On 2019/07/17 13:23, Firo Yang wrote:
> I think there is a problem if dev_watchdog() is triggered before
> netif_carrier_off(). dev_watchdog() might call ->ndo_tx_timeout(), i.e.
> be_tx_timeout(), if txq timeout happens. Thus be_tx_timeout() could still be
> able to access the memory which is being freed by be_update_queues().
Good point. That's a separate problem which would occur in case of real
tx timeout. How about this followup change:
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -4698,8 +4698,13 @@ int be_update_queues(struct be_adapter *adapter)
int status;
if (netif_running(netdev)) {
+ /* be_tx_timeout() must not run concurrently with this
+ * function, synchronize with an already-running dev_watchdog
+ */
+ netif_tx_lock_bh(netdev);
/* device cannot transmit now, avoid dev_watchdog timeouts */
netif_carrier_off(netdev);
+ netif_tx_unlock_bh(netdev);
be_close(netdev);
}