GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-07-06 06:21:31 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

sunvnet: Use RCU to synchronize port usage with vnet_port_remove()

Browse source 
A vnet_port_remove could be triggered as a result of an ldm-unbind
operation by the peer, module unload, or other changes to the
inter-vnet-link configuration.  When this is concurrent with
vnet_start_xmit(), there are several race sequences possible,
such as

thread 1                                    thread 2
vnet_start_xmit
-> tx_port_find
   spin_lock_irqsave(&vp->lock..)
   ret = __tx_port_find(..)
   spin_lock_irqrestore(&vp->lock..)
                                           vio_remove -> ..
                                               ->vnet_port_remove
                                           spin_lock_irqsave(&vp->lock..)
                                           cleanup
                                           spin_lock_irqrestore(&vp->lock..)
                                           kfree(port)
/* attempt to use ret will bomb */

This patch adds RCU locking for port access so that vnet_port_remove
will correctly clean up port-related state.

Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Acked-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Bob Picco <bob.picco@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Sowmini Varadhan 2014-10-25 15:12:20 -04:00 • committed by David S. Miller
parent 69088822ab
commit 2a968dd8f7
1 changed files with 33 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

62
drivers/net/ethernet/sun/sunvnet.c
View file

@ -617,7 +617,8 @@ static void maybe_tx_wakeup(struct vnet *vp)
struct vnet_port *port; struct vnet_port *port;
int wake = 1; int wake = 1;
list_for_each_entry(port, &vp->port_list, list) { rcu_read_lock();
list_for_each_entry_rcu(port, &vp->port_list, list) {
struct vio_dring_state *dr; struct vio_dring_state *dr;
dr = &port->vio.drings[VIO_DRIVER_TX_RING]; dr = &port->vio.drings[VIO_DRIVER_TX_RING];
@ -627,6 +628,7 @@ static void maybe_tx_wakeup(struct vnet *vp)
break; break;
} }
} }
rcu_read_unlock();
if (wake) if (wake)
netif_wake_queue(dev); netif_wake_queue(dev);
} }
@ -824,13 +826,13 @@ struct vnet_port *__tx_port_find(struct vnet *vp, struct sk_buff *skb)
struct hlist_head *hp = &vp->port_hash[hash]; struct hlist_head *hp = &vp->port_hash[hash];
struct vnet_port *port; struct vnet_port *port;
hlist_for_each_entry(port, hp, hash) { hlist_for_each_entry_rcu(port, hp, hash) {
if (!port_is_up(port)) if (!port_is_up(port))
continue; continue;
if (ether_addr_equal(port->raddr, skb->data)) if (ether_addr_equal(port->raddr, skb->data))
return port; return port;
} }
list_for_each_entry(port, &vp->port_list, list) { list_for_each_entry_rcu(port, &vp->port_list, list) {
if (!port->switch_port) if (!port->switch_port)
continue; continue;
if (!port_is_up(port)) if (!port_is_up(port))
@ -966,7 +968,7 @@ static inline struct sk_buff *vnet_skb_shape(struct sk_buff *skb, void **pstart,
static int vnet_start_xmit(struct sk_buff *skb, struct net_device *dev) static int vnet_start_xmit(struct sk_buff *skb, struct net_device *dev)
{ {
struct vnet *vp = netdev_priv(dev); struct vnet *vp = netdev_priv(dev);
struct vnet_port *port = tx_port_find(vp, skb); struct vnet_port *port = NULL;
struct vio_dring_state *dr; struct vio_dring_state *dr;
struct vio_net_desc *d; struct vio_net_desc *d;
unsigned long flags; unsigned long flags;
@ -977,12 +979,13 @@ static int vnet_start_xmit(struct sk_buff *skb, struct net_device *dev)
int nlen = 0; int nlen = 0;
unsigned pending = 0; unsigned pending = 0;
if (unlikely(!port)) skb = vnet_skb_shape(skb, &start, &nlen);
if (unlikely(!skb))
goto out_dropped; goto out_dropped;
skb = vnet_skb_shape(skb, &start, &nlen); rcu_read_lock();
port = tx_port_find(vp, skb);
if (unlikely(!skb)) if (unlikely(!port))
goto out_dropped; goto out_dropped;
if (skb->len > port->rmtu) { if (skb->len > port->rmtu) {
@ -1002,6 +1005,7 @@ static int vnet_start_xmit(struct sk_buff *skb, struct net_device *dev)
