Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9f313bcb authored by Jakub Kicinski's avatar Jakub Kicinski Committed by Greg Kroah-Hartman
Browse files

net: disable netpoll on fresh napis 



[ Upstream commit 96e97bc07e90f175a8980a22827faf702ca4cb30 ]

napi_disable() makes sure to set the NAPI_STATE_NPSVC bit to prevent
netpoll from accessing rings before init is complete. However, the
same is not done for fresh napi instances in netif_napi_add(),
even though we expect NAPI instances to be added as disabled.

This causes crashes during driver reconfiguration (enabling XDP,
changing the channel count) - if there is any printk() after
netif_napi_add() but before napi_enable().

To ensure memory ordering is correct we need to use RCU accessors.

Reported-by: default avatarRob Sherwood <rsher@fb.com>
Fixes: 2d8bff12 ("netpoll: Close race condition between poll_one_napi and napi_disable")
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 553d1bb7

net/core/dev.c

+2 −1
Original line number Diff line number Diff line
@@ -6196,12 +6196,13 @@ void netif_napi_add(struct net_device *dev, struct napi_struct *napi, 
		pr_err_once("netif_napi_add() called with weight %d on device %s\n",

			    weight, dev->name);

	napi->weight = weight;

	list_add(&napi->dev_list, &dev->napi_list);

	napi->dev = dev;

#ifdef CONFIG_NETPOLL

	napi->poll_owner = -1;

#endif

	set_bit(NAPI_STATE_SCHED, &napi->state);

	set_bit(NAPI_STATE_NPSVC, &napi->state);

	list_add_rcu(&napi->dev_list, &dev->napi_list);

	napi_hash_add(napi);

}

EXPORT_SYMBOL(netif_napi_add);

net/core/netpoll.c

+1 −1
Original line number Diff line number Diff line
@@ -161,7 +161,7 @@ static void poll_napi(struct net_device *dev) 
	struct napi_struct *napi;

	int cpu = smp_processor_id();



	list_for_each_entry(napi, &dev->napi_list, dev_list) {

	list_for_each_entry_rcu(napi, &dev->napi_list, dev_list) {

		if (cmpxchg(&napi->poll_owner, -1, cpu) == -1) {

			poll_one_napi(napi);

			smp_store_release(&napi->poll_owner, -1);