From nobody Mon Jun 8 04:25:57 2026 Received: from stravinsky.debian.org (stravinsky.debian.org [82.195.75.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 13B643EC2DB; Tue, 2 Jun 2026 14:27:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=82.195.75.108 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780410439; cv=none; b=ehPv5DIb1WSbcLOI9TdyQLMXfZqP8cUvvBeQSS9yfFCPnmbm6WM2fakkEjYWqsw2ijyVUwFnrxBkpOKjvYrzqDzM7zM6L7RCoJWrQZHrHNjP5XcrFFH/p4WGbo/0k2vAmPoZom8ytcK5fgL7DUTq7aNixSo1NR+VxZSv5reK418= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780410439; c=relaxed/simple; bh=562SU7/TNbjHOgAtvDMVmgp/nQboEt+IDWOIwdfiJR4=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=epRLXe03JVMmyUWxwqdSH8JEBE0STU8dL7At/OHD4H4aPKqCjaLuI2n7cLA1vE2F4kHV4sM60Yh3+11Cf6KNqU7woKI0LoIQk1s4n22R52RDQ8t0OMxm6C1nfeGNx/+/3CayABu6OfLvlKUFhYI8esl3InhW4j+0fP98noTF4TY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=debian.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b=DvcLN2EA; arc=none smtp.client-ip=82.195.75.108 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=debian.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b="DvcLN2EA" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Cc:To:In-Reply-To:References: Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date: From:Reply-To:Content-ID:Content-Description; bh=kvZFlmg6J6t7QSkGa69BUEUC0wXFqPsgx0WjeD9nEAo=; b=DvcLN2EAltnXeNyxckCoB0PGeW 7yhBjb+HJa7u/sD9wcrO+QGufxbHlY4iuyN8eQH6v9/a4vT89dG1gYAlp83DN2PxnfktKfHtvrxWx oeG47y9XCzoNT4sPvfw9+J+Fy1IM7IfxwgKJm0GCQ+VUuSV5Q65+9TeKkjh6pEMCczsUm1Jws91Ks RSxZtgdCSsoh5dbGENtW+MEMPGzOjcIQT6QcVYC/enX9AKQsVtySVlrVu6ziquycH90o1g7iEQq3A AUK/eq8DOdf90o/StKfG5uLCKC7I4nIGl5fqx8lucQ9K8zfodA7oN0+WPA9nxObfn3ZJ2qXRh3tnG SLCPXtOg==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from ) id 1wUQ5K-0031HX-34; Tue, 02 Jun 2026 14:27:15 +0000 From: Breno Leitao Date: Tue, 02 Jun 2026 07:26:57 -0700 Subject: [PATCH net-next v2 1/3] netconsole: do not schedule skb pool refill from NMI Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260602-netcons_fix_before_move-v2-1-eca3f8a8b1a3@debian.org> References: <20260602-netcons_fix_before_move-v2-0-eca3f8a8b1a3@debian.org> In-Reply-To: <20260602-netcons_fix_before_move-v2-0-eca3f8a8b1a3@debian.org> To: Breno Leitao , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-team@meta.com X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=2411; i=leitao@debian.org; h=from:subject:message-id; bh=562SU7/TNbjHOgAtvDMVmgp/nQboEt+IDWOIwdfiJR4=; b=owEBbQKS/ZANAwAIATWjk5/8eHdtAcsmYgBqHug5tXausjsedjk9abbvX6vKOpLnjorOfwfKs FheSI4HQgSJAjMEAAEIAB0WIQSshTmm6PRnAspKQ5s1o5Of/Hh3bQUCah7oOQAKCRA1o5Of/Hh3 bQXCD/0V+bqhWEEW5PrUPoAYXnFz6FMWyhCCCJvmZ+yooJGmNP9V2xizZoFldb2D4pP28PGWIvf bzd8AjAy6/+vt6Ypx38h3GAZohriD10m032rTF0kdyCUWx+hLX++QpHuIG5bGCmVF5ZBjvWtPdv zMfM7QIc1RvrEvI/uNIABtlRWf+R8k91wZ078plr3R6/haa37JOUZHvp7pVoWuzC7OkEaD3IpIn wK3nCbLnRyJwng9Txn+FViwXl+JtrgOXlhzk+l2eB/9FQ+i3BsLQ/2o1FxdMq1B55PzU02yaWT+ 80Wd1zchN4u8z1dHs6wRZAyx+2p53+6ujmEOLlrIxUgQ/RzntyvGwP5BM5HeuLNe5cLB7oxVs8K