xen-netback: don't populate the hash cache on XenBus disconnect

Occasionally, during the disconnection procedure on XenBus which
includes hash cache deinitialization there might be some packets
still in-flight on other processors. Handling of these packets includes
hashing and hash cache population that finally results in hash cache
data structure corruption.

In order to avoid this we prevent hashing of those packets if there
are no queues initialized. In that case RCU protection of queues guards
the hash cache as well.

Signed-off-by: Igor Druzhinin <igor.druzhinin@citrix.com>
Reviewed-by: Paul Durrant <paul.durrant@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/xen-netback/hash.c b/drivers/net/xen-netback/hash.c
index 0ccb021f1e78687d7c7a9814a05369aafe7c6508..10d580c3dea3f06b53d4bdbff22f693a237e741d 100644 (file)
--- a/drivers/net/xen-netback/hash.c
+++ b/drivers/net/xen-netback/hash.c
@@ -454,6 +454,8 @@ void xenvif_init_hash(struct xenvif *vif)
        if (xenvif_hash_cache_size == 0)
                return;
 
+       BUG_ON(vif->hash.cache.count);
+
        spin_lock_init(&vif->hash.cache.lock);
        INIT_LIST_HEAD(&vif->hash.cache.list);
 }

diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 182d6770f1027120b5cd7165e4b7eea7c8297299..6da12518e6934ce20ec6a1becfdbbef07f430822 100644 (file)
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -153,6 +153,13 @@ static u16 xenvif_select_queue(struct net_device *dev, struct sk_buff *skb,
 {
        struct xenvif *vif = netdev_priv(dev);
        unsigned int size = vif->hash.size;
+       unsigned int num_queues;
+
+       /* If queues are not set up internally - always return 0
+        * as the packet going to be dropped anyway */
+       num_queues = READ_ONCE(vif->num_queues);
+       if (num_queues < 1)
+               return 0;
 
        if (vif->hash.alg == XEN_NETIF_CTRL_HASH_ALGORITHM_NONE)
                return fallback(dev, skb, NULL) % dev->real_num_tx_queues;