diff options
| author |   Ross Lagerwall <ross.lagerwall@citrix.com> | 2015-08-04 15:40:59 +0100 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2015-08-06 23:42:48 -0700 |
| commit | 57b229063ae6dc65036209018dc7f4290cc026bb (patch) | |
| tree | a465b6e776bef923f818d6601c96516c452d85fe /drivers/net | |
| parent | net: Fix skb_set_peeked use-after-free bug (diff) | |
| download | linux-dev-57b229063ae6dc65036209018dc7f4290cc026bb.tar.xz linux-dev-57b229063ae6dc65036209018dc7f4290cc026bb.zip | |
xen/netback: Wake dealloc thread after completing zerocopy work
Waking the dealloc thread before decrementing inflight_packets is racy
because it means the thread may go to sleep before inflight_packets is
decremented. If kthread_stop() has already been called, the dealloc
thread may wait forever with nothing to wake it. Instead, wake the
thread only after decrementing inflight_packets.
Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/xen-netback/interface.c | 6 | ||||
| -rw-r--r-- | drivers/net/xen-netback/netback.c | 1 |
2 files changed, 6 insertions, 1 deletions
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c index 1a83e190fc15..28577a31549d 100644 --- a/drivers/net/xen-netback/interface.c +++ b/drivers/net/xen-netback/interface.c @@ -61,6 +61,12 @@ void xenvif_skb_zerocopy_prepare(struct xenvif_queue *queue, void xenvif_skb_zerocopy_complete(struct xenvif_queue *queue) { atomic_dec(&queue->inflight_packets); + + /* Wake the dealloc thread _after_ decrementing inflight_packets so + * that if kthread_stop() has already been called, the dealloc thread + * does not wait forever with nothing to wake it. + */ + wake_up(&queue->dealloc_wq); } int xenvif_schedulable(struct xenvif *vif) diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c index 1b406e706a01..3f44b522b831 100644 --- a/drivers/net/xen-netback/netback.c +++ b/drivers/net/xen-netback/netback.c @@ -1541,7 +1541,6 @@ void xenvif_zerocopy_callback(struct ubuf_info *ubuf, bool zerocopy_success) smp_wmb(); queue->dealloc_prod++; } while (ubuf); - wake_up(&queue->dealloc_wq); spin_unlock_irqrestore(&queue->callback_lock, flags); if (likely(zerocopy_success)) |