usb: gadget: u_ether: synchronize with transmit when stopping queue

When disconnecting, it's possible that another thread has already made it
into eth_start_xmit before we call netif_stop_queue. This can lead to a
crash as eth_start_xmit tries to use resources that gether_disconnect is
freeing. Use netif_tx_lock/unlock around netif_stop_queue to ensure no
threads are executing during the remainder of gether_disconnect.

Signed-off-by: Jeff Westfahl <[email protected]>
Tested-by: Jaeden Amero <[email protected]>
Signed-off-by: Felipe Balbi <[email protected]>

diff --git a/drivers/usb/gadget/u_ether.c b/drivers/usb/gadget/u_ether.c
index 3d78a8844e438f7e1904c5429655af8a4708d95d..97b027724ee7a5a5ce28d1fdf5feb9335c4fef22 100644 (file)
--- a/drivers/usb/gadget/u_ether.c
+++ b/drivers/usb/gadget/u_ether.c
@@ -1120,7 +1120,10 @@ void gether_disconnect(struct gether *link)
 
        DBG(dev, "%s\n", __func__);
 
+       netif_tx_lock(dev->net);
        netif_stop_queue(dev->net);
+       netif_tx_unlock(dev->net);
+
        netif_carrier_off(dev->net);
 
        /* disable endpoints, forcing (synchronous) completion