net: qcom/emac: disable interrupts before calling phy_disconnect
authorTimur Tabi <timur@codeaurora.org>
Fri, 14 Oct 2016 19:14:35 +0000 (14:14 -0500)
committerDavid S. Miller <davem@davemloft.net>
Sat, 15 Oct 2016 21:34:43 +0000 (17:34 -0400)
There is a race condition that can occur if EMAC interrupts are
enabled when phy_disconnect() is called.  phy_disconnect() sets
adjust_link to NULL.  When an interrupt occurs, the ISR might
call phy_mac_interrupt(), which wakes up the workqueue function
phy_state_machine().  This function might reference adjust_link,
thereby causing a null pointer exception.

Signed-off-by: Timur Tabi <timur@codeaurora.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/ethernet/qualcomm/emac/emac-mac.c

index e97968ed4b8f7294cf6869ab4351711b8d9f55e5..6fb3bee904d38f228f6587881f0a6a2f03557731 100644 (file)
@@ -1021,14 +1021,18 @@ void emac_mac_down(struct emac_adapter *adpt)
        napi_disable(&adpt->rx_q.napi);
 
        phy_stop(adpt->phydev);
-       phy_disconnect(adpt->phydev);
 
-       /* disable mac irq */
+       /* Interrupts must be disabled before the PHY is disconnected, to
+        * avoid a race condition where adjust_link is null when we get
+        * an interrupt.
+        */
        writel(DIS_INT, adpt->base + EMAC_INT_STATUS);
        writel(0, adpt->base + EMAC_INT_MASK);
        synchronize_irq(adpt->irq.irq);
        free_irq(adpt->irq.irq, &adpt->irq);
 
+       phy_disconnect(adpt->phydev);
+
        emac_mac_reset(adpt);
 
        emac_tx_q_descs_free(adpt);