GRCxKIjfZdZtlUcaLb0/bnRxC4YF5hOGybzglPxod/5lZyUhMF0MjYhVF83DS4PT9GR9Tlz2HCW 4ofSGJdMPM251zogNHNkjQS2k9YwJUmRXe8fHPq4NEsUuwDxTv1EH95M/WCRGxf2YhBvoquj11x THhTSTSTxArqP+TYuzWyLR95rb1pJ/qN868rnlcNyNkDHRlx/s0ldht3+LT+34yXtF3VImRY0g7 A8q2ch/jUEPdEAifz7iHJaW2eXqF0dZvs8n+JHp2Iph0MaA2QzJf0Yiju7PWFpu402i+xcUV9c2 y0hgTAmBGlfHOiw== X-Developer-Key: i=leitao@debian.org; a=openpgp; fpr=AC8539A6E8F46702CA4A439B35A3939FFC78776D X-Debian-User: leitao When alloc_skb() fails in find_skb(), the fallback path dequeues an skb from np->skb_pool and unconditionally calls schedule_work() to top the pool back up. schedule_work() ends up taking the workqueue pool locks, which are not NMI-safe. netconsole_write() is registered as the nbcon write_atomic callback and is explicitly marked CON_NBCON_ATOMIC_UNSAFE, meaning it is invoked from emergency/panic contexts including NMIs. If the NMI interrupts a thread already holding the workqueue pool lock, calling schedule_work() self-deadlocks and the panic message that was being printed is lost. Introduce netcons_skb_pop() to fold the pool dequeue and the refill request into a single helper. The helper skips schedule_work() when called from NMI context; the pool is best-effort, and the next non-NMI invocation of find_skb() will refill it. This keeps the fast path untouched, the panic path NMI-safe, and the locking rules around the fallback pool documented in one place. Signed-off-by: Breno Leitao --- drivers/net/netconsole.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c index 8ecc2c71c699..918e4a9f4456 100644 --- a/drivers/net/netconsole.c +++ b/drivers/net/netconsole.c @@ -1654,6 +1654,23 @@ static struct notifier_block netconsole_netdev_notif= ier =3D { .notifier_call =3D netconsole_netdev_event, }; =20 +/* Pop a pre-allocated skb from the pool and request a refill. + * + * The refill is requested via schedule_work(), which takes the workqueue + * pool locks and is therefore not NMI-safe. Skip the refill when called + * from NMI context; the next non-NMI caller will top the pool back up. + */ +static struct sk_buff *netcons_skb_pop(struct netpoll *np) +{ + struct sk_buff *skb; + + skb =3D skb_dequeue(&np->skb_pool); + if (!in_nmi()) + schedule_work(&np->refill_wq); + + return skb; +} + static struct sk_buff *find_skb(struct netpoll *np, int len, int reserve) { int count =3D 0; @@ -1663,10 +1680,8 @@ static struct sk_buff *find_skb(struct netpoll *np, = int len, int reserve) repeat: =20 skb =3D alloc_skb(len, GFP_ATOMIC); - if (!skb) { - skb =3D skb_dequeue(&np->skb_pool); - schedule_work(&np->refill_wq); - } + if (!skb) + skb =3D netcons_skb_pop(np); =20 if (!skb) { if (++count < 10) { --=20 2.54.0 From nobody Mon Jun 8 04:25:57 2026 Received: from stravinsky.debian.org (stravinsky.debian.org [82.195.75.