| From foo@baz Sun Jan 10 01:16:11 PM CET 2021 |
| From: Jeff Dike <jdike@akamai.com> |
| Date: Tue, 22 Dec 2020 21:54:21 -0500 |
| Subject: virtio_net: Fix recursive call to cpus_read_lock() |
| |
| From: Jeff Dike <jdike@akamai.com> |
| |
| [ Upstream commit de33212f768c5d9e2fe791b008cb26f92f0aa31c ] |
| |
| virtnet_set_channels can recursively call cpus_read_lock if CONFIG_XPS |
| and CONFIG_HOTPLUG are enabled. |
| |
| The path is: |
| virtnet_set_channels - calls get_online_cpus(), which is a trivial |
| wrapper around cpus_read_lock() |
| netif_set_real_num_tx_queues |
| netif_reset_xps_queues_gt |
| netif_reset_xps_queues - calls cpus_read_lock() |
| |
| This call chain and potential deadlock happens when the number of TX |
| queues is reduced. |
| |
| This commit the removes netif_set_real_num_[tr]x_queues calls from |
| inside the get/put_online_cpus section, as they don't require that it |
| be held. |
| |
| Fixes: 47be24796c13 ("virtio-net: fix the set affinity bug when CPU IDs are not consecutive") |
| Signed-off-by: Jeff Dike <jdike@akamai.com> |
| Acked-by: Jason Wang <jasowang@redhat.com> |
| Acked-by: Michael S. Tsirkin <mst@redhat.com> |
| Link: https://lore.kernel.org/r/20201223025421.671-1-jdike@akamai.com |
| Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/net/virtio_net.c | 12 +++++++----- |
| 1 file changed, 7 insertions(+), 5 deletions(-) |
| |
| --- a/drivers/net/virtio_net.c |
| +++ b/drivers/net/virtio_net.c |
| @@ -1372,14 +1372,16 @@ static int virtnet_set_channels(struct n |
| |
| get_online_cpus(); |
| err = virtnet_set_queues(vi, queue_pairs); |
| - if (!err) { |
| - netif_set_real_num_tx_queues(dev, queue_pairs); |
| - netif_set_real_num_rx_queues(dev, queue_pairs); |
| - |
| - virtnet_set_affinity(vi); |
| + if (err) { |
| + put_online_cpus(); |
| + goto err; |
| } |
| + virtnet_set_affinity(vi); |
| put_online_cpus(); |
| |
| + netif_set_real_num_tx_queues(dev, queue_pairs); |
| + netif_set_real_num_rx_queues(dev, queue_pairs); |
| +err: |
| return err; |
| } |
| |