All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Neil Horman <nhorman@tuxdriver.com>,
	Shreyas Bhatewara <sbhatewara@vmware.com>,
	"VMware, Inc." <pv-drivers@vmware.com>,
	"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 3.4 26/35] vmxnet3: fix netpoll race condition
Date: Thu, 20 Mar 2014 17:11:17 -0700	[thread overview]
Message-ID: <20140321001055.016874270@linuxfoundation.org> (raw)
In-Reply-To: <20140321001054.038170009@linuxfoundation.org>

3.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Neil Horman <nhorman@tuxdriver.com>

commit d25f06ea466ea521b563b76661180b4e44714ae6 upstream.

vmxnet3's netpoll driver is incorrectly coded.  It directly calls
vmxnet3_do_poll, which is the driver internal napi poll routine.  As the netpoll
controller method doesn't block real napi polls in any way, there is a potential
for race conditions in which the netpoll controller method and the napi poll
method run concurrently.  The result is data corruption causing panics such as this
one recently observed:
PID: 1371   TASK: ffff88023762caa0  CPU: 1   COMMAND: "rs:main Q:Reg"
 #0 [ffff88023abd5780] machine_kexec at ffffffff81038f3b
 #1 [ffff88023abd57e0] crash_kexec at ffffffff810c5d92
 #2 [ffff88023abd58b0] oops_end at ffffffff8152b570
 #3 [ffff88023abd58e0] die at ffffffff81010e0b
 #4 [ffff88023abd5910] do_trap at ffffffff8152add4
 #5 [ffff88023abd5970] do_invalid_op at ffffffff8100cf95
 #6 [ffff88023abd5a10] invalid_op at ffffffff8100bf9b
    [exception RIP: vmxnet3_rq_rx_complete+1968]
    RIP: ffffffffa00f1e80  RSP: ffff88023abd5ac8  RFLAGS: 00010086
    RAX: 0000000000000000  RBX: ffff88023b5dcee0  RCX: 00000000000000c0
    RDX: 0000000000000000  RSI: 00000000000005f2  RDI: ffff88023b5dcee0
    RBP: ffff88023abd5b48   R8: 0000000000000000   R9: ffff88023a3b6048
    R10: 0000000000000000  R11: 0000000000000002  R12: ffff8802398d4cd8
    R13: ffff88023af35140  R14: ffff88023b60c890  R15: 0000000000000000
    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
 #7 [ffff88023abd5b50] vmxnet3_do_poll at ffffffffa00f204a [vmxnet3]
 #8 [ffff88023abd5b80] vmxnet3_netpoll at ffffffffa00f209c [vmxnet3]
 #9 [ffff88023abd5ba0] netpoll_poll_dev at ffffffff81472bb7

The fix is to do as other drivers do, and have the poll controller call the top
half interrupt handler, which schedules a napi poll properly to recieve frames

Tested by myself, successfully.

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
CC: Shreyas Bhatewara <sbhatewara@vmware.com>
CC: "VMware, Inc." <pv-drivers@vmware.com>
CC: "David S. Miller" <davem@davemloft.net>
Reviewed-by: Shreyas N Bhatewara <sbhatewara@vmware.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/vmxnet3/vmxnet3_drv.c |   16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1728,12 +1728,18 @@ static void
 vmxnet3_netpoll(struct net_device *netdev)
 {
 	struct vmxnet3_adapter *adapter = netdev_priv(netdev);
+	int i;
 
-	if (adapter->intr.mask_mode == VMXNET3_IMM_ACTIVE)
-		vmxnet3_disable_all_intrs(adapter);
-
-	vmxnet3_do_poll(adapter, adapter->rx_queue[0].rx_ring[0].size);
-	vmxnet3_enable_all_intrs(adapter);
+	switch (adapter->intr.type) {
+	case VMXNET3_IT_MSIX:
+		for (i = 0; i < adapter->num_rx_queues; i++)
+			vmxnet3_msix_rx(0, &adapter->rx_queue[i]);
+		break;
+	case VMXNET3_IT_MSI:
+	default:
+		vmxnet3_intr(0, adapter->netdev);
+		break;
+	}
 
