qed: Fix race condition between scheduling and destroying the slowpath workqueue

commit 3b85720d3fd72e6ef4de252cd2f67548eb645eb4 upstream.

Calling queue_delayed_work concurrently with
destroy_workqueue might race to an unexpected outcome -
scheduled task after wq is destroyed or other resources
(like ptt_pool) are freed (yields NULL pointer dereference).
cancel_delayed_work prevents the race by cancelling
the timer triggered for scheduling a new task.

Fixes: 59ccf86fe ("qed: Add driver infrastucture for handling mfw requests")
Signed-off-by: Denis Bolotin <dbolotin@marvell.com>
Signed-off-by: Michal Kalderon <mkalderon@marvell.com>
Signed-off-by: Yuval Basson <ybason@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 38f7f40..e72f9f1 100644 (file)
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -1087,9 +1087,6 @@ static void qed_update_pf_params(struct qed_dev *cdev,
 #define QED_PERIODIC_DB_REC_INTERVAL_MS                100
 #define QED_PERIODIC_DB_REC_INTERVAL \
        msecs_to_jiffies(QED_PERIODIC_DB_REC_INTERVAL_MS)
-#define QED_PERIODIC_DB_REC_WAIT_COUNT         10
-#define QED_PERIODIC_DB_REC_WAIT_INTERVAL \
-       (QED_PERIODIC_DB_REC_INTERVAL_MS / QED_PERIODIC_DB_REC_WAIT_COUNT)
 
 static int qed_slowpath_delayed_work(struct qed_hwfn *hwfn,
                                     enum qed_slowpath_wq_flag wq_flag,
@@ -1123,7 +1120,7 @@ void qed_periodic_db_rec_start(struct qed_hwfn *p_hwfn)
 
 static void qed_slowpath_wq_stop(struct qed_dev *cdev)
 {
-       int i, sleep_count = QED_PERIODIC_DB_REC_WAIT_COUNT;
+       int i;
 
        if (IS_VF(cdev))
                return;
@@ -1135,13 +1132,7 @@ static void qed_slowpath_wq_stop(struct qed_dev *cdev)
                /* Stop queuing new delayed works */
                cdev->hwfns[i].slowpath_wq_active = false;
 
-               /* Wait until the last periodic doorbell recovery is executed */
-               while (test_bit(QED_SLOWPATH_PERIODIC_DB_REC,
-                               &cdev->hwfns[i].slowpath_task_flags) &&
-                      sleep_count--)
-                       msleep(QED_PERIODIC_DB_REC_WAIT_INTERVAL);
-
-               flush_workqueue(cdev->hwfns[i].slowpath_wq);
+               cancel_delayed_work(&cdev->hwfns[i].slowpath_task);
                destroy_workqueue(cdev->hwfns[i].slowpath_wq);
        }
 }