mirror of
https://github.com/torvalds/linux.git
synced 2026-10-26 00:56:03 +01:00
9e92ad4630
mxl862xx_setup() arms the stats poll before mxl862xx_setup_mdio(), and
nothing stops it until dsa_register_switch() has returned an error to
mxl862xx_probe(). DSA frees the dsa_port list before it returns, so a
poll that fires once .setup or a later step of dsa_tree_setup() has
failed walks freed ports. On shutdown the user ports stay registered,
and the WORK_STOPPED flag test in mxl862xx_get_stats64() is not atomic
with the cancel in mxl862xx_shutdown(), so a re-arm that read the flag
before it was set queues the poll after cancel_delayed_work_sync() has
returned.
Arm the poll once .setup has succeeded and stop it from a .teardown op,
which DSA calls on unregister and after a failed registration, in both
cases before it frees the ports. Use disable_delayed_work_sync() there
and in shutdown(): it drains a running poll as the cancel did and turns
every later attempt to queue the work into a no-op, so the re-arm
cannot bring the poll back. remove() and the probe error path only set
WORK_STOPPED, which crc_err_work tests before it walks the ports.
Fixes:
|
||
|---|---|---|
| .. | ||
| b53 | ||
| hirschmann | ||
| lantiq | ||
| microchip | ||
| mv88e6xxx | ||
| mxl862xx | ||
| netc | ||
| ocelot | ||
| qca | ||
| realtek | ||
| sja1105 | ||
| xrs700x | ||
| bcm_sf2_cfp.c | ||
| bcm_sf2_regs.h | ||
| bcm_sf2.c | ||
| bcm_sf2.h | ||
| dsa_loop.c | ||
| Kconfig | ||
| ks8995.c | ||
| lan9303_i2c.c | ||
| lan9303_mdio.c | ||
| lan9303-core.c | ||
| lan9303.h | ||
| Makefile | ||
| mt7530-mdio.c | ||
| mt7530-mmio.c | ||
| mt7530.c | ||
| mt7530.h | ||
| mt7628.c | ||
| mv88e6060.c | ||
| mv88e6060.h | ||
| rzn1_a5psw.c | ||
| rzn1_a5psw.h | ||
| vitesse-vsc73xx-core.c | ||
| vitesse-vsc73xx-platform.c | ||
| vitesse-vsc73xx-spi.c | ||
| vitesse-vsc73xx.h | ||
| yt921x.c | ||
| yt921x.h | ||