[PATCH net 0/2] net: usb: cdc_ncm/cdc_mbim: fix netpoll lockup in tx_fixup

[PATCH net 0/2] net: usb: cdc_ncm/cdc_mbim: fix netpoll lockup in tx_fixup

[Nicolai Buchwitz]

Mikkel reported lockups with netconsole on a cdc_ncm device. Further
analysis showed that netpoll calls ndo_start_xmit() with IRQs off but
BHs on while holding the txq lock, and the spin_unlock_bh() in the
tx_fixup paths runs pending softirqs. A transmit from one of them then
spins on that txq lock.

Patch 1 fixes cdc_ncm. Mikkel reproduced the lockup and tested the fix.
Patch 2 fixes the same code in cdc_mbim and is untested.

Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
---
Nicolai Buchwitz (2):
      net: usb: cdc_ncm: don't enable BHs in tx_fixup under netpoll
      net: usb: cdc_mbim: don't enable BHs in tx_fixup under netpoll

 drivers/net/usb/cdc_mbim.c | 6 ++++--
 drivers/net/usb/cdc_ncm.c  | 8 ++++++--
 2 files changed, 10 insertions(+), 4 deletions(-)
---
base-commit: 044ad3c90d9d2df2c5cb3325ae17b4e9603a311f
change-id: 20261020-cdc-ncm-netpoll-d7a7f69dd2cc

Best regards,
--  
Nicolai Buchwitz <nb@tipi-net.de>

[PATCH net 1/2] net: usb: cdc_ncm: don't enable BHs in tx_fixup under netpoll

[Nicolai Buchwitz]

netpoll holds the txq lock and calls ndo_start_xmit() with IRQs off but
BHs on. The spin_unlock_bh() in cdc_ncm_tx_fixup() then runs pending
softirqs. If one of them transmits, it spins on the txq lock that
netpoll holds. With netconsole on a cdc_ncm device this ends in a soft
or hard lockup.

Use spin_lock_irqsave(), which is safe both under netpoll and on the
normal xmit path.

Fixes: c84ff1d6dff3 ("cdc_ncm: reduce driver latency in the data path")
Reported-by: Mikkel Eskildsen <mke@visotia.com>
Closes: https://lore.kernel.org/netdev/PRAP189MB185019A5A8D411482BB6E0CDA9982@PRAP189MB1850.EURP189.PROD.OUTLOOK.COM/
Tested-by: Mikkel Eskildsen <mke@visotia.com>
Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
---
 drivers/net/usb/cdc_ncm.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 35db38cb3e4a2..b579442f4a272 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -1524,6 +1524,7 @@ cdc_ncm_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
 {
 	struct sk_buff *skb_out;
 	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
+	unsigned long irqflags;
 
 	/*
 	 * The Ethernet API we are using does not support transmitting
@@ -1535,14 +1536,17 @@ cdc_ncm_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
 	if (ctx == NULL)
 		goto error;
 
-	spin_lock_bh(&ctx->mtx);
+	/* netpoll calls this with IRQs off and BHs on, so unlocking with
+	 * spin_unlock_bh() would run softirqs that need the held txq lock.
+	 */
+	spin_lock_irqsave(&ctx->mtx, irqflags);
 
 	if (ctx->is_ndp16)
 		skb_out = cdc_ncm_fill_tx_frame(dev, skb, cpu_to_le32(USB_CDC_NCM_NDP16_NOCRC_SIGN));
 	else
 		skb_out = cdc_ncm_fill_tx_frame(dev, skb, cpu_to_le32(USB_CDC_NCM_NDP32_NOCRC_SIGN));
 
-	spin_unlock_bh(&ctx->mtx);
+	spin_unlock_irqrestore(&ctx->mtx, irqflags);
 	return skb_out;
 
 error:

-- 
2.53.0

Re: [PATCH net 1/2] net: usb: cdc_ncm: don't enable BHs in tx_fixup under netpoll

[sashiko-bot]

> netpoll holds the txq lock and calls ndo_start_xmit() with IRQs off but
> BHs on. The spin_unlock_bh() in cdc_ncm_tx_fixup() then runs pending
> softirqs. If one of them transmits, it spins on the txq lock that
> netpoll holds. With netconsole on a cdc_ncm device this ends in a soft
> or hard lockup.
> 
> Use spin_lock_irqsave(), which is safe both under netpoll and on the
> normal xmit path.
> 
> Fixes: c84ff1d6dff3 ("cdc_ncm: reduce driver latency in the data path")
> Reported-by: Mikkel Eskildsen <mke@visotia.com>
> Closes: https://lore.kernel.org/netdev/PRAP189MB185019A5A8D411482BB6E0CDA9982@PRAP189MB1850.EURP189.PROD.OUTLOOK.COM/
> Tested-by: Mikkel Eskildsen <mke@visotia.com>
> Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261020-cdc-ncm-netpoll-v1-0-682184384b49@tipi-net.de?part=1

