]>
Commit | Line | Data |
---|---|---|
e7503a51 GKH |
1 | From foo@baz Fri Jan 4 20:27:35 CET 2019 |
2 | From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> | |
3 | Date: Wed, 19 Dec 2018 23:23:00 +0100 | |
4 | Subject: gro_cell: add napi_disable in gro_cells_destroy | |
5 | ||
6 | From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> | |
7 | ||
8 | [ Upstream commit 8e1da73acded4751a93d4166458a7e640f37d26c ] | |
9 | ||
10 | Add napi_disable routine in gro_cells_destroy since starting from | |
11 | commit c42858eaf492 ("gro_cells: remove spinlock protecting receive | |
12 | queues") gro_cell_poll and gro_cells_destroy can run concurrently on | |
13 | napi_skbs list producing a kernel Oops if the tunnel interface is | |
14 | removed while gro_cell_poll is running. The following Oops has been | |
15 | triggered removing a vxlan device while the interface is receiving | |
16 | traffic | |
17 | ||
18 | [ 5628.948853] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 | |
19 | [ 5628.949981] PGD 0 P4D 0 | |
20 | [ 5628.950308] Oops: 0002 [#1] SMP PTI | |
21 | [ 5628.950748] CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 4.20.0-rc6+ #41 | |
22 | [ 5628.952940] RIP: 0010:gro_cell_poll+0x49/0x80 | |
23 | [ 5628.955615] RSP: 0018:ffffc9000004fdd8 EFLAGS: 00010202 | |
24 | [ 5628.956250] RAX: 0000000000000000 RBX: ffffe8ffffc08150 RCX: 0000000000000000 | |
25 | [ 5628.957102] RDX: 0000000000000000 RSI: ffff88802356bf00 RDI: ffffe8ffffc08150 | |
26 | [ 5628.957940] RBP: 0000000000000026 R08: 0000000000000000 R09: 0000000000000000 | |
27 | [ 5628.958803] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000040 | |
28 | [ 5628.959661] R13: ffffe8ffffc08100 R14: 0000000000000000 R15: 0000000000000040 | |
29 | [ 5628.960682] FS: 0000000000000000(0000) GS:ffff88803ea00000(0000) knlGS:0000000000000000 | |
30 | [ 5628.961616] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 | |
31 | [ 5628.962359] CR2: 0000000000000008 CR3: 000000000221c000 CR4: 00000000000006b0 | |
32 | [ 5628.963188] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 | |
33 | [ 5628.964034] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 | |
34 | [ 5628.964871] Call Trace: | |
35 | [ 5628.965179] net_rx_action+0xf0/0x380 | |
36 | [ 5628.965637] __do_softirq+0xc7/0x431 | |
37 | [ 5628.966510] run_ksoftirqd+0x24/0x30 | |
38 | [ 5628.966957] smpboot_thread_fn+0xc5/0x160 | |
39 | [ 5628.967436] kthread+0x113/0x130 | |
40 | [ 5628.968283] ret_from_fork+0x3a/0x50 | |
41 | [ 5628.968721] Modules linked in: | |
42 | [ 5628.969099] CR2: 0000000000000008 | |
43 | [ 5628.969510] ---[ end trace 9d9dedc7181661fe ]--- | |
44 | [ 5628.970073] RIP: 0010:gro_cell_poll+0x49/0x80 | |
45 | [ 5628.972965] RSP: 0018:ffffc9000004fdd8 EFLAGS: 00010202 | |
46 | [ 5628.973611] RAX: 0000000000000000 RBX: ffffe8ffffc08150 RCX: 0000000000000000 | |
47 | [ 5628.974504] RDX: 0000000000000000 RSI: ffff88802356bf00 RDI: ffffe8ffffc08150 | |
48 | [ 5628.975462] RBP: 0000000000000026 R08: 0000000000000000 R09: 0000000000000000 | |
49 | [ 5628.976413] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000040 | |
50 | [ 5628.977375] R13: ffffe8ffffc08100 R14: 0000000000000000 R15: 0000000000000040 | |
51 | [ 5628.978296] FS: 0000000000000000(0000) GS:ffff88803ea00000(0000) knlGS:0000000000000000 | |
52 | [ 5628.979327] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 | |
53 | [ 5628.980044] CR2: 0000000000000008 CR3: 000000000221c000 CR4: 00000000000006b0 | |
54 | [ 5628.980929] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 | |
55 | [ 5628.981736] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 | |
56 | [ 5628.982409] Kernel panic - not syncing: Fatal exception in interrupt | |
57 | [ 5628.983307] Kernel Offset: disabled | |
58 | ||
59 | Fixes: c42858eaf492 ("gro_cells: remove spinlock protecting receive queues") | |
60 | Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> | |
61 | Acked-by: Eric Dumazet <edumazet@google.com> | |
62 | Signed-off-by: David S. Miller <davem@davemloft.net> | |
63 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
64 | --- | |
65 | include/net/gro_cells.h | 1 + | |
66 | 1 file changed, 1 insertion(+) | |
67 | ||
68 | --- a/include/net/gro_cells.h | |
69 | +++ b/include/net/gro_cells.h | |
70 | @@ -84,6 +84,7 @@ static inline void gro_cells_destroy(str | |
71 | for_each_possible_cpu(i) { | |
72 | struct gro_cell *cell = per_cpu_ptr(gcells->cells, i); | |
73 | ||
74 | + napi_disable(&cell->napi); | |
75 | netif_napi_del(&cell->napi); | |
76 | __skb_queue_purge(&cell->napi_skbs); | |
77 | } |