Patchwork [3.5.y.z,extended,stable] Patch "xen-netback: cancel the credit timer when taking the vif down" has been added to staging queue

mail settings
Submitter Luis Henriques
Date Feb. 28, 2013, 11:59 a.m.
Message ID <>
Download mbox | patch
Permalink /patch/223946/
State New
Headers show


Luis Henriques - Feb. 28, 2013, 11:59 a.m.
This is a note to let you know that I have just added a patch titled

    xen-netback: cancel the credit timer when taking the vif down

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see



From bb9419be8427f5015615518699baed20a94a6839 Mon Sep 17 00:00:00 2001
From: David Vrabel <>
Date: Thu, 14 Feb 2013 03:18:58 +0000
Subject: [PATCH] xen-netback: cancel the credit timer when taking the vif down

commit 3e55f8b306cf305832a4ac78aa82e1b40e818ece upstream.

If the credit timer is left armed after calling
xen_netbk_remove_xenvif(), then it may fire and attempt to schedule
the vif which will then oops as vif->netbk == NULL.

This may happen both in the fatal error path and during normal
disconnection from the front end.

The sequencing during shutdown is critical to ensure that: a)
vif->netbk doesn't become unexpectedly NULL; and b) the net device/vif
is not freed.

1. Mark as unschedulable (netif_carrier_off()).
2. Synchronously cancel the timer.
3. Remove the vif from the schedule list.
4. Remove it from it netback thread group.
5. Wait for vif->refcnt to become 0.

Signed-off-by: David Vrabel <>
Acked-by: Ian Campbell <>
Reported-by: Christopher S. Aker <>
Signed-off-by: David S. Miller <>
Signed-off-by: Luis Henriques <>
 drivers/net/xen-netback/interface.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)



diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index b8c5193..221f426 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -132,6 +132,7 @@  static void xenvif_up(struct xenvif *vif)
 static void xenvif_down(struct xenvif *vif)
+	del_timer_sync(&vif->credit_timeout);
@@ -363,8 +364,6 @@  void xenvif_disconnect(struct xenvif *vif)
 	wait_event(vif->waiting_to_free, atomic_read(&vif->refcnt) == 0);

-	del_timer_sync(&vif->credit_timeout);
 	if (vif->irq)
 		unbind_from_irqhandler(vif->irq, vif);