On 2019/07/17 13:23, Firo Yang wrote: > I think there is a problem if dev_watchdog() is triggered before > netif_carrier_off(). dev_watchdog() might call ->ndo_tx_timeout(), i.e. > be_tx_timeout(), if txq timeout happens. Thus be_tx_timeout() could still be > able to access the memory which is being freed by be_update_queues().
Good point. That's a separate problem which would occur in case of real tx timeout. How about this followup change: --- a/drivers/net/ethernet/emulex/benet/be_main.c +++ b/drivers/net/ethernet/emulex/benet/be_main.c @@ -4698,8 +4698,13 @@ int be_update_queues(struct be_adapter *adapter) int status; if (netif_running(netdev)) { + /* be_tx_timeout() must not run concurrently with this + * function, synchronize with an already-running dev_watchdog + */ + netif_tx_lock_bh(netdev); /* device cannot transmit now, avoid dev_watchdog timeouts */ netif_carrier_off(netdev); + netif_tx_unlock_bh(netdev); be_close(netdev); }