Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f00e35e2 authored by wangyunjian's avatar wangyunjian Committed by David S. Miller
Browse files

virtio_net: fix virtnet_open and virtnet_probe competing for try_fill_recv 



In function virtnet_open() and virtnet_probe(), func try_fill_recv() may
be executed at the same time. VQ in virtqueue_add() has not been protected
well and BUG_ON will be triggered when virito_net.ko being removed.

Signed-off-by: default avatarYunjian Wang <wangyunjian@huawei.com>
Acked-by: default avatarJason Wang <jasowang@redhat.com>
Acked-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent bae5499c

drivers/net/virtio_net.c

+2 −16
Original line number Diff line number Diff line
@@ -1925,24 +1925,11 @@ static int virtnet_probe(struct virtio_device *vdev) 


	virtio_device_ready(vdev);



	/* Last of all, set up some receive buffers. */

	for (i = 0; i < vi->curr_queue_pairs; i++) {

		try_fill_recv(vi, &vi->rq[i], GFP_KERNEL);



		/* If we didn't even get one input buffer, we're useless. */

		if (vi->rq[i].vq->num_free ==

		    virtqueue_get_vring_size(vi->rq[i].vq)) {

			free_unused_bufs(vi);

			err = -ENOMEM;

			goto free_recv_bufs;

		}

	}



	vi->nb.notifier_call = &virtnet_cpu_callback;

	err = register_hotcpu_notifier(&vi->nb);

	if (err) {

		pr_debug("virtio_net: registering cpu notifier failed\n");

		goto free_recv_bufs;

		goto free_unregister_netdev;

	}



	/* Assume link up if device can't report link status,
@@ -1960,10 +1947,9 @@ static int virtnet_probe(struct virtio_device *vdev) 


	return 0;



free_recv_bufs:

free_unregister_netdev:

	vi->vdev->config->reset(vdev);



	free_receive_bufs(vi);

	unregister_netdev(dev);

free_vqs:

	cancel_delayed_work_sync(&vi->refill);