linux-yocto/include
John Ernberg d68a867d74 net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
commit 0d9cfc9b8c upstream.

The Gemalto Cinterion PLS83-W modem (cdc_ether) is emitting confusing link
up and down events when the WWAN interface is activated on the modem-side.

Interrupt URBs will in consecutive polls grab:
* Link Connected
* Link Disconnected
* Link Connected

Where the last Connected is then a stable link state.

When the system is under load this may cause the unlink_urbs() work in
__handle_link_change() to not complete before the next usbnet_link_change()
call turns the carrier on again, allowing rx_submit() to queue new SKBs.

In that event the URB queue is filled faster than it can drain, ending up
in a RCU stall:

    rcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 0-.... } 33108 jiffies s: 201 root: 0x1/.
    rcu: blocking rcu_node structures (internal RCU debug):
    Sending NMI from CPU 1 to CPUs 0:
    NMI backtrace for cpu 0

    Call trace:
     arch_local_irq_enable+0x4/0x8
     local_bh_enable+0x18/0x20
     __netdev_alloc_skb+0x18c/0x1cc
     rx_submit+0x68/0x1f8 [usbnet]
     rx_alloc_submit+0x4c/0x74 [usbnet]
     usbnet_bh+0x1d8/0x218 [usbnet]
     usbnet_bh_tasklet+0x10/0x18 [usbnet]
     tasklet_action_common+0xa8/0x110
     tasklet_action+0x2c/0x34
     handle_softirqs+0x2cc/0x3a0
     __do_softirq+0x10/0x18
     ____do_softirq+0xc/0x14
     call_on_irq_stack+0x24/0x34
     do_softirq_own_stack+0x18/0x20
     __irq_exit_rcu+0xa8/0xb8
     irq_exit_rcu+0xc/0x30
     el1_interrupt+0x34/0x48
     el1h_64_irq_handler+0x14/0x1c
     el1h_64_irq+0x68/0x6c
     _raw_spin_unlock_irqrestore+0x38/0x48
     xhci_urb_dequeue+0x1ac/0x45c [xhci_hcd]
     unlink1+0xd4/0xdc [usbcore]
     usb_hcd_unlink_urb+0x70/0xb0 [usbcore]
     usb_unlink_urb+0x24/0x44 [usbcore]
     unlink_urbs.constprop.0.isra.0+0x64/0xa8 [usbnet]
     __handle_link_change+0x34/0x70 [usbnet]
     usbnet_deferred_kevent+0x1c0/0x320 [usbnet]
     process_scheduled_works+0x2d0/0x48c
     worker_thread+0x150/0x1dc
     kthread+0xd8/0xe8
     ret_from_fork+0x10/0x20

Get around the problem by delaying the carrier on to the scheduled work.

This needs a new flag to keep track of the necessary action.

The carrier ok check cannot be removed as it remains required for the
LINK_RESET event flow.

Fixes: 4b49f58fff ("usbnet: handle link change")
Cc: stable@vger.kernel.org
Signed-off-by: John Ernberg <john.ernberg@actia.se>
Link: https://patch.msgid.link/20250723102526.1305339-1-john.ernberg@actia.se
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-15 12:14:12 +02:00
..
acpi ACPICA: Avoid sequence overread in call to strncmp() 2025-06-27 11:11:26 +01:00
asm-generic
clocksource
crypto crypto: ahash - Set default reqsize from ahash_alg 2025-05-29 11:02:40 +02:00
cxl
drm drm/amdgpu: Reset the clear flag in buddy during resume 2025-08-01 09:48:42 +01:00
dt-bindings
keys
kunit
kvm
linux net: usbnet: Avoid potential RCU stall on LINK_CHANGE event 2025-08-15 12:14:12 +02:00
math-emu
media media: v4l: Memset argument to 0 before calling get_mbus_config pad op 2025-05-29 11:02:49 +02:00
memory
misc
net net: drop UFO packets in udp_rcv_segment() 2025-08-15 12:14:06 +02:00
pcmcia
ras
rdma RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject() 2025-05-29 11:02:19 +02:00
rv
scsi
soc soc: qcom: ice: introduce devm_of_qcom_ice_get 2025-05-02 07:58:52 +02:00
sound ASoC: tas2781: Fix the wrong step for TLV on tas2781 2025-08-15 12:14:06 +02:00
target
trace rxrpc: Fix recv-recv race of completed call 2025-07-24 08:56:35 +02:00
uapi vhost: Reintroduce kthread API and add mode selection 2025-08-15 12:13:58 +02:00
ufs scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices 2025-05-29 11:01:58 +02:00
vdso
video
xen