fl4.saddr = ip_hdr(skb)->saddr; fl4.saddr = ip_hdr(skb)->saddr;
rt = ip_route_output_key(dev_net(dev), &fl4); rt = ip_route_output_key(dev_net(dev), &fl4);
rcu_read_unlock();
if (!IS_ERR(rt)) { if (!IS_ERR(rt)) {
skb_dst_set(skb, &rt->dst); skb_dst_set(skb, &rt->dst);
icmp_send(skb, ICMP_DEST_UNREACH, icmp_send(skb, ICMP_DEST_UNREACH,
@ -1027,7 +1031,7 @@ static int vnet_start_xmit(struct sk_buff *skb, struct net_device *dev)
netdev_err(dev, "BUG! Tx Ring full when queue awake!\n"); netdev_err(dev, "BUG! Tx Ring full when queue awake!\n");
dev->stats.tx_errors++; dev->stats.tx_errors++;
} }
spin_unlock_irqrestore(&port->vio.lock, flags); rcu_read_unlock();
return NETDEV_TX_BUSY; return NETDEV_TX_BUSY;
} }
@ -1121,25 +1125,27 @@ ldc_start_done:
} }
spin_unlock_irqrestore(&port->vio.lock, flags); spin_unlock_irqrestore(&port->vio.lock, flags);
(void)mod_timer(&port->clean_timer, jiffies + VNET_CLEAN_TIMEOUT);
rcu_read_unlock();
vnet_free_skbs(freeskbs); vnet_free_skbs(freeskbs);
(void)mod_timer(&port->clean_timer, jiffies + VNET_CLEAN_TIMEOUT);
return NETDEV_TX_OK; return NETDEV_TX_OK;
out_dropped_unlock: out_dropped_unlock:
spin_unlock_irqrestore(&port->vio.lock, flags); spin_unlock_irqrestore(&port->vio.lock, flags);
out_dropped: out_dropped:
if (skb)
dev_kfree_skb(skb);
vnet_free_skbs(freeskbs);
if (pending) if (pending)
(void)mod_timer(&port->clean_timer, (void)mod_timer(&port->clean_timer,
jiffies + VNET_CLEAN_TIMEOUT); jiffies + VNET_CLEAN_TIMEOUT);
else if (port) else if (port)
del_timer(&port->clean_timer); del_timer(&port->clean_timer);
if (port)
rcu_read_unlock();
if (skb)
dev_kfree_skb(skb);
vnet_free_skbs(freeskbs);
dev->stats.tx_dropped++; dev->stats.tx_dropped++;
return NETDEV_TX_OK; return NETDEV_TX_OK;
} }
@ -1269,18 +1275,17 @@ static void vnet_set_rx_mode(struct net_device *dev)
{ {
struct vnet *vp = netdev_priv(dev); struct vnet *vp = netdev_priv(dev);
struct vnet_port *port; struct vnet_port *port;
unsigned long flags;
spin_lock_irqsave(&vp->lock, flags); rcu_read_lock();
if (!list_empty(&vp->port_list)) { list_for_each_entry_rcu(port, &vp->port_list, list) {
port = list_entry(vp->port_list.next, struct vnet_port, list);
if (port->switch_port) { if (port->switch_port) {
__update_mc_list(vp, dev); __update_mc_list(vp, dev);
__send_mc_list(vp, port); __send_mc_list(vp, port);
break;
} }
} }
spin_unlock_irqrestore(&vp->lock, flags); rcu_read_unlock();
} }
static int vnet_change_mtu(struct net_device *dev, int new_mtu) static int vnet_change_mtu(struct net_device *dev, int new_mtu)
@ -1633,10 +1638,11 @@ static int vnet_port_probe(struct vio_dev *vdev, const struct vio_device_id *id)
spin_lock_irqsave(&vp->lock, flags); spin_lock_irqsave(&vp->lock, flags);
if (switch_port) if (switch_port)
list_add(&port->list, &vp->port_list); list_add_rcu(&port->list, &vp->port_list);
else else
list_add_tail(&port->list, &vp->port_list); list_add_tail_rcu(&port->list, &vp->port_list);
hlist_add_head(&port->hash, &vp->port_hash[vnet_hashfn(port->raddr)]); hlist_add_head_rcu(&port->hash,
&vp->port_hash[vnet_hashfn(port->raddr)]);
spin_unlock_irqrestore(&vp->lock, flags); spin_unlock_irqrestore(&vp->lock, flags);
dev_set_drvdata(&vdev->dev, port); dev_set_drvdata(&vdev->dev, port);
@ -1671,18 +1677,16 @@ static int vnet_port_remove(struct vio_dev *vdev)
struct vnet_port *port = dev_get_drvdata(&vdev->dev); struct vnet_port *port = dev_get_drvdata(&vdev->dev);
if (port) { if (port) {
struct vnet *vp = port->vp;
unsigned long flags;
del_timer_sync(&port->vio.timer); del_timer_sync(&port->vio.timer);
del_timer_sync(&port->clean_timer);
napi_disable(&port->napi); napi_disable(&port->napi);
spin_lock_irqsave(&vp->lock, flags);
list_del(&port->list);
hlist_del(&port->hash);
spin_unlock_irqrestore(&vp->lock, flags);
list_del_rcu(&port->list);
hlist_del_rcu(&port->hash);
synchronize_rcu();
del_timer_sync(&port->clean_timer);
netif_napi_del(&port->napi); netif_napi_del(&port->napi);
vnet_port_free_tx_bufs(port); vnet_port_free_tx_bufs(port);
vio_ldc_free(&port->vio); vio_ldc_free(&port->vio);