stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Neil Horman <nhorman@tuxdriver.com>,
	Shreyas Bhatewara <sbhatewara@vmware.com>,
	"VMware, Inc." <pv-drivers@vmware.com>,
	"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 3.4 26/35] vmxnet3: fix netpoll race condition
Date: Thu, 20 Mar 2014 17:11:17 -0700	[thread overview]
Message-ID: <20140321001055.016874270@linuxfoundation.org> (raw)
In-Reply-To: <20140321001054.038170009@linuxfoundation.org>

3.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Neil Horman <nhorman@tuxdriver.com>

commit d25f06ea466ea521b563b76661180b4e44714ae6 upstream.

vmxnet3's netpoll driver is incorrectly coded.  It directly calls
vmxnet3_do_poll, which is the driver internal napi poll routine.  As the netpoll
controller method doesn't block real napi polls in any way, there is a potential
for race conditions in which the netpoll controller method and the napi poll
method run concurrently.  The result is data corruption causing panics such as this
one recently observed:
PID: 1371   TASK: ffff88023762caa0  CPU: 1   COMMAND: "rs:main Q:Reg"
 #0 [ffff88023abd5780] machine_kexec at ffffffff81038f3b
 #1 [ffff88023abd57e0] crash_kexec at ffffffff810c5d92
 #2 [ffff88023abd58b0] oops_end at ffffffff8152b570
 #3 [ffff88023abd58e0] die at ffffffff81010e0b
 #4 [ffff88023abd5910] do_trap at ffffffff8152add4
 #5 [ffff88023abd5970] do_invalid_op at ffffffff8100cf95
 #6 [ffff88023abd5a10] invalid_op at ffffffff8100bf9b
    [exception RIP: vmxnet3_rq_rx_complete+1968]
    RIP: ffffffffa00f1e80  RSP: ffff88023abd5ac8  RFLAGS: 00010086
    RAX: 0000000000000000  RBX: ffff88023b5dcee0  RCX: 00000000000000c0
    RDX: 0000000000000000  RSI: 00000000000005f2  RDI: ffff88023b5dcee0
    RBP: ffff88023abd5b48   R8: 0000000000000000   R9: ffff88023a3b6048
    R10: 0000000000000000  R11: 0000000000000002  R12: ffff8802398d4cd8
    R13: ffff88023af35140  R14: ffff88023b60c890  R15: 0000000000000000
    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
 #7 [ffff88023abd5b50] vmxnet3_do_poll at ffffffffa00f204a [vmxnet3]
 #8 [ffff88023abd5b80] vmxnet3_netpoll at ffffffffa00f209c [vmxnet3]
 #9 [ffff88023abd5ba0] netpoll_poll_dev at ffffffff81472bb7

The fix is to do as other drivers do, and have the poll controller call the top
half interrupt handler, which schedules a napi poll properly to recieve frames

Tested by myself, successfully.

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
CC: Shreyas Bhatewara <sbhatewara@vmware.com>
CC: "VMware, Inc." <pv-drivers@vmware.com>
CC: "David S. Miller" <davem@davemloft.net>
Reviewed-by: Shreyas N Bhatewara <sbhatewara@vmware.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/vmxnet3/vmxnet3_drv.c |   16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1728,12 +1728,18 @@ static void
 vmxnet3_netpoll(struct net_device *netdev)
 {
 	struct vmxnet3_adapter *adapter = netdev_priv(netdev);
+	int i;
 
-	if (adapter->intr.mask_mode == VMXNET3_IMM_ACTIVE)
-		vmxnet3_disable_all_intrs(adapter);
-
-	vmxnet3_do_poll(adapter, adapter->rx_queue[0].rx_ring[0].size);
-	vmxnet3_enable_all_intrs(adapter);
+	switch (adapter->intr.type) {
+	case VMXNET3_IT_MSIX:
+		for (i = 0; i < adapter->num_rx_queues; i++)
+			vmxnet3_msix_rx(0, &adapter->rx_queue[i]);
+		break;
+	case VMXNET3_IT_MSI:
+	default:
+		vmxnet3_intr(0, adapter->netdev);
+		break;
+	}
 
