From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Neil Horman <nhorman@tuxdriver.com>,
Shreyas Bhatewara <sbhatewara@vmware.com>,
"VMware, Inc." <pv-drivers@vmware.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 3.4 26/35] vmxnet3: fix netpoll race condition
Date: Thu, 20 Mar 2014 17:11:17 -0700 [thread overview]
Message-ID: <20140321001055.016874270@linuxfoundation.org> (raw)
In-Reply-To: <20140321001054.038170009@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neil Horman <nhorman@tuxdriver.com>
commit d25f06ea466ea521b563b76661180b4e44714ae6 upstream.
vmxnet3's netpoll driver is incorrectly coded. It directly calls
vmxnet3_do_poll, which is the driver internal napi poll routine. As the netpoll
controller method doesn't block real napi polls in any way, there is a potential
for race conditions in which the netpoll controller method and the napi poll
method run concurrently. The result is data corruption causing panics such as this
one recently observed:
PID: 1371 TASK: ffff88023762caa0 CPU: 1 COMMAND: "rs:main Q:Reg"
#0 [ffff88023abd5780] machine_kexec at ffffffff81038f3b
#1 [ffff88023abd57e0] crash_kexec at ffffffff810c5d92
#2 [ffff88023abd58b0] oops_end at ffffffff8152b570
#3 [ffff88023abd58e0] die at ffffffff81010e0b
#4 [ffff88023abd5910] do_trap at ffffffff8152add4
#5 [ffff88023abd5970] do_invalid_op at ffffffff8100cf95
#6 [ffff88023abd5a10] invalid_op at ffffffff8100bf9b
[exception RIP: vmxnet3_rq_rx_complete+1968]
RIP: ffffffffa00f1e80 RSP: ffff88023abd5ac8 RFLAGS: 00010086
RAX: 0000000000000000 RBX: ffff88023b5dcee0 RCX: 00000000000000c0
RDX: 0000000000000000 RSI: 00000000000005f2 RDI: ffff88023b5dcee0
RBP: ffff88023abd5b48 R8: 0000000000000000 R9: ffff88023a3b6048
R10: 0000000000000000 R11: 0000000000000002 R12: ffff8802398d4cd8
R13: ffff88023af35140 R14: ffff88023b60c890 R15: 0000000000000000
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
#7 [ffff88023abd5b50] vmxnet3_do_poll at ffffffffa00f204a [vmxnet3]
#8 [ffff88023abd5b80] vmxnet3_netpoll at ffffffffa00f209c [vmxnet3]
#9 [ffff88023abd5ba0] netpoll_poll_dev at ffffffff81472bb7
The fix is to do as other drivers do, and have the poll controller call the top
half interrupt handler, which schedules a napi poll properly to recieve frames
Tested by myself, successfully.
