From nobody Mon Jun 8 12:15:40 2026 Received: from stravinsky.debian.org (stravinsky.debian.org [82.195.75.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 573843403F2; Fri, 29 May 2026 07:45:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=82.195.75.108 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780040732; cv=none; b=manwNZA0N8s+40U0PJFls0UGFZImdFYElWUhelgMzrLBi5QykxWQVE7bmpv9ntyvrWCaKOSdkZultkMJo4zszQnA4/M7W1OA83VMIQxxYEGljuy3T841aMoKuNzrIQSXDu6pJ/CMVJcPQaWKfkWhKVtcVABKQMvcCLoliZD3DDY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780040732; c=relaxed/simple; bh=UbOAfliXwjnfF8vmn8x8EREiXGcuVW7ymVZEtLwcXZY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=ehK9rYfDmv/narqYY45xGL6Il+nVHlLvIeNJKDuL5TviJvMJExLuD3EdQMaRT7DkpHdHBsKbltc9Cs8w2u+2EfDlP4K2h1ftXirDfNyDDzr4HEHda1iF9NTFnXi9U/qdzV4SBaa6870ULFj5bmGCY8n51XRTCxoqEY4RIkiWiZA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=debian.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b=dkKfXBZC; arc=none smtp.client-ip=82.195.75.108 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=debian.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b="dkKfXBZC" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Cc:To:In-Reply-To:References: Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date: From:Reply-To:Content-ID:Content-Description; bh=WarqaN6exri5sK3N2I5R9aD/CatfUNqjEnaMVNpBBdg=; b=dkKfXBZCUfUO4XuWcDLnOTpb7q VQkZ5Wvh72UHbzqnonbFUAjt757z/TwtmP6LThgLiF434MhfHPtfnDdyRDf739bX8cZ0BvN/bSbCm A10YziBIJipkKa49epuYLh6iQ/1nU9oga0jkIF48L34t0xAaWmoU3BSiaETraUC4UPrWZlbpxe9Nf KGeCbpZr97RCcx4seev8/aTKBJkRtSoFKOR+sHPCiJIQingaB6LRHbh1JxJ9q7myiLFM+YreCcEg1 7Ym5aYr2PBDW09bUzJp086q8Wqk2HAQFGRL7hz2oz8KdR0HrIHGEH3BrzE6Nl40bLj+k2FsAChwjB 21woQ6Sw==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from ) id 1wSruC-004kM3-13; Fri, 29 May 2026 07:45:20 +0000 From: Breno Leitao Date: Fri, 29 May 2026 03:45:11 -0400 Subject: [PATCH net 1/3] netconsole: do not schedule skb pool refill from NMI Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260529-netcons_fix_before_move-v1-1-cb2d1426dd75@debian.org> References: <20260529-netcons_fix_before_move-v1-0-cb2d1426dd75@debian.org> In-Reply-To: <20260529-netcons_fix_before_move-v1-0-cb2d1426dd75@debian.org> To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Neil Horman , Cong Wang Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Breno Leitao , kernel-team@meta.com X-Mailer: b4 0.16-dev-d5d98 X-Developer-Signature: v=1; a=openpgp-sha256; l=2485; i=leitao@debian.org; h=from:subject:message-id; bh=UbOAfliXwjnfF8vmn8x8EREiXGcuVW7ymVZEtLwcXZY=; b=owEBbQKS/ZANAwAKATWjk5/8eHdtAcsmYgBqGUQM10C7KfVV1x7B9PjVIqDqOzYgy6K+Hr1xQ UeX18Te+XqJAjMEAAEKAB0WIQSshTmm6PRnAspKQ5s1o5Of/Hh3bQUCahlEDAAKCRA1o5Of/Hh3 bd7LEACJDmS7Hk7+rBdOm4DR3mwwcNwkJrzUXEdYOIOpMFpYgUY12M/A9v4xLrn39NlYAbWNVHF jrkpgtqBfwQlPdf6nCpxWzeUjH150JvMs98z6/Iq03MNIFqyFOl7MtbI2t7JmZocjjHOSL6vaTE NY319CU/chcO1RCXRoua9g6sOWsXpuJ/TES9gJm8zDgD/I1pAqfwcGhSWs53d5veBZA4cdWmLRP 54+he8vElHUsIGWWt79vIz6EZYWDnuMmgn8suEJbEQZlt/gcstJFTtX3b97MTDCoWab1LzeRq8h vyzwJ0HeMDrjC8eKQFsW+S/PzsDtCJZLXypqcGCUw9V1qESbi83Ne5iWT6d9JbQGaTFuz1+teKY 