| Message ID | 20200325225505.23998-5-parri.andrea@gmail.com |
|---|---|
| State | RFC |
| Delegated to: | David Miller |
| Headers | show |
| Series | None | expand |
On Wed, 25 Mar 2020 23:54:58 +0100 "Andrea Parri (Microsoft)" <parri.andrea@gmail.com> wrote: > vmbus_chan_sched() might call the netvsc driver callback function that > ends up scheduling NAPI work. This "work" can access the channel ring > buffer, so we must ensure that any such work is completed and that the > ring buffer is no longer being accessed before freeing the ring buffer > data structure in the channel closure path. To this end, disable NAPI > before calling vmbus_close() in netvsc_device_remove(). > > Suggested-by: Michael Kelley <mikelley@microsoft.com> > Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> > Cc: "David S. Miller" <davem@davemloft.net> > Cc: <netdev@vger.kernel.org> Do you have a test that reproduces this issue? The netvsc device is somewhat unique in that it needs NAPI enabled on the primary channel to interact with the host. Therefore it can't call napi_disable in the normal dev->stop() place. Acked-by: Stephen Hemminger <stephen@networkplumber.org>
On Thu, Mar 26, 2020 at 08:26:36AM -0700, Stephen Hemminger wrote: > On Wed, 25 Mar 2020 23:54:58 +0100 > "Andrea Parri (Microsoft)" <parri.andrea@gmail.com> wrote: > > > vmbus_chan_sched() might call the netvsc driver callback function that > > ends up scheduling NAPI work. This "work" can access the channel ring > > buffer, so we must ensure that any such work is completed and that the > > ring buffer is no longer being accessed before freeing the ring buffer > > data structure in the channel closure path. To this end, disable NAPI > > before calling vmbus_close() in netvsc_device_remove(). > > > > Suggested-by: Michael Kelley <mikelley@microsoft.com> > > Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> > > Cc: "David S. Miller" <davem@davemloft.net> > > Cc: <netdev@vger.kernel.org> > > Do you have a test that reproduces this issue? I don't (or I'm not aware of such a test). > > The netvsc device is somewhat unique in that it needs NAPI > enabled on the primary channel to interact with the host. > Therefore it can't call napi_disable in the normal dev->stop() place. > > Acked-by: Stephen Hemminger <stephen@networkplumber.org> Thanks! Andrea
diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c index 23f358cb7f494..256ee90c74460 100644 --- a/drivers/hv/channel.c +++ b/drivers/hv/channel.c @@ -609,6 +609,12 @@ void vmbus_reset_channel_cb(struct vmbus_channel *channel) * the former is accessing channel->inbound.ring_buffer, the latter * could be freeing the ring_buffer pages, so here we must stop it * first. + * + * vmbus_chan_sched() might call the netvsc driver callback function + * that ends up scheduling NAPI work that accesses the ring buffer. + * At this point, we have to ensure that any such work is completed + * and that the channel ring buffer is no longer being accessed, cf. + * the calls to napi_disable() in netvsc_device_remove(). */ tasklet_disable(&channel->callback_event); diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c index 1b320bcf150a4..806cc85d10033 100644 --- a/drivers/net/hyperv/netvsc.c +++ b/drivers/net/hyperv/netvsc.c @@ -635,9 +635,12 @@ void netvsc_device_remove(struct hv_device *device) RCU_INIT_POINTER(net_device_ctx->nvdev, NULL); - /* And disassociate NAPI context from device */ - for (i = 0; i < net_device->num_chn; i++) + /* Disable NAPI and disassociate its context from the device. */ + for (i = 0; i < net_device->num_chn; i++) { + /* See also vmbus_reset_channel_cb(). */ + napi_disable(&net_device->chan_table[i].napi); netif_napi_del(&net_device->chan_table[i].napi); + } /* * At this point, no one should be accessing net_device
vmbus_chan_sched() might call the netvsc driver callback function that ends up scheduling NAPI work. This "work" can access the channel ring buffer, so we must ensure that any such work is completed and that the ring buffer is no longer being accessed before freeing the ring buffer data structure in the channel closure path. To this end, disable NAPI before calling vmbus_close() in netvsc_device_remove(). Suggested-by: Michael Kelley <mikelley@microsoft.com> Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> Cc: "David S. Miller" <davem@davemloft.net> Cc: <netdev@vger.kernel.org> --- drivers/hv/channel.c | 6 ++++++ drivers/net/hyperv/netvsc.c | 7 +++++-- 2 files changed, 11 insertions(+), 2 deletions(-)