net: disable netpoll on fresh napis (96e97bc0) · Commits · 戴 / test

napi_disable() makes sure to set the NAPI_STATE_NPSVC bit to prevent netpoll from accessing rings before init is complete. However, the same is not done for fresh napi instances in netif_napi_add(), even though we expect NAPI instances to be added as disabled. This causes crashes during driver reconfiguration (enabling XDP, changing the channel count) - if there is any printk() after netif_napi_add() but before napi_enable(). To ensure memory ordering is correct we need to use RCU accessors. Reported-by:

Rob Sherwood <rsher@fb.com> Fixes: ("netpoll: Close race condition between poll_one_napi and napi_disable") Signed-off-by:

Jakub Kicinski <kuba@kernel.org> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/core/dev.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -6612,12 +6612,13 @@ void netif_napi_add(struct net_device dev, struct napi_struct napi,
		netdev_err_once(dev, "%s() called with weight %d\n", __func__,
		weight);
		napi->weight = weight;
		list_add(&napi->dev_list, &dev->napi_list);
		napi->dev = dev;
		#ifdef CONFIG_NETPOLL
		napi->poll_owner = -1;
		#endif
		set_bit(NAPI_STATE_SCHED, &napi->state);
		set_bit(NAPI_STATE_NPSVC, &napi->state);
		list_add_rcu(&napi->dev_list, &dev->napi_list);
		napi_hash_add(napi);
		}
		EXPORT_SYMBOL(netif_napi_add);

net/core/netpoll.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -162,7 +162,7 @@ static void poll_napi(struct net_device *dev)
		struct napi_struct *napi;
		int cpu = smp_processor_id();

		list_for_each_entry(napi, &dev->napi_list, dev_list) {
		list_for_each_entry_rcu(napi, &dev->napi_list, dev_list) {
		if (cmpxchg(&napi->poll_owner, -1, cpu) == -1) {
		poll_one_napi(napi);
		smp_store_release(&napi->poll_owner, -1);

Admin message