0F1+knHOBrbZOVpqEAVuDKxlMxUlU1PV4zHfHmRZQ/lTwsqNrBwGBrM8Zp2WB8AoV6AIdlTij1b 9dGa5vP1arPDA7D60S8f/FmuSSbbNeMmPL7rDwKZpM8aanc+CJzDXwPp4SdDQiTb5NcO2hVAKw9 8lPvck7PAZx9WG/9mX/dLeYdMN0oOiNb+w9anXH24tUCR6AhhKQ/Ug0UB+9gMuo2yxlwCQ5jssa 2By++LtcGEUsGsJUmDzQaSddCVRRegeGgsKXCAwkgjwsJHpJ236MyHZk9DIBoHIxhabWGChiQf5 vpn7nNMsynk8MpQ== X-Developer-Key: i=leitao@debian.org; a=openpgp; fpr=AC8539A6E8F46702CA4A439B35A3939FFC78776D X-Debian-User: leitao When alloc_skb() fails in find_skb(), the fallback path dequeues an skb from np->skb_pool and unconditionally calls schedule_work() to top the pool back up. schedule_work() ends up taking the workqueue pool locks, which are not NMI-safe. netconsole_write() is registered as the nbcon write_atomic callback and is explicitly marked CON_NBCON_ATOMIC_UNSAFE, meaning it is invoked from emergency/panic contexts including NMIs. If the NMI interrupts a thread already holding the workqueue pool lock, calling schedule_work() self-deadlocks and the panic message that was being printed is lost. Introduce netcons_skb_pop() to fold the pool dequeue and the refill request into a single helper. The helper skips schedule_work() when called from NMI context; the pool is best-effort, and the next non-NMI invocation of find_skb() will refill it. This keeps the fast path untouched, the panic path NMI-safe, and the locking rules around the fallback pool documented in one place. Fixes: 248f6571fd4c ("netpoll: Optimize skb refilling on critical path") Signed-off-by: Breno Leitao --- drivers/net/netconsole.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c index d804d44af87c..699bdfa1fb45 100644 --- a/drivers/net/netconsole.c +++ b/drivers/net/netconsole.c @@ -1654,6 +1654,23 @@ static struct notifier_block netconsole_netdev_notif= ier =3D { .notifier_call =3D netconsole_netdev_event, }; =20 +/* Pop a pre-allocated skb from the pool and request a refill. + * + * The refill is requested via schedule_work(), which takes the workqueue + * pool locks and is therefore not NMI-safe. Skip the refill when called + * from NMI context; the next non-NMI caller will top the pool back up. + */ +static struct sk_buff *netcons_skb_pop(struct netpoll *np) +{ + struct sk_buff *skb; + + skb =3D skb_dequeue(&np->skb_pool); + if (!in_nmi()) + schedule_work(&np->refill_wq); + + return skb; +} + static struct sk_buff *find_skb(struct netpoll *np, int len, int reserve) { int count =3D 0; @@ -1663,10 +1680,8 @@ static struct sk_buff *find_skb(struct netpoll *np, = int len, int reserve) repeat: =20 skb =3D alloc_skb(len, GFP_ATOMIC); - if (!skb) { - skb =3D skb_dequeue(&np->skb_pool); - schedule_work(&np->refill_wq); - } + if (!skb) + skb =3D netcons_skb_pop(np); =20 if (!skb) { if (++count < 10) { --=20 2.51.0 From nobody Mon Jun 8 12:15:40 2026 Received: from stravinsky.debian.org (stravinsky.debian.org [82.195.75.