net: decreasing real_num_tx_queues needs to flush qdisc
authorJohn Fastabend <john.r.fastabend@intel.com>
Thu, 1 Jul 2010 13:21:57 +0000 (13:21 +0000)
committerDavid S. Miller <davem@davemloft.net>
Sat, 3 Jul 2010 04:59:07 +0000 (21:59 -0700)
commitf0796d5c73e59786d09a1e617689d1d415f2db44
treeecb17c65c5b6a162824a1e11fee24364852837f8
parent4ef6acff83222f4496ceef7d1f0ee9e50a5bb403
net: decreasing real_num_tx_queues needs to flush qdisc

Reducing real_num_queues needs to flush the qdisc otherwise
skbs with queue_mappings greater then real_num_tx_queues can
be sent to the underlying driver.

The flow for this is,

dev_queue_xmit()
dev_pick_tx()
skb_tx_hash()  => hash using real_num_tx_queues
skb_set_queue_mapping()
...
qdisc_enqueue_root() => enqueue skb on txq from hash
...
dev->real_num_tx_queues -= n
...
sch_direct_xmit()
dev_hard_start_xmit()
ndo_start_xmit(skb,dev) => skb queue set with old hash

skbs are enqueued on the qdisc with skb->queue_mapping set
0 < queue_mappings < real_num_tx_queues.  When the driver
decreases real_num_tx_queues skb's may be dequeued from the
qdisc with a queue_mapping greater then real_num_tx_queues.

This fixes a case in ixgbe where this was occurring with DCB
and FCoE. Because the driver is using queue_mapping to map
skbs to tx descriptor rings we can potentially map skbs to
rings that no longer exist.

Signed-off-by: John Fastabend <john.r.fastabend@intel.com>
Tested-by: Ross Brattain <ross.b.brattain@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/ixgbe/ixgbe_main.c
include/linux/netdevice.h
include/net/sch_generic.h
net/core/dev.c