diff options
| author |   Eric Dumazet <eric.dumazet@gmail.com> | 2010-11-16 19:26:42 -0800 |
|---|---|---|
| committer |   Jeff Kirsher <jeffrey.t.kirsher@intel.com> | 2010-11-16 19:26:42 -0800 |
| commit | 1a51502bddca7ac1e921d918b741ffd2bec149ed (patch) | |
| tree | ee41f3f5fdba243eb2e68b0fd8ee4c8c84d72c2b /drivers/net/ixgbe/ixgbe.h | |
| parent | net: reorder struct sock fields (diff) | |
| download | linux-dev-1a51502bddca7ac1e921d918b741ffd2bec149ed.tar.xz linux-dev-1a51502bddca7ac1e921d918b741ffd2bec149ed.zip | |
ixgbe: delay rx_ring freeing
"cat /proc/net/dev" uses RCU protection only.
Its quite possible we call a driver get_stats() method while device is
dismantling and freeing its data structures.
So get_stats() methods must be very careful not accessing driver private
data without appropriate locking.
In ixgbe case, we access rx_ring pointers. These pointers are freed in
ixgbe_clear_interrupt_scheme() and set to NULL, this can trigger NULL
dereference in ixgbe_get_stats64()
A possible fix is to use RCU locking in ixgbe_get_stats64() and defer
rx_ring freeing after a grace period in ixgbe_clear_interrupt_scheme()
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Reported-by: Tantilov, Emil S <emil.s.tantilov@intel.com>
Tested-by: Ross Brattain <ross.b.brattain@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Diffstat (limited to 'drivers/net/ixgbe/ixgbe.h')
| -rw-r--r-- | drivers/net/ixgbe/ixgbe.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/net/ixgbe/ixgbe.h b/drivers/net/ixgbe/ixgbe.h index ed8703cfffb7..018e143612b2 100644 --- a/drivers/net/ixgbe/ixgbe.h +++ b/drivers/net/ixgbe/ixgbe.h @@ -192,6 +192,7 @@ struct ixgbe_ring { unsigned int size; /* length in bytes */ dma_addr_t dma; /* phys. address of descriptor ring */ + struct rcu_head rcu; } ____cacheline_internodealigned_in_smp; enum ixgbe_ring_f_enum { |