Skip to content

Commit bc6de28

Browse files
stonezdmPaolo Abeni
authored andcommitted
drivers: net: hippi: Fix deadlock in rr_close()
There is a deadlock in rr_close(), which is shown below: (Thread 1) | (Thread 2) | rr_open() rr_close() | add_timer() spin_lock_irqsave() //(1) | (wait a time) ... | rr_timer() del_timer_sync() | spin_lock_irqsave() //(2) (wait timer to stop) | ... We hold rrpriv->lock in position (1) of thread 1 and use del_timer_sync() to wait timer to stop, but timer handler also need rrpriv->lock in position (2) of thread 2. As a result, rr_close() will block forever. This patch extracts del_timer_sync() from the protection of spin_lock_irqsave(), which could let timer handler to obtain the needed lock. Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> Link: https://lore.kernel.org/r/20220417125519.82618-1-duoming@zju.edu.cn Signed-off-by: Paolo Abeni <pabeni@redhat.com>
1 parent 5e62421 commit bc6de28

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

drivers/net/hippi/rrunner.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1355,7 +1355,9 @@ static int rr_close(struct net_device *dev)
13551355

13561356
rrpriv->fw_running = 0;
13571357

1358+
spin_unlock_irqrestore(&rrpriv->lock, flags);
13581359
del_timer_sync(&rrpriv->timer);
1360+
spin_lock_irqsave(&rrpriv->lock, flags);
13591361

13601362
writel(0, &regs->TxPi);
13611363
writel(0, &regs->IpRxPi);

0 commit comments

Comments
 (0)