diff options
author | Sameeh Jubran <sameehj@amazon.com> | 2019-09-15 17:29:44 +0300 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2019-09-16 21:40:18 +0200 |
commit | a53651ec93a8d7ab5b26c5390e0c389048b4b4b6 (patch) | |
tree | 3cb41a30ff56472b6218a126d71cbea2097d2639 /drivers/net/ethernet/intel/ice/ice_main.c | |
parent | 81e09359b4658fde625b59da554386179af31e33 (diff) | |
download | linux-a53651ec93a8d7ab5b26c5390e0c389048b4b4b6.tar.bz2 |
net: ena: don't wake up tx queue when down
There is a race condition that can occur when calling ena_down().
The ena_clean_tx_irq() - which is a part of the napi handler -
function might wake up the tx queue when the queue is supposed
to be down (during recovery or changing the size of the queues
for example) This causes the ena_start_xmit() function to trigger
and possibly try to access the destroyed queues.
The race is illustrated below:
Flow A: Flow B(napi handler)
ena_down()
netif_carrier_off()
netif_tx_disable()
ena_clean_tx_irq()
netif_tx_wake_queue()
ena_napi_disable_all()
ena_destroy_all_io_queues()
After these flows the tx queue is active and ena_start_xmit() accesses
the destroyed queue which leads to a kernel panic.
fixes: 1738cd3ed342 (net: ena: Add a driver for Amazon Elastic Network Adapters (ENA))
Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/intel/ice/ice_main.c')
0 files changed, 0 insertions, 0 deletions