generic: reset mbuf destructor on unregif

This prevents from crashes that happen when mbufs are lazily consumed
by drivers. In this case mbuf destructors (which call into netmap) could
be invoked when netmap data structures (or netmap module) were gone.

Author: vmaffione

LINUX/bsd_glue.h

@@ -199,7 +199,7 @@ struct thread;
  */
 #define MBUF_TXQ(m)		skb_get_queue_mapping(m)
 #define MBUF_RXQ(m)		(skb_rx_queue_recorded(m) ? skb_get_rx_queue(m) : 0)
-#define SET_MBUF_DESTRUCTOR(m, f) m->destructor = (void *)&f
+#define SET_MBUF_DESTRUCTOR(m, f) m->destructor = (void *)f
 
 /* Magic number for sk_buff.priority field, used to take decisions in
  * generic_ndo_start_xmit(), linux_generic_rx_handler() and

sys/dev/netmap/netmap_generic.c

@@ -359,21 +359,22 @@ generic_netmap_register(struct netmap_adapter *na, int enable)
 	} else if (na->tx_rings[0].tx_pool) {
 		/* Disable netmap mode. We enter here only if the previous
 		   generic_netmap_register(na, 1) was successfull.
-		   If it was not, na->tx_rings[0].tx_pool was set to NULL by the
-		   error handling code below. */
+		   If it was not, na->tx_rings[0].tx_pool was set to NULL
+		   by the error handling code below. */
 		rtnl_lock();
 
 		na->na_flags &= ~NAF_NETMAP_ON;
 
 		/* Release packet steering control. */
 		nm_os_catch_tx(gna, 0);
 
-		/* Do not intercept packets on the rx path. */
+		/* Stop intercepting packets on the RX path. */
 		nm_os_catch_rx(gna, 0);
 
 		rtnl_unlock();
 
-		/* Free the mbufs going to the netmap rings */
+		/* Free the mbufs still pending in the RX queues, that
+		 * did not end up into the corresponding netmap RX rings. */
 		for (r=0; r<na->num_rx_rings; r++) {
 			mbq_safe_purge(&na->rx_rings[r].rx_queue);
 			mbq_safe_fini(&na->rx_rings[r].rx_queue);
@@ -383,9 +384,21 @@ generic_netmap_register(struct netmap_adapter *na, int enable)
 			nm_os_mitigation_cleanup(&gna->mit[r]);
 		free(gna->mit, M_DEVBUF);
 
+		/* Decrement reference counter for the mbufs in the
+		 * TX pools. These mbufs can be still pending in drivers,
+		 * (e.g. this happens with virtio-net driver, which
+		 * does lazy reclaiming of transmitted mbufs).
+		 * Therefore it is necessary to remove the
+		 * destructor (which invokes netmap code), since the
+		 * the netmap module may disappear before pending mbufs
+		 * are consumed. */
 		for (r=0; r<na->num_tx_rings; r++) {
 			for (i=0; i<na->num_tx_desc; i++) {
-				m_freem(na->tx_rings[r].tx_pool[i]);
+				m = na->tx_rings[r].tx_pool[i];
+				if (m) {
+					SET_MBUF_DESTRUCTOR(m, NULL);
+					m_freem(m);
+				}
 			}
 			free(na->tx_rings[r].tx_pool, M_DEVBUF);
 		}