From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Neil Horman <nhorman@tuxdriver.com>,
Shreyas Bhatewara <sbhatewara@vmware.com>,
"VMware, Inc." <pv-drivers@vmware.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 3.4 26/35] vmxnet3: fix netpoll race condition
Date: Thu, 20 Mar 2014 17:11:17 -0700 [thread overview]
Message-ID: <20140321001055.016874270@linuxfoundation.org> (raw)
In-Reply-To: <20140321001054.038170009@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neil Horman <nhorman@tuxdriver.com>
commit d25f06ea466ea521b563b76661180b4e44714ae6 upstream.
vmxnet3's netpoll driver is incorrectly coded. It directly calls
vmxnet3_do_poll, which is the driver internal napi poll routine. As the netpoll
controller method doesn't block real napi polls in any way, there is a potential
for race conditions in which the netpoll controller method and the napi poll
method run concurrently. The result is data corruption causing panics such as this
one recently observed:
PID: 1371 TASK: ffff88023762caa0 CPU: 1 COMMAND: "rs:main Q:Reg"
#0 [ffff88023abd5780] machine_kexec at ffffffff81038f3b
#1 [ffff88023abd57e0] crash_kexec at ffffffff810c5d92
#2 [ffff88023abd58b0] oops_end at ffffffff8152b570
#3 [ffff88023abd58e0] die at ffffffff81010e0b
#4 [ffff88023abd5910] do_trap at ffffffff8152add4
#5 [ffff88023abd5970] do_invalid_op at ffffffff8100cf95
#6 [ffff88023abd5a10] invalid_op at ffffffff8100bf9b
[exception RIP: vmxnet3_rq_rx_complete+1968]
RIP: ffffffffa00f1e80 RSP: ffff88023abd5ac8 RFLAGS: 00010086
RAX: 0000000000000000 RBX: ffff88023b5dcee0 RCX: 00000000000000c0
RDX: 0000000000000000 RSI: 00000000000005f2 RDI: ffff88023b5dcee0
RBP: ffff88023abd5b48 R8: 0000000000000000 R9: ffff88023a3b6048
R10: 0000000000000000 R11: 0000000000000002 R12: ffff8802398d4cd8
R13: ffff88023af35140 R14: ffff88023b60c890 R15: 0000000000000000
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
#7 [ffff88023abd5b50] vmxnet3_do_poll at ffffffffa00f204a [vmxnet3]
#8 [ffff88023abd5b80] vmxnet3_netpoll at ffffffffa00f209c [vmxnet3]
#9 [ffff88023abd5ba0] netpoll_poll_dev at ffffffff81472bb7
The fix is to do as other drivers do, and have the poll controller call the top
half interrupt handler, which schedules a napi poll properly to recieve frames
Tested by myself, successfully.
