virtio_net: fix race in RX VQ processing
authorMichael S. Tsirkin <mst@redhat.com>
Tue, 9 Jul 2013 05:13:04 +0000 (08:13 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 28 Jul 2013 23:29:56 +0000 (16:29 -0700)
commit2b0e8a4ff83fd85afe5d0b84a2e1c6faa5fa56b8
tree797347db0c30e89ff3fbb442e69cac79e1e5d269
parentc23b1ece6112ed0f227fdc881db33c6427b65222
virtio_net: fix race in RX VQ processing

[ Upstream commit cbdadbbf0c790f79350a8f36029208944c5487d0 ]

virtio net called virtqueue_enable_cq on RX path after napi_complete, so
with NAPI_STATE_SCHED clear - outside the implicit napi lock.
This violates the requirement to synchronize virtqueue_enable_cq wrt
virtqueue_add_buf.  In particular, used event can move backwards,
causing us to lose interrupts.
In a debug build, this can trigger panic within START_USE.

Jason Wang reports that he can trigger the races artificially,
by adding udelay() in virtqueue_enable_cb() after virtio_mb().

However, we must call napi_complete to clear NAPI_STATE_SCHED before
polling the virtqueue for used buffers, otherwise napi_schedule_prep in
a callback will fail, causing us to lose RX events.

To fix, call virtqueue_enable_cb_prepare with NAPI_STATE_SCHED
set (under napi lock), later call virtqueue_poll with
NAPI_STATE_SCHED clear (outside the lock).

Reported-by: Jason Wang <jasowang@redhat.com>
Tested-by: Jason Wang <jasowang@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/virtio_net.c