[PATCH] net: fix race in process_backlog

[PATCH] net: fix race in process_backlog

[Peter Zijlstra]

Subject: net: fix race in process_backlog

The recent NAPI rework (4fa57c9ea9f36f9ca852f3a88ca5d2f1aebbc960)
introduced a race between netif_rx() and process_backlog() which
resulted in softirq processing to drop dead.

netif_rx()		process_backlog()

			irq_disable();
			skb = __skb_dequeue();
			irq_enable();

irq_disable();
__skb_queue_tail();
napi_schedule();
irq_enable();

			if (!skb)
			  napi_complete();  <-- oops!

we cleared the napi bit, even though there is data to process.

Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
---
 net/core/dev.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Index: linux-2.6/net/core/dev.c
===================================================================
--- linux-2.6.orig/net/core/dev.c
+++ linux-2.6/net/core/dev.c
@@ -2095,11 +2095,11 @@ static int process_backlog(struct napi_s
 
 		local_irq_disable();
 		skb = __skb_dequeue(&queue->input_pkt_queue);
-		local_irq_enable();
 		if (!skb) {
-			napi_complete(napi);
+			__napi_complete(napi);
 			break;
 		}
+		local_irq_enable();
 
 		dev = skb->dev;
 

Re: [PATCH] net: fix race in process_backlog

[Stephen Hemminger]

On Wed, 03 Oct 2007 17:44:53 +0200
Peter Zijlstra <a.p.zijlstra@chello.nl> wrote:

> Subject: net: fix race in process_backlog
> 
> The recent NAPI rework (4fa57c9ea9f36f9ca852f3a88ca5d2f1aebbc960)
> introduced a race between netif_rx() and process_backlog() which
> resulted in softirq processing to drop dead.
> 
> netif_rx()		process_backlog()
> 
> 			irq_disable();
> 			skb = __skb_dequeue();
> 			irq_enable();
> 
> irq_disable();
> __skb_queue_tail();
> napi_schedule();
> irq_enable();
> 
> 			if (!skb)
> 			  napi_complete();  <-- oops!
> 
> we cleared the napi bit, even though there is data to process.
> 
> Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>

Acked-by: Stephen Hemminger <shemminger@linux-foundation.org>


-- 
Stephen Hemminger <shemminger@linux-foundation.org>

Re: [PATCH] net: fix race in process_backlog

[David Miller]

From: Peter Zijlstra <a.p.zijlstra@chello.nl>
Date: Wed, 03 Oct 2007 17:44:53 +0200

> Index: linux-2.6/net/core/dev.c
> ===================================================================
> --- linux-2.6.orig/net/core/dev.c
> +++ linux-2.6/net/core/dev.c
> @@ -2095,11 +2095,11 @@ static int process_backlog(struct napi_s
>  
>  		local_irq_disable();
>  		skb = __skb_dequeue(&queue->input_pkt_queue);
> -		local_irq_enable();
>  		if (!skb) {
> -			napi_complete(napi);
> +			__napi_complete(napi);
>  			break;
>  		}
> +		local_irq_enable();

What re-enables interrupts in the !skb path?

Re: [PATCH] net: fix race in process_backlog

[Stephen Hemminger]

On Wed, 03 Oct 2007 14:58:07 -0700 (PDT)
David Miller <davem@davemloft.net> wrote:

> From: Peter Zijlstra <a.p.zijlstra@chello.nl>
> Date: Wed, 03 Oct 2007 17:44:53 +0200
> 
> > Index: linux-2.6/net/core/dev.c
> > ===================================================================
> > --- linux-2.6.orig/net/core/dev.c
> > +++ linux-2.6/net/core/dev.c
> > @@ -2095,11 +2095,11 @@ static int process_backlog(struct napi_s
> >  
> >  		local_irq_disable();
> >  		skb = __skb_dequeue(&queue->input_pkt_queue);
> > -		local_irq_enable();
> >  		if (!skb) {
> > -			napi_complete(napi);
> > +			__napi_complete(napi);
> >  			break;
> >  		}
> > +		local_irq_enable();
> 
> What re-enables interrupts in the !skb path?

This looks like a better fix. the irq_enable is needed in both cases.

--- a/net/core/dev.c	2007-09-27 07:19:10.000000000 -0700
+++ b/net/core/dev.c	2007-10-03 15:03:54.000000000 -0700
@@ -2077,12 +2077,14 @@ static int process_backlog(struct napi_s
 
 		local_irq_disable();
 		skb = __skb_dequeue(&queue->input_pkt_queue);
-		local_irq_enable();
 		if (!skb) {
-			napi_complete(napi);
+			__napi_complete(napi);
+			local_irq_enable();
 			break;
 		}
 
+		local_irq_enable();
+
 		dev = skb->dev;
 
 		netif_receive_skb(skb);


-- 
Stephen Hemminger <shemminger@linux-foundation.org>

Re: [PATCH] net: fix race in process_backlog

[David Miller]

From: Stephen Hemminger <shemminger@linux-foundation.org>
Date: Wed, 3 Oct 2007 15:05:19 -0700

> On Wed, 03 Oct 2007 14:58:07 -0700 (PDT)
> David Miller <davem@davemloft.net> wrote:
> 
> > From: Peter Zijlstra <a.p.zijlstra@chello.nl>
> > Date: Wed, 03 Oct 2007 17:44:53 +0200
> > 
> > > Index: linux-2.6/net/core/dev.c
> > > ===================================================================
> > > --- linux-2.6.orig/net/core/dev.c
> > > +++ linux-2.6/net/core/dev.c
> > > @@ -2095,11 +2095,11 @@ static int process_backlog(struct napi_s
> > >  
> > >  		local_irq_disable();
> > >  		skb = __skb_dequeue(&queue->input_pkt_queue);
> > > -		local_irq_enable();
> > >  		if (!skb) {
> > > -			napi_complete(napi);
> > > +			__napi_complete(napi);
> > >  			break;
> > >  		}
> > > +		local_irq_enable();
> > 
> > What re-enables interrupts in the !skb path?
> 
> This looks like a better fix. the irq_enable is needed in both cases.

Yep, applied, thanks Peter and Stephen.