netdev - [PATCH] net: clear offline CPU backlog.state in dev_cpu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250723083808.1220363-1-wangyongyong@gztozed.com>
Date: Wed, 23 Jul 2025 16:38:08 +0800
From: wangyongyong@...ozed.com
To: "David S . Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>,
	Paolo Abeni <pabeni@...hat.com>
Cc: Simon Horman <horms@...nel.org>,
	netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	wangyongyong <wangyongyong@...ozed.com>
Subject: [PATCH] net: clear offline CPU backlog.state in dev_cpu_dead()

From: wangyongyong <wangyongyong@...ozed.com>

When a packet is enqueued to a remote CPU's backlog queue via enqueue_to_backlog(),
the following race condition can occur with CPU hotplug:

1. Source CPU sets NAPI_STATE_SCHED on target CPU's softnet_data->backlog.state
2. Source CPU raises NET_RX_SOFTIRQ to schedule NAPI polling
3. Target CPU is taken offline before the IPI arrives
4. dev_cpu_dead() fails to clear NAPI_STATE_SCHED because backlog isn't in poll_list

This results in:
- Stale NAPI_STATE_SCHED flag on offline CPU's backlog.state
- When the target CPU comes back online, the persistent NAPI_STATE_SCHED flag
  prevents the backlog from being properly added to poll_list, causing packet
  processing stalls
Signed-off-by: wangyongyong <wangyongyong@...ozed.com>
---
 net/core/dev.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/core/dev.c b/net/core/dev.c
index be97c440ecd5..fd92ab79c02a 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -12385,6 +12385,7 @@ static int dev_cpu_dead(unsigned int oldcpu)
 		else
 			____napi_schedule(sd, napi);
 	}
+	oldsd->backlog.state &= NAPIF_STATE_THREADED;
 
 	raise_softirq_irqoff(NET_TX_SOFTIRQ);
 	local_irq_enable();
-- 
2.25.1