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 99AAF3FF893; Tue, 2 Jun 2026 14:27:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=82.195.75.108 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780410442; cv=none; b=RlA4WKeoJlkb2hriQ3qWOZc2sd1y08Q8onkZzQZ8+E8wIfje58TsXhfHLIlJicSC+Ren8OslAnqwvcLAE9mA34mn4TtMmL193+kLBbmya8Mv9FUDPfTUoSBJd/JdfcmJLP2FVhCoY5ybDnwpX305coIRhSTcGpfHewx5KNSKfHQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780410442; c=relaxed/simple; bh=i6qClQ5+W9ctQ1d1kEsgy818nsHiIexncQiAotuiatM=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=QHSe0dgAqv4+Bd6eNZYoevk7/JgJ8UDDaOUOf9kOHf7reISNKgl+7j8anzgBad0WcAdhUzjwnJRe8zjk9CKqHCpBDBTaCquyJzrPwXKDojxn2pv6AhCAwtgSTgE9dZQRVPvAqtGBsCRH1weZ284YX0dqt+xNkOrwCCw/DCde1ME= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=debian.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b=hX88hPQG; arc=none smtp.client-ip=82.195.75.108 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=debian.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b="hX88hPQG" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Cc:To:In-Reply-To:References: Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date: From:Reply-To:Content-ID:Content-Description; bh=/IDfQoAzumKqf8CoKiK/GBUYkM85ZxvSCVtce+/KjkE=; b=hX88hPQGxYD18q6tFbmK4PURF9 fprLXhtsihK0Z2mVzYD9E+2j3PehjJFBUuGtEUAr4cdRx0+/LVXkUQ4fcb4JubLvftBIx0gxvzBqX XgDcWeDNISxcWYxqvei7RRYZNxL6VtVwVArRWN3j+oFAH/HfRSFzqCx2riege1tDxYyHm+Xt9jG2J uoJR2ZEnhL41Sf38I5y5yyY17Lkxdi0EkU0rn6TeLf0DmXrnqOk3beSUT2QPIz3tSRcyv8Zf5w6zo yVCQ7a02+qnjx+drLUbikxPCq5e9QiJOc7cE0EvAgEMBO+jU+Rg4XLsmvtkuJ99esfzma+wEh8qTM 6zmHxPZA==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from ) id 1wUQ5O-0031Hd-2V; Tue, 02 Jun 2026 14:27:19 +0000 From: Breno Leitao Date: Tue, 02 Jun 2026 07:26:58 -0700 Subject: [PATCH net-next v2 2/3] netconsole: do not dequeue pooled skbs that cannot satisfy len Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260602-netcons_fix_before_move-v2-2-eca3f8a8b1a3@debian.org> References: <20260602-netcons_fix_before_move-v2-0-eca3f8a8b1a3@debian.org> In-Reply-To: <20260602-netcons_fix_before_move-v2-0-eca3f8a8b1a3@debian.org> To: Breno Leitao , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-team@meta.com X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=4304; i=leitao@debian.org; h=from:subject:message-id; bh=i6qClQ5+W9ctQ1d1kEsgy818nsHiIexncQiAotuiatM=; b=owEBbQKS/ZANAwAIATWjk5/8eHdtAcsmYgBqHug5NwZEDjMxquwEK8o0h/zb4XArCH4wFDBvN kwy1Sbt3XiJAjMEAAEIAB0WIQSshTmm6PRnAspKQ5s1o5Of/Hh3bQUCah7oOQAKCRA1o5Of/Hh3 bdF4D/9Hs4qtL0n7BjAJRs8XPHivuvFdQRMXD4dtaB0jfVSSrDiajrmG3CSlzS8/GozR+cTqkmJ VxQijxaxIJ0gDSYnZMJrfHVm2piIrGM8MV83YGrhmMXMT4XWI885fGgpV/YxTd/tqea+6ldChU9 qkovrHx2Ck8gfzdnL0aHmbbDwBfdDX0vjW3IRdIT7q34+CzuKqc5W9YTjNx9pMtxO6JltuJkfeM AuE5lQogDRYjvQx48EwQyA2JIryLQsImqPOTvktroj+nBmF2stHQ3uci+955Gp8HlOa3Qpb47n5 6HiLZbW6TK5gA1+fWFEC6BMnU7687QTlIAEQI7b82WFYZpym941Xc2qysCdu66BtMppbw1gkIgk 6MzjIRARac2dUzgTs8qQMPZ6NhSpVSVDr68wnaum2FqE9dZSc3jq2seWsa8jEsyg8xDpqHT6eZ4 gF9VVdCIfNnxUxl3vxrAHN++5/Oyi2vZXc/vLkFk/jzWyr2kBOy3+xsosKSfumjmjAwg1VfhBXj KPelSTyareEaeqkqz5DkC5FK30ejNr+E7bzLlw9yQpnAYn6iAW8/4QvB+Ljo2co6A3V7YgASoce p6HHoocvV2TkwbHaa9ctiCN1DdzRSbrRDr8F4YzPgwXNtXQ7lk2enXDBQkDDtBWQuEe8cj06i7U 7K4tEuG7SIHayQg== X-Developer-Key: i=leitao@debian.org; a=openpgp; fpr=AC8539A6E8F46702CA4A439B35A3939FFC78776D X-Debian-User: