objpool_push() runs with interrupts disabled, but a kretprobe that returns in NMI context can push to the same per-CPU slot in the middle of it. With rethook-based kretprobes (and, before v6.14, fprobe) this is reachable since kretprobes moved to objpool in v6.7. The nested push publishes slot->last past the unwritten entry of the interrupted push, so a pop on another CPU can take a NULL or stale pointer, which hands an object out twice and loses another, and slot->last can move backwards, after which a pop on the owning CPU spins with interrupts disabled.
Patch 1 publishes the entries in order with a cmpxchg() on slot->last. Patch 2 adds a KUnit test in which a pinned hard hrtimer stands in for the NMI. It fails without patch 1 and passes with it. The race was found with a TLA+ model of __objpool_try_add_slot() and __objpool_try_get_slot() on one slot: a task push that an NMI push can interrupt at every step, pops on another CPU, and recycled objects. Memory is sequentially consistent, with one level of nesting. TLC finds the bug in current code, no violation with patch 1 (up to five objects, four task pushes, three nested pushes, five remote pops), and shows that a plain-store version of the fix lets last fall behind head. The model (Objpool.tla and its .cfg files) can be posted if that is useful. No earlier report of this was found: searches of patchwork (objpool, rethook, kretprobe, objpool_push) and of the linux-kernel archive on marc.info (objpool NMI, objpool_push, rethook NMI, kretprobe NMI) turned up nothing related. lore was not searched. Testing is described under "---" in each patch. In short: KUnit on UML x86_64 (4 CPUs, 3 runs before and after, plus 1 CPU and CONFIG_SMP=n), W=1 builds for x86_64 and i386, checkpatch --strict. Not tested: real NMIs through a kretprobe on hardware, weakly ordered architectures, and performance in the kernel. This series was prepared with Claude Code (Anthropic), model Claude Opus 5.5 (claude-opus-5-5). The code, the test, the changelogs and this cover letter were written with the assistant; the TLA+ model checker TLC found the race. Shashank Mohan Jain (2): objpool: keep objpool_push() correct when a push from NMI nests in it lib/tests: add KUnit test for nested objpool pushes MAINTAINERS | 1 + include/linux/objpool.h | 37 ++++- lib/Kconfig.debug | 13 ++ lib/tests/Makefile | 1 + lib/tests/objpool_kunit.c | 329 ++++++++++++++++++++++++++++++++++++++ 5 files changed, 373 insertions(+), 8 deletions(-) create mode 100644 lib/tests/objpool_kunit.c -- 2.43.0
