diff options
| author | Joe Damato <[email protected]> | 2025-06-03 16:34:01 +0000 |
|---|---|---|
| committer | Tony Nguyen <[email protected]> | 2025-06-10 16:10:47 +0000 |
| commit | b4a8085ceefb7bbb12c2b71c55e71fc946c6929f (patch) | |
| tree | 6143689e15948c24c6b92d29a6f92da5c1929790 /drivers/net/ethernet/intel/e1000/e1000_main.c | |
| parent | ice/ptp: fix crosstimestamp reporting (diff) | |
| download | kernel-b4a8085ceefb7bbb12c2b71c55e71fc946c6929f.tar.gz kernel-b4a8085ceefb7bbb12c2b71c55e71fc946c6929f.zip | |
e1000: Move cancel_work_sync to avoid deadlock
Previously, e1000_down called cancel_work_sync for the e1000 reset task
(via e1000_down_and_stop), which takes RTNL.
As reported by users and syzbot, a deadlock is possible in the following
scenario:
CPU 0:
- RTNL is held
- e1000_close
- e1000_down
- cancel_work_sync (cancel / wait for e1000_reset_task())
CPU 1:
- process_one_work
- e1000_reset_task
- take RTNL
To remedy this, avoid calling cancel_work_sync from e1000_down
(e1000_reset_task does nothing if the device is down anyway). Instead,
call cancel_work_sync for e1000_reset_task when the device is being
removed.
Fixes: e400c7444d84 ("e1000: Hold RTNL when e1000_down can be called")
Reported-by: [email protected]
Closes: https://lore.kernel.org/netdev/[email protected]/
Reported-by: John <[email protected]>
Closes: https://lore.kernel.org/netdev/CAP=Rh=OEsn4y_2LvkO3UtDWurKcGPnZ_NPSXK=FbgygNXL37Sw@mail.gmail.com/
Signed-off-by: Joe Damato <[email protected]>
Acked-by: Stanislav Fomichev <[email protected]>
Acked-by: Jacob Keller <[email protected]>
Signed-off-by: Tony Nguyen <[email protected]>
Diffstat (limited to 'drivers/net/ethernet/intel/e1000/e1000_main.c')
| -rw-r--r-- | drivers/net/ethernet/intel/e1000/e1000_main.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c index 3f089c3d47b2..d8595e84326d 100644 --- a/drivers/net/ethernet/intel/e1000/e1000_main.c +++ b/drivers/net/ethernet/intel/e1000/e1000_main.c @@ -477,10 +477,6 @@ static void e1000_down_and_stop(struct e1000_adapter *adapter) cancel_delayed_work_sync(&adapter->phy_info_task); cancel_delayed_work_sync(&adapter->fifo_stall_task); - - /* Only kill reset task if adapter is not resetting */ - if (!test_bit(__E1000_RESETTING, &adapter->flags)) - cancel_work_sync(&adapter->reset_task); } void e1000_down(struct e1000_adapter *adapter) @@ -1266,6 +1262,10 @@ static void e1000_remove(struct pci_dev *pdev) unregister_netdev(netdev); + /* Only kill reset task if adapter is not resetting */ + if (!test_bit(__E1000_RESETTING, &adapter->flags)) + cancel_work_sync(&adapter->reset_task); + e1000_phy_hw_reset(hw); kfree(adapter->tx_ring); |