leitao find_skb() falls back to np->skb_pool when the GFP_ATOMIC alloc_skb() fails. The pool is refilled by refill_skbs(), which always allocates buffers of MAX_SKB_SIZE (ethhdr + iphdr + udphdr + MAX_UDP_CHUNK =3D=3D 1502 bytes). netconsole, however, computes the requested length dynamically as total_len + np->dev->needed_tailroom If the egress device declares a non-zero needed_tailroom (e.g. some tunnel or hardware accelerator devices), the required length can exceed MAX_SKB_SIZE. The pooled skb is then handed back to the caller, which immediately performs skb_put(skb, len), trips the tail > end check, and triggers skb_over_panic(). Leave the normal alloc_skb(len, GFP_ATOMIC) path untouched -- the slab allocator can still satisfy oversized requests when memory is available, so senders to devices with non-zero needed_tailroom keep working in the common case. Only the pool fallback is gated: when alloc_skb() failed and len exceeds the pool buffer size, skip the skb_dequeue() instead of burning a pre-allocated skb on a request that would later trip skb_over_panic(). Reserving pool entries for requests they can actually satisfy also keeps the panic path, which depends on the pool being primed, intact. When that drop happens, emit a rate-limited net_warn() so the user notices that netconsole is unable to push messages on the egress device. The warn is skipped under in_nmi() for the same reason schedule_work() is: printk machinery taken by net_warn_ratelimited() is not NMI-safe and would risk recursing into the same nbcon console we are servicing. MAX_SKB_SIZE / MAX_UDP_CHUNK were private to net/core/netpoll.c. Move them to include/linux/netpoll.h so netconsole can reference the same definition that refill_skbs() uses, keeping the two in sync by construction. The header now pulls in and explicitly so MAX_SKB_SIZE remains self-contained for any future user. Signed-off-by: Breno Leitao --- drivers/net/netconsole.c | 7 ++++++- include/linux/netpoll.h | 16 ++++++++++++++++ net/core/netpoll.c | 7 ------- 3 files changed, 22 insertions(+), 8 deletions(-) diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c index 918e4a9f4456..b77879ead641 100644 --- a/drivers/net/netconsole.c +++ b/drivers/net/netconsole.c @@ -1680,8 +1680,13 @@ static struct sk_buff *find_skb(struct netpoll *np, = int len, int reserve) repeat: =20 skb =3D alloc_skb(len, GFP_ATOMIC); - if (!skb) + if (!skb) { + /* The pool is refilled with MAX_SKB_SIZE buffers */ + if (WARN_ON_ONCE(len > MAX_SKB_SIZE)) + return NULL; + skb =3D netcons_skb_pop(np); + } =20 if (!skb) { if (++count < 10) { diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h index e4b8f1f91e54..88f7daa8560e 100644 --- a/include/linux/netpoll.h +++ b/include/linux/netpoll.h @@ -13,12 +13,28 @@ #include #include #include +#include +#include =20 union inet_addr { __be32 ip; struct in6_addr in6; }; =20 +/* + * Maximum payload netpoll's preallocated skb pool can carry. Keep this in + * sync with the buffer size used by refill_skbs() in net/core/netpoll.c; + * callers (e.g. netconsole) use