linux/net/openvswitch
Denis V. Lunev aaaaf87ea9 openvswitch: fix soft lockup in the netlink flow dump
A production compute node carrying a few thousand datapath flows hit a
soft lockup inside a single netlink flow dump and panicked.

ovs_flow_cmd_dump() calls ovs_flow_stats_get() for every flow it
emits, and that releases stats->lock with spin_unlock_bh() once per
CPU that has touched the flow. Every release is a local_bh_enable(),
and each one runs the pending softirq backlog in the dumping thread's
own context.

The skb bounds the flows one callback emits, but not the softirq work
it absorbs. On a CPU that carries the box's packet load the backlog
refills as fast as it drains, so the dumping thread becomes that CPU's
softirq engine. It never sleeps and it has no reschedule point, so
under voluntary preemption nothing can take the CPU away from it:
neither the ksoftirqd the kernel woke to take the work over, nor the
stopper thread the softlockup detector dispatches to refresh its
timestamp.

Hold BH off across the whole callback instead, the way
ctnetlink_dump_table() does, so the nested spin_unlock_bh() stop
draining softirqs. The loop already runs under rcu_read_lock() and
cannot sleep. What it gives up is preemption under CONFIG_PREEMPT,
since a BH-off region is not preemptible outside PREEMPT_RT. The
region stays short: the skb caps the flows one callback emits, and
empty buckets cost no skb space but are each visited once per dump, as
the cursor only moves forward. The table grows on insert and shrinks
only on flush, so the walk is bounded by the largest flow count the
datapath has held. The softirq backlog the callback used to absorb has
no bound at all.

Fixes: 63e7959c4b ("openvswitch: Per NUMA node flow stats.")
Cc: stable@vger.kernel.org
Signed-off-by: Denis V. Lunev <den@openvz.org>
Reviewed-by: Ilya Maximets <i.maximets@ovn.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2026-10-05 03:51:13 +01:00
..
actions.c net: openvswitch: fix skb leak on flow key update failure during ct 2026-07-29 17:42:33 -07:00
conntrack.c net: openvswitch: conntrack: fix helper UAF due to extensions realloc 2026-09-24 09:56:01 -07:00
conntrack.h openvswitch: Fix CT limit teardown use-after-free 2026-08-24 11:38:09 -07:00
datapath.c openvswitch: fix soft lockup in the netlink flow dump 2026-10-05 03:51:13 +01:00
datapath.h openvswitch: Fix CT limit teardown use-after-free 2026-08-24 11:38:09 -07:00
dp_notify.c net: replace use of system_wq with system_percpu_wq 2025-09-22 17:40:30 -07:00
drop.h net: openvswitch: add misc error drop reasons 2023-08-14 08:01:06 +01:00
flow_netlink.c net: openvswitch: reject oversized nested action attrs 2026-07-11 13:09:11 +02:00
flow_netlink.h net: openvswitch: remove never-working support for setting nsh fields 2025-11-14 18:13:24 -08:00
flow_table.c net: openvswitch: fix use-after-free of the flow table mask array 2026-09-08 17:24:10 -07:00
flow_table.h net: openvswitch: Annotate struct mask_array with __counted_by 2023-10-17 13:56:03 +02:00
flow.c openvswitch: fix wrong flag value in get_ipv6_ext_hdrs() 2026-09-10 08:51:30 -07:00
flow.h net: openvswitch: reduce cpu_used_mask memory 2023-02-06 22:36:29 -08:00
Kconfig openvswitch: remove support for legacy tunnel types 2026-08-06 15:09:23 +02:00
Makefile openvswitch: remove support for legacy tunnel types 2026-08-06 15:09:23 +02:00
meter.c net: openvswitch: fix potential UAF on meter attach failure 2026-07-30 13:20:03 +02:00
meter.h net: openvswitch: remove unnecessary linux/genetlink.h include 2024-04-01 21:44:34 -07:00
openvswitch_trace.c
openvswitch_trace.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
vport-internal_dev.c net: rename netns_local to netns_immutable 2025-03-04 12:44:48 +01:00
vport-internal_dev.h
vport-netdev.c openvswitch: remove support for legacy tunnel types 2026-08-06 15:09:23 +02:00
vport-netdev.h openvswitch: remove support for legacy tunnel types 2026-08-06 15:09:23 +02:00
vport.c net: openvswitch: unexport ovs_vport_alloc/free 2026-08-13 18:33:35 -07:00
vport.h openvswitch: vport: remove infrastructure for separate modules 2026-08-06 15:09:23 +02:00