xps_needed is incremented only when a new dev map is allocated (in __netif_set_xps_queue). Therefore it should be decremented only when we actually have a dev map to destroy. Without this, it may be decremented too many times which causes netif_reset_xps_queues to return early and not actually clean up the old dev maps. This results in a crash in __netif_set_xps_queue when it is called later.
The crash occurred when having multiple ixgbe devices in a host. lldpad would reconfigure them to be FCoE-capable causing reset_xps_queues / set_xps_queue to be called several times. The xps_needed count would get out of sync and eventually the above-mentioned crash would occur. Signed-off-by: Ross Lagerwall <ross.lagerw...@citrix.com> --- net/core/dev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/core/dev.c b/net/core/dev.c index ddc551f24ba2..8aa72e93af9f 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -2233,11 +2233,12 @@ static void netif_reset_xps_queues(struct net_device *dev, u16 offset, clean_xps_maps(dev, possible_mask, dev_maps, nr_ids, offset, count, false); -out_no_maps: if (static_key_enabled(&xps_rxqs_needed)) static_key_slow_dec_cpuslocked(&xps_rxqs_needed); static_key_slow_dec_cpuslocked(&xps_needed); + +out_no_maps: mutex_unlock(&xps_map_mutex); cpus_read_unlock(); } -- 2.17.1