 }
 #endif	/* CONFIG_NET_POLL_CONTROLLER */



  parent reply	other threads:[~2014-03-21  0:12 UTC|newest]

Thread overview: 37+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-03-21  0:10 [PATCH 3.4 00/35] 3.4.84-stable review Greg Kroah-Hartman
2014-03-21  0:10 ` [PATCH 3.4 01/35] ocfs2: fix quota file corruption Greg Kroah-Hartman
2014-03-21  0:10 ` [PATCH 3.4 02/35] ocfs2 syncs the wrong range Greg Kroah-Hartman
2014-03-21  0:10 ` [PATCH 3.4 03/35] sched: Fix double normalization of vruntime Greg Kroah-Hartman
2014-03-21  0:10 ` [PATCH 3.4 04/35] virtio-net: alloc big buffers also when guest can receive UFO Greg Kroah-Hartman
2014-03-21  0:10 ` [PATCH 3.4 05/35] tg3: Dont check undefined error bits in RXBD Greg Kroah-Hartman
2014-03-21  0:10 ` [PATCH 3.4 06/35] net: sctp: fix sctp_sf_do_5_1D_ce to verify if we/peer is AUTH capable Greg Kroah-Hartman
2014-03-21  0:10 ` [PATCH 3.4 07/35] mac80211: fix AP powersave TX vs. wakeup race Greg Kroah-Hartman
2014-03-21  0:10 ` [PATCH 3.4 08/35] ath9k: Fix ETSI compliance for AR9462 2.0 Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 09/35] mwifiex: copy APs HT capability info correctly Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 11/35] ALSA: oxygen: Xonar DG(X): capture from I2S channel 1, not 2 Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 12/35] ALSA: usb-audio: Add quirk for Logitech Webcam C500 Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 13/35] powerpc: Align p_dyn, p_rela and p_st symbols Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 14/35] ARM: 7991/1: sa1100: fix compile problem on Collie Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 15/35] x86/amd/numa: Fix northbridge quirk to assign correct NUMA node Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 16/35] genirq: Remove racy waitqueue_active check Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 17/35] cpuset: fix a race condition in __cpuset_node_allowed_softwall() Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 18/35] tracing: Do not add event files for modules that fail tracepoints Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 19/35] firewire: net: fix use after free Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 20/35] firewire: dont use PREPARE_DELAYED_WORK Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 21/35] libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for Seagate Momentus SpinPoint M8 (2BA30001) Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 22/35] NFS: Fix a delegation callback race Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 23/35] fs/proc/base.c: fix GPF in /proc/$PID/map_files Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 24/35] drm/radeon/atom: select the proper number of lanes in transmitter setup Greg Kroah-Hartman
2014-03-21  0:11 ` Greg Kroah-Hartman [this message]
2014-03-21  0:11 ` [PATCH 3.4 27/35] vmxnet3: fix building without CONFIG_PCI_MSI Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 28/35] can: flexcan: flexcan_open(): fix error path if flexcan_chip_start() fails Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 29/35] SCSI: isci: fix reset timeout handling Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 30/35] SCSI: isci: correct erroneous for_each_isci_host macro Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 31/35] SCSI: qla2xxx: Poll during initialization for ISP25xx and ISP83xx Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 32/35] SCSI: storvsc: NULL pointer dereference fix Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 33/35] Btrfs: fix data corruption when reading/updating compressed extents Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 34/35] ALSA: oxygen: modify adjust_dg_dac_routing function Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 35/35] jiffies: Avoid undefined behavior from signed overflow Greg Kroah-Hartman
2014-03-21  5:26 ` [PATCH 3.4 00/35] 3.4.84-stable review Guenter Roeck
2014-03-22 21:56   ` Shuah Khan
2014-03-24  4:33     ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20140321001055.016874270@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=davem@davemloft.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=nhorman@tuxdriver.com \
    --cc=pv-drivers@vmware.com \
    --cc=sbhatewara@vmware.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.