CVE-2025-37859

page_pool: avoid infinite loop to schedule delayed worker

published May 9, 2025

CVSS
—
EPSS
0%
Percentile
23.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

page_pool: avoid infinite loop to schedule delayed worker

We noticed the kworker in page_pool_release_retry() was waken

up repeatedly and infinitely in production because of the

buggy driver causing the inflight less than 0 and warning

us in page_pool_inflight()[1].

Since the inflight value goes negative, it means we should

not expect the whole page_pool to get back to work normally.

This patch mitigates the adverse effect by not rescheduling

the kworker when detecting the inflight negative in

page_pool_release_retry().

[1]

[Mon Feb 10 20:36:11 2025] ------------[ cut here ]------------

[Mon Feb 10 20:36:11 2025] Negative(-51446) inflight packet-pages

...

[Mon Feb 10 20:36:11 2025] Call Trace:

[Mon Feb 10 20:36:11 2025] page_pool_release_retry+0x23/0x70

[Mon Feb 10 20:36:11 2025] process_one_work+0x1b1/0x370

[Mon Feb 10 20:36:11 2025] worker_thread+0x37/0x3a0

[Mon Feb 10 20:36:11 2025] kthread+0x11a/0x140

[Mon Feb 10 20:36:11 2025] ? process_one_work+0x370/0x370

[Mon Feb 10 20:36:11 2025] ? __kthread_cancel_work+0x40/0x40

[Mon Feb 10 20:36:11 2025] ret_from_fork+0x35/0x40

[Mon Feb 10 20:36:11 2025] ---[ end trace ebffe800f33e7e34 ]---

Note: before this patch, the above calltrace would flood the

dmesg due to repeated reschedule of release_dw kworker.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00314 · 23.1th percentile
Published
2025-05-09T06:42Z
EPSS history
Timeline
  • 09 MAY 06:42Z
    page_pool: avoid infinite loop to schedule delayed worker
    cvelistv5