Re: [PATCH net] tun: delete the flow entries of the moved queue on detach

[Willem de Bruijn]

Umang Pokhriyal wrote:
> When a queue is detached, __tun_detach() moves the last queue into the
> freed slot and decrements tun->numqueues. The flow entries that point at
> the old index of the moved queue, now tun->numqueues, are meant to be
> deleted, but the call passes tun->numqueues + 1, an index that never
> exists, so nothing is deleted.
> 
> Until those entries are refreshed by a write on their flow or age out,
> tun_automq_select_queue() returns an index past the last queue, and
> netdev_core_pick_tx() sends every such flow to queue 0 and warns:
> 
>   tapq0 selects TX queue 3, but real number of TX queues is 3
> 
> Found with an LLM while testing how a VMM detaches tap queues when a
> guest lowers its virtio-net queue pairs. With four queues, 30 flows
> learned on queue 3 and queue 1 detached, all 30 went to queue 0 with the
> warning; with this patch they are spread by hash and no warning is
> printed (3 runs each, in a guest booted on net).
> 
> Pass tun->numqueues.
> 
> Fixes: 96442e42429e ("tuntap: choose the txq based on rxq")
> Signed-off-by: Umang Pokhriyal <umangpokhriyall@xxxxxxxxx>

Reviewed-by: Willem de Bruijn <willemb@xxxxxxxxxx>