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
CC: Shreyas Bhatewara <sbhatewara@vmware.com>
CC: "VMware, Inc." <pv-drivers@vmware.com>
CC: "David S. Miller" <davem@davemloft.net>
Reviewed-by: Shreyas N Bhatewara <sbhatewara@vmware.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/vmxnet3/vmxnet3_drv.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1728,12 +1728,18 @@ static void
vmxnet3_netpoll(struct net_device *netdev)
{
struct vmxnet3_adapter *adapter = netdev_priv(netdev);
+ int i;
- if (adapter->intr.mask_mode == VMXNET3_IMM_ACTIVE)
- vmxnet3_disable_all_intrs(adapter);
-
- vmxnet3_do_poll(adapter, adapter->rx_queue[0].rx_ring[0].size);
- vmxnet3_enable_all_intrs(adapter);
+ switch (adapter->intr.type) {
+ case VMXNET3_IT_MSIX:
+ for (i = 0; i < adapter->num_rx_queues; i++)
+ vmxnet3_msix_rx(0, &adapter->rx_queue[i]);
+ break;
+ case VMXNET3_IT_MSI:
+ default:
+ vmxnet3_intr(0, adapter->netdev);
+ break;
+ }
}
#endif /* CONFIG_NET_POLL_CONTROLLER */
next prev parent reply other threads:[~2014-03-21 0:12 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-03-21 0:10 [PATCH 3.4 00/35] 3.4.84-stable review Greg Kroah-Hartman
2014-03-21 0:10 ` [PATCH 3.4 01/35] ocfs2: fix quota file corruption Greg Kroah-Hartman
2014-03-21 0:10 ` [PATCH 3.4 02/35] ocfs2 syncs the wrong range Greg Kroah-Hartman
2014-03-21 0:10 ` [PATCH 3.4 03/35] sched: Fix double normalization of vruntime Greg Kroah-Hartman
2014-03-21 0:10 ` [PATCH 3.4 04/35] virtio-net: alloc big buffers also when guest can receive UFO Greg Kroah-Hartman
2014-03-21 0:10 ` [PATCH 3.4 05/35] tg3: Dont check undefined error bits in RXBD Greg Kroah-Hartman
2014-03-21 0:10 ` [PATCH 3.4 06/35] net: sctp: fix sctp_sf_do_5_1D_ce to verify if we/peer is AUTH capable Greg Kroah-Hartman
2014-03-21 0:10 ` [PATCH 3.4 07/35] mac80211: fix AP powersave TX vs. wakeup race Greg Kroah-Hartman
2014-03-21 0:10 ` [PATCH 3.4 08/35] ath9k: Fix ETSI compliance for AR9462 2.0 Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 09/35] mwifiex: copy APs HT capability info correctly Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 11/35] ALSA: oxygen: Xonar DG(X): capture from I2S channel 1, not 2 Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 12/35] ALSA: usb-audio: Add quirk for Logitech Webcam C500 Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 13/35] powerpc: Align p_dyn, p_rela and p_st symbols Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 14/35] ARM: 7991/1: sa1100: fix compile problem on Collie Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 15/35] x86/amd/numa: Fix northbridge quirk to assign correct NUMA node Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 16/35] genirq: Remove racy waitqueue_active check Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 17/35] cpuset: fix a race condition in __cpuset_node_allowed_softwall() Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 18/35] tracing: Do not add event files for modules that fail tracepoints Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 19/35] firewire: net: fix use after free Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 20/35] firewire: dont use PREPARE_DELAYED_WORK Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 21/35] libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for Seagate Momentus SpinPoint M8 (2BA30001) Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 22/35] NFS: Fix a delegation callback race Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 23/35] fs/proc/base.c: fix GPF in /proc/$PID/map_files Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 24/35] drm/radeon/atom: select the proper number of lanes in transmitter setup Greg Kroah-Hartman
2014-03-21 0:11 ` Greg Kroah-Hartman [this message]
2014-03-21 0:11 ` [PATCH 3.4 27/35] vmxnet3: fix building without CONFIG_PCI_MSI Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 28/35] can: flexcan: flexcan_open(): fix error path if flexcan_chip_start() fails Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 29/35] SCSI: isci: fix reset timeout handling Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 30/35] SCSI: isci: correct erroneous for_each_isci_host macro Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 31/35] SCSI: qla2xxx: Poll during initialization for ISP25xx and ISP83xx Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 32/35] SCSI: storvsc: NULL pointer dereference fix Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 33/35] Btrfs: fix data corruption when reading/updating compressed extents Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 34/35] ALSA: oxygen: modify adjust_dg_dac_routing function Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 35/35] jiffies: Avoid undefined behavior from signed overflow Greg Kroah-Hartman
2014-03-21 5:26 ` [PATCH 3.4 00/35] 3.4.84-stable review Guenter Roeck
2014-03-22 21:56 ` Shuah Khan
2014-03-24 4:33 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140321001055.016874270@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=nhorman@tuxdriver.com \
--cc=pv-drivers@vmware.com \
--cc=sbhatewara@vmware.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.