diff options
| author | Michael Chan <michael.chan@broadcom.com> | 2017-01-06 16:18:53 -0500 |
|---|---|---|
| committer | Sasha Levin <alexander.levin@verizon.com> | 2017-09-10 16:36:05 -0400 |
| commit | a445f819b5e06bb52e1ae7ca160d20b0490f0447 (patch) | |
| tree | 502b6e1db9c92c43ec3248bc5423bcc0b81530f8 | |
| parent | 7c0dbe308ab6ed7ee7226d8935f72cbfb317bc0d (diff) | |
tg3: Fix race condition in tg3_get_stats64().
[ Upstream commit f5992b72ebe0dde488fa8f706b887194020c66fc ]
The driver's ndo_get_stats64() method is not always called under RTNL.
So it can race with driver close or ethtool reconfigurations. Fix the
race condition by taking tp->lock spinlock in tg3_free_consistent()
when freeing the tp->hw_stats memory block. tg3_get_stats64() is
already taking tp->lock.
Reported-by: Wang Yufen <wangyufen@huawei.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
| -rw-r--r-- | drivers/net/ethernet/broadcom/tg3.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c index 7896f0f1fa05..f9713fe036ef 100644 --- a/drivers/net/ethernet/broadcom/tg3.c +++ b/drivers/net/ethernet/broadcom/tg3.c @@ -8722,11 +8722,14 @@ static void tg3_free_consistent(struct tg3 *tp) tg3_mem_rx_release(tp); tg3_mem_tx_release(tp); + /* Protect tg3_get_stats64() from reading freed tp->hw_stats. */ + tg3_full_lock(tp, 0); if (tp->hw_stats) { dma_free_coherent(&tp->pdev->dev, sizeof(struct tg3_hw_stats), tp->hw_stats, tp->stats_mapping); tp->hw_stats = NULL; } + tg3_full_unlock(tp); } /* |