| Message ID | 20211022233139.31775-1-dongli.zhang@oracle.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 042b2046d0f05cf8124c26ff65dbb6148a4404fb |
| Headers | show |
| Series | [1/1] xen/netfront: stop tx queues during live migration | expand |
Hello: This patch was applied to netdev/net.git (master) by David S. Miller <davem@davemloft.net>: On Fri, 22 Oct 2021 16:31:39 -0700 you wrote: > The tx queues are not stopped during the live migration. As a result, the > ndo_start_xmit() may access netfront_info->queues which is freed by > talk_to_netback()->xennet_destroy_queues(). > > This patch is to netif_device_detach() at the beginning of xen-netfront > resuming, and netif_device_attach() at the end of resuming. > > [...] Here is the summary with links: - [1/1] xen/netfront: stop tx queues during live migration https://git.kernel.org/netdev/net/c/042b2046d0f0 You are awesome, thank you!
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c index e31b98403f31..fc41ba95f81d 100644 --- a/drivers/net/xen-netfront.c +++ b/drivers/net/xen-netfront.c @@ -1730,6 +1730,10 @@ static int netfront_resume(struct xenbus_device *dev) dev_dbg(&dev->dev, "%s\n", dev->nodename); + netif_tx_lock_bh(info->netdev); + netif_device_detach(info->netdev); + netif_tx_unlock_bh(info->netdev); + xennet_disconnect_backend(info); return 0; } @@ -2349,6 +2353,10 @@ static int xennet_connect(struct net_device *dev) * domain a kick because we've probably just requeued some * packets. */ + netif_tx_lock_bh(np->netdev); + netif_device_attach(np->netdev); + netif_tx_unlock_bh(np->netdev); + netif_carrier_on(np->netdev); for (j = 0; j < num_queues; ++j) { queue = &np->queues[j];
The tx queues are not stopped during the live migration. As a result, the ndo_start_xmit() may access netfront_info->queues which is freed by talk_to_netback()->xennet_destroy_queues(). This patch is to netif_device_detach() at the beginning of xen-netfront resuming, and netif_device_attach() at the end of resuming. CPU A CPU B talk_to_netback() -> if (info->queues) xennet_destroy_queues(info); to free netfront_info->queues xennet_start_xmit() to access netfront_info->queues -> err = xennet_create_queues(info, &num_queues); The idea is borrowed from virtio-net. Cc: Joe Jin <joe.jin@oracle.com> Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com> --- Since I am not able to reproduce the corner case on purpose, I create a patch to reproduce. https://raw.githubusercontent.com/finallyjustice/patchset/master/xen-netfront-send-GARP-during-live-migration.patch drivers/net/xen-netfront.c | 8 ++++++++ 1 file changed, 8 insertions(+)