Linux kernel source tree
Go to file
Breno Leitao 327c20c21d netpoll: Fix deadlock in memory allocation under spinlock
Fix a AA deadlock in refill_skbs() where memory allocation while holding
skb_pool->lock can trigger a recursive lock acquisition attempt.

The deadlock scenario occurs when the system is under severe memory
pressure:

1. refill_skbs() acquires skb_pool->lock (spinlock)
2. alloc_skb() is called while holding the lock
3. Memory allocator fails and calls slab_out_of_memory()
4. This triggers printk() for the OOM warning
5. The console output path calls netpoll_send_udp()
6. netpoll_send_udp() attempts to acquire the same skb_pool->lock
7. Deadlock: the lock is already held by the same CPU

Call stack:
  refill_skbs()
    spin_lock_irqsave(&skb_pool->lock)    <- lock acquired
    __alloc_skb()
      kmem_cache_alloc_node_noprof()
        slab_out_of_memory()
          printk()
            console_flush_all()
              netpoll_send_udp()
                skb_dequeue()
                  spin_lock_irqsave(&skb_pool->lock)     <- deadlock attempt

This bug was exposed by commit 248f6571fd ("netpoll: Optimize skb
refilling on critical path") which removed refill_skbs() from the
critical path (where nested printk was being deferred), letting nested
printk being called from inside refill_skbs()

Refactor refill_skbs() to never allocate memory while holding
the spinlock.

Another possible solution to fix this problem is protecting the
refill_skbs() from nested printks, basically calling
printk_deferred_{enter,exit}() in refill_skbs(), then, any nested
pr_warn() would be deferred.

I prefer this approach, given I _think_ it might be a good idea to move
the alloc_skb() from GFP_ATOMIC to GFP_KERNEL in the future, so, having
the alloc_skb() outside of the lock will be necessary step.

There is a possible TOCTOU issue when checking for the pool length, and
queueing the new allocated skb, but, this is not an issue, given that
an extra SKB in the pool is harmless and it will be eventually used.

Signed-off-by: Breno Leitao <leitao@debian.org>
Fixes: 248f6571fd ("netpoll: Optimize skb refilling on critical path")
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20251103-fix_netpoll_aa-v4-1-4cfecdf6da7c@debian.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-04 19:17:00 -08:00
arch - Remove dead code leftovers after a recent mitigations cleanup which fail 2025-10-26 09:57:18 -07:00
block block-6.18-20251023 2025-10-24 12:48:19 -07:00
certs sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3 2024-09-20 19:52:48 +03:00
crypto This push contains the following changes: 2025-10-10 08:56:16 -07:00
Documentation Including fixes from wireless, Bluetooth and netfilter. 2025-10-30 18:35:35 -07:00
drivers net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error 2025-11-04 19:15:36 -08:00
fs Three ksmbd server fixes 2025-10-28 18:00:40 -07:00
include virtio_net: fix alignment for virtio_net_hdr_v1_hash 2025-11-04 17:14:07 -08:00
init printk changes for 6.18 2025-10-04 11:13:11 -07:00
io_uring io_uring: fix buffer auto-commit for multishot uring_cmd 2025-10-23 19:41:31 -06:00
ipc namespace-6.18-rc1 2025-09-29 11:20:29 -07:00
kernel sched_ext: Fixes for v6.18-rc3 2025-10-27 10:52:18 -07:00
lib lib/crypto: poly1305: Restore dependency of arch code on !KMSAN 2025-10-22 10:52:10 -07:00
LICENSES LICENSES: Replace the obsolete address of the FSF in the GFDL-1.2 2025-07-24 11:15:39 +02:00
mm slab fixes for 6.18-rc3 2025-10-24 12:40:51 -07:00
net netpoll: Fix deadlock in memory allocation under spinlock 2025-11-04 19:17:00 -08:00
rust Driver core fixes for 6.18-rc3 2025-10-25 11:03:46 -07:00
samples Char/Misc/IIO/Binder changes for 6.18-rc1 2025-10-04 16:26:32 -07:00
scripts Kbuild fixes for 6.18 #1 2025-10-11 15:47:12 -07:00
security integrity-v6.18 2025-10-05 10:48:33 -07:00
sound ALSA: hda/realtek: Fix mute led for HP Omen 17-cb0xxx 2025-10-17 16:37:21 +02:00
tools selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh 2025-10-31 17:41:54 -07:00
usr gen_init_cpio: Ignore fsync() returning EINVAL on pipes 2025-10-07 09:53:05 -07:00
virt KVM x86 fixes for 6.18: 2025-10-18 10:25:43 +02:00
.clang-format memblock: drop for_each_free_mem_pfn_range_in_zone_from() 2025-09-14 08:49:03 +03:00
.clippy.toml rust: clean Rust 1.88.0's warning about clippy::disallowed_macros configuration 2025-05-07 00:11:47 +02:00
.cocciconfig
.editorconfig .editorconfig: remove trim_trailing_whitespace option 2024-06-13 16:47:52 +02:00
.get_maintainer.ignore MAINTAINERS: remove Alyssa Rosenzweig 2025-09-18 21:17:31 +02:00
.gitattributes .gitattributes: set diff driver for Rust source code files 2023-05-31 17:48:25 +02:00
.gitignore .gitignore: ignore compile_commands.json globally 2025-08-12 15:53:55 -07:00
.mailmap MAINTAINERS: Update Alex Williamson's email address 2025-10-20 15:45:03 -06:00
.pylintrc tools: docs: parse-headers.py: move it from sphinx dir 2025-08-29 15:54:42 -06:00
.rustfmt.toml rust: add .rustfmt.toml 2022-09-28 09:02:20 +02:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: mark ISDN subsystem as orphan 2025-10-27 17:49:45 -07:00
Kbuild sched: Make migrate_{en,dis}able() inline 2025-09-25 09:57:16 +02:00
Kconfig io_uring: Rename KConfig to Kconfig 2025-02-19 14:53:27 -07:00
MAINTAINERS MAINTAINERS: add brcm tag driver to b53 2025-11-03 16:39:55 -08:00
Makefile Linux 6.18-rc3 2025-10-26 15:59:49 -07:00
README README: Fix spelling 2024-03-18 03:36:32 -06:00

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.