Linux kernel -stable discussions
 help / color / mirror / Atom feed
* xen-netback fixes for stable 35876b5 3e55f8b
@ 2013-02-22 16:47 William Dauchy
  2013-02-22 17:08 ` Greg Kroah-Hartman
                   ` (2 more replies)
  0 siblings, 3 replies; 8+ messages in thread
From: William Dauchy @ 2013-02-22 16:47 UTC (permalink / raw)
  To: stable
  Cc: Greg Kroah-Hartman, Ben Hutchings, linux-kernel@vger.kernel.org,
	ian.campbell, david.vrabel, Christopher S. Aker

[-- Attachment #1: Type: text/plain, Size: 2851 bytes --]

Hello,

I believe the two commits 35876b5 and 3e55f8b could be included in stable tree.
35876b5 is related to 4885628 already in the stable tree and fixes a
possible oops.
3e55f8b is fixing another possible oops (see commit messages).

I tested them on top of a v3.4.33.
Could we consider adding these patches in stable tree at least for v3.4?

Tested-by: William Dauchy <william@gandi.net>
Cc: stable@vger.kernel.org



commit 35876b5ffc154c357476b2c3bdab10feaf4bd8f0
Author: David Vrabel <david.vrabel@citrix.com>
Date:   Thu Feb 14 03:18:57 2013 +0000

    xen-netback: correctly return errors from netbk_count_requests()
   
    netbk_count_requests() could detect an error, call
    netbk_fatal_tx_error() but return 0.  The vif may then be used
    afterwards (e.g., in a call to netbk_tx_error().
   
    Since netbk_fatal_tx_error() could set vif->refcnt to 1, the vif may
    be freed immediately after the call to netbk_fatal_tx_error() (e.g.,
    if the vif is also removed).
   
    Netback thread              Xenwatch thread
    -------------------------------------------
    netbk_fatal_tx_err()        netback_remove()
                                  xenvif_disconnect()
                                    ...
                                    free_netdev()
    netbk_tx_err() Oops!
   
    Signed-off-by: Wei Liu <wei.liu2@citrix.com>
    Signed-off-by: Jan Beulich <JBeulich@suse.com>
    Signed-off-by: David Vrabel <david.vrabel@citrix.com>
    Reported-by: Christopher S. Aker <caker@theshore.net>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 3e55f8b306cf305832a4ac78aa82e1b40e818ece
Author: David Vrabel <david.vrabel@citrix.com>
Date:   Thu Feb 14 03:18:58 2013 +0000

    xen-netback: cancel the credit timer when taking the vif down
   
    If the credit timer is left armed after calling
    xen_netbk_remove_xenvif(), then it may fire and attempt to schedule
    the vif which will then oops as vif->netbk == NULL.
   
    This may happen both in the fatal error path and during normal
    disconnection from the front end.
   
    The sequencing during shutdown is critical to ensure that: a)
    vif->netbk doesn't become unexpectedly NULL; and b) the net device/vif
    is not freed.
   
    1. Mark as unschedulable (netif_carrier_off()).
    2. Synchronously cancel the timer.
    3. Remove the vif from the schedule list.
    4. Remove it from it netback thread group.
    5. Wait for vif->refcnt to become 0.
   
    Signed-off-by: David Vrabel <david.vrabel@citrix.com>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Reported-by: Christopher S. Aker <caker@theshore.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>


Regards,
-- 
William

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

^ permalink raw reply	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2013-02-22 18:32 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-02-22 16:47 xen-netback fixes for stable 35876b5 3e55f8b William Dauchy
2013-02-22 17:08 ` Greg Kroah-Hartman
2013-02-22 17:17   ` William Dauchy
2013-02-22 17:28     ` Greg Kroah-Hartman
2013-02-22 17:37       ` William Dauchy
2013-02-22 17:44 ` Ian Campbell
2013-02-22 17:51   ` William Dauchy
2013-02-22 18:32 ` David Miller

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox