diff options
| author | Michael Chan | 2017-01-06 22:18:53 +0100 |
|---|---|---|
| committer | David S. Miller | 2017-01-08 03:35:04 +0100 |
| commit | f5992b72ebe0dde488fa8f706b887194020c66fc (patch) | |
| tree | 86fb8320ceb68c4dbfb22c5100e5382c6528b89d /drivers/net/ethernet/broadcom/tg3.c | |
| parent | be2net: fix unicast list filling (diff) | |
| download | kernel-qcow2-linux-f5992b72ebe0dde488fa8f706b887194020c66fc.tar.gz kernel-qcow2-linux-f5992b72ebe0dde488fa8f706b887194020c66fc.tar.xz kernel-qcow2-linux-f5992b72ebe0dde488fa8f706b887194020c66fc.zip | |
tg3: Fix race condition in tg3_get_stats64().
The driver's ndo_get_stats64() method is not always called under RTNL.
So it can race with driver close or ethtool reconfigurations. Fix the
race condition by taking tp->lock spinlock in tg3_free_consistent()
when freeing the tp->hw_stats memory block. tg3_get_stats64() is
already taking tp->lock.
Reported-by: Wang Yufen <wangyufen@huawei.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/broadcom/tg3.c')
| -rw-r--r-- | drivers/net/ethernet/broadcom/tg3.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c index 185e9e047aa9..ae42de4fdddf 100644 --- a/drivers/net/ethernet/broadcom/tg3.c +++ b/drivers/net/ethernet/broadcom/tg3.c @@ -8720,11 +8720,14 @@ static void tg3_free_consistent(struct tg3 *tp) tg3_mem_rx_release(tp); tg3_mem_tx_release(tp); + /* Protect tg3_get_stats64() from reading freed tp->hw_stats. */ + tg3_full_lock(tp, 0); if (tp->hw_stats) { dma_free_coherent(&tp->pdev->dev, sizeof(struct tg3_hw_stats), tp->hw_stats, tp->stats_mapping); tp->hw_stats = NULL; } + tg3_full_unlock(tp); } /* |