Re: [PATCH net 1/2] net: usb: cdc_ncm: don't enable BHs in tx_fixup under netpoll

[Nicolai Buchwitz]

On October 20, 2026 9:16:55 AM GMT+02:00, Nicolai Buchwitz <nb@tipi-net.de> wrote:
>netpoll holds the txq lock and calls ndo_start_xmit() with IRQs off but
>BHs on. The spin_unlock_bh() in cdc_ncm_tx_fixup() then runs pending
>softirqs. If one of them transmits, it spins on the txq lock that
>netpoll holds. With netconsole on a cdc_ncm device this ends in a soft
>or hard lockup.
>
>Use spin_lock_irqsave(), which is safe both under netpoll and on the
>normal xmit path.
>
>Fixes: c84ff1d6dff3 ("cdc_ncm: reduce driver latency in the data path")
>Reported-by: Mikkel Eskildsen <mke@visotia.com>
>Closes: https://lore.kernel.org/netdev/PRAP189MB185019A5A8D411482BB6E0CDA9982@PRAP189MB1850.EURP189.PROD.OUTLOOK.COM/
>Tested-by: Mikkel Eskildsen <mke@visotia.com>
>Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
>---
> drivers/net/usb/cdc_ncm.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
>diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
>index 35db38cb3e4a2..b579442f4a272 100644
>--- a/drivers/net/usb/cdc_ncm.c
>+++ b/drivers/net/usb/cdc_ncm.c
>@@ -1524,6 +1524,7 @@ cdc_ncm_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
> {
> 	struct sk_buff *skb_out;
> 	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
>+	unsigned long irqflags;

x-mas, argh ... broken before and after, will fix this in v2.

But let's hear what/if clashiko will add, before I mark it cr in pwbot ...

> [...]

[PATCH net 2/2] net: usb: cdc_mbim: don't enable BHs in tx_fixup under netpoll

[Nicolai Buchwitz]

cdc_mbim_tx_fixup() has the same spin_unlock_bh() as cdc_ncm_tx_fixup().
Under netpoll it runs pending softirqs while the txq lock is held, and
a transmit from one of them spins on that lock.

Use spin_lock_irqsave() as in cdc_ncm.

Fixes: 9bf211a30b3f ("net: cdc_mbim: adding MBIM driver")
Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
---
 drivers/net/usb/cdc_mbim.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
index a7010a0664c7d..7158716c1f106 100644
--- a/drivers/net/usb/cdc_mbim.c
+++ b/drivers/net/usb/cdc_mbim.c
@@ -223,6 +223,7 @@ static struct sk_buff *cdc_mbim_tx_fixup(struct usbnet *dev, struct sk_buff *skb
 	struct cdc_mbim_state *info = (void *)&dev->data;
 	struct cdc_ncm_ctx *ctx = info->ctx;
 	__le32 sign = cpu_to_le32(USB_CDC_MBIM_NDP16_IPS_SIGN);
+	unsigned long irqflags;
 	u16 tci = 0;
 	bool is_ip;
 	u8 *c;
@@ -289,9 +290,10 @@ static struct sk_buff *cdc_mbim_tx_fixup(struct usbnet *dev, struct sk_buff *skb
 		}
 	}
 
-	spin_lock_bh(&ctx->mtx);
+	/* IRQs are off and BHs on under netpoll, see cdc_ncm_tx_fixup() */
+	spin_lock_irqsave(&ctx->mtx, irqflags);
 	skb_out = cdc_ncm_fill_tx_frame(dev, skb, sign);
-	spin_unlock_bh(&ctx->mtx);
+	spin_unlock_irqrestore(&ctx->mtx, irqflags);
 	return skb_out;
 
 error:

-- 
2.53.0

Re: [PATCH net 2/2] net: usb: cdc_mbim: don't enable BHs in tx_fixup under netpoll

[sashiko-bot]

> cdc_mbim_tx_fixup() has the same spin_unlock_bh() as cdc_ncm_tx_fixup().
> Under netpoll it runs pending softirqs while the txq lock is held, and
> a transmit from one of them spins on that lock.
> 
> Use spin_lock_irqsave() as in cdc_ncm.
> 
> Fixes: 9bf211a30b3f ("net: cdc_mbim: adding MBIM driver")
> Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261020-cdc-ncm-netpoll-v1-0-682184384b49@tipi-net.de?part=2