bnxt_en: Fix possible crash in bnxt_fw_reset_task().
authorMichael Chan <michael.chan@broadcom.com>
Wed, 26 Aug 2020 05:08:36 +0000 (01:08 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 9 Sep 2020 17:14:17 +0000 (19:14 +0200)
commite4d07b93a26beb89158555da30c55d0571095f3c
tree222325fda22c11232a8f66a5ab973c00296c57d5
parente0543e56fa6234ca93689b0f8a3e4f74c364af4e
bnxt_en: Fix possible crash in bnxt_fw_reset_task().

[ Upstream commit b148bb238c02f0c7797efed026e9bba5892d2172 ]

bnxt_fw_reset_task() is run from a delayed workqueue.  The current
code is not cancelling the workqueue in the driver's .remove()
method and it can potentially crash if the device is removed with
the workqueue still pending.

The fix is to clear the BNXT_STATE_IN_FW_RESET flag and then cancel
the delayed workqueue in bnxt_remove_one().  bnxt_queue_fw_reset_work()
also needs to check that this flag is set before scheduling.  This
will guarantee that no rescheduling will be done after it is cancelled.

Fixes: 230d1f0de754 ("bnxt_en: Handle firmware reset.")
Reviewed-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/ethernet/broadcom/bnxt/bnxt.c