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
CC: Shreyas Bhatewara <sbhatewara@vmware.com>
CC: "VMware, Inc." <pv-drivers@vmware.com>
CC: "David S. Miller" <davem@davemloft.net>
Reviewed-by: Shreyas N Bhatewara <sbhatewara@vmware.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/vmxnet3/vmxnet3_drv.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1728,12 +1728,18 @@ static void
vmxnet3_netpoll(struct net_device *netdev)
{
struct vmxnet3_adapter *adapter = netdev_priv(netdev);
+ int i;
- if (adapter->intr.mask_mode == VMXNET3_IMM_ACTIVE)
- vmxnet3_disable_all_intrs(adapter);
-
- vmxnet3_do_poll(adapter, adapter->rx_queue[0].rx_ring[0].size);
- vmxnet3_enable_all_intrs(adapter);
+ switch (adapter->intr.type) {
+ case VMXNET3_IT_MSIX:
+ for (i = 0; i < adapter->num_rx_queues; i++)
+ vmxnet3_msix_rx(0, &adapter->rx_queue[i]);
+ break;
+ case VMXNET3_IT_MSI:
+ default:
+ vmxnet3_intr(0, adapter->netdev);
+ break;
+ }
}
#endif /* CONFIG_NET_POLL_CONTROLLER */
next prev parent reply other threads:[~2014-03-21 0:11 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-03-21 0:10 [PATCH 3.4 00/35] 3.4.84-stable review Greg Kroah-Hartman
2014-03-21 0:10 ` [PATCH 3.4 01/35] ocfs2: fix quota file corruption Greg Kroah-Hartman
2014-03-21 0:10 ` [PATCH 3.4 02/35] ocfs2 syncs the wrong range Greg Kroah-Hartman
2014-03-21 0:10 ` [PATCH 3.4 03/35] sched: Fix double normalization of vruntime Greg Kroah-Hartman
2014-03-21 0:10 ` [PATCH 3.4 04/35] virtio-net: alloc big buffers also when guest can receive UFO Greg Kroah-Hartman
2014-03-21 0:10 ` [PATCH 3.4 05/35] tg3: Dont check undefined error bits in RXBD Greg Kroah-Hartman
2014-03-21 0:10 ` [PATCH 3.4 06/35] net: sctp: fix sctp_sf_do_5_1D_ce to verify if we/peer is AUTH capable Greg Kroah-Hartman
2014-03-21 0:10 ` [PATCH 3.4 07/35] mac80211: fix AP powersave TX vs. wakeup race Greg Kroah-Hartman
2014-03-21 0:10 ` [PATCH 3.4 08/35] ath9k: Fix ETSI compliance for AR9462 2.0 Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 09/35] mwifiex: copy APs HT capability info correctly Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 11/35] ALSA: oxygen: Xonar DG(X): capture from I2S channel 1, not 2 Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 12/35] ALSA: usb-audio: Add quirk for Logitech Webcam C500 Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 13/35] powerpc: Align p_dyn, p_rela and p_st symbols Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 14/35] ARM: 7991/1: sa1100: fix compile problem on Collie Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 15/35] x86/amd/numa: Fix northbridge quirk to assign correct NUMA node Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 16/35] genirq: Remove racy waitqueue_active check Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 17/35] cpuset: fix a race condition in __cpuset_node_allowed_softwall() Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 18/35] tracing: Do not add event files for modules that fail tracepoints Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 19/35] firewire: net: fix use after free Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 20/35] firewire: dont use PREPARE_DELAYED_WORK Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 21/35] libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for Seagate Momentus SpinPoint M8 (2BA30001) Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 22/35] NFS: Fix a delegation callback race Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 23/35] fs/proc/base.c: fix GPF in /proc/$PID/map_files Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 24/35] drm/radeon/atom: select the proper number of lanes in transmitter setup Greg Kroah-Hartman
2014-03-21 0:11 ` Greg Kroah-Hartman [this message]
2014-03-21 0:11 ` [PATCH 3.4 27/35] vmxnet3: fix building without CONFIG_PCI_MSI Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 28/35] can: flexcan: flexcan_open(): fix error path if flexcan_chip_start() fails Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 29/35] SCSI: isci: fix reset timeout handling Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 30/35] SCSI: isci: correct erroneous for_each_isci_host macro Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 31/35] SCSI: qla2xxx: Poll during initialization for ISP25xx and ISP83xx Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 32/35] SCSI: storvsc: NULL pointer dereference fix Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 33/35] Btrfs: fix data corruption when reading/updating compressed extents Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 34/35] ALSA: oxygen: modify adjust_dg_dac_routing function Greg Kroah-Hartman
2014-03-21 0:11 ` [PATCH 3.4 35/35] jiffies: Avoid undefined behavior from signed overflow Greg Kroah-Hartman
2014-03-21 5:26 ` [PATCH 3.4 00/35] 3.4.84-stable review Guenter Roeck
2014-03-22 21:56 ` Shuah Khan
2014-03-24 4:33 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140321001055.016874270@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=nhorman@tuxdriver.com \
--cc=pv-drivers@vmware.com \
--cc=sbhatewara@vmware.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).