* [PATCH net 1/2] net: usb: cdc_ncm: don't enable BHs in tx_fixup under netpoll
2026-10-20 7:16 [PATCH net 0/2] net: usb: cdc_ncm/cdc_mbim: fix netpoll lockup in tx_fixup Nicolai Buchwitz
@ 2026-10-20 7:16 ` Nicolai Buchwitz
2026-10-20 8:59 ` sashiko-bot
2026-10-20 7:16 ` [PATCH net 2/2] net: usb: cdc_mbim: " Nicolai Buchwitz
1 sibling, 1 reply; 5+ messages in thread
From: Nicolai Buchwitz @ 2026-10-20 7:16 UTC (permalink / raw)
To: Oliver Neukum, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Sjur Brændeland, Alexey Orishko,
Greg Suarez, Bjørn Mork
Cc: Breno Leitao, linux-usb, netdev, linux-kernel, Nicolai Buchwitz,
Mikkel Eskildsen
netpoll holds the txq lock and calls ndo_start_xmit() with IRQs off but
BHs on. The spin_unlock_bh() in cdc_ncm_tx_fixup() then runs pending
softirqs. If one of them transmits, it spins on the txq lock that
netpoll holds. With netconsole on a cdc_ncm device this ends in a soft
or hard lockup.
Use spin_lock_irqsave(), which is safe both under netpoll and on the
normal xmit path.
Fixes: c84ff1d6dff3 ("cdc_ncm: reduce driver latency in the data path")
Reported-by: Mikkel Eskildsen <mke@visotia.com>
Closes: https://lore.kernel.org/netdev/PRAP189MB185019A5A8D411482BB6E0CDA9982@PRAP189MB1850.EURP189.PROD.OUTLOOK.COM/
Tested-by: Mikkel Eskildsen <mke@visotia.com>
Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
---
drivers/net/usb/cdc_ncm.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 35db38cb3e4a2..b579442f4a272 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -1524,6 +1524,7 @@ cdc_ncm_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
{
struct sk_buff *skb_out;
struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
+ unsigned long irqflags;
/*
* The Ethernet API we are using does not support transmitting
@@ -1535,14 +1536,17 @@ cdc_ncm_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
if (ctx == NULL)
goto error;
- spin_lock_bh(&ctx->mtx);
+ /* netpoll calls this with IRQs off and BHs on, so unlocking with
+ * spin_unlock_bh() would run softirqs that need the held txq lock.
+ */
+ spin_lock_irqsave(&ctx->mtx, irqflags);
if (ctx->is_ndp16)
skb_out = cdc_ncm_fill_tx_frame(dev, skb, cpu_to_le32(USB_CDC_NCM_NDP16_NOCRC_SIGN));
else
skb_out = cdc_ncm_fill_tx_frame(dev, skb, cpu_to_le32(USB_CDC_NCM_NDP32_NOCRC_SIGN));
- spin_unlock_bh(&ctx->mtx);
+ spin_unlock_irqrestore(&ctx->mtx, irqflags);
return skb_out;
error:
--
2.53.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH net 2/2] net: usb: cdc_mbim: don't enable BHs in tx_fixup under netpoll
2026-10-20 7:16 [PATCH net 0/2] net: usb: cdc_ncm/cdc_mbim: fix netpoll lockup in tx_fixup Nicolai Buchwitz
2026-10-20 7:16 ` [PATCH net 1/2] net: usb: cdc_ncm: don't enable BHs in tx_fixup under netpoll Nicolai Buchwitz
@ 2026-10-20 7:16 ` Nicolai Buchwitz
2026-10-20 8:59 ` sashiko-bot
1 sibling, 1 reply; 5+ messages in thread
From: Nicolai Buchwitz @ 2026-10-20 7:16 UTC (permalink / raw)
To: Oliver Neukum, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Sjur Brændeland, Alexey Orishko,
Greg Suarez, Bjørn Mork
Cc: Breno Leitao, linux-usb, netdev, linux-kernel, Nicolai Buchwitz
cdc_mbim_tx_fixup() has the same spin_unlock_bh() as cdc_ncm_tx_fixup().
Under netpoll it runs pending softirqs while the txq lock is held, and
a transmit from one of them spins on that lock.
Use spin_lock_irqsave() as in cdc_ncm.
Fixes: 9bf211a30b3f ("net: cdc_mbim: adding MBIM driver")
Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
---
drivers/net/usb/cdc_mbim.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
index a7010a0664c7d..7158716c1f106 100644
--- a/drivers/net/usb/cdc_mbim.c
+++ b/drivers/net/usb/cdc_mbim.c
@@ -223,6 +223,7 @@ static struct sk_buff *cdc_mbim_tx_fixup(struct usbnet *dev, struct sk_buff *skb
struct cdc_mbim_state *info = (void *)&dev->data;
struct cdc_ncm_ctx *ctx = info->ctx;
__le32 sign = cpu_to_le32(USB_CDC_MBIM_NDP16_IPS_SIGN);
+ unsigned long irqflags;
u16 tci = 0;
bool is_ip;
u8 *c;
@@ -289,9 +290,10 @@ static struct sk_buff *cdc_mbim_tx_fixup(struct usbnet *dev, struct sk_buff *skb
}
}
- spin_lock_bh(&ctx->mtx);
+ /* IRQs are off and BHs on under netpoll, see cdc_ncm_tx_fixup() */
+ spin_lock_irqsave(&ctx->mtx, irqflags);
skb_out = cdc_ncm_fill_tx_frame(dev, skb, sign);
- spin_unlock_bh(&ctx->mtx);
+ spin_unlock_irqrestore(&ctx->mtx, irqflags);
return skb_out;
error:
--
2.53.0
^ permalink raw reply related [flat|nested] 5+ messages in thread