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 572DA33F5A4; Fri, 29 May 2026 07:45:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=82.195.75.108 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780040731; cv=none; b=YJT+9OOyS4K377QAKAFk2eBqp9LhjipP5S4goHrlkWjLslVAkc2ofhJRTOmsG5GnEgvz3bRfjDYSyhkgFSTEhsiqXsx/KaO33bqCkIG17O8AVKzNg9fyq/gjF9dzTu5Hw+PUWqazQmwe8LfwJbeTChDbyOtfBP8CGm44bUUBdWM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780040731; c=relaxed/simple; bh=mEM95G3WNy6plziLguYpsnPOf7PAIL0711uhgZK4fMw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=cxdRGKQT4O4M62I9yU7V6TayjVHAXlbGitU3Cn1WMPSQSkViu24EiiHBdTfulbC/MwerQ/LTcrqiY2rp9ScMhcVSYXXw1ypYo86sZrLgFOJ5fnHxaZcuKEcmd9SM81nlnX7bORzbytevxR46YM/bXfKPbcKSc5b1Siod4400QKU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=debian.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b=F237WIcV; arc=none smtp.client-ip=82.195.75.108 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=debian.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b="F237WIcV" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Cc:To:In-Reply-To:References: Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date: From:Reply-To:Content-ID:Content-Description; bh=Y2P1ayzVY7FwXmEpq+5FJne3BKpnMFMzUXsWtT6mEVY=; b=F237WIcV+KEddYQm8+bL3fQgQm YfiVTG72OVAKiDnUh/A+nhE/5LANGS3glUsyWwktOhew4/SqZ3JiO/KdgxOAcaDGHDHzYSDcoiX7x vyQSR7J8O0U2PHTz0sx4dwCZhKDDLtsrz0ITkTzq1D5d3AgHKB+/trLpnvcYhqjBo2NUGHZSPAh7j maUqdLGkB/O2o6nABbkEb91B3ZVjE8wDZXIumyGcpIwWRzaLpfETy3fEhjKgKPN1UhHU/Ysg5vUSQ JQre4Vq5UGDjLgyONoyVI24szXvquoHsbKBMGyMnWWvIdLHf083Q/iaQYjyfK45TWu5ZPAw4+ez12 bdrPnfvA==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from ) id 1wSruD-004kM5-1g; Fri, 29 May 2026 07:45:21 +0000 From: Breno Leitao Date: Fri, 29 May 2026 03:45:12 -0400 Subject: [PATCH net 2/3] netconsole: do not dequeue pooled skbs that cannot satisfy len Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260529-netcons_fix_before_move-v1-2-cb2d1426dd75@debian.org> References: <20260529-netcons_fix_before_move-v1-0-cb2d1426dd75@debian.org> In-Reply-To: <20260529-netcons_fix_before_move-v1-0-cb2d1426dd75@debian.org> To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Neil Horman , Cong Wang Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Breno Leitao , kernel-team@meta.com X-Mailer: b4 0.16-dev-d5d98 X-Developer-Signature: v=1; a=openpgp-sha256; l=4366; i=leitao@debian.org; h=from:subject:message-id; bh=mEM95G3WNy6plziLguYpsnPOf7PAIL0711uhgZK4fMw=; b=owEBbQKS/ZANAwAKATWjk5/8eHdtAcsmYgBqGUQMSS85VJvrhxKGQlisDTMktYQdRMPcdjnHI qZRT0b01mSJAjMEAAEKAB0WIQSshTmm6PRnAspKQ5s1o5Of/Hh3bQUCahlEDAAKCRA1o5Of/Hh3 bfp1EACPmTE08kNbFONb4I4Gr8l+veHNfFq7Tg4A8uyIaxgk50m5PCVvEAhcYZsWHDAWMcSqGU3 /Z3IXKbPe1Fr8R0EInMtREyn+snbQJ3a4I4zCodul0AxJq+0ErjzwyKbvildSLxOVwXomwCi/SS eNbWklgXxRYnP4eh41g3lUGCcAFO1Qqw8rM0f4epezgSMvrt7xEoYotzRjguG3pqYfHfyrJVEXZ ZpYd4XRRZo9FR8h7Iw5LskegTkKFu5u5TfVlR/1EFYYShBkd6yUq12wmiexV0vaZ4CQvauS5ae2 sHRVEA1SeGPqfGiuPRE7rfVnO1ZPehbL5EJTwGbPKaYgT1uCojziUsnwwRhEtGXUvE3knrZjGA6 5ufFsT2/6QTHqXtNGiH1sug+IBq/PjF2kO8vuJUS87THets36/6smIjk8UKa3O3c2yUht8YS2X0 kQ/naZvCVQvmjoB2VCe0tR115k3KJO8ykzNkWni5u3ZQ1e59ZXF1+E1v42AActj0ltAXqb4+j5O C8sdBnKijxUe59xuvMPVCpPbDXHvS02svg3L441o/Q8UgxnRTN5TUMBUJnEhqPtJc7Bs7T1odB2 dfdJikbcW+KKCiQj2sCKI2m2P7S9HCrPikKj9sBULZ7kWQEsfwb29Msts5FvUDVEFRl1UFHeg6Y 24nRM2Hbn34UJNw== X-Developer-Key: i=leitao@debian.org; a=openpgp; fpr=AC8539A6E8F46702CA4A439B35A3939FFC78776D X-Debian-User: