| From foo@baz Wed Aug 9 11:19:16 PDT 2017 |
| From: Michael Chan <michael.chan@broadcom.com> |
| Date: Fri, 6 Jan 2017 16:18:53 -0500 |
| Subject: tg3: Fix race condition in tg3_get_stats64(). |
| |
| From: Michael Chan <michael.chan@broadcom.com> |
| |
| |
| [ Upstream commit f5992b72ebe0dde488fa8f706b887194020c66fc ] |
| |
| The driver's ndo_get_stats64() method is not always called under RTNL. |
| So it can race with driver close or ethtool reconfigurations. Fix the |
| race condition by taking tp->lock spinlock in tg3_free_consistent() |
| when freeing the tp->hw_stats memory block. tg3_get_stats64() is |
| already taking tp->lock. |
| |
| Reported-by: Wang Yufen <wangyufen@huawei.com> |
| Signed-off-by: Michael Chan <michael.chan@broadcom.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Sasha Levin <alexander.levin@verizon.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/net/ethernet/broadcom/tg3.c | 3 +++ |
| 1 file changed, 3 insertions(+) |
| |
| --- a/drivers/net/ethernet/broadcom/tg3.c |
| +++ b/drivers/net/ethernet/broadcom/tg3.c |
| @@ -8722,11 +8722,14 @@ static void tg3_free_consistent(struct t |
| tg3_mem_rx_release(tp); |
| tg3_mem_tx_release(tp); |
| |
| + /* Protect tg3_get_stats64() from reading freed tp->hw_stats. */ |
| + tg3_full_lock(tp, 0); |
| if (tp->hw_stats) { |
| dma_free_coherent(&tp->pdev->dev, sizeof(struct tg3_hw_stats), |
| tp->hw_stats, tp->stats_mapping); |
| tp->hw_stats = NULL; |
| } |
| + tg3_full_unlock(tp); |
| } |
| |
| /* |
