netdev - Re: i40e: Fix preempt count leak in napi poll tracepoint

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aYpalNvTIiD4nym4@devvm20253.cco0.facebook.com>
Date: Mon, 9 Feb 2026 14:07:16 -0800
From: Joe Damato <joe@...a.to>
To: Thomas Gleixner <tglx@...nel.org>
Cc: intel-wired-lan@...ts.osuosl.org,
	Tony Nguyen <anthony.l.nguyen@...el.com>,
	Przemek Kitszel <przemyslaw.kitszel@...el.com>,
	netdev@...r.kernel.org
Subject: Re: i40e: Fix preempt count leak in napi poll tracepoint

On Sat, Feb 07, 2026 at 11:50:23AM +0100, Thomas Gleixner wrote:
> Using get_cpu() in the tracepoint assignment causes an obvious preempt
> count leak because nothing invokes put_cpu() to undo it:
> 
>   softirq: huh, entered softirq 3 NET_RX with preempt_count 00000100, exited with 00000101?
> 
> This clearly has seen a lot of testing in the last 3+ years...

I'm the author who introduced the bug. FWIW, I did use it quite a bit when I
had i40e devices.
 
> Use smp_processor_id() instead.

Thanks.
 
> Fixes: 6d4d584a7ea8 ("i40e: Add i40e_napi_poll tracepoint")
> Signed-off-by: Thomas Gleixner <tglx@...nel.org>
> Cc: Tony Nguyen <anthony.l.nguyen@...el.com>
> Cc: Przemek Kitszel <przemyslaw.kitszel@...el.com>
> Cc: intel-wired-lan@...ts.osuosl.org
> Cc: netdev@...r.kernel.org
> ---
>  drivers/net/ethernet/intel/i40e/i40e_trace.h |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> --- a/drivers/net/ethernet/intel/i40e/i40e_trace.h
> +++ b/drivers/net/ethernet/intel/i40e/i40e_trace.h
> @@ -88,7 +88,7 @@ TRACE_EVENT(i40e_napi_poll,
>  		__entry->rx_clean_complete = rx_clean_complete;
>  		__entry->tx_clean_complete = tx_clean_complete;
>  		__entry->irq_num = q->irq_num;
> -		__entry->curr_cpu = get_cpu();
> +		__entry->curr_cpu = smp_processor_id();
>  		__assign_str(qname);
>  		__assign_str(dev_name);
>  		__assign_bitmask(irq_affinity, cpumask_bits(&q->affinity_mask),
> 

Reviewed-by: Joe Damato <joe@...a.to>