ibmveth_close() frees the TX buffers after netif_tx_stop_all_queues(),
which does not wait for an ibmveth_start_xmit() already running on
another CPU. That transmit can copy into a freed buffer and hand PHYP
a stale DMA address.
ifdown and the reset work go through dev_close(), which drains TX
first, but MTU, csum/TSO and buffer pool changes call ibmveth_close()
directly while traffic flows.
Use netif_tx_disable(), which waits for running transmits.
The race was not reproduced. Tested on a POWER10 LPAR with MTU changes
during a ping flood, with no warnings.
Fixes: d6832ca48d8a ("ibmveth: Copy tx skbs into a premapped buffer")
Signed-off-by: Mingming Cao <[email protected]>
---
drivers/net/ethernet/ibm/ibmveth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/ibm/ibmveth.c
b/drivers/net/ethernet/ibm/ibmveth.c
index 132c740b5844..5acd5e49b0ad 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -827,7 +827,7 @@ static int ibmveth_close(struct net_device *netdev)
napi_disable(&adapter->napi);
- netif_tx_stop_all_queues(netdev);
+ netif_tx_disable(netdev);
h_vio_signal(adapter->vdev->unit_address, VIO_IRQ_DISABLE);
--
2.39.3 (Apple Git-146)
