[PATCH net] vhost_net: don't continue to call the recvmsg when meet errors

[Yunjian Wang]

When we meet an error(err=-EBADFD) recvmsg, the error handling in vhost
handle_rx() will continue. This will cause a soft CPU lockup in vhost thread.

Signed-off-by: Yunjian Wang <wangyunj...@huawei.com>
---
 drivers/vhost/net.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 5dc128a..edc470b 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -717,6 +717,9 @@ static void handle_rx(struct vhost_net *net)
pr_debug("Discarded rx packet: "
 " len %d, expected %zd\n", err, sock_len);
vhost_discard_vq_desc(vq, headcount);
+   /* Don't continue to do, when meet errors. */
+   if (err < 0)
+   goto out;
continue;
}
/* Supply virtio_net_hdr if VHOST_NET_F_VIRTIO_NET_HDR */
-- 
1.9.5.msysgit.1

[PATCH net v3] virtio_net: fix virtnet_open and virtnet_probe competing for try_fill_recv

[Yunjian Wang]

In function virtnet_open() and virtnet_probe(), func try_fill_recv() may
be executed at the same time. VQ in virtqueue_add() has not been protected
well and BUG_ON will be triggered when virito_net.ko being removed.

Signed-off-by: Yunjian Wang <wangyunj...@huawei.com>
Acked-by: Jason Wang <jasow...@redhat.com>
Acked-by: Michael S. Tsirkin <m...@redhat.com>
---
 drivers/net/virtio_net.c | 18 ++
 1 file changed, 2 insertions(+), 16 deletions(-)

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 49d84e5..e0638e5 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1925,24 +1925,11 @@ static int virtnet_probe(struct virtio_device *vdev)
 
virtio_device_ready(vdev);
 
-   /* Last of all, set up some receive buffers. */
-   for (i = 0; i < vi->curr_queue_pairs; i++) {
-   try_fill_recv(vi, >rq[i], GFP_KERNEL);
-
-   /* If we didn't even get one input buffer, we're useless. */
-   if (vi->rq[i].vq->num_free ==
-   virtqueue_get_vring_size(vi->rq[i].vq)) {
-   free_unused_bufs(vi);
-   err = -ENOMEM;
-   goto free_recv_bufs;
-   }
-   }
-
vi->nb.notifier_call = _cpu_callback;
err = register_hotcpu_notifier(>nb);
if (err) {
pr_debug("virtio_net: registering cpu notifier failed\n");
-   goto free_recv_bufs;
+   goto free_unregister_netdev;
}
 
/* Assume link up if device can't report link status,
@@ -1960,10 +1947,9 @@ static int virtnet_probe(struct virtio_device *vdev)
 
return 0;
 
-free_recv_bufs:
+free_unregister_netdev:
vi->vdev->config->reset(vdev);
 
-   free_receive_bufs(vi);
unregister_netdev(dev);
 free_vqs:
cancel_delayed_work_sync(>refill);
-- 
1.7.12.4