Patchwork [3.5.y.z,extended,stable] Patch "virtio_net: fix race in RX VQ processing" has been added to staging queue

mail settings
Submitter Luis Henriques
Date Aug. 4, 2013, 9:49 a.m.
Message ID <>
Download mbox | patch
Permalink /patch/264495/
State New
Headers show


Luis Henriques - Aug. 4, 2013, 9:49 a.m.
This is a note to let you know that I have just added a patch titled

    virtio_net: fix race in RX VQ processing

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see



From d1b89c1bfc90124357b663ab6f5b9cc02eb6c629 Mon Sep 17 00:00:00 2001
From: "Michael S. Tsirkin" <>
Date: Fri, 2 Aug 2013 14:31:53 +0100
Subject: [PATCH] virtio_net: fix race in RX VQ processing

commit cbdadbbf0c790f79350a8f36029208944c5487d0 upstream

virtio net called virtqueue_enable_cq on RX path after napi_complete, so
with NAPI_STATE_SCHED clear - outside the implicit napi lock.
This violates the requirement to synchronize virtqueue_enable_cq wrt
virtqueue_add_buf.  In particular, used event can move backwards,
causing us to lose interrupts.
In a debug build, this can trigger panic within START_USE.

Jason Wang reports that he can trigger the races artificially,
by adding udelay() in virtqueue_enable_cb() after virtio_mb().

However, we must call napi_complete to clear NAPI_STATE_SCHED before
polling the virtqueue for used buffers, otherwise napi_schedule_prep in
a callback will fail, causing us to lose RX events.

To fix, call virtqueue_enable_cb_prepare with NAPI_STATE_SCHED
set (under napi lock), later call virtqueue_poll with
NAPI_STATE_SCHED clear (outside the lock).

Reported-by: Jason Wang <>
Tested-by: Jason Wang <>
Acked-by: Jason Wang <>
Signed-off-by: Michael S. Tsirkin <>
Signed-off-by: David S. Miller <>
[wg: Backported to 3.2]
Signed-off-by: Wolfram Gloger <>
Signed-off-by: Luis Henriques<>
 drivers/net/virtio_net.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)



diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index f18149a..858a8da 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -528,7 +528,7 @@  static int virtnet_poll(struct napi_struct *napi, int budget)
 	struct virtnet_info *vi = container_of(napi, struct virtnet_info, napi);
 	void *buf;
-	unsigned int len, received = 0;
+	unsigned int r, len, received = 0;

 	while (received < budget &&
@@ -545,8 +545,9 @@  again:

 	/* Out of packets? */
 	if (received < budget) {
+		r = virtqueue_enable_cb_prepare(vi->rvq);
-		if (unlikely(!virtqueue_enable_cb(vi->rvq)) &&
+		if (unlikely(virtqueue_poll(vi->rvq, r)) &&
 		    napi_schedule_prep(napi)) {