Skip to content

Commit

Permalink
virtio-net: correct error handling of virtqueue_kick()
Browse files Browse the repository at this point in the history
Current error handling of virtqueue_kick() was wrong in two places:
- The skb were freed immediately when virtqueue_kick() fail during
  xmit. This may lead double free since the skb was not detached from
  the virtqueue.
- try_fill_recv() returns false when virtqueue_kick() fail. This will
  lead unnecessary rescheduling of refill work.

Actually, it's safe to just ignore the kick failure in those two
places. So this patch fixes this by partially revert commit
6797590.

Fixes 6797590
(virtio_net: verify if virtqueue_kick() succeeded).

Cc: Heinz Graalfs <graalfs@linux.vnet.ibm.com>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Jason Wang authored and David S. Miller committed Mar 27, 2014
1 parent de14439 commit 681daee
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions drivers/net/virtio_net.c
Original file line number Diff line number Diff line change
Expand Up @@ -671,8 +671,7 @@ static bool try_fill_recv(struct receive_queue *rq, gfp_t gfp)
if (err)
break;
} while (rq->vq->num_free);
if (unlikely(!virtqueue_kick(rq->vq)))
return false;
virtqueue_kick(rq->vq);
return !oom;
}

Expand Down Expand Up @@ -877,7 +876,7 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev)
err = xmit_skb(sq, skb);

/* This should not happen! */
if (unlikely(err) || unlikely(!virtqueue_kick(sq->vq))) {
if (unlikely(err)) {
dev->stats.tx_fifo_errors++;
if (net_ratelimit())
dev_warn(&dev->dev,
Expand All @@ -886,6 +885,7 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev)
kfree_skb(skb);
return NETDEV_TX_OK;
}
virtqueue_kick(sq->vq);

/* Don't wait up for transmitted skbs to be freed. */
skb_orphan(skb);
Expand Down

0 comments on commit 681daee

Please sign in to comment.