From 9433d2f334ed1b089cfc83cfcdeb28e6a3f3f412 Mon Sep 17 00:00:00 2001 From: Zack Gomez Date: Fri, 25 Sep 2026 16:45:37 -0400 Subject: [PATCH] netpoll: bound the deferred transmit queue __netpoll_send_skb() parks an skb on npinfo->txq whenever the device cannot take it at once, and once the queue is non-empty every later skb goes straight there to keep ordering. queue_process() drains it from a workqueue and, unlike the direct path, never polls the device for completions: when the ring is stopped it backs off HZ/10. Nothing limits the queue length. A producer that outruns that drain therefore grows the queue until the host is out of memory. Observed with netconsole forwarding a GPU driver that logged one line at ~1e5/s after a firmware hang. The NIC was moving ~17k packets/s: completions for each burst surfaced tens of ms later, outside the one-tick window, so queue_process() slept HZ/10 per ring while ~1e5 lines/s kept arriving. The queue grew at ~170 MB/s, unreclaimable slab reached 51 GiB in five minutes and the OOM killer ran from kswapd with 341 MiB of anonymous memory on the whole box. What the queue held was the flood itself; the OOM report never left the host. Reproduced on the same host (netconsole over a 10G ConnectX-4 Lx) under the same slow-completion condition: 200k lines to /dev/kmsg in 0.12 s grew unreclaimable slab by 173 MiB, about 188k skbs, draining at ~8-10k packets/s. With prompt completions the same burst drains at line rate; a stall on the link while lines keep arriving faster than the drain reproduces the growth. Until the 2006 netpoll rework [1] the deferred path drained through dev_queue_xmit(), with the stack's own backpressure, and was capped at 16 skbs (MAX_QUEUE_DEPTH). That series moved it to a direct hard_start_xmit() with the HZ/10 back-off and made the queue per-device, dropping the cap on the way. Cap it at 1024 skbs per device and drop new skbs beyond that. The drop is counted in tx_dropped of the device whose queue is full and freed with SKB_DROP_REASON_FULL_RING. A netconsole target bound directly to that device also gets NET_XMIT_DROP and, with CONFIG_NETCONSOLE_DYNAMIC, counts it in xmit_drop_count. When a stacked device (bond, bridge, team, vlan, macvlan) passes the skb down and the lower device's queue is the one that fills, the return value does not reach netconsole and the lower device's tx_dropped is the record. The bound holds either way. Nothing is logged on the drop path because that would recurse into the console being drained. [1] https://lore.kernel.org/netdev/20061026225645.482978803@osdl.org/ Signed-off-by: Zack Gomez Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20260925204537.2664119-1-zack.gomez@gmail.com Signed-off-by: Jakub Kicinski --- net/core/netpoll.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/net/core/netpoll.c b/net/core/netpoll.c index fe1e0cda5d6b..aafbb19a2887 100644 --- a/net/core/netpoll.c +++ b/net/core/netpoll.c @@ -38,6 +38,15 @@ #define USEC_PER_POLL 50 +/* + * Cap on skbs parked in npinfo->txq while the device is busy. The queue + * exists to ride out a transient stall; a producer that outruns the + * device for longer than that must lose packets, not grow it without + * bound. Checked without the queue lock, so the queue can overshoot + * slightly. + */ +#define NETPOLL_TXQ_MAX 1024 + /* * carrier_timeout is netconsole-specific and only kept here to preserve the * netpoll.carrier_timeout module-parameter ABI. Its value is exposed to @@ -314,6 +323,12 @@ static netdev_tx_t __netpoll_send_skb(struct netpoll *np, struct sk_buff *skb) } if (!dev_xmit_complete(status)) { + if (skb_queue_len_lockless(&npinfo->txq) >= NETPOLL_TXQ_MAX) { + dev_core_stats_tx_dropped_inc(dev); + dev_kfree_skb_irq_reason(skb, + SKB_DROP_REASON_FULL_RING); + goto out; + } skb_queue_tail(&npinfo->txq, skb); schedule_delayed_work(&npinfo->tx_work,0); }