From: Bert Kenward <bkenw...@solarflare.com>
Date: Fri, 11 Nov 2016 15:56:51 +0000
> efx_copy_channel() doesn't correctly clear the napi_hash related state.
> This means that when napi_hash_add is called for that channel nothing is
> done, and we are left with a copy of the napi_hash_node from the old
> channel. When we later call napi_hash_del() on this channel we have a
> stale napi_hash_node.
>
> Corruption is only seen when there are multiple entries in one of the
> napi_hash lists. This is made more likely by having a very large number
> of channels. Testing was carried out with 512 channels - 32 channels on
> each of 16 ports.
>
> This failure typically appears as protection faults within napi_by_id()
> or napi_hash_add(). efx_copy_channel() is only used when tx or rx ring
> sizes are changed (ethtool -G).
>
> Fixes: 36763266bbe8 ("sfc: Add support for busy polling")
> Signed-off-by: Bert Kenward <bkenw...@solarflare.com>
Applied to net.