leitao find_skb() falls back to np->skb_pool when the GFP_ATOMIC alloc_skb() fails. The pool is refilled by refill_skbs(), which always allocates buffers of MAX_SKB_SIZE (ethhdr + iphdr + udphdr + MAX_UDP_CHUNK =3D=3D 1502 bytes). netconsole, however, computes the requested length dynamically as total_len + np->dev->needed_tailroom If the egress device declares a non-zero needed_tailroom (e.g. some tunnel or hardware accelerator devices), the required length can exceed MAX_SKB_SIZE. The pooled skb is then handed back to the caller, which immediately performs skb_put(skb, len), trips the tail > end check, and triggers skb_over_panic(). Leave the normal alloc_skb(len, GFP_ATOMIC) path untouched -- the slab allocator can still satisfy oversized requests when memory is available, so senders to devices with non-zero needed_tailroom keep working in the common case. Only the pool fallback is gated: when alloc_skb() failed and len exceeds the pool buffer size, skip the skb_dequeue() instead of burning a pre-allocated skb on a request that would later trip skb_over_panic(). Reserving pool entries for requests they can actually satisfy also keeps the panic path, which depends on the pool being primed, intact. When that drop happens, emit a rate-limited net_warn() so the user notices that netconsole is unable to push messages on the egress device. The warn is skipped under in_nmi() for the same reason schedule_work() is: printk machinery taken by net_warn_ratelimited() is not NMI-safe and would risk recursing into the same nbcon console we are servicing. MAX_SKB_SIZE / MAX_UDP_CHUNK were private to net/core/netpoll.c. Move them to include/linux/netpoll.h so netconsole can reference the same definition that refill_skbs() uses, keeping the two in sync by construction. The header now pulls in and explicitly so MAX_SKB_SIZE remains self-contained for any future user. Fixes: 954fba027405 ("netpoll: fix netpoll_send_udp() bugs") Signed-off-by: Breno Leitao --- drivers/net/netconsole.c | 7 ++++++- include/linux/netpoll.h | 16 ++++++++++++++++ net/core/netpoll.c | 7 ------- 3 files changed, 22 insertions(+), 8 deletions(-) diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c index 699bdfa1fb45..a3dcbe713a0b 100644 --- a/drivers/net/netconsole.c +++ b/drivers/net/netconsole.c @@ -1680,8 +1680,13 @@ static struct sk_buff *find_skb(struct netpoll *np, = int len, int reserve) repeat: =20 skb =3D alloc_skb(len, GFP_ATOMIC); - if (!skb) + if (!skb) { + /* The pool is refilled with MAX_SKB_SIZE buffers */ + if (WARN_ON_ONCE(len > MAX_SKB_SIZE)) + return NULL; + skb =3D netcons_skb_pop(np); + } =20 if (!skb) { if (++count < 10) { diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h index e4b8f1f91e54..88f7daa8560e 100644 --- a/include/linux/netpoll.h +++ b/include/linux/netpoll.h @@ -13,12 +13,28 @@ #include #include #include +#include +#include =20 union inet_addr { __be32 ip; struct in6_addr in6; }; =20 +/* + * Maximum payload netpoll's preallocated skb pool can carry. Keep this in + * sync with the buffer size used by refill_skbs() in net/core/netpoll.c; + * callers (e.g. netconsole) use it to detect requests