Subject: Re: [PATCH net v3] netpoll: Fix deadlock in memory allocation under spinlock

From: Jakub Kicinski <[email-masked]>
Date: Thu, 16 Oct 2025 16:23:23 -0700

On Tue, 14 Oct 2025 09:37:50 -0700 Breno Leitao wrote:
> +	while (1) {
> +		spin_lock_irqsave(&skb_pool->lock, flags);
> +		if (skb_pool->qlen >= MAX_SKBS)
> +			goto unlock;
> +		spin_unlock_irqrestore(&skb_pool->lock, flags);

No need for the lock here:

	if (READ_ONCE(..) >= MAX_SKBS)

>  		skb = alloc_skb(MAX_SKB_SIZE, GFP_ATOMIC);
>  		if (!skb)
> -			break;
> +			return;
>  
> +		spin_lock_irqsave(&skb_pool->lock, flags);
> +		if (skb_pool->qlen >= MAX_SKBS)
> +			/* Discard if len got increased (TOCTOU) */
> +			goto discard;

Not sure this is strictly needed, the number 32 (MAX_SKBS) was not
chosen super scientifically anyway, doesn't matter if we go over a
little. But if we care I think we can:

	if (skb_pool->qlen < MAX_SKBS)
		__skb_queue_tail(skb_pool, skb);
	else
		dev_kfree_skb_any(skb);

and there's no need for the gotos

>  		__skb_queue_tail(skb_pool, skb);
> +		spin_unlock_irqrestore(&skb_pool->lock, flags);
>  	}
-- 
pw-bot: cr