 }
 #endif	/* CONFIG_NET_POLL_CONTROLLER */



  parent reply	other threads:[~2014-03-21  0:11 UTC|newest]

Thread overview: 37+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-03-21  0:10 [PATCH 3.4 00/35] 3.4.84-stable review Greg Kroah-Hartman
2014-03-21  0:10 ` [PATCH 3.4 01/35] ocfs2: fix quota file corruption Greg Kroah-Hartman
2014-03-21  0:10 ` [PATCH 3.4 02/35] ocfs2 syncs the wrong range Greg Kroah-Hartman
2014-03-21  0:10 ` [PATCH 3.4 03/35] sched: Fix double normalization of vruntime Greg Kroah-Hartman
2014-03-21  0:10 ` [PATCH 3.4 04/35] virtio-net: alloc big buffers also when guest can receive UFO Greg Kroah-Hartman
2014-03-21  0:10 ` [PATCH 3.4 05/35] tg3: Dont check undefined error bits in RXBD Greg Kroah-Hartman
2014-03-21  0:10 ` [PATCH 3.4 06/35] net: sctp: fix sctp_sf_do_5_1D_ce to verify if we/peer is AUTH capable Greg Kroah-Hartman
2014-03-21  0:10 ` [PATCH 3.4 07/35] mac80211: fix AP powersave TX vs. wakeup race Greg Kroah-Hartman
2014-03-21  0:10 ` [PATCH 3.4 08/35] ath9k: Fix ETSI compliance for AR9462 2.0 Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 09/35] mwifiex: copy APs HT capability info correctly Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 11/35] ALSA: oxygen: Xonar DG(X): capture from I2S channel 1, not 2 Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 12/35] ALSA: usb-audio: Add quirk for Logitech Webcam C500 Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 13/35] powerpc: Align p_dyn, p_rela and p_st symbols Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 14/35] ARM: 7991/1: sa1100: fix compile problem on Collie Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 15/35] x86/amd/numa: Fix northbridge quirk to assign correct NUMA node Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 16/35] genirq: Remove racy waitqueue_active check Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 17/35] cpuset: fix a race condition in __cpuset_node_allowed_softwall() Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 18/35] tracing: Do not add event files for modules that fail tracepoints Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 19/35] firewire: net: fix use after free Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 20/35] firewire: dont use PREPARE_DELAYED_WORK Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 21/35] libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for Seagate Momentus SpinPoint M8 (2BA30001) Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 22/35] NFS: Fix a delegation callback race Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 23/35] fs/proc/base.c: fix GPF in /proc/$PID/map_files Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 24/35] drm/radeon/atom: select the proper number of lanes in transmitter setup Greg Kroah-Hartman
2014-03-21  0:11 ` Greg Kroah-Hartman [this message]
2014-03-21  0:11 ` [PATCH 3.4 27/35] vmxnet3: fix building without CONFIG_PCI_MSI Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 28/35] can: flexcan: flexcan_open(): fix error path if flexcan_chip_start() fails Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 29/35] SCSI: isci: fix reset timeout handling Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 30/35] SCSI: isci: correct erroneous for_each_isci_host macro Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 31/35] SCSI: qla2xxx: Poll during initialization for ISP25xx and ISP83xx Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 32/35] SCSI: storvsc: NULL pointer dereference fix Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 33/35] Btrfs: fix data corruption when reading/updating compressed extents Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 34/35] ALSA: oxygen: modify adjust_dg_dac_routing function Greg Kroah-Hartman
2014-03-21  0:11 ` [PATCH 3.4 35/35] jiffies: Avoid undefined behavior from signed overflow Greg Kroah-Hartman
2014-03-21  5:26 ` [PATCH 3.4 00/35] 3.4.84-stable review Guenter Roeck
2014-03-22 21:56   ` Shuah Khan
2014-03-24  4:33     ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20140321001055.016874270@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=davem@davemloft.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=nhorman@tuxdriver.com \
    --cc=pv-drivers@vmware.com \
    --cc=sbhatewara@vmware.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).