the pool can never + * satisfy and avoid dequeuing a pooled skb that would later trip + * skb_over_panic() in skb_put(). + */ +#define MAX_UDP_CHUNK 1460 +#define MAX_SKB_SIZE \ + (sizeof(struct ethhdr) + \ + sizeof(struct iphdr) + \ + sizeof(struct udphdr) + \ + MAX_UDP_CHUNK) + struct netpoll { struct net_device *dev; netdevice_tracker dev_tracker; diff --git a/net/core/netpoll.c b/net/core/netpoll.c index b3fe59445f2d..229dde818ab3 100644 --- a/net/core/netpoll.c +++ b/net/core/netpoll.c @@ -41,16 +41,9 @@ * message gets out even in extreme OOM situations. */ =20 -#define MAX_UDP_CHUNK 1460 #define MAX_SKBS 32 #define USEC_PER_POLL 50 =20 -#define MAX_SKB_SIZE \ - (sizeof(struct ethhdr) + \ - sizeof(struct iphdr) + \ - sizeof(struct udphdr) + \ - MAX_UDP_CHUNK) - static unsigned int carrier_timeout =3D 4; module_param(carrier_timeout, uint, 0644); =20 --=20 2.51.0 From nobody Mon Jun 8 12:15:40 2026 Received: from stravinsky.debian.org (stravinsky.debian.org [82.195.75.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 57243328635; Fri, 29 May 2026 07:45:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=82.195.75.108 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780040731; cv=none; b=AhIXY+Rp51IfLDPUWFFb4ebRBuzSOyaq5P2D/CJSzgLlLkKNokK62SnA4TGWr+wJAZ03PxRTk1691IOLfU+ADGlQjMd8KDkqwL8MUgiRDKDZiJRwiLBW0y/VovNMBAmf2+AGccaK+pNWKIteEH8TU2Z6N5/QJKTqNHaPcmjvcVY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780040731; c=relaxed/simple; bh=4/rcVikLzFNIHzwXr/tDb8JuW0A5WAxO1YnN5vnYRJ8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=qREvKycvZEYMYbJ9bb00KqOouiErtkM+DqDFFGwIpb7U7g351p8B9NtLRJGhSUH0z7+69v7a2C2xqw0/MdEHiuUF5J9JvG+56hLoh1lO5/bzOA6KN2vhEaDM5g1hP+jMZNEfNJO9fgW20w8NKFpwoKJU24qwqaIfrR8mZTghkgU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=debian.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b=sqUs01N4; arc=none smtp.client-ip=82.195.75.108 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=debian.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b="sqUs01N4" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Cc:To:In-Reply-To:References: Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date: From:Reply-To:Content-ID:Content-Description; bh=1ZTNUeL1mmdwYNv7ZCEh9fXBBMB8CAmIvFx5V3p+ucI=; b=sqUs01N4kVHhHla4q/ZaVuExLI ZEzaOc2k5JksVh6Re62+iQrdRpVbAQ6Zq7OAa/j4gapgf3AVzhFKqjRdTXKW5tHTffeiuoZHvbiN6 zyhysk6SROSavoGHMhMEKKi1VVKYu85HfHUh+gOc1GGfKsQxlC+eK83jnTM1cF1MJcD0WFko0thc8 ndJqU4D2R/+D2dqPerwRSICp/3LrZUgqmslJ/XxCXBdKAYghtFgZpg4SAs3DQ/QAnrJoleM3LeTQU KRMaoEk3L3w4qtAXCjU8J9zrWZa4eKQ99P7BdPBEWfYxSq60tKbrMDXHSKiIvOsC5xXjtlw2y9rfD ZKWltt4A==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from ) id 1wSruE-004kM7-2U; Fri, 29 May 2026 07:45:22 +0000 From: Breno Leitao Date: Fri, 29 May 2026 03:45:13 -0400 Subject: [PATCH net 3/3] netconsole: take target_cleanup_list_lock in drop_netconsole_target() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260529-netcons_fix_before_move-v1-3-cb2d1426dd75@debian.org> References: <20260529-netcons_fix_before_move-v1-0-cb2d1426dd75@debian.org> In-Reply-To: <20260529-netcons_fix_before_move-v1-0-cb2d1426dd75@debian.org> To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Neil Horman , Cong Wang Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Breno Leitao , kernel-team@meta.com X-Mailer: b4 0.16-dev-d5d98 X-Developer-Signature: v=1; a=openpgp-sha256; l=1956; i=leitao@debian.org; h=from:subject:message-id; bh=4/rcVikLzFNIHzwXr/tDb8JuW0A5WAxO1YnN5vnYRJ8=; b=owEBbQKS/ZANAwAKATWjk5/8eHdtAcsmYgBqGUQMqv6yG5bTKI5irUeICW72HQT7N0xNKAQHW lf1i/R6JO6JAjMEAAEKAB0WIQSshTmm6PRnAspKQ5s1o5Of/Hh3bQUCahlEDAAKCRA1o5Of/Hh3 bSzHD/4/0Yu/gfenShs5VNG14I8JjwEwuKf3Djw1DnUanHvNCzpumM3Xpg6UQdkIFv4Gplh7yQC HGN2DMuNRGVnSBY4TUrIOnzEO21Lsx0z1ou/MMbjNeRw00LliPCf6DkwtLJqN0Etnas8nvmGGv3 2WwJ7QUU/17/wkEGgV8OvPYgFzq2Pmu6CBsH1AWmKsvlA6gy+b6wZgCT8IroJSP9SXH7F/U3IiZ ZK1VIddi3g0mPOSmdY6LdCLV9pm/BcRnDMTEpz87afMtjtJr//FrukNhkXt86vFPwB5N1zbG38O Lqal2eXrWADl8rFHdOcg3zKqE6HlW2395PQzDAgMr4p7U2bMBC3GpPejSHPtBSCmRC9HMSZZ3Cp vS4rHeEiXi2zL8c3WmSOoArYaHldI4FWrQ4+c9jbxMePBFOKnJJE7CwNRp3vO2JErbm0kxFuMWq r+bOc9Q2omotWoJc/tgxZt3crzBHWIB4H6X1ebfYNjPBpLXHHGo8Vqq9OkLmXKq87mC1gJs48TB iPmqI49x+lRwe0qsTLSsCsPCjdajwhMjw/QdXNQmq3TV8Bw9NmFjkCjN8mj+QugYrKY/CqzuPI2 2xN0zCilrpDPLa0krtJz/ifh09adPdkI1FFUfNB3c0IBgweiO0r+6k+FBxTfLmiocVK5APLR+YY Qg6r4ImVMNynkAg== X-Developer-Key: i=leitao@debian.org; a=openpgp; fpr=AC8539A6E8F46702CA4A439B35A3939FFC78776D X-Debian-User: leitao drop_netconsole_target() unlinks the target while only holding target_list_lock. However, when the underlying interface has been unregistered, netconsole_netdev_event() moves the target from target_list to target_cleanup_list, and netconsole_process_cleanups_core() walks that list under target_cleanup_list_lock only. If a user removes the configfs target at the same time the cleanup worker is iterating target_cleanup_list, list_del() can corrupt the list because the two paths take disjoint locks while operating on the same list node. Acquire target_cleanup_list_lock around the list_del() so the unlink is serialised against netconsole_process_cleanups_core() regardless of which list the target currently belongs to. The state transition that downgrades STATE_DEACTIVATED to STATE_DISABLED is left intact and is performed under the same combined locking, preserving the existing ordering with resume_target(). Fixes: 97714695ef90 ("net: netconsole: Defer netpoll cleanup to avoid lock = release during list traversal") Signed-off-by: Breno Leitao --- drivers/net/netconsole.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c index a3dcbe713a0b..9e15d4186436 100644 --- a/drivers/net/netconsole.c +++ b/drivers/net/netconsole.c @@ -1452,6 +1452,7 @@ static void drop_netconsole_target(struct config_grou= p *group, =20 dynamic_netconsole_mutex_lock(); =20 + mutex_lock(&target_cleanup_list_lock); spin_lock_irqsave(&target_list_lock, flags); /* Disable deactivated target to prevent races between resume attempt * and target removal. @@ -1460,6 +1461,7 @@ static void drop_netconsole_target(struct config_grou= p *group, nt->state =3D STATE_DISABLED; list_del(&nt->list); spin_unlock_irqrestore(&target_list_lock, flags); + mutex_unlock(&target_cleanup_list_lock); =20 dynamic_netconsole_mutex_unlock(); =20 --=20 2.51.0