it to detect requests the pool can never + * satisfy and avoid dequeuing a pooled skb that would later trip + * skb_over_panic() in skb_put(). + */ +#define MAX_UDP_CHUNK 1460 +#define MAX_SKB_SIZE \ + (sizeof(struct ethhdr) + \ + sizeof(struct iphdr) + \ + sizeof(struct udphdr) + \ + MAX_UDP_CHUNK) + struct netpoll { struct net_device *dev; netdevice_tracker dev_tracker; diff --git a/net/core/netpoll.c b/net/core/netpoll.c index b3fe59445f2d..229dde818ab3 100644 --- a/net/core/netpoll.c +++ b/net/core/netpoll.c @@ -41,16 +41,9 @@ * message gets out even in extreme OOM situations. */ =20 -#define MAX_UDP_CHUNK 1460 #define MAX_SKBS 32 #define USEC_PER_POLL 50 =20 -#define MAX_SKB_SIZE \ - (sizeof(struct ethhdr) + \ - sizeof(struct iphdr) + \ - sizeof(struct udphdr) + \ - MAX_UDP_CHUNK) - static unsigned int carrier_timeout =3D 4; module_param(carrier_timeout, uint, 0644); =20 --=20 2.54.0 From nobody Mon Jun 8 04:25:57 2026 Received: from stravinsky.debian.org (stravinsky.debian.org [82.195.75.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3D6E03ED125; Tue, 2 Jun 2026 14:27:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=82.195.75.108 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780410446; cv=none; b=awW88qwMx1VKLFbGDG4UNK127j8zfRzddwN3T9hcOAosFpp57LRmhkfKGaFKSq6lBTCAAaJXouAK2EXU7ga2fhMyTW6aCliSAdfdrWx1s/7FD6bobDw+KFgjvVEK9C0/rgwz1UxLCKdiljP74Zyd+BqFzj0q1ebIykM4CF50Bu4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780410446; c=relaxed/simple; bh=a8OZ0VQVcVqKMElz4At9zliiyj4sQ7kpQY6cjBx99mI=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=OQG0eLDFbO+SIv5k/iGiWtsbnH+dl7VvXr0iRH4gW8iE9lu5oiDK/KaS9lsXecjpUdeTCsgBCJIByJqil3IM/IfTQdPCxMGLWQVHXpJcuPjzm1yqYtd1EbrgN447MfylCYLD/bnwTnL6hk+xLmGnN7e19orRmVd8tvDh46Ti2mM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=debian.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b=EhBGFvdc; arc=none smtp.client-ip=82.195.75.108 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=debian.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b="EhBGFvdc" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Cc:To:In-Reply-To:References: Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date: From:Reply-To:Content-ID:Content-Description; bh=nsiVq/97Wtoja7S6snhY2IWdkOS5E9msHwXR3VbmBXE=; b=EhBGFvdcH2cIXgUVWRKtrcACxt RUVCRG/cZ16P9Xh4H07VpOo1NiU6skiH/ScqpmELivnt5eIBT6PdPFFE/XXrK0jKmZ1nB1fXdsZS2 7NBSYAfN79mwtNFYnnPVRUJIxKmMHcKuIvHXu3iih4jhdvOQCWk6V9qWcIDiV765CiDgIgzICLnhk g6vlD6UYTnMi3RnYBUqedQPx9IykAtHXdkbB2KYIa/0d+/Hls6G2B0zXlDRGux5dIjbTmwXaAeSBd sHBoebZTp9GeCsAXm2wi+hrcqBdRmWwvMF+Ttt5gqv6JTtVXAawYzB5u+fty6ZeyHcwitc1fe/vX7 Qn53puiA==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from ) id 1wUQ5T-0031Hp-1F; Tue, 02 Jun 2026 14:27:23 +0000 From: Breno Leitao Date: Tue, 02 Jun 2026 07:26:59 -0700 Subject: [PATCH net-next v2 3/3] netconsole: take target_cleanup_list_lock in drop_netconsole_target() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260602-netcons_fix_before_move-v2-3-eca3f8a8b1a3@debian.org> References: <20260602-netcons_fix_before_move-v2-0-eca3f8a8b1a3@debian.org> In-Reply-To: <20260602-netcons_fix_before_move-v2-0-eca3f8a8b1a3@debian.org> To: Breno Leitao , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-team@meta.com X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=1848; i=leitao@debian.org; h=from:subject:message-id; bh=a8OZ0VQVcVqKMElz4At9zliiyj4sQ7kpQY6cjBx99mI=; b=owEBbQKS/ZANAwAIATWjk5/8eHdtAcsmYgBqHug5b/5U4hO7R8o4Sw0W7DUzAbVrflugwjEXN TEi4BwG07CJAjMEAAEIAB0WIQSshTmm6PRnAspKQ5s1o5Of/Hh3bQUCah7oOQAKCRA1o5Of/Hh3 bXmZD/9gOS3rd9opE5NRUnGkVYintgTLZJVtxkSGysjiwnGLvP6GMCzxiJ+fA1AdKqJKjM7zS/C WQXsgGgI0dxQzgurs0xzNLceltrG3AfYO9WxL+QJ60vm3R6s8qrf89a8SrHOwPzhIxeBVcGnjB2 kecRuA1zfXqb7ZV6qQjzQeAnmnmqdhWbogPzMvfeDGFk6oHJ0sKfwl5mIzwHyGlN1MJ0rrIdmuC DqETVec2l5T0SbkRlUb/uBvHzGYwdjHPYCxUlYp7en412hM5fp5wX+IuyIklajSOCsqyoJvoxsu nyz4kSiTRUIIbVZjRW2SS3e6SlNKJZUMCeAIzbEO2j9U/QIfXjOO5iGBuEuxpXrGjpqhzwE3p+t spwaO71H2tu+sQUBHNuBjvAI15Rz8OXoTV7RX4TK15BhrFBJ780nY2sz5ze7pYCeYluRTgZd8G0 SjG+zcPswu+ujrcBqxsBTv4D+1wHRkwyAw7jDEwcb2UksegAlimnkQ+9rSyxd62dJnzYHkxE00F R5lrFMDKvIiutBQQ45wj2COnS2qjgn9MQVWZby4wtGsPivkIheGuAnFJ4Cm0jbbokuwjMdy/clV NKMemA+B2Li/yA2ZkieSpW9nbvjcZRVLy3u/maUqDFHes5ENmPqDmOGHhT77UeXNGZbcGd0wbtg chl56ibKYoUF2wg== X-Developer-Key: i=leitao@debian.org; a=openpgp; fpr=AC8539A6E8F46702CA4A439B35A3939FFC78776D X-Debian-User: leitao drop_netconsole_target() unlinks the target while only holding target_list_lock. However, when the underlying interface has been unregistered, netconsole_netdev_event() moves the target from target_list to target_cleanup_list, and netconsole_process_cleanups_core() walks that list under target_cleanup_list_lock only. If a user removes the configfs target at the same time the cleanup worker is iterating target_cleanup_list, list_del() can corrupt the list because the two paths take disjoint locks while operating on the same list node. Acquire target_cleanup_list_lock around the list_del() so the unlink is serialised against netconsole_process_cleanups_core() regardless of which list the target currently belongs to. The state transition that downgrades STATE_DEACTIVATED to STATE_DISABLED is left intact and is performed under the same combined locking, preserving the existing ordering with resume_target(). Signed-off-by: Breno Leitao --- drivers/net/netconsole.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c index b77879ead641..59712d1d75fd 100644 --- a/drivers/net/netconsole.c +++ b/drivers/net/netconsole.c @@ -1452,6 +1452,7 @@ static void drop_netconsole_target(struct config_grou= p *group, =20 dynamic_netconsole_mutex_lock(); =20 + mutex_lock(&target_cleanup_list_lock); spin_lock_irqsave(&target_list_lock, flags); /* Disable deactivated target to prevent races between resume attempt * and target removal. @@ -1460,6 +1461,7 @@ static void drop_netconsole_target(struct config_grou= p *group, nt->state =3D STATE_DISABLED; list_del(&nt->list); spin_unlock_irqrestore(&target_list_lock, flags); + mutex_unlock(&target_cleanup_list_lock); =20 dynamic_netconsole_mutex_unlock(); =20 --=20 2.54.0