diff options
| author | Michael Chan <michael.chan@broadcom.com> | 2017-01-06 16:18:53 -0500 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-01-07 21:35:04 -0500 |
| commit | f5992b72ebe0dde488fa8f706b887194020c66fc (patch) | |
| tree | 86fb8320ceb68c4dbfb22c5100e5382c6528b89d | |
| parent | 6052cd1af86f9833b6b0b60d5d4787c4a06d65ea (diff) | |
| download | aspeed-f5992b72ebe0dde488fa8f706b887194020c66fc.tar.gz | |
tg3: Fix race condition in tg3_get_stats64().
The driver's ndo_get_stats64() method is not always called under RTNL.
So it can race with driver close or ethtool reconfigurations. Fix the
race condition by taking tp->lock spinlock in tg3_free_consistent()
when freeing the tp->hw_stats memory block. tg3_get_stats64() is
already taking tp->lock.
Reported-by: Wang Yufen <wangyufen@huawei.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/ethernet/broadcom/tg3.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c index 185e9e047aa9a..ae42de4fdddf6 100644 --- a/drivers/net/ethernet/broadcom/tg3.c +++ b/drivers/net/ethernet/broadcom/tg3.c @@ -8720,11 +8720,14 @@ static void tg3_free_consistent(struct tg3 *tp) tg3_mem_rx_release(tp); tg3_mem_tx_release(tp); + /* Protect tg3_get_stats64() from reading freed tp->hw_stats. */ + tg3_full_lock(tp, 0); if (tp->hw_stats) { dma_free_coherent(&tp->pdev->dev, sizeof(struct tg3_hw_stats), tp->hw_stats, tp->stats_mapping); tp->hw_stats = NULL; } + tg3_full_unlock(tp); } /* |