Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 543fc0ea authored by Jan Beulich's avatar Jan Beulich Committed by Greg Kroah-Hartman
Browse files

xen-netback: properly sync TX responses 



commit 7b55984c96ffe9e236eb9c82a2196e0b1f84990d upstream.

Invoking the make_tx_response() / push_tx_responses() pair with no lock
held would be acceptable only if all such invocations happened from the
same context (NAPI instance or dealloc thread). Since this isn't the
case, and since the interface "spec" also doesn't demand that multicast
operations may only be performed with no in-flight transmits,
MCAST_{ADD,DEL} processing also needs to acquire the response lock
around the invocations.

To prevent similar mistakes going forward, "downgrade" the present
functions to private helpers of just the two remaining ones using them
directly, with no forward declarations anymore. This involves renaming
what so far was make_tx_response(), for the new function of that name
to serve the new (wrapper) purpose.

While there,
- constify the txp parameters,
- correct xenvif_idx_release()'s status parameter's type,
- rename {,_}make_tx_response()'s status parameters for consistency with
  xenvif_idx_release()'s.

Fixes: 210c34dc ("xen-netback: add support for multicast control")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarJan Beulich <jbeulich@suse.com>
Reviewed-by: default avatarPaul Durrant <paul@xen.org>
Link: https://lore.kernel.org/r/980c6c3d-e10e-4459-8565-e8fbde122f00@suse.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 7e9a8498

drivers/net/xen-netback/netback.c

+40 −44
Original line number Diff line number Diff line
@@ -97,13 +97,12 @@ module_param_named(hash_cache_size, xenvif_hash_cache_size, uint, 0644); 
MODULE_PARM_DESC(hash_cache_size, "Number of flows in the hash cache");



static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,

			       u8 status);

			       s8 status);



static void make_tx_response(struct xenvif_queue *queue,

			     struct xen_netif_tx_request *txp,

			     const struct xen_netif_tx_request *txp,

			     unsigned int extra_count,

			     s8       st);

static void push_tx_responses(struct xenvif_queue *queue);

			     s8 status);



static void xenvif_idx_unmap(struct xenvif_queue *queue, u16 pending_idx);
@@ -201,13 +200,9 @@ static void xenvif_tx_err(struct xenvif_queue *queue, 
			  unsigned int extra_count, RING_IDX end)

{

	RING_IDX cons = queue->tx.req_cons;

	unsigned long flags;



	do {

		spin_lock_irqsave(&queue->response_lock, flags);

		make_tx_response(queue, txp, extra_count, XEN_NETIF_RSP_ERROR);

		push_tx_responses(queue);

		spin_unlock_irqrestore(&queue->response_lock, flags);

		if (cons == end)

			break;

		RING_COPY_REQUEST(&queue->tx, cons++, txp);
@@ -458,12 +453,7 @@ static void xenvif_get_requests(struct xenvif_queue *queue, 
	for (shinfo->nr_frags = 0; nr_slots > 0 && shinfo->nr_frags < MAX_SKB_FRAGS;

	     nr_slots--) {

		if (unlikely(!txp->size)) {

			unsigned long flags;



			spin_lock_irqsave(&queue->response_lock, flags);

			make_tx_response(queue, txp, 0, XEN_NETIF_RSP_OKAY);

			push_tx_responses(queue);

			spin_unlock_irqrestore(&queue->response_lock, flags);

			++txp;

			continue;

		}
@@ -489,14 +479,8 @@ static void xenvif_get_requests(struct xenvif_queue *queue, 


		for (shinfo->nr_frags = 0; shinfo->nr_frags < nr_slots; ++txp) {

			if (unlikely(!txp->size)) {

				unsigned long flags;



				spin_lock_irqsave(&queue->response_lock, flags);

				make_tx_response(queue, txp, 0,

						 XEN_NETIF_RSP_OKAY);

				push_tx_responses(queue);

				spin_unlock_irqrestore(&queue->response_lock,

						       flags);

				continue;

			}
@@ -990,7 +974,6 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue, 
					 (ret == 0) ?

					 XEN_NETIF_RSP_OKAY :

					 XEN_NETIF_RSP_ERROR);

			push_tx_responses(queue);

			continue;

		}
@@ -1002,7 +985,6 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue, 


			make_tx_response(queue, &txreq, extra_count,

					 XEN_NETIF_RSP_OKAY);

			push_tx_responses(queue);

			continue;

		}
@@ -1428,8 +1410,35 @@ int xenvif_tx_action(struct xenvif_queue *queue, int budget) 
	return work_done;

}



static void _make_tx_response(struct xenvif_queue *queue,

			     const struct xen_netif_tx_request *txp,

			     unsigned int extra_count,

			     s8 status)

{

	RING_IDX i = queue->tx.rsp_prod_pvt;

	struct xen_netif_tx_response *resp;



	resp = RING_GET_RESPONSE(&queue->tx, i);

	resp->id     = txp->id;

	resp->status = status;



	while (extra_count-- != 0)

		RING_GET_RESPONSE(&queue->tx, ++i)->status = XEN_NETIF_RSP_NULL;



	queue->tx.rsp_prod_pvt = ++i;

}



static void push_tx_responses(struct xenvif_queue *queue)

{

	int notify;



	RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);

	if (notify)

		notify_remote_via_irq(queue->tx_irq);

}



static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,

			       u8 status)

			       s8 status)

{

	struct pending_tx_info *pending_tx_info;

	pending_ring_idx_t index;
@@ -1439,7 +1448,7 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx, 


	spin_lock_irqsave(&queue->response_lock, flags);



	make_tx_response(queue, &pending_tx_info->req,

	_make_tx_response(queue, &pending_tx_info->req,

			  pending_tx_info->extra_count, status);



	/* Release the pending index before pusing the Tx response so
@@ -1454,32 +1463,19 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx, 
	spin_unlock_irqrestore(&queue->response_lock, flags);

}





static void make_tx_response(struct xenvif_queue *queue,

			     struct xen_netif_tx_request *txp,

			     const struct xen_netif_tx_request *txp,

			     unsigned int extra_count,

			     s8       st)

			     s8 status)

{

	RING_IDX i = queue->tx.rsp_prod_pvt;

	struct xen_netif_tx_response *resp;



	resp = RING_GET_RESPONSE(&queue->tx, i);

	resp->id     = txp->id;

	resp->status = st;



	while (extra_count-- != 0)

		RING_GET_RESPONSE(&queue->tx, ++i)->status = XEN_NETIF_RSP_NULL;

	unsigned long flags;



	queue->tx.rsp_prod_pvt = ++i;

}

	spin_lock_irqsave(&queue->response_lock, flags);



static void push_tx_responses(struct xenvif_queue *queue)

{

	int notify;

	_make_tx_response(queue, txp, extra_count, status);

	push_tx_responses(queue);



	RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);

	if (notify)

		notify_remote_via_irq(queue->tx_irq);

	spin_unlock_irqrestore(&queue->response_lock, flags);

}



static void xenvif_idx_unmap(struct xenvif_queue *queue, u16 pending_idx)