lkml.org 
[lkml]   [2019]   [Jan]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 25/71] gro_cell: add napi_disable in gro_cells_destroy
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>

    [ Upstream commit 8e1da73acded4751a93d4166458a7e640f37d26c ]

    Add napi_disable routine in gro_cells_destroy since starting from
    commit c42858eaf492 ("gro_cells: remove spinlock protecting receive
    queues") gro_cell_poll and gro_cells_destroy can run concurrently on
    napi_skbs list producing a kernel Oops if the tunnel interface is
    removed while gro_cell_poll is running. The following Oops has been
    triggered removing a vxlan device while the interface is receiving
    traffic

    [ 5628.948853] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
    [ 5628.949981] PGD 0 P4D 0
    [ 5628.950308] Oops: 0002 [#1] SMP PTI
    [ 5628.950748] CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 4.20.0-rc6+ #41
    [ 5628.952940] RIP: 0010:gro_cell_poll+0x49/0x80
    [ 5628.955615] RSP: 0018:ffffc9000004fdd8 EFLAGS: 00010202
    [ 5628.956250] RAX: 0000000000000000 RBX: ffffe8ffffc08150 RCX: 0000000000000000
    [ 5628.957102] RDX: 0000000000000000 RSI: ffff88802356bf00 RDI: ffffe8ffffc08150
    [ 5628.957940] RBP: 0000000000000026 R08: 0000000000000000 R09: 0000000000000000
    [ 5628.958803] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000040
    [ 5628.959661] R13: ffffe8ffffc08100 R14: 0000000000000000 R15: 0000000000000040
    [ 5628.960682] FS: 0000000000000000(0000) GS:ffff88803ea00000(0000) knlGS:0000000000000000
    [ 5628.961616] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [ 5628.962359] CR2: 0000000000000008 CR3: 000000000221c000 CR4: 00000000000006b0
    [ 5628.963188] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    [ 5628.964034] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    [ 5628.964871] Call Trace:
    [ 5628.965179] net_rx_action+0xf0/0x380
    [ 5628.965637] __do_softirq+0xc7/0x431
    [ 5628.966510] run_ksoftirqd+0x24/0x30
    [ 5628.966957] smpboot_thread_fn+0xc5/0x160
    [ 5628.967436] kthread+0x113/0x130
    [ 5628.968283] ret_from_fork+0x3a/0x50
    [ 5628.968721] Modules linked in:
    [ 5628.969099] CR2: 0000000000000008
    [ 5628.969510] ---[ end trace 9d9dedc7181661fe ]---
    [ 5628.970073] RIP: 0010:gro_cell_poll+0x49/0x80
    [ 5628.972965] RSP: 0018:ffffc9000004fdd8 EFLAGS: 00010202
    [ 5628.973611] RAX: 0000000000000000 RBX: ffffe8ffffc08150 RCX: 0000000000000000
    [ 5628.974504] RDX: 0000000000000000 RSI: ffff88802356bf00 RDI: ffffe8ffffc08150
    [ 5628.975462] RBP: 0000000000000026 R08: 0000000000000000 R09: 0000000000000000
    [ 5628.976413] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000040
    [ 5628.977375] R13: ffffe8ffffc08100 R14: 0000000000000000 R15: 0000000000000040
    [ 5628.978296] FS: 0000000000000000(0000) GS:ffff88803ea00000(0000) knlGS:0000000000000000
    [ 5628.979327] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [ 5628.980044] CR2: 0000000000000008 CR3: 000000000221c000 CR4: 00000000000006b0
    [ 5628.980929] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    [ 5628.981736] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    [ 5628.982409] Kernel panic - not syncing: Fatal exception in interrupt
    [ 5628.983307] Kernel Offset: disabled

    Fixes: c42858eaf492 ("gro_cells: remove spinlock protecting receive queues")
    Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    include/net/gro_cells.h | 1 +
    1 file changed, 1 insertion(+)

    --- a/include/net/gro_cells.h
    +++ b/include/net/gro_cells.h
    @@ -86,6 +86,7 @@ static inline void gro_cells_destroy(str
    for_each_possible_cpu(i) {
    struct gro_cell *cell = per_cpu_ptr(gcells->cells, i);

    + napi_disable(&cell->napi);
    netif_napi_del(&cell->napi);
    __skb_queue_purge(&cell->napi_skbs);
    }

    \
     
     \ /
      Last update: 2019-01-07 18:25    [W:4.251 / U:0.396 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site