 -07:00
2024-05-30 18:29:38 -07:00
2025-09-08 18:06:21 -07:00
2023-10-04 11:49:20 -07:00
2025-07-11 11:00:57 -07:00
2023-07-28 14:07:59 -07:00
2022-12-12 15:04:39 -08:00
2023-09-14 16:16:36 +02:00
2026-02-10 20:21:48 -08:00