3 files changed, 30 insertions, 2 deletions

diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 89b2d429c440..89d1d0556b6e 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -104,6 +104,11 @@ struct xenvif {
         domid_t          domid;
         unsigned int     handle;
 
+        /* Is this interface disabled? True when backend discovers
+         * frontend is rogue.
+         */
+        bool disabled;
+
         /* Use NAPI for guest TX */
         struct napi_struct napi;
         /* When feature-split-event-channels = 0, tx_irq = rx_irq. */
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index cdc298e3b747..ef05c5c49d41 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -63,6 +63,15 @@ static int xenvif_poll(struct napi_struct *napi, int budget)
         struct xenvif *vif = container_of(napi, struct xenvif, napi);
         int work_done;
 
+        /* This vif is rogue, we pretend we've there is nothing to do
+         * for this vif to deschedule it from NAPI. But this interface
+         * will be turned off in thread context later.
+         */
+        if (unlikely(vif->disabled)) {
+                napi_complete(napi);
+                return 0;
+        }
+
         work_done = xenvif_tx_action(vif, budget);
 
         if (work_done < budget) {
@@ -363,6 +372,8 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
         vif->ip_csum = 1;
         vif->dev = dev;
 
+        vif->disabled = false;
+
         vif->credit_bytes = vif->remaining_credit = ~0UL;
         vif->credit_usec  = 0UL;
         init_timer(&vif->credit_timeout);
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index ae34f5fc7fbc..3f021e054ba1 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -711,7 +711,8 @@ static void xenvif_tx_err(struct xenvif *vif,
 static void xenvif_fatal_tx_err(struct xenvif *vif)
 {
         netdev_err(vif->dev, "fatal error; disabling device\n");
-        xenvif_carrier_off(vif);
+        vif->disabled = true;
+        xenvif_kick_thread(vif);
 }
 
 static int xenvif_count_requests(struct xenvif *vif,
@@ -1212,7 +1213,7 @@ static unsigned xenvif_tx_build_gops(struct xenvif *vif, int budget)
                                    vif->tx.sring->req_prod, vif->tx.req_cons,
                                    XEN_NETIF_TX_RING_SIZE);
                         xenvif_fatal_tx_err(vif);
-                        continue;
+                        break;
                 }
 
                 work_to_do = RING_HAS_UNCONSUMED_REQUESTS(&vif->tx);
@@ -1808,7 +1809,18 @@ int xenvif_kthread_guest_rx(void *data)
         while (!kthread_should_stop()) {
                 wait_event_interruptible(vif->wq,
                                          rx_work_todo(vif) ||
+                                         vif->disabled ||
                                          kthread_should_stop());
+
+                /* This frontend is found to be rogue, disable it in
+                 * kthread context. Currently this is only set when
+                 * netback finds out frontend sends malformed packet,
+                 * but we cannot disable the interface in softirq
+                 * context so we defer it here.
+                 */
+                if (unlikely(vif->disabled && netif_carrier_ok(vif->dev)))
+                        xenvif_carrier_off(vif);
+
                 if (kthread_should_stop())
                         break;