On 2019/07/17 13:23, Firo Yang wrote:
> I think there is a problem if dev_watchdog() is triggered before 
> netif_carrier_off(). dev_watchdog() might call ->ndo_tx_timeout(), i.e. 
> be_tx_timeout(), if txq timeout  happens. Thus be_tx_timeout() could still be 
> able to access the memory which is being freed by be_update_queues().

Good point. That's a separate problem which would occur in case of real
tx timeout. How about this followup change:

--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -4698,8 +4698,13 @@ int be_update_queues(struct be_adapter *adapter)
        int status;
 
        if (netif_running(netdev)) {
+               /* be_tx_timeout() must not run concurrently with this
+                * function, synchronize with an already-running dev_watchdog
+                */
+               netif_tx_lock_bh(netdev);
                /* device cannot transmit now, avoid dev_watchdog timeouts */
                netif_carrier_off(netdev);
+               netif_tx_unlock_bh(netdev);
 
                be_close(netdev);
        }

Reply via email to