Commit fd098a23bf8f for kernel

commit fd098a23bf8fda7eae48db9b06e7c34fc4d228fa
Author: Eric Dumazet <edumazet@google.com>
Date:   Wed Jul 22 14:17:43 2026 +0000

    drop_monitor: perform u64_stats updates under IRQ-disabled section

    In net_dm_packet_trace_kfree_skb_hit() and net_dm_hw_trap_packet_probe(),
    u64_stats_update_begin() / u64_stats_inc() / u64_stats_update_end() were
    called after spin_unlock_irqrestore(&...drop_queue.lock, flags), when local
    IRQs had already been re-enabled.

    Tracepoint probes can execute in IRQ or softirq context. On 32-bit
    architectures, u64_stats_update_begin() disables preemption but not interrupts,
    relying on seqcount writes. If a nested interrupt occurs on the same CPU during
    the 64-bit stats update, the reentrant seqcount update can corrupt the
    seqcount state or stats value.

    Fix this by performing the 64-bit per-CPU stats update before releasing
    drop_queue.lock via spin_unlock_irqrestore(), ensuring local interrupts remain
    disabled during the u64_stats update.

    Fixes: e9feb58020f9 ("drop_monitor: Expose tail drop counter")
    Fixes: 5e58109b1ea4 ("drop_monitor: Add support for packet alert mode for hardware drops")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Link: https://patch.msgid.link/20260722141743.3266924-3-edumazet@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index 9abcdee8c76e..abaf108ac4db 100644
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -530,10 +530,10 @@ static void net_dm_packet_trace_kfree_skb_hit(void *ignore,
 	return;

 unlock_free:
-	spin_unlock_irqrestore(&data->drop_queue.lock, flags);
 	u64_stats_update_begin(&data->stats.syncp);
 	u64_stats_inc(&data->stats.dropped);
 	u64_stats_update_end(&data->stats.syncp);
+	spin_unlock_irqrestore(&data->drop_queue.lock, flags);
 	consume_skb(nskb);
 }

@@ -997,10 +997,10 @@ net_dm_hw_trap_packet_probe(void *ignore, const struct devlink *devlink,
 	return;

 unlock_free:
-	spin_unlock_irqrestore(&hw_data->drop_queue.lock, flags);
 	u64_stats_update_begin(&hw_data->stats.syncp);
 	u64_stats_inc(&hw_data->stats.dropped);
 	u64_stats_update_end(&hw_data->stats.syncp);
+	spin_unlock_irqrestore(&hw_data->drop_queue.lock, flags);
 	net_dm_hw_metadata_free(n_hw_metadata);
 free:
 	consume_skb(nskb);